docs: update AGENTS.md and phase plan with session progressmain

Phase 1 complete, Phase 2 in progress:
- cgit visibility control via strict-export
- nixtaml pushed to gitolite
- remote-command app added
- Session notes for resumption

1 files changed, 30 insertions, 1 deletions

diff --git a/AGENTS.md b/AGENTS.md
index 4e25ed9..84bacd2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -25,6 +25,25 @@ nix run .#secrix -- -l
 - **Services**: cgit, ejabberd (XMPP), murmur (Mumble), movim (social), mailserver, nginx
 - **Secrets**: Encrypted via age/Secrix in `secrets/`
 - **State persisted**: `/persist/` directories
+- **Git hosting**: code.crashoverburn.com (cgit + gitolite)
+
+## Git Repositories
+
+| Repository | Visibility | Description |
+|------------|------------|-------------|
+| testing | Public | Gitolite test repo |
+| nixtaml | Public | Main Nix flake (mirrored from GitHub) |
+| nixtaml-website | Public | Website content repo |
+| crash-web | Private | SSH auth only |
+| gitolite-admin | Private | Gitolite admin config |
+
+**Gitolite admin folder**: `/speed-storage/repo/crash-git/gitolite-admin/` (sibling to this repo)
+
+## cgit Visibility Control
+
+Public/private visibility uses `strict-export=git-daemon-export-ok`:
+- **Public repos**: Have `git-daemon-export-ok` file (created declaratively via Nix)
+- **Private repos**: No marker file = hidden from web, SSH access only
 
 ## Gotchas
 
@@ -38,7 +57,17 @@ nix run .#secrix -- -l
    - `services.xserver.layout` → `services.xserver.xkb.layout`
    - `devShell` → `devShells.x86_64-linux.default`
 
-5. **Verify cgit** via: `nix run .#remote-command -- "systemctl status uwsgi"`
+5. **NEVER make imperative changes to remote** - all config must go through Nix or gitolite-admin.
+
+6. **Verify cgit** via: `nix run .#remote-command -- "systemctl status uwsgi"`
+
+7. **cgit accessible at root**: https://code.crashoverburn.com/ (not /git/)
+
+## Phase Status
+
+- **Phase 1**: ✅ Complete (deployment modernization, deprecated fixes)
+- **Phase 2**: In Progress (cgit configured, nixtaml pushed, need nixtaml-website content)
+- **Phase 3**: Pending (nixtaml.tech website integration)
 
 ## Reference