feat: implement governance instruction layer Phase 1

CLAUDE.md

@@ -22,12 +22,17 @@ Read these at the start of every session in this repo:
 
 - `CONTEXT.md` — domain language and principles; challenge any term that conflicts with it
 - `docs/VISION.md` — purpose, goals, roadmap, and long-term Management Application vision
+- `docs/ROADMAP.md` — chunk status table and open questions; read this to orient on where work stands
+- `docs/ai-constitution.md` — full governance evidence base; read when a governance decision needs justification
+- `docs/HUMANS.md` — human practitioner checklist; applies when working with AI tools in this repo
+- **Governance workstream** — `core/instructions/governance.md` (agent rules), loaded via `@import` in `providers/claude-code/CLAUDE.md`; `docs/research/governance_principles/CONTROLS.md` (Phase 2 enforcement spec, Chunk 6)
 
 ## Key rules
 
 - `core/` content must use plain imperative language — no tool names, provider APIs, or format assumptions
 - Never edit files deployed by `sync.sh` directly in a project; put customizations in override files
 - `providers/claude-code/CLAUDE.md` is the deployed global config — edit it there, not here
+- Governance constraints from `core/instructions/governance.md` apply when building content in this repo — hard prohibitions on secrets and data, HITL requirements before irreversible actions, sycophancy resistance, and deterministic execution preference are always in effect
 
 ## Chunk development workflow