diff --git a/AGENTS.md b/AGENTS.md
index edfb729..3b781ab 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -48,17 +48,26 @@ the [runbook index](#runbook-index). The full swap history lives in
   pages (`serverAppConfigs-docs/log.md` carries the wave plan and results)
 - `tests/` — bats suite + Playwright e2e
 
-## Git Workflow
+## Git Workflow — trunk-based (fleet law, aligned 2026-10-18)
 
 All edits flow through git. Never edit files on a remote machine directly.
 
-1. **Source** the live config from the target machine
-2. **Commit** the fetched version here (redact secrets into `.env`)
-3. **Edit** locally
-4. **Test** — `./tests/run.sh` must pass
-5. **Commit and push** — origin is Gitea on Dankclaw
-6. **Pull** on the target (`deploy.sh` does this)
-7. **Deploy** — `scripts/deploy.sh` plans and dispatches only changed services
+`main` is the only long-lived branch: no `develop`, no release branches, no
+back-merges. Frank is the only dev; this repo and `dank/command-center` follow
+the same regime.
+
+1. **Branch fresh** — `git fetch`, then branch off the current `origin/main`
+   (`<type>/<slug>`, type ∈ feat|fix|docs|chore). If main moves under you,
+   merge it into your branch — never rebase.
+2. **Source** the live config from the target machine
+3. **Commit** the fetched version here (redact secrets into `.env`)
+4. **Edit** locally
+5. **Test** — `./tests/run.sh` must pass
+6. **Push the branch and open a PR against `main`** — origin is Gitea on
+   Dankclaw. Merge with `--no-ff`; **never merge a PR without an explicit,
+   current OK from Frank.** Releases: tag `vX.Y.Z` straight on `main`.
+7. **Pull** on the target (`deploy.sh` does this)
+8. **Deploy** — `scripts/deploy.sh` plans and dispatches only changed services
 
 ## Deployment