feat: implement governance instruction layer Phase 1

CONTEXT.md

@@ -70,6 +70,30 @@ Reusable slash commands for AI coding tools, defined as `SKILL.md` files followi
 - **Workflows** — compositions of skills chained into a larger task. Invokable by agents or humans. Example: grill-me → to-prd → to-issues as a product design workflow.
 - **Prompts** — shared fragments (system prompt sections, output formats) embedded into multiple skills or workflows.
 
+### HITL (human-in-the-loop)
+Agent pauses before a consequential action; human approves before execution. Required for irreversible or high-stakes actions (architecture changes, production deployments, security configuration). The agent drafts the change plan and waits — it does not proceed autonomously. Contrast with HOTL.
+
+### HOTL (human-on-the-loop)
+Agent acts; human monitors and can intervene after the fact. Acceptable for low-stakes, bounded, reversible actions where the cost of pausing for approval exceeds the blast radius of an error. The distinction between HITL and HOTL must be explicit and documented — defaulting to HOTL for convenience is not acceptable.
+
+### Symbolic oversight
+Oversight implemented as a gesture (assigning a reviewer) rather than a functional safeguard. A reviewer without the information, time, agency, or intent to evaluate is not oversight — it is the appearance of oversight. The documented failure mode: symbolic oversight passes audits but does not catch errors. Genuine oversight requires: the reviewer has access to what was produced, time to evaluate it meaningfully, authority to reject it, and the intent to do so.
+
+### Data classification tiers
+The four-tier framework governing what data may enter AI context. Apply the tier of the most sensitive element in any dataset or prompt.
+
+| Tier | Examples | AI Rule |
+|---|---|---|
+| **Public** | Publicly available info | No restrictions |
+| **Internal** | Operational data, anonymised logs | Enterprise AI tools only; not consumer/free-tier |
+| **Confidential** | Source code, architecture, personal data, IP | Enterprise AI + contractual data-not-trained guarantee |
+| **Restricted** | GDPR Article 9 health/biometrics, credentials, regulated financial data | Never enters AI context — hard architectural prohibition |
+
+Defined in full in `docs/ai-constitution.md` Section 3. Agent-actionable rules in `core/instructions/governance.md`.
+
+### Sycophancy
+The failure mode where RLHF-trained models prioritise approval over accuracy. Treated as a first-class reliability risk: models change correct answers to wrong ones under user pressure in a majority of observed cases, then persist in the wrong answer. Designing against sycophancy is an explicit obligation, not a quality-of-life concern. Countermeasures: explicit pushback resistance instructions, prompting for dissent, cross-validating against independent sources. Never interpret AI agreement as AI accuracy.
+
 ### Workstream
 A focused work session oriented around a single goal — a feature, bug, improvement, or exploration. Starts with a grill to produce an artifact (PRD, Bug Brief, ADR, etc.), runs through issue implementation, and closes with docs + commit. Ongoing skills (/diagnose, /prototype, /zoom-out) are invoked ad hoc within a workstream as needed.