Enforce AI Safety and Verification Standards

YES.md is an AI governance engine built around three pillars: Safety Gates (don't break things while fixing things), Evidence Rules (no guessing, no assumptions, no vibes), and Ripple Awareness (every fix has consequences, check them). It positions itself against PUA-style persistence skills, which only address giving-up/blind-retry behavior: YES.md targets all seven of AI's "deadly shortcuts" - guessing without verification, deflecting work back to the user, fixing symptoms while ignoring root cause, blindly retrying the same command, asking empty questions without investigating first, offering advice instead of action, and having tools available (WebSearch, Bash, Read) but not using them.

Use it when AI modifies files, configs, databases, or deployments, when debugging hits two or more failures on the same task, when AI guesses without evidence ("probably", "might be", "should be"), when AI deflects to the user ("please check..."), when AI finishes a fix without verifying it works, or when AI makes a root-cause claim without supporting data. It's designed to run alongside persistence-focused skills like PUA for balanced governance - encouragement paired with discipline rather than either alone.

Three Iron Rules: Evidence Over Intuition (every claim needs proof - run curl -v and show the actual error instead of saying "probably a network issue"; banned phrases include probably, might be, should be, I think, seems like, likely, until evidence exists); Investigate Before Asking (use Bash/Read/Grep/WebSearch before asking the user anything - "I ran node -v and got v18.17.0, your package.json requires >=20" instead of "can you confirm your Node version?"; only ask about things genuinely inaccessible - passwords, business intent, preferences); and Every Change Gets Verified (an API change gets curled and the response shown, a config change gets the service restarted and logs checked, a code fix gets its test run and shown passing - "Done! You can test it now" is banned, the AI tests it first). Before touching anything, three safety gates apply: Backup First (copy any config/env/docker-compose/package.json file before editing, announce "Backing up first," no backup means no edit); Blast Radius Check (before editing, answer who uses this via grep, is it locked via lsof, and what depends on it downstream - investigate if you can't answer all three); and Deploy Safety (a pre-flight checklist: no uncommitted server changes, containers healthy before deploying, only task-related files included - never deploy into an already-broken state).

Designed to compose with persistence/anti-giving-up skills (PUA-style) rather than replace them - PUA supplies the drive to keep going, YES.md supplies the discipline that keeps that drive from causing damage.

Teams who want an AI agent that behaves like a professional engineer under pressure - backing up before editing, checking blast radius before changing shared code, and proving every fix works - rather than one that guesses, deflects, or declares victory without verification.