From 3fb7a47469c243b15f260541cf0ae09d7041263d Mon Sep 17 00:00:00 2001
From: Keysat <licensing@keysat.xyz>
Date: Sun, 14 Jun 2026 12:17:16 -0500
Subject: [PATCH] Add inbox-check line; align .gitignore with canonical .claude
 policy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cross-repo git-hygiene audit remediation: surface ~/Projects/standards/INBOX.md items at session start, and switch .gitignore to the deny-by-default .claude/* block (shared wiring allow-listed) plus the canonical secrets/env lines — per standards/portability.md.
---
 .gitignore | 11 ++++++++++-
 AGENTS.md  |  3 +++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 2a85e13..3239af3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,4 +3,13 @@ data/
 *.log
 .DS_Store
 .env
-.claude/
+.env.*
+!.env.example
+
+# Claude Code (deny by default, allow-list shared wiring — see standards/portability.md)
+.claude/*
+!.claude/rules/
+!.claude/agents/
+!.claude/commands/
+!.claude/skills/
+!.claude/settings.json
diff --git a/AGENTS.md b/AGENTS.md
index d1b51c9..08f985a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,6 +2,9 @@
 
 Kid-friendly soccer training tracker PWA for one player ("Gunner"), packaged as a StartOS 0.4.x `.s9pk` service.
 
+> **Inbox check:** At session start, if `~/Projects/standards/INBOX.md` exists, scan it for
+> items tagged `(premier-gunner)` and surface them before proposing next steps; triage with `/triage`.
+
 ## Stack (versions that matter)
 
 - **Backend**: Node.js (ESM, `"type":"module"`) + Fastify 5, `better-sqlite3` 11, `bcryptjs` 3, `@fastify/cookie` 11, `@fastify/static` 8. No build step.