From 56963ab4fd7b682c1bbac9a1098580bdb00bb7f2 Mon Sep 17 00:00:00 2001
From: Keysat <licensing@keysat.xyz>
Date: Sun, 14 Jun 2026 12:17:16 -0500
Subject: [PATCH] Add inbox-check line; align .gitignore with canonical .claude
 policy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cross-repo git-hygiene audit remediation: surface ~/Projects/standards/INBOX.md items at session start, and switch .gitignore to the deny-by-default .claude/* block (shared wiring allow-listed) plus the canonical secrets/env lines — per standards/portability.md.
---
 .gitignore | 10 ++++++++++
 AGENTS.md  |  3 +++
 2 files changed, 13 insertions(+)

diff --git a/.gitignore b/.gitignore
index de887e0..ee3118f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,6 +21,8 @@ logs/
 
 # Env
 .env
+.env.*
+!.env.example
 .env.local
 .env.*.local
 
@@ -49,3 +51,11 @@ proof-of-work/prisma/data/*.db
 start9/*/seed/data/*.db
 start9/*/seed/data/*.db.bak
 start9/*/seed/data/*.bak
+
+# Claude Code — deny by default, allow-list shared wiring (see standards/portability.md)
+.claude/*
+!.claude/rules/
+!.claude/agents/
+!.claude/commands/
+!.claude/skills/
+!.claude/settings.json
diff --git a/AGENTS.md b/AGENTS.md
index fabdec9..39b7438 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,6 +2,9 @@
 
 Self-hosted multi-user workout logger (Next.js app) packaged as a StartOS 0.4 `s9pk`, published to a private Start9 registry.
 
+> **Inbox check:** At session start, if `~/Projects/standards/INBOX.md` exists, scan it for
+> items tagged `(Workout-log)` and surface them before proposing next steps; triage with `/triage`.
+
 ## Stack (versions that matter)
 
 - **Next.js 15** (App Router, server components + server actions, SSE streaming) — dynamic request APIs are async (see Conventions)