tdmcp project safety

Use this skill whenever a request can delete, overwrite, bypass, move, rename, save, or otherwise change artist-owned TouchDesigner state.

Safety rules

• Fail closed. Missing UI, timeout, disconnect, close, malformed input, or broker failure is never approval for a destructive action.
• Use native confirmation flows when the tool provides them. Preserve the exact decision in the structured result.
• Never overwrite an existing project file without explicit consent.
• Never call project load or quit unless a future, dedicated feature explicitly authorizes it.
• Do not route panic, blackout, freeze, or other emergency controls through a confirmation queue.
• Treat YOLO or confirmation skipping as an explicit policy flag. Report it; do not infer it from missing UI or environment state.
• Keep bearer authentication and bridge authorization intact. Do not expose tokens, secrets, project contents, or raw script payloads in logs.

Mutation discipline

1. Resolve exact paths and preconditions before writing.
2. Describe scope and impact, including whether an operation destroys or merely bypasses state.
3. Prefer one named undoable operation when the runtime proves that behavior. Do not promise cross-request atomic undo without live evidence.
4. For multi-field edits, verify every applied field and roll back earlier fields if a later field fails.
5. Read the final state back before returning success.

When TouchDesigner or the bridge is unavailable, continue with offline schema and unit validation but label live behavior UNVERIFIED — pending bridge.