Document rule severity and CI rules in AGENTS.md

.github/workflows/release.yml

@@ -49,7 +49,7 @@ jobs:
           token: ${{ steps.release-token.outputs.token }}
 
       - name: Set up Nub
-        uses: nubjs/setup-nub@v0.6.0
+        uses: nubjs/setup-nub@v0
         with:
           nub-version: 0.9.6
           node-version-file: .nvmrc

.github/workflows/validate.yml

@@ -27,7 +27,7 @@ jobs:
           submodules: true
 
       - name: Set up Nub
-        uses: nubjs/setup-nub@v0.6.0
+        uses: nubjs/setup-nub@v0
         with:
           nub-version: 0.9.6
           node-version-file: .nvmrc

AGENTS.md

@@ -32,6 +32,17 @@ git add vendor/anti-slop
 
 `recommended` enables every anti-slop rule, so a new upstream rule becomes an error in every consumer. Add a `.tegami/` entry that names new rules and choose `minor`.
 
+## Rule severity
+
+- Every rule in `recommended` is an error, and `recommended` sets the `correctness` category to `error`. Do not add `warn` severity. Consumers run `oxlint --deny-warnings`.
+- A new or stricter rule fails lint in every consumer. Fix the findings in each consumer in the same rollout, or add the rule with a scoped consumer override and a stated reason. Do not ship a rule as `warn` first.
+
+## CI workflows
+
+- This repository is public. Jobs run on GitHub-hosted runners (`ubuntu-latest`). Never use self-hosted runner labels in this repository.
+- Use major tags for GitHub Actions. Do not pin an action to a commit SHA or an exact version.
+- Renovate opens dependency pull requests from the shared `SolZeroAI/renovate-config` preset. Submodule updates for `vendor/anti-slop` open their own pull request and do not merge automatically.
+
 ## Validation
 
 Run these commands from the repository root before handoff: