diff --git a/.gitignore b/.gitignore
index 5f15e2b..48527d4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,8 +26,14 @@ ytdlp-cache/
 
 # Local dev secrets
 .env
+.env.*
+!.env.example
 
-# Claude Code state (worktrees, plans, etc.) — but commit the lazy-load
-# rule symlinks under .claude/rules/ (they point into docs/guides/).
+# Claude Code — deny by default (worktrees, plans, local settings stay out),
+# allow-list shared wiring (see standards/portability.md).
 .claude/*
 !.claude/rules/
+!.claude/agents/
+!.claude/commands/
+!.claude/skills/
+!.claude/settings.json
diff --git a/AGENTS.md b/AGENTS.md
index 6bd8817..a3301de 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,6 +2,9 @@
 
 Operator-side, credit-metered service that sits in front of Gemini and the operator's local AI hardware ("Spark Control": Parakeet ASR, Sortformer diarization, TitaNet voice embeddings, a vLLM/Gemma analyze endpoint). The Recaps app (`../recap`) is the client; this repo owns transcription/diarization/analysis routing, the cloud Pro/Max tier + expiry, self-serve billing settlement, and the **internal-meetings** feature (upload audio → transcribe → diarize → cluster → analyze → polish → operator dashboard). **Private. Ships to the operator's own Start9 box via `make install` only — NEVER to the public registry.**
 
+> **Inbox check:** At session start, if `~/Projects/standards/INBOX.md` exists, scan it for
+> items tagged `(recap-relay)` and surface them before proposing next steps; triage with `/triage`.
+
 ## Stack
 
 - **Server**: Node.js (`type: module`, ES modules). Same dev box as the app (`v25.6.1`); container runtime is whatever the `Dockerfile` pins.