feat: Add foundational documentation for security, workflow, and project management

- Create SECURITY.md to outline security policies and practices.
- Establish WORKFLOW.md detailing the project lifecycle from planning to retrospective.
- Introduce decision log structure in decisions/README.md for tracking architecture decisions.
- Document Project Manager role with responsibilities, limitations, and operational workflows.
- Implement templates for ADRs, bugs, meetings, projects, retrospectives, RFCs, roadmaps, and sprints.
- Set up memory logs for architecture and company-wide lessons learned.
- Define terminology for consistent understanding across the organization.

memory/architecture-memory.md

@@ -0,0 +1,30 @@
+# Architecture Memory
+
+Technical context that spans projects: shared-infrastructure quirks, integration details
+between Gitea, Plane, and ACT Runner discovered in practice, and patterns worth reusing across
+projects rather than rediscovering each time. Primarily maintained by the Architect role, but
+open to any engineer who learns something worth keeping. See [../MEMORY.md](../MEMORY.md).
+
+## Log
+
+*No entries yet.*
+
+Known gaps to fill once true, not written speculatively:
+
+- Plane is not yet deployed (`../PLANE.md`) — once it is, record actual workspace conventions
+  discovered during setup here if they differ from what `PLANE.md` assumed.
+- `../GITEA.md` and `../ACT_RUNNER.md` currently use placeholders for instance URLs and runner
+  labels — once replaced with real values, note here anything about the actual instances (quirks,
+  constraints, capacity) that future engineers should know but that doesn't belong in the policy
+  docs themselves.
+
+Format for new entries:
+
+```
+### YYYY-MM-DD — <short title>
+
+<the technical fact or pattern>
+
+**Why:** <how it was discovered / why it matters>
+**How to apply:** <what future work should do differently because of this>
+```

memory/company-memory.md

@@ -0,0 +1,23 @@
+# Company Memory
+
+Cross-cutting facts about how Local LLC actually operates in practice — process patterns and
+organizational decisions that emerged from experience, not policy declared up front. Policy
+itself belongs in the root docs (`README.md`'s repository map); this file is what those docs
+don't capture. See [../MEMORY.md](../MEMORY.md) for what belongs here vs. elsewhere.
+
+## Log
+
+*No entries yet. This company is pre-v0.1 operational — the first real entries will come from
+the first sprint's retrospective (`templates/RETROSPECTIVE.md`) and the first planning sessions
+run under `FOUNDER.md`.*
+
+Format for new entries:
+
+```
+### YYYY-MM-DD — <short title>
+
+<the fact or decision>
+
+**Why:** <the reasoning or incident behind it>
+**How to apply:** <what this should change about future behavior>
+```

memory/lessons-learned.md

@@ -0,0 +1,20 @@
+# Lessons Learned
+
+Retrospective output, incident postmortems, and anything that answers "what would we do
+differently." See [../MEMORY.md](../MEMORY.md) and [../WORKFLOW.md](../WORKFLOW.md) — a
+retrospective that produces no entry here didn't do its job.
+
+## Log
+
+*No entries yet — no sprints have run.*
+
+Format for new entries:
+
+```
+### YYYY-MM-DD — <short title> (Sprint N, <project>, if applicable)
+
+<what happened>
+
+**Why:** <root cause, not just the symptom>
+**How to apply:** <the concrete change this produced — linked to the retro action item if any>
+```

memory/terminology.md

@@ -0,0 +1,21 @@
+# Terminology
+
+Glossary of vocabulary this company has actually settled on, so new agents (and humans) reading
+this repository don't have to infer meaning from context. See [../MEMORY.md](../MEMORY.md).
+
+| Term | Meaning |
+|---|---|
+| **Founder** | The human owner of Local LLC. Final authority on strategic direction. See `../FOUNDER.md`. |
+| **Executive Office** | The Founder's strategy/brainstorming partner (currently an LM Studio "Bionic" model). Explicitly *not* part of the company — outside the chain of command. |
+| **Approval gate** | The point where the Founder must say yes before a plan becomes company work. Nothing reaches Plane before this. See `../FOUNDER.md`. |
+| **CEO** (agent role) | First role inside the company to see an approved plan. Creates Epics, sets milestones and priority, authorizes sprints. Does not write code. |
+| **Project Manager** | Owns Plane operationally: breaks Epics into Stories/Tasks, assigns work, runs sprints, tracks velocity/blockers. Never writes code or makes architecture calls. (Formerly referred to as "Chief of Staff" and, separately, a "Program Manager/PMO" role during early brainstorming — both were consolidated into this single role.) |
+| **Architect** | Technical design authority; approves ADRs; resolves engineering disagreements; peer to the Project Manager, not its superior. |
+| **Employee / AI employee** | Any AI agent filling a defined role in `../ORGANIZATION.md`, with its own Plane account, Gitea identity, memory, and prompt. |
+| **Epic** | Top-level unit of approved work in Plane, created only by the CEO from a Founder-approved plan. |
+| **Story** | A coherent slice of an Epic, created by the Project Manager. |
+| **Task** | The assignable unit of work engineers claim and close; child of a Story. |
+| **ADR** (Architecture Decision Record) | A permanent record of a decision with lasting technical consequence. See `../DECISIONS.md`. |
+| **RFC** | A proposal under discussion, not yet a decision — may become an ADR if accepted. See `templates/RFC.md`. |
+| **Security hold** | A Plane label attached by the Security Engineer that blocks a merge until the Security Engineer or Founder clears it. |
+| **Source of truth** | The one system responsible for a given kind of state — see the table in `../COMPANY.md`. Nothing is allowed to duplicate another system's source of truth. |