docs: TSGCOO prompt — clone TSYSGroupAIOS first for house rules

The agent's first action is cloning TSYSGroupAIOS, reading
BASELINE-PROMPT.md, installing hooks, and summarizing the rules
back to Charles (session-start gate) before any work begins.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

tsgcoo-bootstrap-prompt.md

@@ -44,7 +44,55 @@ Bitwarden exclusively and is fetched at runtime via `bw-run.sh`.
 - The BW client_id, client_secret, and master password live in
   `~/.config/bw/env` (permissions 600). That file is the ONE exception.
 
-## 4. Prerequisites Checklist
+## 4. First Actions (do these before anything else)
+
+You are a new agent on a new account. You know nothing about this environment
+yet. Orient yourself before touching anything.
+
+```bash
+mkdir -p ~/projects
+cd ~/projects
+
+# 1. Clone the governance framework FIRST — this is the house rules
+git clone ssh://git@git.knownelement.com:29418/TSYSGroupCorporate/TSYSGroupAIOS.git
+cd TSYSGroupAIOS
+
+# 2. Install git hooks (sets up pre-commit/pre-push enforcement)
+bash scripts/setup-hooks.sh
+
+# 3. Read the baseline prompt — the 14 canonical principles
+cat BASELINE-PROMPT.md
+
+# 4. Read the project-level policy template
+cat AGENTS.md
+
+# 5. Run the rules audit to verify your environment is clean
+bash scripts/check-rules.sh --fast
+```
+
+After reading `BASELINE-PROMPT.md`, **stop and summarize the rules back to
+Charles** before proceeding. This is the session-start gate — it guarantees
+you're aligned on the operating model before you start making changes.
+
+### Then clone the working repos
+
+```bash
+cd ~/projects
+
+# The provisioning automation you'll be running
+git clone ssh://git@git.knownelement.com:29418/TSYSGroupCorporate/agent-identity-provisioning.git
+
+# The org-buildout docs (full context on the transition plan)
+git clone ssh://git@git.knownelement.com:29418/reachableceo/org-buildout.git
+```
+
+Read these for context:
+- `org-buildout/transition-map.md` — the full current-state map + timeline
+- `org-buildout/agent-identity-bootstrap.md` — the architecture you're implementing
+- `agent-identity-provisioning/AGENTS.md` — the provisioning repo's project policy
+- `agent-identity-provisioning/questions-v1.md` — open questions
+
+### Prerequisites checklist
 
 Before you can run the provisioning, these must be true. Check each one and
 stop if any are missing — ask Charles to provide them.
@@ -58,7 +106,6 @@ echo "=== TSGCOO Prerequisites Check ==="
 # 1. BW access info exists
 if [ -f ~/.config/bw/env ]; then
     echo "[OK] BW env file exists at ~/.config/bw/env"
-    # Source it and verify fields exist (don't print values)
     . ~/.config/bw/env
     [ -n "$BW_CLIENTID" ] && echo "  [OK] BW_CLIENTID is set" || echo "  [FAIL] BW_CLIENTID is missing"
     [ -n "$BW_CLIENTSECRET" ] && echo "  [OK] BW_CLIENTSECRET is set" || echo "  [FAIL] BW_CLIENTSECRET is missing"
@@ -80,7 +127,6 @@ tea login list >/dev/null 2>&1 && echo "[OK] tea CLI is configured" || echo "[FA
 REPO_DIR="$HOME/projects/agent-identity-provisioning"
 if [ -f "$REPO_DIR/agents.yaml" ]; then
     echo "[OK] agents.yaml manifest exists"
-    # Check for placeholder tokens
     if grep -q "REPLACE_WITH_TOKEN" "$REPO_DIR/agents.yaml"; then
         echo "  [FAIL] agents.yaml still has REPLACE_WITH_TOKEN placeholders"
         echo "         Charles needs to fill in real Cloudron invite links"
@@ -100,8 +146,6 @@ echo ""
 echo "=== If any items show [FAIL], stop and ask Charles to provide them. ==="
 ```
 
-Run that script first. If anything fails, stop and ask Charles.
-
 ## 5. Step-by-Step Execution
 
 ### Step 0: Orient yourself