chore: clean up AGENTS.md

Author: brianm

.tasks/in-progress/yv12wc30.md

@@ -3,7 +3,7 @@ yatl_version: 1
 title: Fix abandoned OIDC auth flow blocking subsequent ssh sessions
 id: yv12wc30
 created: 2026-07-13T16:37:06.749142730Z
-updated: 2026-07-13T17:37:00.803717631Z
+updated: 2026-07-13T17:42:48.674308758Z
 author: Brian McCallister
 priority: high
 tags:
@@ -47,3 +47,8 @@ COMPLETED: Singleflight + cancelation implemented. Auth.Run(ctx, attrs, userOutp
 # Log: 2026-07-13T17:37:00Z Brian McCallister
 
 COMPLETED: fd-4 fix in pkg/auth/oidc - plugin previously wrote the auth URL only to stderr and only on browser-open failure, so joiners of a shared flight saw nothing. Now always writes 'To authenticate, visit: URL' to fd 4 (user-visible progress) when the callback server is ready; broker replays it to joining sessions. Best-effort write when no fd 4 (standalone runs). DECISION: kept singleflight over concurrent-flights/last-writer-wins because IdP behavior is unknown - refresh-token rotation with reuse detection makes concurrent refreshes unsafe, plus browser popup storms on parallel ssh. NEXT: manual verification of real browser flow, then commit.
+
+---
+# Log: 2026-07-13T17:42:48Z Brian McCallister
+
+DECISIONS: yatl operations now go through a dedicated yatl subagent (~/.claude/agents/yatl.md, haiku) instead of the yatl skill. The skill's SKILL.md is 18.5KB (~5k tokens) and was being loaded into the main agent's context for what amounts to a few one-line CLI calls. The subagent carries a compact command cheat-sheet instead and returns only a terse result line. AGENTS.md now points at the subagent.

AGENTS.md

@@ -1,19 +1,10 @@
 # Repository guidelines
 
-## Version control and workflow
+## Version control
 This repository uses Jujutsu (`jj`), not git. Use commands such as `jj status`, `jj commit`, and `jj new` when manipulating history.
 
-## Build and test commands
-Primary language is Go. Validate changes with `make build` and `make test` (which wrap `go build ./...` and `go test ./...`). Regenerate protobufs via `make generate` (Buf) whenever files in `proto/` change. Use `go test -race ./pkg/broker` for concurrency-sensitive paths.
-
-## Coding standards
-Keep module folders aligned with runtime components (`cmd/epithet`, `pkg/broker`, `pkg/policyserver`). Never edit generated files in `pkg/brokerv1`. Before proposing custom code that wraps or extends a library, check the library's README, docs, and ecosystem for existing companion packages that already solve the problem.
+## Build and test
+Validate changes with `make build` and `make test`. Regenerate protobufs via `make generate` (Buf) whenever files in `proto/` change. Use `go test -race ./pkg/broker` for concurrency-sensitive paths. Never edit generated files in `pkg/brokerv1`.
 
 ## Task tracking and commits
 Track work in `yatl`; do not introduce other TODO systems. Follow Conventional Commits (`feat:`, `fix:`, `chore:`, `docs:`) written in the imperative so tooling like `svu next` can infer versions.
-
-## Important constants
-- `caserver.RequestBodySizeLimit = 8192`: maximum HTTP request body size for CA requests.
-- `pkg/broker/broker.go:maxRetries = 3`: maximum retry attempts for CA 401 errors and auth failures.
-- `pkg/broker/certs.go:expiryBuffer = 5 seconds`: safety margin for certificate expiry checks.
-- `pkg/broker/broker.go:cleanupInterval = 30 seconds`: frequency of expired agent cleanup.