This gives you the AG-track substrate for grounding the loop (design-doc §6). You define a small frontmatter convention on living designs. You use a resolver at scripts/governs_resolver.py. The resolver answers "which living design governs this file or area?". It reads the wiki/designs/ frontmatter in your local repo. The crickets agentm_bridge.py bridge targets this module's contract with its governing-design verb. This works exactly like its capability verb targets capability_resolver.py. You only need the standard library. You never import design or plugin code. You fail safe to greenfield on any absence.

You pass --json to print the full result dict to stdout instead of the bare path. The exit code remains unchanged. The crickets C3 bridge discovers this surface by path-fallback. It shells out to it using agentm_bridge.py's governing-design verb. It graceful-skips when agentm is absent.

You add machine-readable altitude and ownership to every living design under wiki/designs/. A reader sees what a design governs without opening it. The resolver sees this too.

shape: is not stamped on design docs. It is the Pillar-1 SHAPE axis for host-loaded primitives (a skill, a hook, an agent def). A design document is not a host-loaded primitive. It carries no honest shape: value. You define the key here for the primitives the spine classifies. You never overload it onto kind:. See design-doc §4 (classification spine). This is not yet published as a standalone linkable page in this repo.

You use a controlled vocabulary. You assign one owning design per area. You point other designs in the area up as children. You use these agentm-side values:

An area: outside the vocabulary should fail a valid-area lint. The honesty lints mirror the capability lints. The lints themselves are a follow-on to this resolver. You read the canonical source in the AG area-taxonomy.md spec.

Only status: launched designs participate in resolution by default. The SessionStart paths-only inject also filters on this live truth. You exclude status: proposed designs. You include them only if you pass include_proposed=True or --include-proposed. You use a two-state status enum. The states are proposed → launched (design-doc §9.5).

1. Area-name input — You check if target exactly equals a known area: value. You return that area's design if it matches. For example, shared/foundations returns the Foundations HLD even though it governs no file. You reach area-only roots here. You never match them to a path.
2. Path input — You treat target as a repo-relative path otherwise. You find the most-specific matching governs: glob.
   • You match the exact file (target == pattern).
   • You match the directory prefix (target under pattern + "/").
   • You match the glob (fnmatch, incl. scripts/**).
   • Longest matching pattern wins. A more-specific child wins over the broad agentm/architecture fallback (scripts/**). For example, memory-storage-seam governing scripts/storage_seam.py wins. This is the area-walk-up. A file with no specific owner lands on its area's broad-fallback glob.
   • An exact-specificity tie between different designs is overlap (fail-loud), never a guess. You fail loud because the no-overlap rule was violated. You narrow one glob. Multiple globs from the same design at equal specificity are fine.
3. No match → You return greenfield (exit 1). Children lift in Phase 3. They stamp narrower governs: globs. Resolution refines automatically. You need no resolver change.

{
    "governed": bool,
    "design":   str | None,   # repo-relative path to the governing design
    "area":     str | None,   # the governing design's area
    "reason":   str,          # "governed" | "greenfield" | "overlap" | "error"
}

You never raise an exception. You collapse any internal error to {governed: False, design: None, area: None, reason: "error"}. You fail safe. You mirror capability_resolve.

You perform a low-level scan of wiki/designs/**/*.md. You yield one GovernsEntry(pattern, design, area, status) per pattern. The qualifying design declares these in governs:. You return [] on any I/O error.

You mirror capability_resolver.py. All constraints are non-negotiable:

• One-directional — You read frontmatter as data. You never import design or plugin code. Designs are markdown. You have nothing to import.
• Fail-safe — You use greenfield as the safe default. You never raise on absence.
• Bounded — You run a single index scan of wiki/designs/. You use no arbitrary-tree recursion. You use no network. You use no third-party deps.
• Stdlib-only — You parse frontmatter with a minimal in-module reader. You do not use PyYAML.

Capability resolver · AgentM HLD · Foundations · CI gates