agent rules: first rule "Do it, don't ask" (agents-core and every adapter, README, store-pitfalls lead, first-release, declarations and console skills); the agent runs the real command after the dry run, the owner presses only final public or irreversible buttons and answers compliance facts in one batch; handoff text removed from skills; tests/do-it-dont-ask.test.ts. Pitfall 26

README.md

@@ -28,6 +28,23 @@ No account, no sign-up, no telemetry. A small Bun CLI that talks to the official
 Agent Skills that walk your AI coding tool (or you) through the parts that are still console clicks, and an MCP server
 so agents can call the CLI safely. **storebound never presses Submit, Release or Publish for you.**
 
+## How agents use storebound
+
+**Do it, don't ask.** Your AI agent and storebound do the work: API calls, uploads, builds, CSV and template
+exports, every console page (open, Get Started, Edit, Next, Save draft), console forms and the check afterwards. You
+are not asked to click through consoles or run commands one by one.
+
+- **You press only the final public or irreversible buttons:** Submit for review, releasing a version or a production
+  rollout, App Privacy Publish, legal agreements; plus deleting store data, changing live prices, sending review
+  replies and inviting or removing testers. The agent prepares each one and shows you the dry run first.
+- **You answer only what no file can prove** (Data safety, App Privacy, age rating, export compliance, partial
+  deletion): all of it in one batch at the start (`storebound check` / `validate` list the questions), saved in the
+  config so nobody asks again.
+- **The loop:** plan, the agent drives (API first, its browser for consoles without an API), verify by reading back,
+  continue. `check` and `--dry` catch what a store would refuse before anything is written.
+
+The full rules are in [AGENTS.md](AGENTS.md) (generated from `docs/agents-core.md`).
+
 Pick a profile and start from honest templates: `init --profile app` (utility / productivity app, optional account,
 analytics, no ads; the default), `--profile subscription-app` (accounts + auto-renewable subscriptions) or
 `--profile game` (free-to-play with ads and IAP).
@@ -497,8 +514,8 @@ a terminal first and are never offered over MCP.
   visible browser, goes to the form by itself (Apps > + > New App, the app's App Privacy, Play All apps > Create app,
   Play app list > App content > Start / Manage;
   navigation clicks only, never Save / Submit / Publish / Create / Next), fills what the config proves, highlights the
-  rest and stops before the final button: you click. **Sign-in:** storebound's own profile
-  (one per store, `~/.storebound/console-profile/<store>`): you sign in there once by hand, it is kept between runs
+  rest and stops before the final button: you press it. **Sign-in:** storebound's own profile
+  (one per store, `~/.storebound/console-profile/<store>`): you sign in there once, it is kept between runs
   (session restore on launch, graceful close; tick "Keep me signed in" / "Stay signed in"). storebound starts that
   Chrome itself as a normal window (no `--enable-automation`, `navigator.webdriver` false) so Google accepts the
   sign-in; if Google still answers `/signin/rejected` it says so. A Chrome running with remote debugging is used in
@@ -518,9 +535,11 @@ a terminal first and are never offered over MCP.
   declarations and never presses the form's Create app: you do. With `play.developerId` it opens the form's own URL
   (`/console/u/0/developers/<id>/create-new-app`); it fills App package name from `play.packageName` and presses the
   read-only "Check availability", and clicks the inner `[role=radio]` of Play's material radios (the native input
-  does not update the form). After Create app, add the new app to your service account yourself (Users and
-  permissions > the service account > Add app): app-level permissions do not cover apps created later.
-  When a page has changed it falls back to step-by-step guidance with copyable answers. **Console pages change; this is AI-assisted: review every field and save it yourself.** Desktop: "Fill in
+  does not update the form). After Create app, grant your service account access to the new app (Users and
+  permissions > the service account > Add app; a permission grant, so it is yours): app-level permissions do not
+  cover apps created later. When a page has changed, your agent drives that part with its browser tool from
+  `storebound console plan`. **Console pages change; this is AI-assisted: review every field before you press the
+  final button.** Desktop: "Fill in
   console" on the App info tab. Never over MCP. Skill: `console-autofill`.
 
 MCP gets only the safe parts: `prices_ppp`, `web_init`, `apple_adhoc_options` (local files, dry run by default) and