intent-locklisted

## When to invoke Check for these signal classes before starting any multi-step task: **Ambiguous referents** — a noun phrase that could resolve to more than one entity in context: - Bare demonstratives with no prior binding: "the text", "the doc", "that email", "the file" - Possessives pointing to unintroduced people: "her draft", "their proposal", "his calendar" - Ordinals with unclear basis: "the first one", "the latest version", "the other branch" **Unverified characterizations** — a status or quality claim about a named entity the agent cannot confirm: - "The meeting is substantive" (agent has not read the meeting) - "The PR is approved" (agent has not checked) - "The last run passed" (agent has not run or read CI output) **Identity assumptions** — who is "the user", "me", "us", "the team", or a named person when the identity matters for action: - Sending to "me" when multiple contact entries exist - Filing under "my account" when credentials are ambiguous - "The owner" when ownership is not established in context **Code-vs-runtime dual referent** — a term that names an entity in the active codebase AND a model runtime concept. Fires when the user is working on a tool whose vocabulary mirrors the agent's own runtime (parity-mirror projects like agent CLIs, plugin frameworks, or harness tooling): - "memory" — the project's memory store OR the agent's own session memory - "session" — a project's session class OR the agent's conversation - "hooks" — the project's hook