Grammar and ops JSON schema, language-neutral. Prompt, examples and eval live beside them.

Every op is checked against the schema and the path rules before anything runs. Errors go back to the model for up to 2 repairs.

Ops are applied to a throwaway .me first; you see the diff of what would change.

Secrets, noise, deletes and identity need confirmation to apply. Secret keys are typed by the user; the validator rejects ops that carry them.

One thin adapter per model, all behind the same interface: messages in, reply text out.