Agent governance

.agent/ contains declarative metadata. AGENTS.md files explain ownership, local commands, formatter responsibility, required gates, and the difference between local and remote evidence. The validator rejects credentials, private keys, and executable directives.

The local lifecycle is deliberately split:

1. sibyl init reads supported manifests and lockfiles, derives evidence, and writes schema-valid .agent/ files. It does not execute project code, install dependencies, resolve packages, or contact a service. Existing owned files are preserved unless --force is explicit.
2. sibyl check reads .agent/ metadata and local manifests. It uses only a local registry snapshot supplied by --registry or SIBYL_REGISTRY_SNAPSHOT; an explicit flag takes precedence. Remote registry URLs are rejected, and missing local policy fails closed when dependencies are present.
3. sibyl memory add validates and appends a memory entry in stable order. It preserves malformed existing documents when refusing an update and makes no network request.
4. sibyl sync is the only remote-capable command. It requires an explicit payload, an HTTPS endpoint, environment authorization, schema and secret-content validation, bounded retries, and a successful response.

The command details and exact flags are in the CLI reference.