Nagare Governor: Lane-Assist for IBM Bob

Problem. Headless auto-mode (bob run) is only useful if you can walk away, and today you can't. Prompts and repositories disagree: in our live test the prompt asked for a new table in schema.sql, whose first line reads "RESTRICTED: Do NOT modify without database team approval". Ungoverned Bob followed the prompt and edited the schema. Comments are not enforcement, tool-level edit rules don't see shell writes like sed -i or scripts, and CI only catches the damage afterwards. Solution. Nagare Governor is lane-assist for coding agents. From the task prompt (including negations like "do not touch user_service") and the repository's Python/TypeScript/JavaScript import graph, it synthesizes a write contract: the task targets plus their 1-hop imports are the lane; schemas, migrations, secrets, lockfiles and anything the prompt excludes are protected. The contract is enforced at two layers. Layer 1 lives inside Bob: a SessionStart hook briefs Bob on the contract, an MCP server answers "may I write this file?", and a PreToolUse hook denies out-of-scope writes before a byte changes, including schema changes smuggled into application code as CREATE TABLE. Layer 2 lives on the filesystem: inotify plus git reconciliation restore any write that bypasses Bob's tools to the session baseline (median 8.3-9.7 ms), and quarantine new out-of-scope files instead of deleting them. A PostToolUse hook tells Bob what was reverted so it adapts instead of retrying. Bob is never killed, and the developer's own uncommitted work is never touched. Target users: developers and platform teams who want to let Bob run unattended on real repositories without babysitting it. They run "nagare run <task>" instead of "bob run <task>", and watch the Flight Recorder dashboard, which streams every intervention, what Bob was told, and the evidence. What makes it different: the scope is derived from each task instead of a static allowlist; enforcement covers writes outside the agent's tools; a semantic side-door guard catches DDL in app code; and restores are non-destructive by construction. Evidence. 40 live Bob runs across 10 tasks on 3 real open-source repositories (Flaskr, Healthchecks, Microblog): governed runs stayed in scope 20/20 vs 17/20 ungoverned, with task tests at parity (13/20 vs 12/20) for about 7% more Bob cost. A deterministic demo (python scripts/demo_scripted.py) reproduces every mechanism without any LLM. Open source, MIT.