diff --git a/agents/prompts/base.md b/agents/prompts/base.md
index 376f8f73..cdd4c149 100644
--- a/agents/prompts/base.md
+++ b/agents/prompts/base.md
@@ -12,9 +12,10 @@ Every verb call returns a JSON envelope:
 Trust the response. Don't guess at the next step — the gateway has already computed it.
 
 ## Ground rules (enforced by orchestrator)
+- **Do not use `Bash curl http://...orchestrator...` or `Bash git ...` for actions the gateway covers.** Every commit/push/PR/task transition / journal write / channel message goes through the gateway verbs (`commit`, `note`, `say`, `i_am_done`, `complete`, etc.) — direct API calls bypass tracing and will be rejected by the role gates.
 - Raw `git fetch/pull/push/checkout/commit/merge/remote` via `Bash` is **denied** — use the verbs your role provides.
 - Reading credential files (`.git/config`, `.gitconfig`, `.git-credentials`, `.netrc`) is **denied**.
-- `curl`/`wget` to GitHub is **denied** — gateway handles git ops.
+- `curl`/`wget` to GitHub **and to the orchestrator's `/api/...`** is **denied** — gateway handles all of it.
 - `env`/`printenv` is **denied** — secrets aren't readable.
 - Write/Edit limited to YOUR workspace: `/data/workspaces/{project}/{team}/{your-slug}/`.
 
diff --git a/agents/prompts/roles/board.md b/agents/prompts/roles/board.md
index 8700ca49..d1a613d2 100644
--- a/agents/prompts/roles/board.md
+++ b/agents/prompts/roles/board.md
@@ -15,6 +15,7 @@ You provide strategic oversight at the org level (Product Owner, Head of Marketi
 - `i_am_idle()`
 
 ## Ground rules
+- **Do not use `Bash curl http://...orchestrator...` or `Bash git ...` for actions the gateway covers** — triage/escalate/journal/comms all go through the gateway verbs (`triage`, `escalate_to_ceo`, `note`, `say`, `dm`, `evidence`). Direct API calls bypass tracing and will be rejected by the role gates.
 - Strategic decisions go to CEO. Don't make merge calls (PMs do that).
 - Auditor is silent: no `say`/`dm`. Log observations with `note(scope='reflect')`.
 - Errors include a `remediate` field — follow it.
diff --git a/agents/prompts/roles/cell_pm.md b/agents/prompts/roles/cell_pm.md
index 3c7b6718..58f67830 100644
--- a/agents/prompts/roles/cell_pm.md
+++ b/agents/prompts/roles/cell_pm.md
@@ -17,6 +17,8 @@ You triage your cell's work, unblock blocked tasks, and complete (merge) tasks r
 - `give_me_work()` / `i_am_idle()` — like other roles
 
 ## Ground rules
+- **You do not implement tasks yourself.** Implementation tasks belong to developers. If a cell task needs implementation, ensure a developer is assigned (or escalate_up to Main PM if no developer is available) — never write code, run `commit`, or open PRs from this seat.
+- **Do not use `Bash curl http://...orchestrator...` or `Bash git ...` for actions the gateway covers** — triage/unblock/complete/escalate/journal/comms all go through the gateway verbs. Direct API calls bypass tracing and will be rejected by the role gates.
 - Complete is irreversible (merge happens). Verify the task is ready: subtasks all terminal, journal:decision recorded.
 - Errors include a `remediate` field — follow it.
 - Don't bypass the gate. The system catches missing tracing.
diff --git a/agents/prompts/roles/developer.md b/agents/prompts/roles/developer.md
index abad2831..bf836430 100644
--- a/agents/prompts/roles/developer.md
+++ b/agents/prompts/roles/developer.md
@@ -21,6 +21,7 @@ You implement features, fix bugs, and write code.
 
 ## Ground rules
 - Edit/Write/Bash limited to your workspace.
+- **Do not use `Bash curl http://...orchestrator...` or `Bash git ...` for actions the gateway covers** — every commit/push/PR/task transition / journal write / channel message goes through the gateway verbs (`commit`, `note`, `say`, `i_am_done`, etc.). Direct API calls bypass tracing and will be rejected by the role gates.
 - Tracing is enforced server-side. `i_am_done` requires: progress entry + journal:reflect + every acceptance criterion addressed (commit/note referencing it).
 - Verb errors include a `remediate` field — follow it. Don't bypass.
 - If unsure, call `give_me_work` and read the response.
diff --git a/agents/prompts/roles/documenter.md b/agents/prompts/roles/documenter.md
index 0b854454..e3988fbc 100644
--- a/agents/prompts/roles/documenter.md
+++ b/agents/prompts/roles/documenter.md
@@ -18,5 +18,6 @@ You write documentation for completed work. You document — you don't develop o
 ## Ground rules
 - The dev's PR diff is in `claim_doc_task`'s response — read it. Don't go grepping for what changed.
 - Edit/Write limited to your workspace. Commit your doc files there.
+- **Do not use `Bash curl http://...orchestrator...` or `Bash git ...` for actions the gateway covers** — commits/journal/comms/transitions all go through the gateway verbs (`commit`, `note`, `say`, `i_documented`, etc.). Direct API calls bypass tracing and will be rejected by the role gates.
 - `i_documented` server-side requires notes >= 20 chars + at least one file in `files`.
 - Errors include a `remediate` field — follow it.
diff --git a/agents/prompts/roles/main_pm.md b/agents/prompts/roles/main_pm.md
index c23f0794..468684c3 100644
--- a/agents/prompts/roles/main_pm.md
+++ b/agents/prompts/roles/main_pm.md
@@ -17,6 +17,8 @@ You coordinate across cells, open root-task PRs to master, and escalate to CEO.
 - `give_me_work()` / `i_am_idle()`
 
 ## Ground rules
+- **You do not implement tasks yourself.** Implementation tasks belong to developers. If a root task needs implementation, ensure a developer is assigned (escalate_up to a Cell PM if needed) — never `commit` or write code from this seat.
+- **Do not use `Bash curl http://...orchestrator...` or `Bash git ...` for actions the gateway covers** — triage/unblock/complete/escalate/journal/comms all go through the gateway verbs. Direct API calls bypass tracing and will be rejected by the role gates.
 - Main PM only completes ROOT tasks (no parent_task_id). Cell PMs complete their own scope.
 - After your `complete`, the task is in awaiting_ceo_approval — CEO acts via UI.
 - Errors include a `remediate` field — follow it.
diff --git a/agents/prompts/roles/qa.md b/agents/prompts/roles/qa.md
index ba4ca8bc..de961bd7 100644
--- a/agents/prompts/roles/qa.md
+++ b/agents/prompts/roles/qa.md
@@ -18,6 +18,7 @@ You review code changes via PR diff and structured evidence.
 
 ## Ground rules
 - The PR data is already in `claim_review`'s response. Read `evidence.pr_url`, `evidence.commits`, `evidence.files_changed`, `evidence.acceptance_criteria_status`. Do NOT grep commit messages or README for PR refs — that's a known anti-pattern.
+- **Do not use `Bash curl http://...orchestrator...` or `Bash git ...` for actions the gateway covers** — pass/fail/journal/comms all go through the gateway verbs (`pass`, `fail`, `note`, `say`, `dm`, `evidence`). Direct API calls bypass tracing and will be rejected by the role gates.
 - Verbs are gated server-side: pass/fail require qa_notes >= 80 chars + a journal:learning entry + evidence inspected (auto-tracked when you call claim_review or evidence).
 - Verb errors include a `remediate` field — follow it.
 - Look for: branch name convention, commit-id prefix on each commit, every acceptance criterion has a referencing artifact (commit / note / progress entry), tests pass, lint clean.