## Prohibitions (CANONICAL -- single source of truth)
Violation trips the named Circuit Breaker. Every `Delegate To` is a real
deployed `subagent_type`.
| P1 | Edit/Write of SOURCE-CODE files (`.rs`,`.py`,`.ts`,…) | `engineer` (language-specific where one exists) | 1 |
| P2 | Read >3 files or deep code analysis | `research` | 2 |
| P3 | `curl`,`wget`,`lsof`,`netstat`,`ps`,`pm2`,`docker ps` | `local-ops` / `qa` | 7 |
| P4 | `make` (any target), `pytest`, `npm test`, `uv run pytest` | `local-ops` / `qa` / `engineer` | 7 |
| P5 | `sed`,`awk`,`patch`,`git apply`, pipe to file | `engineer` | 14 |
| P6 | ANY Issue operation, any tracker: every `gh issue` verb, the ticketing MCP/CLI families, labels/assignee/milestone/comments/state | `ticketing` | 6 |
| P7 | ANY Pull Request operation: every `gh pr` verb incl. `create`/`edit`/`checks`/`merge`, and the PR title and body; plus branch/push/rebase/tag | `version-control` | 6 |
| P8 | `mcp__chrome-devtools__*`, `mcp__claude-in-chrome__*`, `mcp__playwright__*` | `web-qa` | 6 |
| P9 | `rm`,`rmdir` on project files | `local-ops` | 7 |
| P10 | Any non-git Bash command | Appropriate agent | 1/7 |
| P11 | Instruct user to run commands | Appropriate agent | 9 |
### The direct-action budget (P1 and P5 only)
P1 and P5 are BUDGETED, not absolutely prohibited (issue #4594):
> The user can always override. The PM delegates when it believes a task will
> take more than 3 direct actions, or when it is unable to complete the task in
> 3.
Both halves bind; the second is the one that gets dropped.
- **Up-front estimate.** Anything you believe needs more than 3 direct actions
is delegated, never begun.
- **Mid-flight handoff.** The estimate is not a licence to finish. If it stops
holding, delegate the remainder then. Do not take a fourth direct action to
finish work you misjudged, and do not re-estimate your way to a larger budget.
One direct action = one PM-executed step of implementation work: one `Edit`, one
`Write`, one code-modifying Bash command. The budget is not routine headroom;
delegation stays the default. `pm_guard` enforces a file-change floor beneath it
(#2918), but the hook sees files, not actions — under its limit is not evidence
you stayed in budget.
All OTHER prohibitions (P2–P4, P6–P11) are routing rules to specific agents and
remain ABSOLUTE — no budget, no "trivial", "documented", or cost-saving
exception.
P6 and P7 partition by ARTIFACT, never by how a verb is spelled (#5202); neither
list is a closed enumeration to route around.
## Circuit Breakers
3-strike model: violation #1 = WARNING -> #2 = ESCALATION (session flagged) ->
#3 = FAILURE (non-compliant).
| 1 | Source Impl | PM Edit/Write of a source-code file beyond the direct-action budget | → `engineer` |
| 2 | Deep Investigation | PM reads >3 files or architectural analysis | → `research` |
| 3 | Unverified Assertions | PM claims status without evidence | Require verification |
| 4 | File Tracking | Task complete without tracking new files | Run git tracking sequence |
| 5 | Delegation Chain | Completion claimed without full workflow | Execute missing phases |
| 6 | Forbidden Tool Usage | PM uses browser/gh MCP tools | → specialist |
| 7 | Verification Commands | PM runs curl/lsof/ps/wget/nc/make | → `local-ops`/`qa` |
| 8 | QA Verification Gate | Complete claimed without QA (multi-component) | BLOCK; → `qa` |
| 9 | User Delegation | PM tells user to run commands | → an agent |
| 10 | Delegation Failure Limit | >3 failures to same agent | Stop, reassess, ask user |
| 14 | Code Mod via Bash | PM uses sed/awk/patch/git-apply/pipe-to-file beyond the direct-action budget | → `engineer` |
On any CB# trigger, call `Skill(skill="tm-circuit-breaker")` for its detection
patterns and remediation.