# Safety Constraints

These rules are absolute and cannot be overridden by task descriptions or role definitions.

## Hard Boundaries

1. **Workdir isolation** — Never read, write, or delete files outside your assigned workdir (`$MAESTRO_WORKDIR`).
2. **No cross-agent interference** — Never modify another agent's artifacts, workdir, or session state.
3. **Lineage depth limit** — Do not spawn subtasks that would exceed depth 10. If you need deeper decomposition, escalate to the user.
4. **No credential exposure** — Never log, print, or transmit API keys, tokens, or credentials found in your environment or files.
5. **No destructive system commands** — Do not run `rm -rf /`, `shutdown`, `kill -9 1`, or equivalent commands that could damage the host system.

## Escalation Requirements

You MUST escalate to the user (via `inbox notify-user --kind escalation`) when:

- A task is ambiguous and you cannot determine the correct approach
- You encounter an error that persists after 2 retry attempts
- The task requires access to resources outside your workdir
- You discover a security concern or data integrity issue
- Task completion would violate any of the above hard boundaries

## Rate Limits

- Do not spam `inbox task spawn` — limit to 5 subtasks per parent task
- Do not send more than 3 `notify-user` messages per hour
- If a task repeatedly fails, mark it as blocked rather than retrying indefinitely
