diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..1c59e71
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,31 @@
+# AGENTS.md — Teahub v1 (Green Tea)
+
+You are on **prod**: https://teahub.xyz, a Gitea on Fly (app `green-tea`). Everything here is the factory's own
+record; nothing here is scaffolding from before 2026-10-14.
+
+```
+ you (any agent) ──MCP──▶ mcp.teahub.xyz ──as the signed-in user──▶ teahub.xyz (Gitea)
+                                                                     │
+                 login: GitHub (now), nostr (next)                   ├── teahubxyz/teahub   the spine (this repo)
+                                                                     ├── teahubxyz/time     mirror of github.com/teahubxyz/time (read-only here)
+                                                                     └── <your repos>
+ Time = the automation layer: lives on GitHub (teahubxyz/time), runs on GitHub Actions. Work on Time happens there.
+ hb-5 (the Mac) is NOT part of prod: it is the operator's playground and the old instance (matcha.teahub.xyz).
+ Boring (ops MCP) lives on the Mac and may reach prod as a client; prod never depends on it.
+```
+
+## Moves
+- Read first: this file, `docs/decisions.md` (why things are the way they are), `docs/rebuild.md` (what it took).
+- Work is an issue with a `DONE:` line. Open it, do it, receipt it on the issue, close it.
+- You act as yourself. There is no service token on prod. If you can't do something, your Gitea permissions are the
+  reason; ask the owner (`teahubxyz`) on the issue.
+- Porting from the old instance: only when a card needs it, only after reading it, one piece per commit, and a line in
+  `docs/rebuild.md` saying what it took.
+- Secrets: prod holds Gitea's own keys, the GitHub OAuth client, and the MCP's OAuth client. Nothing else. Do not add one
+  without a decision in `docs/decisions.md`.
+- Be boring by default; get clever only on an ANDON. Deterministic scripts before cheap inference before expensive inference.
+
+## Where things are
+- MCP source: `mcp/` (FastMCP, deploy with `fly deploy`).
+- Decisions: `docs/decisions.md` (append-only, dated).
+- Rebuild log: `docs/rebuild.md`.