AI handoff

The .rhodd/ai handoff — a bounded context pack AI agents read to continue safely. AI never drives the compile; providers are opt-in with no live calls by default.


Rhodd works without AI. AI becomes safer when Rhodd gives it explicit state.

The handoff stage writes .rhodd/ai — a compact, ordered context pack describing the compiled system. It exists so a future contributor, or an AI agent, can pick up the work without guessing.

A bounded consumer, never the generator

AI is optional and bounded. It consumes the handoff; it never generates the baseline and never drives the compile. The deterministic core is the source of truth — the handoff is just a faithful, machine-readable view of it.

Providers are off by default

Provider integrations exist for OpenAI, Anthropic and Gemini, but they never run by default. They are skipped unless you pass --include provider, and a run that omits them records, literally, that no provider call was made. Compiling a system never contacts a model unless you explicitly ask it to — and a deterministic local fake provider is available for offline validation.

Lint-checked, secrets redacted

The handoff is lint-checked before it is written, and secrets are redacted. The linter errors on api_key / token / secret / password patterns and never prints the value — so the pack you hand to an agent carries the system's shape, not its credentials.

What's in the handoff

.rhodd/ai/ is a structured pack — context.md points an agent at the rest in a sensible read order:

text
.rhodd/ai/
  context.md            system shape + read order
  prompts/              task-scoped prompts, ready to paste
  tasks/                bounded, checkable units of work
  graph.json            services, modules, edges (acyclic)
  model.json            the resolved system
  generation-plan.json  the write set (dry-run clean)
  ownership.md          generated vs user-owned paths
  target-matrix.md      targets → emitted files

Because the handoff is derived from compiled state, an agent reading it is working from facts, not a prompt's best guess — and anything it proposes still flows back through the deterministic compile. See Safety & boundaries for the guarantees around that.