Behavior Profiles

The Persistent Conduct Layer Behind Agent Skills

Skills describe what agents know how to do.

Behavior Profiles describe how agents are expected to conduct themselves while doing it.

A Behavior Profile is a portable conduct contract for an AI agent, delivered through a durable instruction surface. It does not add a new capability. It defines observable expectations for how existing capabilities should be used.

The skill changes. The behavior rule persists.

“Persistent” means the profile remains available in an instruction surface such as AGENTS.md or CLAUDE.md. It does not imply agent memory, universal obedience, cross-session guarantees, or enforcement.

See the Proof Surface

The shortest review path is runnable:

python -B tools/verify_profile_package.py --mode release
python -B harness/harness.py check-profile `
  --suite harness/profiles/scope-control/suite.json `
  --profile scope-control/BEHAVIOR_PROFILE_SCOPE_CONTROL.md
python -B harness/harness.py run-controls `
  --suite harness/profiles/scope-control/suite.json `
  --observations harness/profiles/scope-control/controls.json `
  --profile scope-control/BEHAVIOR_PROFILE_SCOPE_CONTROL.md

The first command checks package integrity and the bound internal dogfood record. The second checks the canonical profile against 19 structural assertions. The third runs eight paired synthetic controls and must discriminate all eight conforming observations from all eight non-conforming observations.

The structural checker must also reject vocabulary without the required structure:

python -B harness/harness.py check-profile `
  --suite harness/profiles/scope-control/suite.json `
  --profile harness/profiles/scope-control/vocabulary-without-structure.md
if ($LASTEXITCODE -eq 0) { throw "negative control unexpectedly passed" }

That non-zero exit is expected. The decoy contains familiar Scope Control words but does not place the required fields in the required sections and list structures.

The proof chain is deliberately explicit:

canonical product artifact (769385...)
-> structurally conforming installable representation (8ebe5924...)
-> internal agent observation record (511c1a...)
-> synthetic harness control record (fb026c...)

These are different evidence roles. Synthetic controls test the harness, not an agent. Internal dogfood records one bounded agent observation campaign, not independent external validation.

Start in Five Minutes

Try Scope Control on your own agent — start with a five-minute test.

1. Open Behavior Profile: Scope Control.
2. Add it to the instruction surface your agent reads.
3. Run the quick test.
4. For release qualification, follow the internal dogfood protocol.
5. Record PASS, FAIL, or CONFUSED using the evidence template.
6. If the behavior matters enough that asking is insufficient, use an enforcement boundary such as Governed Repo.

The operating sequence is:

Describe the conduct
-> install it
-> test it under pressure
-> preserve what happened
-> enforce the critical boundary when instruction is insufficient

The First Profile: Scope Control

Scope Control addresses one recurring failure:

You asked for one change. The agent completed it, then quietly expanded the task.

The profile asks the agent to make six things visible before acting:

• requested task
• authorized scope
• no-touch boundaries
• authorized actions
• done condition
• stop or flag condition

It then asks for a short completion note showing what happened and what stayed outside the task.

The profile does not block files. It makes the scope decision easier to review.

AGENTS.md and Behavior Profiles

AGENTS.md gives coding agents a predictable place for repository instructions. Its official site reported use by more than 60,000 open-source projects when this package was prepared on 2026-08-03.

AGENTS.md tells agents how to work in a repository. A Behavior Profile defines expected conduct that can be carried across repositories and agent environments.

This project uses AGENTS.md as its primary installation surface. It does not compete with or claim ownership of the AGENTS.md format.

What You Can Verify

The package verifier checks whether the reference package is complete and internally consistent:

python -B tools/verify_profile_package.py

The verifier returns a machine-readable decision and an explicit proof boundary.

Before publication, maintainers can also run the fixed, product-specific identity check:

python -B tools/check_scope_control_publication_state.py --source-file scope-control/BEHAVIOR_PROFILE_SCOPE_CONTROL.md

This checks the four frozen identities above, confirms structural conformance for the canonical and installable representations, and confirms that the negative structural control fails. It is a Scope Control publication check, not a generalized provenance system.

A verifier PASS does not prove that an agent obeyed the profile. Behavioral evidence comes from observed pressure-test episodes and must identify its environment, profile version, fixture, expected conduct, observed conduct, evaluator, and limitations.

Install Surfaces

• AGENTS.md installation
• Claude Code / CLAUDE.md installation
• Generic durable instruction-surface installation

Each adapter names its target instruction file or surface, precedence caveat, quick-test step, and evidence limitation.

Open Format

FORMAT.md defines a small reference shape for portable profiles. It is not a universal standard or certification scheme.

Contribute Evidence Before Abstraction

Useful contributions include:

• a reproducible installation result;
• a failure or confusion report;
• a recurring behavior that remains hard to control;
• a bounded fixture;
• a correction to an unsupported claim or unclear limitation.

See CONTRIBUTING.md.

After publication, use the repository issue forms to report an installation result or submit a recurring uncontrolled behavior. Remove secrets, private repository content, customer data, and hidden instructions before submitting evidence.

Related Work

• Behavior Profiles paper
• Governance Loops
• Protected Paths
• Governed Repo demo
• Second Mind Systems

Scope Control Runtime v0.1 (Level 3)

Scope Control Runtime is a distinct experimental enforcement layer for proposed actions. It is separate from the instruction-layer Behavior Profile materials above. Earlier descriptions that profiles do not enforce or block actions apply to those instruction-layer materials, not to this Runtime layer.

Scope Control Runtime v0.1 evaluated proposed agent actions against a declared task boundary before execution through one qualified Claude Code PreToolUse integration surface on pinned Claude Code 2.1.137 in the tested Windows, authenticated-session topology. On the tested live subset, the host honored ALLOW, BLOCK, and DEFER decisions, and DEFER produced a distinct durable deferred item. ASK is qualified at the deterministic decision-engine level only; its live host projection remains unproven.

Qualification limitations:

• LIM-1: ASK is qualified in the deterministic engine; its live Claude Code host seam and host obedience remain unproven.
• LIM-2: Qualification is pinned to Claude Code 2.1.137.
• LIM-3: The evidence is a bounded live sample and does not establish reliability or production stability.
• LIM-4: Shell governance covers only the frozen deterministic supported grammar.
• LIM-5: One adapter and one client are qualified; cross-client compatibility is not established.
• LIM-6: The Runtime is local, experimental, default-off, and non-production.
• LIM-7: Qualification history is local and single-machine at publication time.
• LIM-8a: Authenticated Claude session infrastructure was retained.
• LIM-8b: Windows is the tested operating-system topology.
• LIM-8c: Qualification passed with declared retained dependencies; environmental independence is not established.

The internal qualification suite remains 25/25, with a 16/16 paired engine matrix. The public repository preserves the qualification claim, identities, limitations, architecture, and historical publication record, but active HEAD does not distribute the executable Runtime mechanism. See the Runtime architecture and qualification page and public qualification manifest.

The implementation appeared in earlier public commits. Those commits remain in ordinary Git history; this forward correction does not rewrite or erase that history.

Boundary

This repository provides instruction-layer artifacts, fixtures, evidence templates, and a package-integrity verifier.

It does not provide security, compliance, tamper resistance, remote enforcement, guaranteed behavior, customer validation, or production readiness. See LIMITATIONS.md.

License

MIT. The Second Mind Systems name and logo are not granted by the software license. See LICENSE and TRADEMARKS.md.