diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..3768c1e
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,58 @@
+# AGENTS.md
+
+Guidance for a coding agent working on **this plugin's own repository**. `CLAUDE.md` beside it only
+points here — the two harnesses discover different filenames and one set of instructions has to
+reach both.
+
+**This is not what the plugin is.** `README.md` answers that, for a person deciding whether to
+install it. This file answers "I have to change something in here — what will I break?"
+
+## Where you are
+
+A plugin repository, cloned into `~/officer-dev/plugins/browser`, its own git remote. It is **not**
+part of the platform's repository, and `platform/plugins/browser` is a different thing — that is
+where this plugin gets INSTALLED, by the installer cloning it from gitea. Never edit there; the
+next install overwrites it.
+
+Check the checkout with `bun run plugins:check` from the platform repo.
+
+## What it ships
+
+- `api/router.ts` — routes, mounted at `/api/browser`
+- `sidecar/index.ts` — a process, run by PM2 as `officer-browser`
+- `db/schema.ts` — tables: `browser_pairings`
+- `web/` — panels and a layout; the platform renders the screen, not this plugin
+
+Presence is the declaration: the platform decides what this plugin has by what files exist. Adding
+`db/schema.ts` gives it tables; deleting `api/router.ts` removes its routes. There is no field to
+keep in step.
+
+## What must not change without knowing why
+
+- **Permission key `browser-relay`** — stored as the subject of every grant. Renaming one is a data change, not a rename.
+- **Panel keys** (`officerdev/browser-tabs`, `officerdev/browser-pairing`, `officerdev/browser-preview`) — a user's stored layout names them.
+- **Table names** — they hold real rows on installed machines.
+- **`appName`** — the directory name IS the id: route segment, table prefix, sidecar suffix, install key.
+
+## Traps that have already cost time
+
+- **The relay needs its port reachable from wherever the browser runs** — a proxy host and a firewall rule, not just the process. A connection failure here is usually the network, not the code.
+
+## Verifying
+
+From the platform repo, which is where the toolchain lives:
+
+```bash
+bunx tsgo                 # a red typecheck is not done
+bun test                  # 1 known failure: ModelSelector, unrelated
+bun run plugins:check
+bunx prettier --write <the files you touched>
+```
+
+A sidecar change needs `pm2 restart officer-browser`; anything in `api/` or `web/` needs
+`pm2 restart officer`.
+
+## Related
+
+- `README.md` — what it is and what it claims, for someone installing it
+- `PLUGIN.md` — this plugin's own reference: conventions and API surface
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..8c36885
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,6 @@
+# CLAUDE.md
+
+**The instructions live in [`AGENTS.md`](AGENTS.md). Read it first — this file only points there.**
+
+Kept separate so agents that look for `AGENTS.md` by convention find the same guidance as those that
+look for `CLAUDE.md`, without the two drifting apart.