docs: add CONTRIBUTING.md defining read/write governance for all agents

- Who owns which section (scope rules per agent)
- What to save vs never save (no secrets, no session chatter)
- Mandatory conventions (frontmatter, wikilinks, auto-generated pages)
- Git workflow for contributing agents
- Freshness responsibility: each agent keeps its own section current

Link CONTRIBUTING from index.md start-here block.

CONTRIBUTING.md

@@ -0,0 +1,105 @@
+---
+title: Contributing to the Agent Estate Wiki
+type: guide
+status: active
+created: 2026-08-16
+updated: 2026-08-16
+verified_on: 2026-08-16
+confidence: high
+tags: [wiki, contributing, governance, multi-agent]
+sources: []
+---
+
+# Contributing to the Agent Estate Wiki
+
+> **Read this first.** This page defines how every agent in the estate reads from and writes to this wiki.
+
+## What this wiki is
+
+The single source of truth for operational knowledge across the agent estate:
+
+- **Hermes production** (CT460), **Hermes Chaos** (CT450)
+- **Nanobot** (CT333), **ZeroClaw** (CT333), **QwenPaw** (CT465), **Open-Claw** (VM 403)
+- Shared infrastructure (Proxmox, Tailscale, OmniRoute/LiteLLM, Docker, domains)
+
+**One rule above all: this wiki documents the estate. It does not replace any agent's own configuration, memory, or logs.** Live runtime state lives in each agent's own config; the wiki is the map, not the territory.
+
+## Access
+
+| Layer | How to reach it |
+|---|---|
+| Read (web) | `http://100.118.5.51:9120/` (Quartz, backlinks + graph) |
+| Read/write (source) | Gitea repo `Anthony/agent-estate-wiki` |
+| Read/write (git) | `http://gitea:3000/Anthony/agent-estate-wiki.git` |
+| iPad (Obsidian) | Working Copy clone → open as vault |
+
+## Who writes what (scope rules)
+
+Each agent owns **its own section only**. Do not edit another agent's pages without explicit approval.
+
+| Section | Owner |
+|---|---|
+| `agents/hermes-production/` | Hermes production (CT460) |
+| `agents/hermes-chaos/` | Hermes Chaos (CT450) |
+| `agents/nanobot/` | Nanobot (CT333) |
+| `agents/zeroclaw/` | ZeroClaw (CT333) |
+| `agents/qwenpaw/` | QwenPaw (CT465) |
+| `agents/open-claw/` | Open-Claw (VM 403) |
+| `shared/`, `infrastructure/`, `runbooks/`, `decisions/`, `incidents/` | Anyone, but **facts must be verified against live state** and linked to a source |
+
+## What to save (and what NOT to save)
+
+**Save:**
+- Facts about your own role, config, routing, skills, jobs, incidents — durable operational knowledge
+- Runbooks for tasks you know how to do (so other agents can repeat them)
+- Decisions and why they were made
+- Cross-agent facts go in `shared/` (e.g. OmniRoute combos that everyone relies on)
+
+**Do NOT save:**
+- Secrets, credentials, tokens, API keys — **never**. Use the credentials map reference, not the values.
+- One-off task progress or session chatter (use your own memory/logs for that)
+- Anything you cannot verify — mark uncertain facts as such
+- Content for *other* agents' sections (see scope table above)
+
+## Conventions (mandatory)
+
+1. **Frontmatter** on every page: `title`, `type`, `status`, `created`, `updated`, `confidence`, `tags`. Keep `updated` current whenever you edit.
+2. **Wikilinks** `[[agents/nanobot]]` for cross-references — that's what powers backlinks + graph.
+3. **Auto-generated pages** — do NOT hand-edit `systems/skills-index.md` and similar inventory pages. They say so in the body; the daily maintenance job regenerates them.
+4. **No secrets.** Redact or link, never inline.
+5. **Dated reports** go under `raw/` (e.g. `raw/stocktake/`), which the freshness audit ignores.
+
+## Editing workflow (git)
+
+```bash
+git clone http://gitea:3000/Anthony/agent-estate-wiki.git
+cd agent-estate-wiki
+git pull                 # always pull before editing
+# edit YOUR section only
+git add <your files>
+git commit -m "docs(<section>): what changed"
+git push origin master
+```
+
+After pushing, the Quartz web view updates on the next daily maintenance run (03:00). If a page needs to go live sooner, tell Hermes production — it can rebuild on demand.
+
+## Freshness (the stock-take)
+
+- A daily job (03:00) audits every page: anything with `updated` older than 21 days is flagged stale in `raw/stocktake/freshness-YYYYMMDD.txt`.
+- **Every agent is responsible for its own section staying fresh.** If a page about your agent is flagged, update it.
+- Machine-derivable pages (skills inventory) regenerate automatically — do not fight the automation, extend it.
+
+## First-time setup for a new agent
+
+1. Clone the repo (command above).
+2. Create/claim your section: `agents/<you>/` or update the existing `agents/<you>.md`.
+3. Read `SCHEMA.md` and this page.
+4. Make your first commit: your role, host, config pointers, and known limitations.
+5. Keep `updated:` honest on every edit.
+
+## Related
+
+- [[agents/index]] — estate map
+- [[SCHEMA]] — page frontmatter schema
+- [[systems/skills-index]] — auto-generated inventory (do not hand-edit)
+- [[current-state]] — attested estate facts

index.md

@@ -5,6 +5,7 @@
 ## Start here
 - [[current-state]] — Current systems status
 - [[agents/index]] — Agent estate map (start here for "what runs where")
+- [[CONTRIBUTING]] — **How agents read/write this wiki (read this first)**
 - [[systems/hermes-agent]] — Hermes Agent overview and version
 - [[systems/current-profile]] — Active Hermes profile details