Require safe repo sync at task start

README.md

@@ -127,6 +127,7 @@ When applying this kit, an agent should:
 - read `manifest.json` first,
 - choose `new-repository.md` or `existing-project.md`,
 - read matching `profiles/*.md` guidance after detecting the stack,
+- at the start of each user-requested task, check for upstream repository updates and apply them immediately with a safe fast-forward pull when the working tree is clean,
 - check `git status --short` before editing,
 - preserve unrelated user changes,
 - use the manifest copy map for target paths,

agent-quickstart.md

@@ -9,6 +9,8 @@ Read manifest.json first.
 Use its copyMap for file destinations.
 Use new-repository.md or existing-project.md as the task workflow.
 Use matching profiles/*.md guidance after detecting the stack.
+At the start of each user-requested task, check for upstream repository updates and apply them immediately with a safe fast-forward pull when the working tree is clean.
+If local changes exist, do not overwrite them; fetch or report the blocker before editing.
 For releasable projects, add or preserve scheduled security automation.
 For active projects, add or preserve non-destructive scheduled repository cleanup checks.
 For Codex-maintained projects, add or preserve dependency, release dry-run, and template compliance checks when useful.
@@ -62,6 +64,10 @@ Did you read manifest.json?
   yes -> use copyMap and placeholders from it
   no  -> read it before editing
 
+Is the working tree clean at task start?
+  yes -> run a fast-forward update check such as git pull --ff-only before editing
+  no  -> do not overwrite local changes; fetch or report the blocker before editing
+
 Does a stack profile match?
   yes -> read the matching profiles/*.md file and adapt commands carefully
   no  -> continue with universal rules only

existing-project.md

@@ -25,6 +25,14 @@ Run:
 git status --short
 ```
 
+At task start, check for upstream repository updates and apply them immediately with a safe fast-forward pull when the working tree is clean:
+
+```bash
+git pull --ff-only
+```
+
+If local changes exist, do not overwrite them. Fetch or report the blocker before editing.
+
 Read:
 
 ```text

files/AGENTS.md

@@ -14,6 +14,7 @@ PROJECT_NAME: PROJECT_DESCRIPTION
 - Do not commit secrets, `.env` files, private keys, certificates, or tokens.
 - Do not rewrite history or run destructive git commands unless explicitly requested.
 - Do not create a release unless explicitly requested.
+- At the start of every user-requested task, briefly check the repository for upstream updates and apply them immediately with a safe fast-forward pull when the working tree is clean. If local changes exist, do not overwrite them; fetch or report the blocker before editing.
 - Check `git status --short` before editing and before finishing. Preserve unrelated user changes.
 - Replace all applicable placeholders. Remove non-applicable placeholder sections instead of leaving fake values.
 - Derive `REPOSITORY_OWNER` and `REPOSITORY_NAME` from the target repository remote or `GITHUB_REPOSITORY`. Never reuse the owner from this template repository.

manifest.json

@@ -5,6 +5,7 @@
   "agentResponsibilities": [
     "Read manifest.json before copying files.",
     "Use copyMap target paths unless the repository already has an equivalent convention.",
+    "At the start of each user-requested task, check for upstream repository updates and apply them immediately with a safe fast-forward pull when the working tree is clean.",
     "Check git status before editing and before finishing.",
     "Preserve unrelated user changes.",
     "Replace applicable placeholders and remove non-applicable placeholder sections.",

new-repository.md

@@ -22,6 +22,14 @@ Run:
 git status --short
 ```
 
+At task start, check for upstream repository updates and apply them immediately with a safe fast-forward pull when the working tree is clean:
+
+```bash
+git pull --ff-only
+```
+
+If local changes exist, do not overwrite them. Fetch or report the blocker before editing.
+
 Identify:
 
 - repository name,