diff --git a/CLAUDE.md b/CLAUDE.md
index 0bb6c59..10fb221 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -44,6 +44,15 @@ The project has **re-platformed onto Proxmox**, with a locked **three-component
 >
 > **Never write secrets** — tokens, passwords, private keys, API keys — into `CHANGELOG.md`, `REPORT.md`, or any committed file. Reference them as "stored out-of-band" instead.
 
+## Trunk-based — no branches
+
+All shippable work commits **directly to `main`**; `main` is always equal to what is deployed. **Do NOT create feature/fix branches.**
+
+- **Report-only artifacts** (audits, findings, fixspecs, reconciliations) → `felhom.eu/documentation/` (`audits/`, `backlog/`), committed to `main`. Never a branch, never left loose at the repo root.
+- **Risky/supervised fixes** (agent / golden / provisioning / destructive) are spec'd, then implemented **during the supervised session itself, directly on `main`** — not prepared ahead on a branch.
+- **Unattended escape hatch:** if a fix can't be cleanly verified/shipped, **revert it and report it** for a supervised redo (or paste the diff into the spec doc in `documentation/`) — do not park it on a branch.
+- This supersedes any older "prepared on branch `fix/…`, pending review" pattern. (The build/deploy workflow below already pushes `main` directly.)
+
 ## Code quality rules
 
 - Always double-check generated code for bugs, logic issues, syntax errors