• Periodic rules maintenance (monthly or after installing new skills)
• After a skill-stocktake reveals patterns that should be rules
• When rules feel incomplete relative to the skills being used

• Deduplicate candidates with the same or overlapping principles
• Re-check the "2+ skills" requirement using evidence from all batches combined — a principle found in 1 skill per batch but 2+ skills total is valid

• Skills: {full text of skills in this batch}
• Existing rules: {full text of all rule files}

1. Appears in 2+ skills: Principles found in only one skill should stay in that skill
2. Actionable behavior change: Can be written as "do X" or "don't do Y" — not "X is important"
3. Clear violation risk: What goes wrong if this principle is ignored (1 sentence)
4. Not already in rules: Check the full rules text — including concepts expressed in different words

• Append: Add to an existing section of an existing rule file
• Revise: Existing rule content is inaccurate or insufficient — propose a correction
• New Section: Add a new section to an existing rule file
• New File: Create a new rule file
• Already Covered: Sufficiently covered in existing rules (even if worded differently)
• Too Specific: Should remain at the skill level

• Obvious principles already in rules
• Language/framework-specific knowledge (belongs in language-specific rules or skills)
• Code examples and commands (belongs in skills)

undefined

• Approve: Apply draft to rules as-is
• Modify: Edit draft before applying
• Skip: Do not apply this candidate

results.json

• Timestamp format:

  date -u +%Y-%m-%dT%H:%M:%SZ

  (UTC, second precision)
• Candidate ID format: kebab-case derived from the principle (e.g.,

  llm-output-trust-boundary

  )

{
  "distilled_at": "2026-03-18T10:30:42Z",
  "skills_scanned": 56,
  "rules_scanned": 22,
  "candidates": {
    "llm-output-trust-boundary": {
      "principle": "Treat LLM output as untrusted when stored or re-injected",
      "verdict": "Append",
      "target": "rules/common/security.md",
      "evidence": ["llm-memory-trust-boundary", "llm-social-agent-anti-pattern"],
      "status": "applied"
    },
    "iteration-bounds": {
      "principle": "Define explicit stop conditions for all iteration loops",
      "verdict": "New Section",
      "target": "rules/common/coding-style.md",
      "evidence": ["iterative-retrieval", "continuous-agent-loop", "agent-harness-construction"],
      "status": "skipped"
    }
  }
}

LLM Output Validation

User: Approve 1, 3. Skip 2, 4.

undefined

• What, not How: Extract principles (rules territory) only. Code examples and commands stay in skills.
• Link back: Draft text should include

  See skill: [name]

  references so readers can find the detailed How.
• Deterministic collection, LLM judgment: Scripts guarantee exhaustiveness; the LLM guarantees contextual understanding.
• Anti-abstraction safeguard: The 3-layer filter (2+ skills evidence, actionable behavior test, violation risk) prevents overly abstract principles from entering rules.