# LUMIS

> LUMIS (https://lumis.tools) gives AI coding agents enforceable boundaries. You write down what the project must NOT do (Non-Goals); one hook script stops Claude Code, Cursor, Codex CLI, Windsurf and GitHub Copilot before the forbidden tool call runs and names the boundary it crossed. No account, no telemetry: the log stays in your repository. The same product also runs a "consilium" of AI roles that turns a product idea into a locked specification pack (PRD, architecture, roadmap, constitution) whose Non-Goals become those hooks. Full documentation for assistants: https://lumis.tools/llms-full.txt

## Install the guard in one command (free, MIT, no account)

- As an agent skill: `npx skills add momonanq/lumis-skills --skill lumis-scope-guard --global` — adds `/lumis-scope-guard init`, `check` and `status` to Claude Code, Cursor and any agent the skills CLI supports. Source: https://github.com/momonanq/lumis-skills (MIT).
- From the site, without an account: https://lumis.tools/guard — paste your Non-Goals (and invariants), download the guard pack: `.lumis/scope_guard.json`, `scripts/scope_guard.py` (stdlib Python, one file), hook configs for all five clients, `CONSTITUTION.md`, `.cursorrules`. No model is involved: every line is yours.
- Check the wiring: `python scripts/scope_guard.py doctor`. Read what happened: `python scripts/scope_guard.py report`.

## What the guard does (scope guard, hook version 2026-09-23)

- Refuses a tool call that touches a locked Non-Goal: a forbidden dependency (`pip install stripe`), a forbidden path (`billing/`), a boundary phrase in a write. The refusal names the boundary (NG-n), who set it and where it is written (CONSTITUTION.md, Article I). Exit code 2 is "denied" in all five clients.
- Holds three classes of change for the founder instead of refusing them — a new dependency, an outbound action (`git push`, `gh repo delete`, `npm publish`, a deploy), a write outside the project root. In Claude Code and Cursor this is a real permission prompt; in Codex, Windsurf and Copilot it is a warning. Each class is set to `allow`, `ask` or `block` in `.lumis/scope_guard.json`. Installing from a lockfile, `git push --dry-run`, reads and looks are never held.
- Observe mode: `python scripts/scope_guard.py observe on` (founder's own terminal only) records what would have been stopped and stops nothing but changes to the guard itself. An agent cannot switch it on.
- Protects itself: a tool call that would rewrite the hook, its config, the client hook files or CONSTITUTION.md is refused and logged as `tamper`; `doctor` compares fingerprints of the guard files with a manifest in the repository and a baseline copy outside it. This is a mechanism against a rewrite through the agent, not a security boundary.
- Documents and tests that write a boundary down are allowed (logged as `noted`); read-only commands that mention one are allowed (`inspected`); a single boundary word in a long sentence only warns (`possible`). UI code that breaks a visual Non-Goal and a route, table or directory absent from ARCHITECTURE.md get a warning, never a block.
- Every event is appended to `.lumis/guard.log`; `report` prints the counts and the founder's requests (`request --reason "…"`). Nothing leaves the machine.

## Evidence (every number has a source in the repository's evidence register)

- 77 attempts to rewrite the guard through an agent, 69 refused, the other 8 named one by one — reproducible with `examples/tamper_cases.py` in the public repository. An independent rerun of a third-party set of 105 cases (Skillkeel/tamper-cases) by its author: 48/50 guard-file tampers refused, 0 false positives on the benign forms.
- A reproducible bench (`scripts/agent_bench.py`) ran the same coding agent (Claude Code, claude-sonnet-5) with and without the pack on eight tasks, three repeats each, 54 runs, raw records public: same pass rate, zero boundary crossings in both arms, the pack cost more tokens on some tasks. LUMIS does not claim that it prevents drift or saves tokens; the bench is published because it is honest.
- Observe mode and the held classes are demonstrated on a fresh install in `sales-os/01-evidence/guard-modes-2026-09-25/probe.txt`.
- What LUMIS does not claim: "cannot be bypassed", "catches all destructive commands", any token or time saving, replacing Cursor or Claude Code.

## The full pack (the consilium, paid runs)

- Input: a one-paragraph product idea, optional tech stack, optional Non-Goals, optional design brief; an existing spec, pitch deck or requirements document (PDF, Markdown or TXT, about 25 pages) can be attached as the baseline.
- Process, about 5 minutes, visible in real time: GTM strategist → product strategist → devil's advocate → lead arbiter → UX → art director → solution architect → consistency check between architecture and roadmap.
- Output: PRD.md, ARCHITECTURE.md (entities, endpoints, file plan), ROADMAP.md, COMMERCIAL.md, DECISION_LOG.md, CONSTITUTION.md (Non-Goals and invariants), DESIGN_CONSTITUTION.md + design-tokens.json, MASTER_PROMPT.md (kickoff prompt with a startup ritual and a drift rule), .cursorrules, START_HERE.md, the scope guard wired for all five clients, and, when the architecture declares enough (FastAPI + one SQL engine + fielded entities), a backend skeleton with every handler returning 501.
- Amend: change Non-Goals, invariants or stack later; only the dependent artifacts are rebuilt, the guard config and CONSTITUTION.md together. AMEND_REPORT.md says which numbered items landed.
- Bring-your-own-spec mode: attach your specification, put the first milestone in the idea field, add Non-Goals; LUMIS writes no PRD, only the enforceable pack around your spec (CONSTITUTION.md with provenance, hooks, MASTER_PROMPT.md, P0_SCOPE.md). One run.
- Public passport: a project can be shared as one read-only page (example: https://lumis.tools/verify/RentGuard).
- LUMIS does not generate UI code or HTML prototypes.

## Who it is for

- Developers and solo founders using AI coding agents who lose time to scope creep: features the agent added "while it was in there".
- Small agencies and studios that need a fixed scope and a specification to quote against.
- Founders who want a PRD and architecture before paying a developer.

## Pricing (one-time credit packs, credits do not expire)

- Free: 2 runs — 1 at sign-up, 1 after confirming the e-mail. No card required. The guard itself is free forever, no account.
- Solo Hacker: $29 for 12 runs. Pro Founder: $49 for 40 runs. Agency & Studio: $199 for 150 runs.
- One consilium run costs one credit; bring-your-own-spec runs cost one credit; the first 2 amends per project are free, then 1 credit. Regenerations, exports (ZIP, GitHub), the guard pack, the skill and the public passport are free.
- Payment by bank card (Lava.top) or crypto (Cryptomus). Refunds within 14 days for unused packs. No subscription.

## How to use it with an AI coding agent

1. Install the guard (one command above) or run the consilium at https://lumis.tools.
2. Put CONSTITUTION.md, .cursorrules and the hook configs in the root of the code repository; run `python scripts/scope_guard.py doctor`.
3. Paste MASTER_PROMPT.md into the agent. It starts with a startup ritual (lists loaded rules, hooks and Non-Goals) and must record a Feature Delta before any change outside the PRD scope.
4. When the agent asks to lift a boundary, decide it in LUMIS Amend (or edit `.lumis/scope_guard.json` yourself and run `write-manifest`); the agent cannot.

## Facts

- Model behind the consilium: Google Gemini (Flash family); no user data is used for model training. The guard itself calls no model.
- Interface languages: English and Russian.
- Legal: https://lumis.tools/terms, https://lumis.tools/privacy, https://lumis.tools/refund
- Support: support@lumis.tools, Telegram channel @lumis_tools
- Made by a solo founder; launched in 2026. Sitemap: https://lumis.tools/sitemap.xml