diff --git a/AGENTS.md b/AGENTS.md
index 5e6ae1b..54ae185 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -151,6 +151,13 @@ for a full audit or `--fast` for pre-commit speed. Bypass with `--no-verify`
   inside it.
 - **Use sub-agents as subcontractors:** scoped spec in, distilled deliverable out.
   Never read 10+ files sequentially; batch into agent calls.
+- **Command timeouts (NON-NEGOTIABLE):** Every command that touches a remote
+  system MUST be wrapped with `timeout`. Hard limits: 30s for quick reads
+  (status, ps, ls), 120s for standard operations, 300s for deployments/pulls.
+  If a command hits the timeout, STOP and investigate root cause — never
+  blindly retry. A hung command is a failed command. Detect failure fast,
+  diagnose, fix, move on. Example: `timeout 120 bash tests/remote.sh vm 'cmd'`.
+  This applies to ALL tools — bash, docker, CLIs, sub-agents.
 
 ## Questions (NON-NEGOTIABLE)