What it is
AgiRook is a local kernel. Policy lives in files. The ledger and the derived graph are the record. It attaches to the harness you already use.
Scan is not enable. Enable is not spend. An installed harness is ignored until I turn it on. Spend, live dispatch, and destructive work are separate local gates. A model never writes those files.
The one-shot lane is agirook dispatch --prompt. That is not a job. Jobs are scheduled exec specs, not chat briefs.
ContextForge sits beside it as a local sidecar. If cf is missing, dispatch still runs. That is fail-soft, not a blocked session.
Hermes is the walked example, not a product of ours. A smoke of v0.20.1: skip without live-ok, then one live shot.
Why it exists
I run more than one agent harness. Without a kernel, each one keeps its own memory, its own permissions, and its own idea of what it is allowed to do. AgiRook is the shared layer: policy, ledger, and a derived graph.
What I would defend
Policy is files, not prompts. Enable, live-ok, budget, destructive-ok, and review-ok are local records. Missing or junk is deny.
Scan is not enable. Enable is not spend. Install and scan do not turn a harness on. Enable does not imply a live shot.
The record is the kernel's. The ledger and the derived graph are the record. A workbench can show them when attached. It does not own them.
Status is honest. This is private incubation. APIs and storage will break until the first public tag. I am not calling it shipped.
One sentence
Who is on the job. You choose which agent can run. That association holds.