# LUMIS

> LUMIS (https://lumis.tools) gives AI coding agents enforceable boundaries. You write down what the project must NOT do (Non-Goals); one hook script stops Claude Code, Cursor, Codex CLI, Devin Desktop (ex-Windsurf) and GitHub Copilot before the forbidden tool call runs and names the boundary it crossed. No account, no telemetry: the log stays in your repository. The same product also runs a "consilium" of AI roles that turns a product idea into a locked specification pack (PRD, architecture, roadmap, constitution) whose Non-Goals become those hooks. Full documentation for assistants: https://lumis.tools/llms-full.txt

## Install the guard in one command (free, MIT, no account)

- As an agent skill: `npx skills add momonanq/lumis-skills --skill lumis-scope-guard --global` — adds `/lumis-scope-guard init`, `check` and `status` to Claude Code, Cursor and any agent the skills CLI supports. Source: https://github.com/momonanq/lumis-skills (MIT).
- From the site, without an account: https://lumis.tools/guard — paste your Non-Goals (and invariants), download the guard pack: `.lumis/scope_guard.json`, `scripts/scope_guard.py` (stdlib Python, one file), hook configs for all five clients, `CONSTITUTION.md`, `.cursorrules`. No model is involved: every line is yours.
- On /guard: ready boundaries to click in (payments, native mobile, cryptocurrency, microservices, enterprise auth, multi-tenancy, marketplace, email sending, websockets), each worded so the text matcher arms it (packages, paths and phrases, matched as text); a checkbox that makes push, publish and deploy a hard refusal instead of a question; and `SCOPE_ANNEX.md` in the pack, a short template an agency attaches to a fixed-price statement of work (Non-Goals as NG-n, how they are checked, what a change request is) — a template, not legal advice.
- Check the wiring: `python scripts/scope_guard.py doctor`. Read what happened: `python scripts/scope_guard.py report`.
- On every pull request: `lumis_guard.py init --ci` (and both ZIPs) add the GitHub Actions workflow `.github/workflows/lumis-boundary-check.yml`; commit it with `.lumis/` and `scripts/`. It needs no hook in any client and covers commits made by people too.

## What the guard does (scope guard, hook version 2026-09-30)

- Refuses a tool call that touches a locked Non-Goal, on high-precision evidence only: a forbidden dependency as the whole name an install, an import or a manifest line brings in (`pip install stripe`, `import stripe`, `'@stripe/stripe-js'`; `import export_utils` is not the package `expo`, `ws = wb.active` not the package `ws`), a forbidden path (`billing/`), a boundary phrase or a name the Non-Goal writes as code (`@Transactional`) on a line of code. The refusal names the boundary (NG-n), who set it and where it is written (CONSTITUTION.md, Article I). Exit code 2 is "denied" in all five clients.
- Holds three classes of change for the founder instead of refusing them — a new dependency, an outbound action (`git push`, `gh repo delete`, `npm publish`, a deploy), a write outside the project root. In Claude Code, Cursor and GitHub Copilot this is a real permission prompt (the Copilot cloud agent treats it as a refusal); in Codex and Devin Desktop (ex-Windsurf) it is a warning. Each class is set to `allow`, `ask` or `block` in `.lumis/scope_guard.json`. Installing from a lockfile, `git push --dry-run`, reads and looks are never held.
- Observe mode: `python scripts/scope_guard.py observe on` (founder's own terminal only) records what would have been stopped and stops nothing but changes to the guard itself. An agent cannot switch it on.
- Protects itself: a tool call that would rewrite the hook, its config, the client hook files or CONSTITUTION.md is refused and logged as `tamper`; `doctor` compares fingerprints of the guard files with a manifest in the repository and a baseline copy outside it. This is a mechanism against a rewrite through the agent, not a security boundary.
- Documents, tests, comment lines and ignore files (`.gitignore` and its kin) that write a boundary down are allowed (logged as `noted`); read-only commands that mention one are allowed (`inspected`); a single boundary word in a long sentence, a word that is only one part of a boundary's phrase, and a word found only inside another tool's option or an import (`--frozen-lockfile`, `from collections import`) only warn (`possible`). UI code that breaks a visual Non-Goal and a route, table or directory absent from ARCHITECTURE.md get a warning, never a block.
- Every event is appended to `.lumis/guard.log`; `report` prints the counts and the founder's requests (`request --reason "…"`). Nothing leaves the machine.
- The same contract on a pull request diff: `python scripts/scope_guard.py check-diff --base <ref> --head <ref>` judges the added lines against `.lumis/scope_guard.json` on the base branch with the hook's own matcher. BLOCK (exit 2): a Non-Goal trigger on a line of code (not a comment), a file under a forbidden path, a new top-level directory ARCHITECTURE.md does not plan, a new dependency when `classes.dependency` is `block`, a change to the hook or the workflow, a config deleted or left with no boundary. WARN: a trigger in docs, tests, comments or ignore files, a new dependency held for the reviewer, a route or table not in ARCHITECTURE.md, a submodule, a change to the boundaries (shown as which NG-n was lifted, which other key changed, in which commit, by whom). Exit 1 means it could not run, or the diff was larger than it reads with no BLOCK in the part read (INCOMPLETE); never a PASS.
- The report: one pull request comment, the job summary and SARIF for GitHub code scanning; each finding names the boundary (NG-n, who set it, where it is written), the file and line, the trigger and the line. No score, no model. It matches text, paths, packages and directories, not meaning (a home-grown billing module that never says "stripe" passes); JS/TS are text patterns only; outbound actions, writes outside the project, scripts' `bash -c`, binary files and submodule content are not read. A pull request runs its own copy of the workflow: make it a required check with CODEOWNERS on the guard's files. A review aid, not a security boundary. Spec: docs/BOUNDARY_CHECK_CI.md in https://lumis.tools/llms-full.txt

## Evidence (every number has a source in the repository's evidence register)

- 77 attempts to rewrite the guard through an agent, 69 refused, the other 8 named one by one — reproducible with `examples/tamper_cases.py` in the public repository. An independent rerun of a third-party set of 105 cases (Skillkeel/tamper-cases) by its author: 48/50 guard-file tampers refused, 0 false positives on the benign forms.
- A reproducible bench (`scripts/agent_bench.py`) ran the same coding agent (Claude Code, claude-sonnet-5) with and without the pack on eight tasks, three repeats each, 54 runs, raw records public: same pass rate, zero boundary crossings in both arms, the pack cost more tokens on some tasks. LUMIS does not claim that it prevents drift or saves tokens; the bench is published because it is honest.
- Observe mode and the held classes are demonstrated on a fresh install in `sales-os/01-evidence/guard-modes-2026-09-25/probe.txt`.
- What LUMIS does not claim: "cannot be bypassed", "catches all destructive commands", any token or time saving, replacing Cursor or Claude Code.

## The full pack (the consilium, paid runs)

- Input: a one-paragraph product idea, optional tech stack, optional Non-Goals, optional design brief; an existing spec, pitch deck or requirements document (PDF, Markdown or TXT, about 25 pages) can be attached as the baseline.
- Process, about 5 minutes, visible in real time: GTM strategist → product strategist → devil's advocate → lead arbiter → UX → art director → solution architect → consistency check between architecture and roadmap.
- Output: PRD.md, ARCHITECTURE.md (entities, endpoints, file plan), ROADMAP.md, COMMERCIAL.md, DECISION_LOG.md, CONSTITUTION.md (Non-Goals and invariants), DESIGN_CONSTITUTION.md + design-tokens.json, MASTER_PROMPT.md (kickoff prompt with a startup ritual and a drift rule), .cursorrules, START_HERE.md, the scope guard wired for all five clients, and, when the architecture declares enough (FastAPI + one SQL engine + fielded entities), a backend skeleton with every handler returning 501.
- Amend: change Non-Goals, invariants or stack later; only the dependent artifacts are rebuilt, the guard config and CONSTITUTION.md together. AMEND_REPORT.md says which numbered items landed.
- Bring-your-own-spec mode: attach your specification, put the first milestone in the idea field, add Non-Goals; LUMIS writes no PRD, only the enforceable pack around your spec (CONSTITUTION.md with provenance, hooks, MASTER_PROMPT.md, P0_SCOPE.md). One run.
- Public passport: a project can be shared as one read-only page (example: https://lumis.tools/verify/RentGuard).
- LUMIS does not generate UI code or HTML prototypes.

## Who it is for

- Developers and solo founders using AI coding agents who lose time to scope creep: features the agent added "while it was in there".
- Small agencies and studios that need a fixed scope and a specification to quote against.
- Founders who want a PRD and architecture before paying a developer.

## Pricing (one-time credit packs, credits do not expire)

- Free: 2 runs — 1 at sign-up, 1 after confirming the e-mail. No card required. The guard itself is free forever, no account.
- Solo Hacker: $29 for 12 runs. Pro Founder: $49 for 40 runs. Agency & Studio: $199 for 150 runs. Every pack includes the same features; the packs differ only in the number of runs and the price.
- One consilium run costs one credit; bring-your-own-spec runs cost one credit; the first 2 amends per project are free, then 1 credit. Regenerations, the ZIP export, the git commands to push a project to your own repository, the guard pack, the skill and the public passport are free.
- Payment by bank card (Lava.top) or crypto (Cryptomus). Refunds within 14 days for unused packs. No subscription.

## How to use it with an AI coding agent

1. Install the guard (one command above) or run the consilium at https://lumis.tools.
2. Put CONSTITUTION.md, .cursorrules and the hook configs in the root of the code repository; run `python scripts/scope_guard.py doctor`.
3. Paste MASTER_PROMPT.md into the agent. It starts with a startup ritual (lists loaded rules, hooks and Non-Goals) and must record a Feature Delta before any change outside the PRD scope.
4. When the agent asks to lift a boundary, decide it in LUMIS Amend (or edit `.lumis/scope_guard.json` yourself and run `write-manifest`); the agent cannot.

## Facts

- Model behind the consilium: Google Gemini (Flash family); no user data is used for model training. The guard itself calls no model.
- Interface languages: English and Russian.
- Legal: https://lumis.tools/terms, https://lumis.tools/privacy, https://lumis.tools/refund
- Support: support@lumis.tools, Telegram channel @lumis_tools
- Made by a solo founder; launched in 2026. Sitemap: https://lumis.tools/sitemap.xml