diff --git a/.gitignore b/.gitignore
index de887e0..ee3118f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,6 +21,8 @@ logs/
 
 # Env
 .env
+.env.*
+!.env.example
 .env.local
 .env.*.local
 
@@ -49,3 +51,11 @@ proof-of-work/prisma/data/*.db
 start9/*/seed/data/*.db
 start9/*/seed/data/*.db.bak
 start9/*/seed/data/*.bak
+
+# Claude Code — deny by default, allow-list shared wiring (see standards/portability.md)
+.claude/*
+!.claude/rules/
+!.claude/agents/
+!.claude/commands/
+!.claude/skills/
+!.claude/settings.json
diff --git a/AGENTS.md b/AGENTS.md
index fabdec9..39b7438 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,6 +2,9 @@
 
 Self-hosted multi-user workout logger (Next.js app) packaged as a StartOS 0.4 `s9pk`, published to a private Start9 registry.
 
+> **Inbox check:** At session start, if `~/Projects/standards/INBOX.md` exists, scan it for
+> items tagged `(Workout-log)` and surface them before proposing next steps; triage with `/triage`.
+
 ## Stack (versions that matter)
 
 - **Next.js 15** (App Router, server components + server actions, SSE streaming) — dynamic request APIs are async (see Conventions)