feat: implement governance instruction layer Phase 1

docs/VISION.md

@@ -13,6 +13,7 @@ Designed to start as a personal homelab tool and grow into something shareable w
 - **Layered override model** — global defaults defined here, project-level overrides live in each project
 - **Pull-based distribution** — projects opt into updates consciously; no automatic or silent changes
 - **Scales gracefully** — works solo today, designed to onboard a team and open source later
+- **Governance layer** — hard prohibitions on secrets and data, data classification framework, HITL requirements, sycophancy resistance, and deterministic execution preference; loaded into every session via `@import`, not left to per-prompt instruction
 
 ## Non-Goals (for now)
 
@@ -40,7 +41,7 @@ Projects consume from this repo by pulling updates via `sync.sh` (chunk 6). Unti
 
 ```
 ai-development/
-├── docs/                        # Workflow artifacts and issues (prd/, ard/, bug/, notes/, adr/, issues/)
+├── docs/                        # Workflow artifacts and issues (prd/, ard/, bug/, notes/, adr/, issues/) + research/ (raw research audit trail)
 ├── .agents/                     # Agent Skills standard location (provider-agnostic)
 │   └── skills/                  # SKILL.md files — read natively by Claude Code, Copilot, Cursor, etc.
 ├── core/                        # Provider-agnostic source of truth
@@ -71,6 +72,14 @@ ai-development/
 
 `~/.claude/CLAUDE.md` is an index, not a content dump. It tells the agent where things are; the agent pulls what it needs using its Read tool. This keeps context size minimal — only what is needed for every session is loaded upfront.
 
+### Governance layer
+
+`core/instructions/governance.md` is the always-on governance instruction file. Unlike the on-demand instruction files in the content index, governance.md is loaded into every Claude session via `@import` in `providers/claude-code/CLAUDE.md`. This is a technical guarantee, not a behavioural instruction — `@import` causes Claude Code to expand and load the file at launch, before any interaction begins.
+
+The governance layer has two phases:
+- **Phase 1** (complete): instruction and documentation layer — `governance.md` loaded via `@import`; `docs/ai-constitution.md` and `docs/HUMANS.md` as human-facing reference; `CONTEXT.md` extended with governance domain language.
+- **Phase 2** (Chunk 6): deterministic enforcement layer — pre-commit hooks, CI gates, secret scanning, licence scanning. Specified in `docs/research/governance_principles/CONTROLS.md`.
+
 ### This repo's own CLAUDE.md
 
 This repo has a `CLAUDE.md` at its root — a meta file that tells Claude how to work *in this repo itself* (structure, conventions, how to add skills/workflows/providers). This is distinct from `providers/claude-code/CLAUDE.md`, which is the global config deployed to `~/.claude/` for use across all projects. Do not conflate the two.