diff --git a/.gitignore b/.gitignore
index d6fe8f9..37a962f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,4 +21,3 @@ Thumbs.db
 .claude/
 
 # Local hygiene notes (not for commit)
-CLAUDE.md
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..e1c15f4
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,26 @@
+# AGENTS.md — Repo hygiene
+
+Scope: this file covers *repo hygiene* — branching, remotes, CI, cleanup. It is not project documentation.
+
+## Branch model
+- Single-trunk: `main` only. No `dev` or `beta` branch. Land small changes directly, or use short-lived `feature/x`/`fix/x` branches for anything non-trivial and merge back to `main`.
+- This replaced an earlier three-branch (`dev`/`beta`/`main`) model after `main` silently rotted across the ecosystem. Don't recreate those branches.
+
+## Channel
+- **Pacman-only, permanently.** There is no `bakery.toml` on purpose: breadlock installs a root-owned `/etc/pam.d/breadlock` PAM service (and `breadgreet` is a greetd greeter). Bakery has no privileged-install path. Do not add `bakery.toml`.
+- Releases are `v*` tags. `.forgejo/workflows/package.yml` builds the `[breadway]` pacman package. There are no bakery tracks (`dev`/`beta`/`stable` indexes) for this repo.
+
+## Remotes
+- `origin` — Forgejo (`git.breadway.dev` via Hestia, SSH) — authoritative. Push here.
+- `github` — GitHub mirror (push-mirror; do not push to it by hand).
+
+## CI
+- `.forgejo/workflows/package.yml` triggers only on `push: tags: ['v*']` — regular pushes to `main` run nothing. Tag a release to trigger packaging.
+- No build/lint/test CI runs on ordinary commits or PRs — test locally before merging.
+
+## Cleanup
+- Delete feature/fix branches (local + remote) once merged. Check with `git branch --merged main`.
+
+## Don't
+- Don't add `bakery.toml`.
+- Don't embed credentials in remote URLs — SSH or a credential helper only.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c60c189..c8b1d9c 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -12,7 +12,7 @@ service, which bakery cannot install. Don't add one. Releases are `v*`
 tags that fire `.forgejo/workflows/package.yml` into the `[breadway]`
 pacman repo. There are no bakery tracks.
 
-See `CLAUDE.md` (local hygiene notes) for remotes and CI details.
+See `AGENTS.md` for remotes and CI details.
 
 ## Local development