dominicnunez · Sep 12, 2026 · Sep 12, 2026 · Sep 12, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -11,6 +11,10 @@ Agent OS is a Go modular monolith for operating persistent AI-assisted organizat
 - Preserve `docs/handoff/` as the immutable architecture source. Publish any
   strengthened active runtime contract outside that tree instead of silently
   rewriting the handoff snapshot.
+- Keep repository files self-contained. Do not reference workspace-only project
+  files, local planning notes, attachments, or machine-specific project paths.
+  Cite tracked repository files or publicly accessible sources instead. Put any
+  necessary requirement directly in the appropriate repository document.
 
 ## Project-wide boundaries
 
@@ -71,7 +75,7 @@ Follow OpenAI's [additional safety-check guidance](https://help.openai.com/en/ar
 8. Keep PRs cohesive and bounded without omitting necessary callers merely to
    reduce diff size. Track independent confirmed defects under the issue policy
    below and resolve them before proceeding to later goal parts.
-9. Keep `docs/THREAT_MODEL.md` aligned with code changes affecting architecture,
+9. Keep `docs/threat-model.md` aligned with code changes affecting architecture,
    trust boundaries, attack surfaces, security controls, prerequisites, residual
    risks, or severity. Update it in the same PR as relevant code and keep its
    stated baseline accurate. Distinguish implemented controls from incomplete
@@ -91,20 +95,16 @@ Follow OpenAI's [additional safety-check guidance](https://help.openai.com/en/ar
   records; preserve immutable handoff evidence.
 - Keep user-facing messages minimal. Report meaningful outcomes, blockers, and
   decisions rather than routine local commits or repeated compliance statements.
-- Use the project Markdown documents to guide task work and maintain the
+- Use tracked project documentation to guide task work and maintain the
   user-requested goal and evidence of remaining work. Completing one PR does not
   complete the broader goal; do not silently narrow it to the current PR.
-- Incorporate `multi-llm-provider-architecture-prompt.md` into the provider goal.
-  Agent OS should support all providers Hermes offers where feasible, and use
+- Agent OS should support all providers Hermes offers where feasible, and use
   multiple configured providers/models for different agent tasks according to
   what the user has available. Do not constrain an organization to one provider.
   Record feasibility limits and unfinished coverage explicitly.
-- Assess `AGENT_OS_ARCHITECTURAL_IMPROVEMENTS.md` for merit after the current
-  task/PR, preserving the architecture and scope boundaries above. Treat
-  proposals as proposals to evaluate, not automatically approved implementation.
-- These project planning files may be supplied in the parent workspace rather
-  than tracked in a checkout. Consult the supplied originals and maintain
-  traceable status; do not modify the immutable `docs/handoff/` snapshot.
+- Assess proposed architectural improvements for merit after the current task/PR,
+  preserving the architecture and scope boundaries above. Treat proposals as
+  proposals to evaluate, not automatically approved implementation.
 
 ## Commits, PRs, and review sequencing
 
@@ -139,7 +139,7 @@ Follow OpenAI's [additional safety-check guidance](https://help.openai.com/en/ar
   project file outside the repository. Estimate the first status check from
   comparable observations and adjust as evidence changes; avoid frequent fixed
   polling and never treat an estimated completion time as an actual reply.
-- Security-sensitive code and any PR changing `docs/THREAT_MODEL.md` require a
+- Security-sensitive code and any PR changing `docs/threat-model.md` require a
   security review. Request it by commenting `@codex security review` only after
   general review has returned with no outstanding issues. This supersedes the
   earlier permission to request security review before general review finishes.

diff --git a/SECURITY.md b/SECURITY.md
@@ -35,5 +35,5 @@ issue tracker is enabled.
 The V1 runtime treats model output and operator text as untrusted, separates
 work, completion-review, and approval credentials, and keeps real providers and
 consequential adapters disabled by default. See
-[docs/THREAT_MODEL.md](docs/THREAT_MODEL.md) for trust boundaries, controls,
+[docs/threat-model.md](docs/threat-model.md) for trust boundaries, controls,
 known residual risks, and verification expectations.
diff --git a/docs/README.md b/docs/README.md
@@ -26,7 +26,7 @@
 
 ## Security and releases
 
-- [Threat model](THREAT_MODEL.md) - protected assets, attack surfaces, controls, and residual risks.
+- [Threat model](threat-model.md) - protected assets, attack surfaces, controls, and residual risks.
 - [Execution authority](EXECUTION_AUTHORITY.md) - supply-chain boundaries, consequential tool capabilities, containment prerequisites, and staged promotion.
 - [Event ledger integrity](EVENT_LEDGER_INTEGRITY.md) - stored-byte chaining, verification boundaries, and residual tampering risks.
 - [Incident replay](INCIDENT_REPLAY.md) - bounded, payload-free reconstruction of one durable Work conversation.

diff --git a/docs/development/CI.md b/docs/development/CI.md
@@ -39,6 +39,6 @@ history and assessment-bundle checks, and classifier regressions remain active.
 The existing history-verification rules are unchanged.
 
 Skipping code checks does not waive reviews. Follow `AGENTS.md` for review
-sequencing; changes to `docs/THREAT_MODEL.md` still require security review after
+sequencing; changes to `docs/threat-model.md` still require security review after
 a clean general review. Workflow changes themselves require full code checks
 and security review.
diff --git a/docs/THREAT_MODEL.md → docs/threat-model.md b/docs/THREAT_MODEL.md → docs/threat-model.md
diff --git a/scripts/build_aims_assessment_bundle.py b/scripts/build_aims_assessment_bundle.py
@@ -59,7 +59,7 @@
     "docs/ORGANIZATIONAL_KNOWLEDGE.md": "organizational-memory",
     "docs/SHARED_COORDINATION.md": "shared-coordination",
     "docs/SQLITE_RECOVERY.md": "resilience-and-recovery",
-    "docs/THREAT_MODEL.md": "ai-and-security-risk",
+    "docs/threat-model.md": "ai-and-security-risk",
     "docs/development/BUILD_CONTRACT.md": "lifecycle-controls",
     "docs/development/ISO_IEC_42001_READINESS.md": "readiness-register",
     "docs/development/V1_ACCEPTANCE_STATUS.md": "acceptance-evidence",

diff --git a/scripts/test_build_aims_assessment_bundle.py b/scripts/test_build_aims_assessment_bundle.py
@@ -57,7 +57,7 @@ def setUp(self) -> None:
             "docs/ORGANIZATIONAL_KNOWLEDGE.md",
             "docs/SHARED_COORDINATION.md",
             "docs/SQLITE_RECOVERY.md",
-            "docs/THREAT_MODEL.md",
+            "docs/threat-model.md",
             "docs/development/BUILD_CONTRACT.md",
             "docs/development/ISO_IEC_42001_READINESS.md",
             "docs/development/V1_ACCEPTANCE_STATUS.md",