[kyle-sexton]

No related issue: org-wide pointer rollout (owner-approved 2026-10-09)

Summary

Adds one fixed pointer line, under a short ## Org architecture heading in the agent instructions file, to the private melodic-software/architecture repo (cross-repo decisions, glossary, why each trust link exists, repo map).

Fix

The same line goes into every governed, non-archived repo so an agent in any of them finds the org context and knows to stop if access is denied. The section sits before ## Code Review Rules so that section stays last. A follow-up in melodic-software/standards adds a repo-policy check that fails a repo whose AGENTS.md or CLAUDE.md lacks melodic-software/architecture.

Verification

• The added line is byte-identical to the approved text across the rollout.
• The file diff is the new section only; no existing line changed.
• Repo hooks and checks ran on commit and in CI.

Related

• Owner-approved org-wide rollout, 2026-10-09.
• Standards check: see the linked melodic-software/standards PR from this rollout.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T21:43:11.868052Z	68f0cbc	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 47s —— View job

---

Security review (/review:security-review)

• Gather context (diff vs origin/main, PR body, changed files)
• Apply skip gate / instruction-surface lens
• Report findings

Diff reviewed: AGENTS.md (+4/−0), commit 68f0cbc

+## Org architecture
+
+Org architecture (cross-repo decisions, glossary, why each trust link exists): private repo `melodic-software/architecture`. Repo map: `gh api orgs/melodic-software/properties/values` (system and role per repo). Read it with `gh api repos/melodic-software/architecture/contents/<path>`; on Claude Code on the web, attach it at session start; in CI, check it out with a read-only App token. If access is denied, stop and tell the user.

Instruction-surface lens: the change is purely additive — a new section inserted before ## Code Review Rules. No existing line is deleted, narrowed, or softened, so this isn't an instruction-removal case and the exception-register check doesn't apply (the register file isn't present in this checkout either, for completeness). The new text itself fails closed ("If access is denied, stop and tell the user") rather than falling back to a weaker default.

Result: no security issues found. This is a documentation-only change with no code, workflow, or permission modifications, and no injection, authz, or secret-handling surface in the diff.

[claude]

Claude finished @kyle-sexton's task in 1m 20s —— View job

---

Code review complete

• Gather context (PR diff, CLAUDE.md/AGENTS.md guidelines)
• Review changed file (AGENTS.md)
• Post findings

Skip gate applied: this change is a trivial, pre-approved doc addition — a
single fixed pointer paragraph under a new ## Org architecture heading in
AGENTS.md (+4/-0, no existing lines touched). It matches skip-gate criterion
3 ("change is trivial/automated with no meaningful review surface"), so no
deep multi-agent fan-out was run.

What I checked:

• Diff is additive only (git diff origin/main...HEAD -- AGENTS.md); no
  existing content changed. Confirmed ## Code Review Rules remains the last
  section as the PR description claims.
• The heading text is unique in the file (no duplicate ## Org architecture
  section elsewhere), and the new section isn't referenced by any dangling
  anchor link.
• .markdownlint-cli2.jsonc disables MD013 (line length) repo-wide, so the
  new section's single long paragraph (line 141) doesn't violate lint config,
  even though it reads differently from this file's usual ~80-column wrap —
  consistent with the PR's stated goal of a byte-identical line across the
  org-wide rollout, so not flagging it as a style nit.
• The gh api orgs/.../properties/values / repos/.../architecture/contents/<path>
  commands referenced are external GitHub API calls whose success depends on
  org-level configuration (custom properties, App token scope) outside this
  repo's diff; not independently verifiable from the changed file alone, and
  the PR's own verification claims (byte-identical line, hooks/CI ran) are
  author-asserted, not something I re-ran.

No findings. No inline comments were posted — I found no correctness,
architecture, or maintainability issue a careful reviewer would block on in
this change.

[github-actions]

claude-security-review has reviewed this pull request through 68f0cbc; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through 68f0cbc; a later push is reviewed from there.