diff --git a/docs/exit-codes.md b/docs/exit-codes.md
new file mode 100644
index 00000000..23657685
--- /dev/null
+++ b/docs/exit-codes.md
@@ -0,0 +1,13 @@
+# Exit-code contract (sketch)
+
+| Code | Meaning | Caller should |
+|---|---|---|
+| 0 | gate passed | ship it |
+| 1 | gate failed on findings | look at the report |
+| 2 | policy failed to parse | fix the config, do not retry |
+| 3 | input unreadable | fix the path |
+
+## Open questions
+
+- Should 2 and 3 collapse into one, or stay apart for CI dashboards?
+- Do we ever need a distinct code for "passed with warnings"?