diff --git a/SETTINGS.yaml b/SETTINGS.yaml
new file mode 100644
index 0000000..e5cd4f5
--- /dev/null
+++ b/SETTINGS.yaml
@@ -0,0 +1,51 @@
+# yaml-language-server: $schema=./schemas/agent-runtime.schema.json
+
+version: 1
+
+model:
+  class: balanced
+  reasoning: medium
+
+runtime:
+  filesystem: workspace-write
+  approval: guarded-auto
+  network_access: false
+  tools:
+    - shell
+    - read
+    - edit
+    - write
+    - glob
+    - grep
+    - web_fetch
+    - web_search
+
+safety:
+  protected_paths:
+    - ~/.ssh/**
+    - ~/.aws/**
+    - ~/.gnupg/**
+    - "**/.env*"
+  dangerous_shell_commands:
+    ask:
+      - rm *
+      - rmdir *
+      - git push --force*
+      - git push -f*
+      - git reset --hard*
+      - git clean *
+      - chmod *
+      - dd *
+      - mkfs*
+      - shred *
+      - kill *
+      - killall *
+      - sudo *
+
+targets:
+  claude:
+    claude_md_excludes:
+      - .claude/agent-memory/**
+  codex:
+    approval_policy: untrusted
+    network_access: false
diff --git a/TEAM.yaml b/TEAM.yaml
new file mode 100644
index 0000000..e8b8587
--- /dev/null
+++ b/TEAM.yaml
@@ -0,0 +1,276 @@
+version: 1
+
+agents:
+  order:
+    - architect
+    - auditor
+    - debugger
+    - documenter
+    - researcher
+    - reviewer
+    - worker
+  items:
+    architect:
+      id: architect
+      name: architect
+      description: Research-first planning agent. Handles triage, research coordination, architecture design, and wave decomposition. Use before any non-trivial implementation task. Produces the implementation blueprint the entire team follows.
+      model: opus
+      effort: max
+      permission_mode: plan
+      tools:
+        - Read
+        - Glob
+        - Grep
+        - WebFetch
+        - WebSearch
+        - Bash
+        - Write
+      disallowed_tools: []
+      max_turns: 35
+      skills:
+        - conventions
+        - message-schema
+      instruction_file: agents/architect.md
+    auditor:
+      id: auditor
+      name: auditor
+      description: Use after implementation — audits for security vulnerabilities and validates runtime behavior. Builds, tests, and probes acceptance criteria. Never modifies code.
+      model: sonnet
+      effort: ""
+      permission_mode: ""
+      tools:
+        - Read
+        - Glob
+        - Grep
+        - Bash
+        - WebFetch
+        - WebSearch
+      disallowed_tools:
+        - Write
+        - Edit
+      max_turns: 25
+      skills:
+        - conventions
+        - message-schema
+        - qa-checklist
+      background: true
+      instruction_file: agents/auditor.md
+    debugger:
+      id: debugger
+      name: debugger
+      description: Use immediately when encountering a bug, error, or unexpected behavior. Diagnoses root cause and applies a minimal targeted fix. Does not refactor or improve surrounding code.
+      model: sonnet
+      effort: ""
+      permission_mode: acceptEdits
+      tools:
+        - Read
+        - Write
+        - Edit
+        - Glob
+        - Grep
+        - Bash
+      disallowed_tools: []
+      max_turns: 20
+      skills:
+        - conventions
+        - worker-protocol
+        - message-schema
+        - qa-checklist
+      instruction_file: agents/debugger.md
+    documenter:
+      id: documenter
+      name: documenter
+      description: Use when asked to write or update documentation — READMEs, API references, architecture overviews, inline doc comments, or changelogs. Reads code first, writes accurate docs. Never modifies source code.
+      model: sonnet
+      effort: high
+      permission_mode: ""
+      tools:
+        - Read
+        - Write
+        - Edit
+        - Glob
+        - Grep
+        - Bash
+      disallowed_tools: []
+      max_turns: 20
+      skills:
+        - conventions
+        - worker-protocol
+        - message-schema
+        - qa-checklist
+      memory: project
+      instruction_file: agents/documenter.md
+    researcher:
+      id: researcher
+      name: researcher
+      description: Use to answer a specific research question with verified facts. Spawned in parallel — one instance per topic. Stateless. Returns verified facts, source URLs, and gotchas.
+      model: sonnet
+      effort: ""
+      permission_mode: plan
+      tools:
+        - Read
+        - Glob
+        - Grep
+        - Bash
+        - WebFetch
+        - WebSearch
+      disallowed_tools:
+        - Write
+        - Edit
+      max_turns: 10
+      skills:
+        - message-schema
+      instruction_file: agents/researcher.md
+    reviewer:
+      id: reviewer
+      name: reviewer
+      description: Use after implementation — reviews code quality and verifies claims against source, docs, and acceptance criteria. Never modifies code.
+      model: sonnet
+      effort: ""
+      permission_mode: plan
+      tools:
+        - Read
+        - Glob
+        - Grep
+        - Bash
+        - WebFetch
+        - WebSearch
+      disallowed_tools:
+        - Write
+        - Edit
+      max_turns: 20
+      skills:
+        - conventions
+        - message-schema
+        - qa-checklist
+      instruction_file: agents/reviewer.md
+    worker:
+      id: worker
+      name: worker
+      description: Universal implementer. Handles all task tiers — trivial to architectural. Model is scaled by the orchestrator based on task complexity (haiku for trivial, sonnet for standard, opus for architectural/ambiguous). Default implementer for all implementation work.
+      model: sonnet
+      effort: ""
+      permission_mode: acceptEdits
+      tools:
+        - Read
+        - Write
+        - Edit
+        - Glob
+        - Grep
+        - Bash
+      disallowed_tools: []
+      max_turns: 25
+      skills:
+        - conventions
+        - worker-protocol
+        - message-schema
+        - qa-checklist
+      isolation: worktree
+      instruction_file: agents/worker.md
+
+skills:
+  order:
+    - conventions
+    - message-schema
+    - orchestrate
+    - qa-checklist
+    - worker-protocol
+  items:
+    conventions:
+      id: conventions
+      name: conventions
+      description: Core coding conventions and quality priorities for all projects.
+      instruction_file: skills/conventions/SKILL.md
+      applies_to:
+        - claude
+        - codex
+      install_mode: shared
+    message-schema:
+      id: message-schema
+      name: message-schema
+      description: Typed envelope schema for all inter-agent communication. Defines message types, required fields, and signal routing contracts.
+      instruction_file: skills/message-schema/SKILL.md
+      applies_to:
+        - claude
+        - codex
+      install_mode: shared
+    orchestrate:
+      id: orchestrate
+      name: orchestrate
+      description: Orchestration framework for decomposing and delegating complex tasks to the agent team. Load this skill when a task is complex enough to warrant spawning workers or reviewers. Covers task tiers, planning pipeline, wave dispatch, review, and git flow.
+      instruction_file: skills/orchestrate/SKILL.md
+      applies_to:
+        - claude
+        - codex
+      install_mode: shared
+    qa-checklist:
+      id: qa-checklist
+      name: qa-checklist
+      description: Self-validation checklist. All workers run this against their own output before returning results.
+      instruction_file: skills/qa-checklist/SKILL.md
+      applies_to:
+        - claude
+        - codex
+      install_mode: shared
+    worker-protocol:
+      id: worker-protocol
+      name: worker-protocol
+      description: Standard output format, feedback handling, and operational procedures for all worker agents.
+      instruction_file: skills/worker-protocol/SKILL.md
+      applies_to:
+        - claude
+        - codex
+      install_mode: shared
+
+rules:
+  order:
+    - 01-session
+    - 02-responses
+    - 03-git
+    - 04-tools
+    - 05-verification
+    - 06-nix
+    - 07-research
+  items:
+    01-session:
+      id: 01-session
+      source_file: rules/01-session.md
+      applies_to:
+        - claude
+        - codex
+    02-responses:
+      id: 02-responses
+      source_file: rules/02-responses.md
+      applies_to:
+        - claude
+        - codex
+    03-git:
+      id: 03-git
+      source_file: rules/03-git.md
+      applies_to:
+        - claude
+        - codex
+    04-tools:
+      id: 04-tools
+      source_file: rules/04-tools.md
+      applies_to:
+        - claude
+        - codex
+    05-verification:
+      id: 05-verification
+      source_file: rules/05-verification.md
+      applies_to:
+        - claude
+        - codex
+    06-nix:
+      id: 06-nix
+      source_file: rules/06-nix.md
+      applies_to:
+        - claude
+        - codex
+    07-research:
+      id: 07-research
+      source_file: rules/07-research.md
+      applies_to:
+        - claude
+        - codex
diff --git a/schemas/agent-runtime.schema.json b/schemas/agent-runtime.schema.json
new file mode 100644
index 0000000..1a977d6
--- /dev/null
+++ b/schemas/agent-runtime.schema.json
@@ -0,0 +1,162 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://example.com/schemas/agent-runtime.schema.json",
+  "title": "Agent Runtime Config",
+  "description": "Portable runtime policy for deriving tool-specific AI harness configuration.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "version",
+    "model",
+    "runtime",
+    "safety"
+  ],
+  "properties": {
+    "version": {
+      "type": "integer",
+      "const": 1
+    },
+    "model": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "class",
+        "reasoning"
+      ],
+      "properties": {
+        "class": {
+          "type": "string",
+          "enum": [
+            "fast",
+            "balanced",
+            "powerful"
+          ],
+          "description": "Portable model tier. Adapters map this to provider-specific model names."
+        },
+        "reasoning": {
+          "type": "string",
+          "enum": [
+            "low",
+            "medium",
+            "high",
+            "max"
+          ]
+        }
+      }
+    },
+    "runtime": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "filesystem",
+        "approval",
+        "network_access",
+        "tools"
+      ],
+      "properties": {
+        "filesystem": {
+          "type": "string",
+          "enum": [
+            "read-only",
+            "workspace-write"
+          ]
+        },
+        "approval": {
+          "type": "string",
+          "enum": [
+            "manual",
+            "guarded-auto",
+            "full-auto"
+          ],
+          "description": "Portable approval intent. Adapters degrade where exact behavior is unavailable."
+        },
+        "network_access": {
+          "type": "boolean"
+        },
+        "tools": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "shell",
+              "read",
+              "edit",
+              "write",
+              "glob",
+              "grep",
+              "web_fetch",
+              "web_search"
+            ]
+          },
+          "uniqueItems": true
+        }
+      }
+    },
+    "safety": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "protected_paths",
+        "dangerous_shell_commands"
+      ],
+      "properties": {
+        "protected_paths": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "dangerous_shell_commands": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "ask"
+          ],
+          "properties": {
+            "ask": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      }
+    },
+    "targets": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "claude": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "claude_md_excludes": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "codex": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "approval_policy": {
+              "type": "string",
+              "enum": [
+                "on-request",
+                "untrusted",
+                "never"
+              ]
+            },
+            "network_access": {
+              "type": "boolean"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/schemas/team.schema.json b/schemas/team.schema.json
new file mode 100644
index 0000000..1710b80
--- /dev/null
+++ b/schemas/team.schema.json
@@ -0,0 +1,544 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://example.com/schemas/team.schema.json",
+  "title": "Team Protocol Config",
+  "description": "Portable team-level inventory and metadata for agents, skills, and rules. For v1 this schema enforces strict inventory membership/order; generator runtime still validates referenced files exist on disk.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "version",
+    "agents",
+    "skills",
+    "rules"
+  ],
+  "properties": {
+    "version": {
+      "type": "integer",
+      "const": 1
+    },
+    "agents": {
+      "$ref": "#/$defs/inventory_agents"
+    },
+    "skills": {
+      "$ref": "#/$defs/inventory_skills"
+    },
+    "rules": {
+      "$ref": "#/$defs/inventory_rules"
+    }
+  },
+  "$defs": {
+    "id_agent": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]*$"
+    },
+    "id_skill": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]*$"
+    },
+    "id_rule": {
+      "type": "string",
+      "pattern": "^[0-9]{2}-[a-z0-9-]+$"
+    },
+    "tool_name": {
+      "type": "string",
+      "enum": [
+        "Read",
+        "Write",
+        "Edit",
+        "Glob",
+        "Grep",
+        "Bash",
+        "WebFetch",
+        "WebSearch"
+      ]
+    },
+    "target_name": {
+      "type": "string",
+      "enum": [
+        "claude",
+        "codex"
+      ]
+    },
+    "agent_item": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "name",
+        "description",
+        "model",
+        "effort",
+        "permission_mode",
+        "tools",
+        "disallowed_tools",
+        "max_turns",
+        "skills",
+        "instruction_file"
+      ],
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/id_agent"
+        },
+        "name": {
+          "type": "string",
+          "minLength": 1
+        },
+        "description": {
+          "type": "string",
+          "minLength": 1
+        },
+        "model": {
+          "type": "string",
+          "enum": [
+            "haiku",
+            "sonnet",
+            "opus"
+          ]
+        },
+        "effort": {
+          "type": "string",
+          "enum": [
+            "",
+            "low",
+            "medium",
+            "high",
+            "max"
+          ]
+        },
+        "permission_mode": {
+          "type": "string",
+          "enum": [
+            "",
+            "plan",
+            "acceptEdits"
+          ]
+        },
+        "tools": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/tool_name"
+          },
+          "uniqueItems": true
+        },
+        "disallowed_tools": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/tool_name"
+          },
+          "uniqueItems": true
+        },
+        "max_turns": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "skills": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/id_skill"
+          },
+          "uniqueItems": true
+        },
+        "background": {
+          "type": "boolean"
+        },
+        "memory": {
+          "type": "string",
+          "enum": [
+            "project"
+          ]
+        },
+        "isolation": {
+          "type": "string",
+          "enum": [
+            "worktree"
+          ]
+        },
+        "instruction_file": {
+          "type": "string",
+          "pattern": "^agents/[a-z0-9-]+\\.md$"
+        }
+      }
+    },
+    "skill_item": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "name",
+        "description",
+        "instruction_file",
+        "applies_to",
+        "install_mode"
+      ],
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/id_skill"
+        },
+        "name": {
+          "type": "string",
+          "minLength": 1
+        },
+        "description": {
+          "type": "string",
+          "minLength": 1
+        },
+        "instruction_file": {
+          "type": "string",
+          "pattern": "^skills/[a-z0-9-]+/SKILL\\.md$"
+        },
+        "applies_to": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/target_name"
+          },
+          "minItems": 1,
+          "uniqueItems": true
+        },
+        "install_mode": {
+          "type": "string",
+          "enum": [
+            "shared"
+          ]
+        }
+      }
+    },
+    "rule_item": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "source_file",
+        "applies_to"
+      ],
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/id_rule"
+        },
+        "source_file": {
+          "type": "string",
+          "pattern": "^rules/[0-9]{2}-[a-z0-9-]+\\.md$"
+        },
+        "applies_to": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/target_name"
+          },
+          "minItems": 1,
+          "uniqueItems": true
+        }
+      }
+    },
+    "inventory_agents": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Agent inventory for protocol v1. This schema enforces exact order, exact keys, and key/id equality for the current repository inventory.",
+      "required": [
+        "order",
+        "items"
+      ],
+      "properties": {
+        "order": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/id_agent"
+          },
+          "uniqueItems": true,
+          "const": [
+            "architect",
+            "auditor",
+            "debugger",
+            "documenter",
+            "researcher",
+            "reviewer",
+            "worker"
+          ]
+        },
+        "items": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "architect",
+            "auditor",
+            "debugger",
+            "documenter",
+            "researcher",
+            "reviewer",
+            "worker"
+          ],
+          "properties": {
+            "architect": {
+              "allOf": [
+                { "$ref": "#/$defs/agent_item" },
+                {
+                  "properties": {
+                    "id": { "const": "architect" }
+                  }
+                }
+              ]
+            },
+            "auditor": {
+              "allOf": [
+                { "$ref": "#/$defs/agent_item" },
+                {
+                  "properties": {
+                    "id": { "const": "auditor" }
+                  }
+                }
+              ]
+            },
+            "debugger": {
+              "allOf": [
+                { "$ref": "#/$defs/agent_item" },
+                {
+                  "properties": {
+                    "id": { "const": "debugger" }
+                  }
+                }
+              ]
+            },
+            "documenter": {
+              "allOf": [
+                { "$ref": "#/$defs/agent_item" },
+                {
+                  "properties": {
+                    "id": { "const": "documenter" }
+                  }
+                }
+              ]
+            },
+            "researcher": {
+              "allOf": [
+                { "$ref": "#/$defs/agent_item" },
+                {
+                  "properties": {
+                    "id": { "const": "researcher" }
+                  }
+                }
+              ]
+            },
+            "reviewer": {
+              "allOf": [
+                { "$ref": "#/$defs/agent_item" },
+                {
+                  "properties": {
+                    "id": { "const": "reviewer" }
+                  }
+                }
+              ]
+            },
+            "worker": {
+              "allOf": [
+                { "$ref": "#/$defs/agent_item" },
+                {
+                  "properties": {
+                    "id": { "const": "worker" }
+                  }
+                }
+              ]
+            }
+          }
+        }
+      }
+    },
+    "inventory_skills": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Skill inventory for protocol v1. This schema enforces exact order, exact keys, and key/id equality for the current repository inventory.",
+      "required": [
+        "order",
+        "items"
+      ],
+      "properties": {
+        "order": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/id_skill"
+          },
+          "uniqueItems": true,
+          "const": [
+            "conventions",
+            "message-schema",
+            "orchestrate",
+            "qa-checklist",
+            "worker-protocol"
+          ]
+        },
+        "items": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "conventions",
+            "message-schema",
+            "orchestrate",
+            "qa-checklist",
+            "worker-protocol"
+          ],
+          "properties": {
+            "conventions": {
+              "allOf": [
+                { "$ref": "#/$defs/skill_item" },
+                {
+                  "properties": {
+                    "id": { "const": "conventions" }
+                  }
+                }
+              ]
+            },
+            "message-schema": {
+              "allOf": [
+                { "$ref": "#/$defs/skill_item" },
+                {
+                  "properties": {
+                    "id": { "const": "message-schema" }
+                  }
+                }
+              ]
+            },
+            "orchestrate": {
+              "allOf": [
+                { "$ref": "#/$defs/skill_item" },
+                {
+                  "properties": {
+                    "id": { "const": "orchestrate" }
+                  }
+                }
+              ]
+            },
+            "qa-checklist": {
+              "allOf": [
+                { "$ref": "#/$defs/skill_item" },
+                {
+                  "properties": {
+                    "id": { "const": "qa-checklist" }
+                  }
+                }
+              ]
+            },
+            "worker-protocol": {
+              "allOf": [
+                { "$ref": "#/$defs/skill_item" },
+                {
+                  "properties": {
+                    "id": { "const": "worker-protocol" }
+                  }
+                }
+              ]
+            }
+          }
+        }
+      }
+    },
+    "inventory_rules": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Rule inventory for protocol v1. This schema enforces exact order, exact keys, and key/id equality for the current repository inventory.",
+      "required": [
+        "order",
+        "items"
+      ],
+      "properties": {
+        "order": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/id_rule"
+          },
+          "uniqueItems": true,
+          "const": [
+            "01-session",
+            "02-responses",
+            "03-git",
+            "04-tools",
+            "05-verification",
+            "06-nix",
+            "07-research"
+          ]
+        },
+        "items": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "01-session",
+            "02-responses",
+            "03-git",
+            "04-tools",
+            "05-verification",
+            "06-nix",
+            "07-research"
+          ],
+          "properties": {
+            "01-session": {
+              "allOf": [
+                { "$ref": "#/$defs/rule_item" },
+                {
+                  "properties": {
+                    "id": { "const": "01-session" }
+                  }
+                }
+              ]
+            },
+            "02-responses": {
+              "allOf": [
+                { "$ref": "#/$defs/rule_item" },
+                {
+                  "properties": {
+                    "id": { "const": "02-responses" }
+                  }
+                }
+              ]
+            },
+            "03-git": {
+              "allOf": [
+                { "$ref": "#/$defs/rule_item" },
+                {
+                  "properties": {
+                    "id": { "const": "03-git" }
+                  }
+                }
+              ]
+            },
+            "04-tools": {
+              "allOf": [
+                { "$ref": "#/$defs/rule_item" },
+                {
+                  "properties": {
+                    "id": { "const": "04-tools" }
+                  }
+                }
+              ]
+            },
+            "05-verification": {
+              "allOf": [
+                { "$ref": "#/$defs/rule_item" },
+                {
+                  "properties": {
+                    "id": { "const": "05-verification" }
+                  }
+                }
+              ]
+            },
+            "06-nix": {
+              "allOf": [
+                { "$ref": "#/$defs/rule_item" },
+                {
+                  "properties": {
+                    "id": { "const": "06-nix" }
+                  }
+                }
+              ]
+            },
+            "07-research": {
+              "allOf": [
+                { "$ref": "#/$defs/rule_item" },
+                {
+                  "properties": {
+                    "id": { "const": "07-research" }
+                  }
+                }
+              ]
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/spec/agent-runtime-v1.md b/spec/agent-runtime-v1.md
new file mode 100644
index 0000000..4bf333d
--- /dev/null
+++ b/spec/agent-runtime-v1.md
@@ -0,0 +1,105 @@
+# Agent Runtime Config v1
+
+`SETTINGS.yaml` is the human-authored source of truth for portable runtime intent in this repo.
+
+Team inventory metadata is defined separately in `TEAM.yaml` (see `spec/team-protocol-v1.md`). This spec only covers runtime policy.
+
+## Goals
+
+- Keep one editable config for approval, filesystem, network, and model intent.
+- Generate backward-compatible Claude and Codex outputs from that shared intent.
+- Make adapter lossiness explicit where provider config surfaces do not line up.
+
+## Scope
+
+Version 1 standardizes:
+
+- portable model tier and reasoning level
+- filesystem access intent
+- approval intent
+- network access intent
+- portable tool classes
+- protected path rules
+- dangerous shell command prompts
+- target-specific escape hatches only when the target exposes settings with no shared equivalent
+
+Version 1 does not attempt to standardize:
+
+- every provider model name
+- provider-specific tool grammars
+- every future runtime capability for local agents, IDE plugins, or hosted agents
+
+## Shared fields
+
+### `model`
+
+- `class`: `fast | balanced | powerful`
+- `reasoning`: `low | medium | high | max`
+
+### `runtime`
+
+- `filesystem`: `read-only | workspace-write`
+- `approval`: `manual | guarded-auto | full-auto`
+- `network_access`: boolean
+- `tools`: portable tool classes such as `shell`, `read`, `edit`, `write`, `glob`, `grep`, `web_fetch`, `web_search`
+
+### `safety`
+
+- `protected_paths`: glob patterns that should remain blocked from normal reads or writes
+- `dangerous_shell_commands.ask`: shell command patterns that should remain approval-gated
+
+### `targets`
+
+Target blocks are escape hatches, not the main schema. Use them only where a runtime exposes a knob with no shared equivalent.
+
+Current target-specific fields:
+
+- `targets.claude.claude_md_excludes`
+- `targets.codex.approval_policy`
+- `targets.codex.network_access`
+
+## Adapter rules
+
+### Claude Code
+
+`settings.json` is generated as a compatibility artifact.
+
+- `runtime.filesystem = read-only` -> `permissions.defaultMode = "plan"`
+- `runtime.filesystem = workspace-write` -> `permissions.defaultMode = "acceptEdits"`
+- `runtime.tools` -> Claude tool allow-list
+- `safety.protected_paths` -> Claude `deny` entries for `Read`, `Write`, and `Edit`
+- `dangerous_shell_commands.ask` -> Claude `ask` entries wrapped as `Bash(...)`
+
+Lossiness:
+
+- Claude vends `allow` / `deny` / `ask` as tool-pattern rules.
+- Shared `approval` intent does not map 1:1 to Claude beyond `plan` vs `acceptEdits`.
+
+### Codex CLI
+
+`codex/config.toml` is generated directly from shared intent.
+
+- `runtime.filesystem = read-only` -> `sandbox_mode = "read-only"`
+- `runtime.filesystem = workspace-write` -> `sandbox_mode = "workspace-write"`
+- `runtime.approval = manual` -> `approval_policy = "on-request"`
+- `runtime.approval = guarded-auto` -> `approval_policy = "untrusted"`
+- `runtime.approval = full-auto` -> `approval_policy = "never"`
+- `runtime.network_access` -> `[sandbox_workspace_write].network_access`
+
+Lossiness:
+
+- Codex does not expose Claude-style per-tool `allow` / `deny` / `ask` pattern controls in `config.toml`.
+- Protected paths and dangerous command prompts are therefore only partially representable in Codex config today.
+
+## Compatibility contract
+
+The repo preserves these compatibility artifacts:
+
+- `settings.json`
+- `claude/settings.json`
+- `claude/CLAUDE.md`
+- `codex/config.toml`
+- `codex/AGENTS.md`
+- generated agent outputs for both targets
+
+These are build artifacts, not authored source files. `SETTINGS.yaml` is the required runtime input.
diff --git a/spec/team-protocol-v1.md b/spec/team-protocol-v1.md
new file mode 100644
index 0000000..ef2c56a
--- /dev/null
+++ b/spec/team-protocol-v1.md
@@ -0,0 +1,136 @@
+# Team Protocol v1
+
+`TEAM.yaml` defines the team metadata and inventory protocol for portable generation targets in this repo.
+
+Implementation status:
+
+- Wave 1: protocol + documentation introduced
+- Wave 2: generator + install integration completed; TEAM metadata is the active source of truth for team inventory behavior
+
+## Goals
+
+- Define a neutral, schema-backed source for agents, skills, and rules metadata.
+- Keep Claude and Codex as adapter targets rather than protocol sources.
+- Preserve Markdown as the human-authored instruction content format.
+- Preserve current generated output behavior unless a narrow caveat is explicitly documented.
+
+## Scope
+
+Version 1 standardizes:
+
+- agent inventory and metadata required for generation
+- skill inventory metadata
+- rule inventory and deterministic ordering
+- adapter boundaries for Claude and Codex
+- validation requirements needed by the generator
+
+Version 1 does not standardize:
+
+- full prose structure for skills/rules/agents
+- provider-specific runtime/tool grammars
+- every future adapter target
+
+## Source-of-Truth Split
+
+- `SETTINGS.yaml`: runtime policy protocol (filesystem, approval intent, network, model intent)
+- `TEAM.yaml`: team inventory protocol (agents, skills, rules metadata and references)
+- Markdown files: instruction bodies
+  - agents: `agents/*.md`
+  - skills: `skills/*/SKILL.md`
+  - rules: `rules/*.md`
+
+Generated artifacts remain:
+
+- `settings.json`
+- `claude/`
+- `codex/`
+
+## Required TEAM Inventories
+
+`TEAM.yaml` must contain:
+
+- `agents`
+- `skills`
+- `rules`
+
+## Agent Contract
+
+Each agent entry includes metadata required for adapter generation:
+
+- `id`
+- `name`
+- `description`
+- `model`
+- `effort`
+- `permission_mode`
+- `tools`
+- `disallowed_tools`
+- `max_turns`
+- `skills`
+- optional `background`
+- optional `memory`
+- optional `isolation`
+- `instruction_file`
+
+`instruction_file` points to the Markdown source for long-form instructions.
+
+## Skill Contract
+
+Each skill entry includes lightweight metadata and content reference:
+
+- `id`
+- `description`
+- `instruction_file`
+- optional target/install metadata
+
+Skill prose remains in `skills/*/SKILL.md`.
+
+## Rule Contract
+
+Each rule entry includes:
+
+- `id`
+- `source_file`
+- deterministic order metadata
+- optional target metadata
+
+Rule prose remains in `rules/*.md`.
+
+## Adapter Boundaries
+
+Claude and Codex are render targets.
+
+Current target behavior:
+
+- Claude generation consumes TEAM metadata + Markdown content and outputs:
+  - `claude/CLAUDE.md`
+  - `claude/settings.json`
+  - `claude/agents/*.md`
+- Codex generation consumes TEAM metadata + Markdown content and outputs:
+  - `codex/config.toml`
+  - `codex/AGENTS.md`
+  - `codex/agents/*.toml`
+
+## Validation Requirements
+
+TEAM validation enforces schema + runtime checks for:
+
+- schema version correctness
+- required sections present
+- unique IDs for agents/skills/rules
+- referenced files exist
+- deterministic rule ordering inputs are valid
+- `order` IDs match declared inventory keys
+- item `id` matches keyed map entry
+
+## Compatibility Caveats
+
+- Existing YAML frontmatter in `agents/*.md` may remain for editorial continuity, but generation does not use it for team metadata.
+- Output diffs that are purely formatting-related are acceptable; semantic behavior changes are not unless explicitly documented.
+- TEAM schema is intentionally rigid/repo-specific in v1; inventory additions/removals require schema updates in lockstep.
+
+## Out of Scope
+
+- Rewriting instruction prose for style
+- Full content schemas for skill/rule prose
+- Generalizing all future adapters in v1