docs: align repository agent instructions with VNext runtime truth

[Joncallim]

Summary

Fixes a safety-relevant instruction drift found by the post-VNext repository audit (#350).

The root agent instruction surface still stated that specialist execution and local repository file application were default-on. The live runtime, README, ADRs and tests instead keep specialist/host writes hard fail-closed until an OS-enforced confined writer exists.

This PR aligns repository-agent guidance with the accepted VNext architecture without changing runtime code.

Changes

• AGENTS.md
  • makes ADR 0014 the product-wide VNext ontology and ADR 0007 the Software Engineering/coding taxonomy;
  • states the current specialist/host-write boundary truthfully;
  • makes explicit that feature flags/request prose do not grant authority;
  • clarifies that Security/Adversarial/Reviewer agents produce evidence rather than allow decisions;
  • avoids ceremonial model calls and notes the legacy provider-selection path will be replaced by [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335;
  • clarifies coding roles are not universal across future installable Workforces.
• CLAUDE.md
  • points Claude at ADR 0014 and the VNext architecture first;
  • records the current fail-closed execution boundary.
• web/CLAUDE.md
  • applies the same VNext/current-runtime distinction inside the web package;
  • states that a feature flag is not authority and reviewer output cannot widen permissions.

Why this is blocking documentation, not polish

Repository agents use these files as operating instructions. A stale statement that writes are available can cause future architecture/implementation/review work to assume an execution authority that Forge deliberately does not provide.

Validation

Documentation/instruction-only change; no runtime code.

Final head: d1325afee81435ce0bcf44b23fd95930a72c40a0

• PR Contract Check #961: success
• Web CI #998: success

The PR remains intentionally unmerged pending explicit operator authorization.

Related: #333, #334, #336, #350

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T01:59:16.313233Z	d1325af	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d1325afee8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require independent review for every pull request

For a small documentation, configuration, or mechanical PR, the new “substantive” qualifier permits the operator to recommend a merge without an independent Review pass. That contradicts the unchanged core responsibility requiring every pull request to be reviewed via the Review role, leaving the merge workflow ambiguous; remove the qualifier or define the same exception consistently in both rules.

AGENTS.md reference: AGENTS.md:L105-L107

Useful? React with 👍 / 👎.