diff --git a/AGENTS.md b/AGENTS.md
index ffe64cd..0723005 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -49,3 +49,27 @@ When REPL is down: fall back to the SBCL cycle above.
 - Validate before committing
 - If a tool fails, explain why and ask before trying alternatives
 - Before shipping a version, run the `** File Update Checklist` in `docs/ROADMAP.org`
+
+## Core Boundary (HARD RULE)
+
+- **YOU MAY NOT add files to `passepartout.asd` `:components` without asking for permission.**
+  ASDF `:components` is the core harness. Files there load on every daemon boot,
+  cannot be hot-reloaded, and a bug there kills the agent's brainstem.
+
+- When you want to add a new module, **ask first**. Provide:
+  1. Why it cannot be a skill (the self-repair criterion — can the agent fix it
+     if corrupted without human help?) Demonstrate specifically how a broken
+     version of this file prevents the agent from perceiving, reasoning,
+     or acting — not just degrading performance or losing a feature.
+  2. What it depends on and what depends on it
+  3. Why it cannot use `fboundp` guards from core
+
+- **Default: everything is a skill.** Skills load via `skill-initialize-all`,
+  are hot-reloadable, self-repairable, and a bug in a skill degrades the agent
+  but doesn't kill it. The harness stays thin.
+
+- **The self-repair criterion**: a file belongs in core only if, when corrupted,
+  the agent *cannot* fix it without human help. Corrupted core = dead brain,
+  dead hands, or unreachable. Corrupted skill = degraded but self-repairable.
+  This criterion is documented in `docs/ARCHITECTURE.org` and
+  `docs/DESIGN_DECISIONS.org`.
diff --git a/projects/passepartout b/projects/passepartout
index 924bf8f..c86d079 160000
--- a/projects/passepartout
+++ b/projects/passepartout
@@ -1 +1 @@
-Subproject commit 924bf8f479217798aa53eca8190519f7b1220028
+Subproject commit c86d07941832a7452251629e83a937c3c5974866