docs: AGENTS.md references ChallengeAI only; dependabot monthly consolidated PR

.challengeai/challenge-cli.md

@@ -31,17 +31,15 @@ and that agreement is worth enforcing mechanically rather than by habit.
 
 ## In this repository
 
-FedSpeak has two agent entry points, not fully parallel: `README.md` at the
-repo root (Claude Code) and `CONTRIBUTING.md` (also Claude-specific, despite
-the generic name — it's a second, narrower file scoped to the acronym-adding
-workflow specifically, not a Codex entry point). **There is no `AGENTS.md`,
-so Codex has no dedicated entry file in this repository as of this
-writing** — a real gap against this tool's own "One source, two runtimes"
-principle: Codex started directly in this repo today would discover neither
-`README.md` nor anything under `.challengeai/` on its own, since it reads
-`AGENTS.md` specifically. Closing it means adding a root `AGENTS.md`; that's
-a deliberate decision for a maintainer to make, not something this pass
-made unasked.
+FedSpeak has one agent entry point: `AGENTS.md` at the repo root. It is
+runtime-neutral, points at this folder and `CHALLENGEAI.md` for federal
+delivery standards, and carries the repo-specific rules (data policy,
+module format, release gates). There are no parallel per-tool agent files
+to keep in sync, which is the cleanest way to satisfy "One source, two
+runtimes": any agent that reads `AGENTS.md` lands on the same guidance.
+`README.md` is the human-facing repo guide and `CONTRIBUTING.md` is the
+acronym-adding workflow; `AGENTS.md` defers to both rather than restating
+them.
 `README.md` and `CONTRIBUTING.md` are not kept byte-identical below a shared
 heading the way some MetaPhase repos keep `AGENTS.md`/`README.md` in sync —
 they cover different scopes (`README.md` is the general repo guide;

.github/dependabot.yml

@@ -1,53 +1,35 @@
+# Policy: one consolidated version-update PR per month covering every npm
+# dependency in both manifests (patch, minor, and major). Security updates
+# are the only exception: Dependabot opens those individually and immediately
+# when an advisory is published, regardless of this schedule.
 version: 2
 updates:
   - package-ecosystem: npm
-    directory: /
+    directories:
+      - /
+      - /cli-package
     schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 5
+      interval: monthly
+    open-pull-requests-limit: 1
     target-branch: dev
     commit-message:
       prefix: "chore(deps)"
     groups:
-      prod-deps:
-        dependency-type: production
-        update-types: [minor, patch]
-      dev-deps:
-        dependency-type: development
-        update-types: [minor, patch]
-    ignore:
-      # Majors handled deliberately, not by bot
-      - dependency-name: react
-        update-types: [version-update:semver-major]
-      - dependency-name: react-dom
-        update-types: [version-update:semver-major]
-      - dependency-name: vite
-        update-types: [version-update:semver-major]
-      - dependency-name: vitest
-        update-types: [version-update:semver-major]
-      - dependency-name: "@vitest/*"
-        update-types: [version-update:semver-major]
-      - dependency-name: tailwindcss
-        update-types: [version-update:semver-major]
-      - dependency-name: eslint
-        update-types: [version-update:semver-major]
-      - dependency-name: typescript
-        update-types: [version-update:semver-major]
-
-  - package-ecosystem: npm
-    directory: /cli-package
-    schedule:
-      interval: weekly
-      day: monday
-    target-branch: dev
-    commit-message:
-      prefix: "chore(deps)"
+      monthly-updates:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: [patch, minor, major]
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: monthly
+    open-pull-requests-limit: 1
     target-branch: dev
     commit-message:
       prefix: "chore(ci)"
+    groups:
+      monthly-actions:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: [patch, minor, major]

.gitignore

@@ -30,8 +30,9 @@ dist-ssr
 # Test output directories
 coverage/
 
-# Claude (keep agents.md tracked, ignore local settings)
+# Agent tool local settings (AGENTS.md is the only tracked agent file)
 .claude/
+.cursor/
 
 # Deno
 deno.lock

AGENTS.md

@@ -16,14 +16,15 @@ Read this before starting work; update it whenever the user gives new standing g
 
 1. `README.md` — overview, quick start, API and package reference, project structure.
 2. This file.
-3. `CONTRIBUTING.md` — how to add acronyms, commit style, git workflow.
-4. `CHANGELOG.md` — what shipped in each version.
-5. `public/llms.txt` — the agent-facing description of the service (keep it accurate when endpoints or counts change).
+3. [`CHALLENGEAI.md`](CHALLENGEAI.md) and the [`.challengeai/`](.challengeai/) folder — federal delivery standards and how this repo measures against them.
+4. `CONTRIBUTING.md` — how to add acronyms, commit style, git workflow.
+5. `CHANGELOG.md` — what shipped in each version.
+6. `public/llms.txt` — the agent-facing description of the service (keep it accurate when endpoints or counts change).
 
 ## Standing Preferences
 
 - **No AI attribution anywhere.** No `Co-Authored-By` trailers naming a model or vendor, no "Generated with" lines, no model names in commit messages, PR titles, PR bodies, branch names, or code comments. Commits and PRs are authored by humans only. If a tool injects such a trailer, strip it before pushing.
-- **No agent-specific instruction files other than this one.** Do not add `CLAUDE.md`, `.claude/`, `.cursor/`, or similar. Conventions belong in `README.md`, `CONTRIBUTING.md`, or here.
+- **This file and the ChallengeAI layer are the only agent guidance.** Do not add vendor- or tool-specific instruction files or dot-folders. Conventions belong in `README.md`, `CONTRIBUTING.md`, or here; federal delivery standards belong in [`.challengeai/`](.challengeai/) with [`CHALLENGEAI.md`](CHALLENGEAI.md) as the index.
 - Branch names: short, descriptive, professional (`feat/data-2026-refresh`, `chore/security-deps-batch`).
 - Commit messages: imperative mood, prefixed (`feat:`, `fix:`, `docs:`, `chore:`, `ci:`, `release:`).
 - Refer to the company as **"MetaPhase"** in user-facing copy. Full legal name only in `LICENSE`.
@@ -50,7 +51,7 @@ Read this before starting work; update it whenever the user gives new standing g
 - `public/` — `openapi.json`, `llms.txt`, `llms-full.txt`, `robots.txt`, `sitemap.xml`, manifest, favicon.
 - `tests/` — Vitest: `decoder`, `encoder`, `truncate`, `mcp`, `data`.
 - `scripts/sync-cli-package.sh` — copies shared sources, data, README, LICENSE into `cli-package/`.
-- `.github/workflows/ci.yml` — lint → typecheck → test → build on Node 20. `dependabot.yml` — weekly grouped minor/patch bumps to `dev`; majors for the framework stack are ignored on purpose.
+- `.github/workflows/ci.yml` — lint → typecheck → test → build on Node 20. `dependabot.yml` — one consolidated version-update PR per month (all npm deps in both manifests, patch through major) plus one monthly PR for GitHub Actions. Security advisories are the only exception: those arrive as individual, immediate PRs and should be merged promptly. Do not change this cadence without the user.
 
 ## Module Format
 
@@ -100,9 +101,9 @@ Every PR must pass locally and in CI:
 
 - Merge PRs, deploy to `main`, tag releases, or publish to npm.
 - Delete acronym entries or rewrite descriptions in a way that adds opinion.
-- Close Dependabot PRs before the superseding change has merged.
+- Close Dependabot PRs before the superseding change has merged, or change the monthly consolidated-PR cadence.
 - Add authentication, telemetry, or any form of user data collection.
 
 ## Maintenance Rule
 
-When the user gives process feedback, record it here so every future session picks it up. Keep this file the single source of agent guidance for the repo.
+When the user gives process feedback, record it here so every future session picks it up. Keep this file the single source of repo-specific agent guidance; federal standards stay in `.challengeai/`. Do not create parallel agent files that would need syncing.