docs: align scaffolded agent maintenance contract

[devantler]

🤖 Generated by the Daily AI Engineer

Why

Every new tenant copies its agent instructions once and then owns them outside template sync. The scaffold still encoded a retired maintainer-promotion gate and treated bot identities and branch shape as trust, so future agents could inherit unsafe merge and dependency-automation boundaries.

What

• align the tenant maintenance section with current ownership, external-code, dependency-bot, exact-head review, CLEAN merge, and user-path evaluation rules;
• keep the maintain skill as a thin pointer to the canonical section;
• add a scaffold-only regression guard with adversarial mutations and wire it into the existing validation workflow.

Fixes #82
Part of #6

[devantler]

🤖 Generated by the Daily AI Engineer

Readiness evidence

Exact head: 9d4e765651334e79a89907ce8580a7ba6645428c

• TDD RED: the new guard rejected current main because the dependency-automation no-action boundary was absent.
• sh scripts/agent-instructions.test.sh: PASS for the intended scaffold plus five adversarial mutations (removed bot boundary, restored human-promotion gate, branch-shape trust, removed exact-head readiness, removed user-path evaluation).
• sh scripts/rename-placeholders.test.sh: PASS, including its cross-checkout and rendered-scaffold assertions.
• ShellCheck: PASS for all three scaffold scripts.
• Actionlint: PASS for every workflow.
• Zizmor: no findings in the changed workflow (one repository-configured suppression).
• kubectl kustomize deploy/: 8 resources rendered.
• Workflow shape check: exactly one unconditional, fail-closed agent-contract step reaches the template validation job.
• Diff check: PASS.

User evaluation

Copied the changed scaffold into a fresh temporary tenant checkout, initialized it as its own repository, then invoked scripts/agent-instructions.test.sh by absolute path from /tmp (outside that checkout). The helper resolved the scaffold that owns it—not the caller's Git root—and the inherited AGENTS.md exposed the expected no-action, external static-review, exact-head, real-user-path, and bare-squash boundaries. This trial caught and fixed an initial caller-root bug before the PR was opened.

The PR remains draft until current-head CI and exact-head review are green.

[devantler]

🤖 Generated by the Daily AI Engineer

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9d4e765651

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Daily AI Engineer

Exact-head readiness update

Supersedes the earlier readiness snapshot after making the pentad definition explicit. Exact head 7a4f55bd8b6d47b95fbabff2d5222df24953d52a is clean locally and all 11 current-head GitHub check runs are terminal green, including Validate Scaffold, Platform Admissibility, CodeQL, Zizmor, dependency review, and required CI.

The focused contract guard, ShellCheck, Actionlint, diff check, and fresh-tenant cross-checkout user trial were repeated successfully at this head. No CodeRabbit review exists, so no supported pre-merge summary is expected on the Codex review lane.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 7a4f55bd8b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Daily AI Engineer

Post-review-fix readiness

Exact head c2243d86ae241e0f5936e8dd888381708fa1261f addresses all five valid Codex findings with five new RED/GREEN controls. The focused guard now passes the intended scaffold plus ten safety mutations; ShellCheck, Actionlint, onboarding, render, Zizmor, diff check, and the fresh-tenant cross-checkout trial pass. All 12 current-head GitHub check runs are terminal green, including Validate Scaffold and Platform Admissibility, and all review threads are resolved with fix evidence.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: c2243d86ae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".