Aligning site-specific agent governance with the current organization

legacy coding-agent settings, which was specific to another coding agent, and legacy instruction artifact, which only redirected to AGENTS.md, were removed. Command permissions were no longer duplicated in a separate configuration format. Child-local governance and technical working boundaries were consolidated in the AGENTS.md read by Codex.

AGENTS.md was rewritten around the parent and child being independent Git repositories whose branches, working trees, commits, and remotes had to be inspected from their respective roots. Because parent-workspace instructions were not automatically inherited by the child, the file became a self-contained supplemental guide. It also required work to stop and return to the primary domain lead instead of guessing when child rules conflicted with parent organization governance.

The same document defined the current role routing and Task-first flow as configured behavior. These definitions do not establish that each role participated in this Activity.

• Mako / Executive Secretary was defined as the top-level router that passed CEO intent to the primary domain lead and tracked gates, blockers, progress, and the final summary.
• Yui / Organization Designer was defined as the site's primary domain lead, responsible for requirement clarification, deciding whether an Epic was needed, preparing INVEST User Stories, sequencing specialist delegation, and integrating results. After CEO approval of a domain request, a Japanese requirements Task had to be created before substantive work.
• Design, technical design and Task decomposition, and implementation were delegated to their corresponding specialist roles and linked to the requirements Task or another linked Task.
• Ritsu / PR Reviewer independently reviewed final work products and repeated review after findings were addressed. Work could not be reported complete before an explicit PASS.
• Assigned roles handled changes, verification, work branches, commits, non-force pushes, linked drafts, and review findings. Only Mako performed readiness, merge, post-integration Issue updates, and the return to main.
• Merge required the CEO to approve the target and method explicitly in the current trusted transcript. Domain-request approval and a review PASS could not substitute for merge approval.

An intermediate check found that the information returned to Mako after a blocked merge was incomplete. AGENTS.md added a six-field relay packet containing the target, desired merge method, evidence of current-thread CEO approval, rejection reason, unresolved gates, and return destination. Insufficient permission, connector or risk-reviewer rejection, conflict, or missing approval evidence had to stop without switching to another connector, gh, or another identity. A failed merge already being handled by Mako likewise prohibited fallback and did not allow the linked Issue to be closed.

The technical material retained in AGENTS.md continued to describe a static site built with Astro and TypeScript and managed with pnpm, with Cloudflare Pages as the hosting target. The build command remained pnpm build, the output directory remained dist, and quality checks remained pnpm check and pnpm build. Directory boundaries, dependency policy, preference for static HTML and CSS, and the location of Cloudflare Pages headers were also preserved.

Environment-variable and secret boundaries were retained. environment-setting template held only public variable keys and explanations, values with the PUBLIC_ prefix were treated as public values included in the browser bundle, and local values belonged in an uncommitted local environment values. API tokens, credentials, recovery codes, private keys, passwords, and personal data were prohibited from the repository, documentation, tests, and logs. PUBLIC_SITE_URL remained the expected public environment variable.

The structure example in project guide, the heading and description in explanatory-comment policy, and the package identity in package settings were synchronized with the current site identity. The package manager, dependencies, and scripts did not change. AI-work template was updated to reference the parent organization governance, operating model, and Skills and to offer the current repository and Custom Agent role choices. A site-specific source of truth was not guessed; when undefined, it had to be established through a separate Task.

Verification ran pnpm check and pnpm build. It parsed package settings as JSON and the Issue Form as YAML, then searched the changed files for stale identity, organization, role, and local absolute-path references. It also checked that required technical terms and governance boundaries remained present, deleted files were absent, the final scope contained seven files, and the diff had no whitespace errors.

The following excerpt from AGENTS.md was checked line by line against the primary Commit diff at the cutoff.

## Delivery Boundaries

- 担当 role は child repo の branch と working tree を確認し、`main` 上で直接編集しません。
- remote Git / GitHub 操作の前に、親 workspace で利用可能な `authentication preflight` を実行します。
- 担当 role は作業 branch の作成、変更、検証、commit、non-force push、linked draft PR 作成、Ritsu finding 対応までを担当します。
- PR ready 化、merge、merge 成功後の linked Issue 完了更新または close、main 復帰は Mako だけが実行します。
- merge は CEO 本人が trusted transcript 上の現スレッドで、対象 repository、対象 PR、merge method を明示承認した後に限ります。domain request の承認や Ritsu PASS は merge 承認の代わりになりません。