chore(gds): resync projections against current estate

.claude/CLAUDE.md

@@ -1 +1,67 @@
-@../AGENTS.md
+<!--
+GENERATED FILE - DO NOT EDIT DIRECTLY
+generator: gds
+bundle: 0.1.0-dev
+source-commit: 97e8bbaa3a0734b156b03bad704503bc46d7575b
+input-digest: sha256:e759457c95ddb0f0506dc807acac650fd860690a42ff24fb9e19bd737d1159df
+output-digest: sha256:9b6d8b6f0e6c280a791c45746a10e0f456ed362fde3df6d6ebc8b38f815443be
+edit-source:
+  - .gds/repository.yaml
+  - policies/base/repository-default.yaml
+  - policies/owners/organization-default.yaml
+  - policies/roles/public-module.yaml
+  - templates/agents/repository.md.tmpl
+  - templates/github-actions/go.yml.tmpl
+  - templates/harnesses/claude.md.tmpl
+-->
+# Claude Code repository contract
+
+## Scope
+
+- GDS repository ID: `repo_01KYFD7H750WXQ7NW4YGZDXH7N`.
+- Roles: `module`.
+- Canonical repository facts: `.gds/repository.yaml`.
+- Applied policy bundle: `.gds/bundle.lock.yaml` (`0.1.0-dev`).
+- This is a first-class Claude Code projection compiled from the same typed
+  inputs as `AGENTS.md`; neither projection is a manual policy source.
+
+## Repository boundaries
+
+- Treat this Git repository as one independent mutation boundary.
+- Preserve unrelated dirty changes, branches, worktrees, and submodules.
+- Run `gds context --json` before work crosses repository boundaries.
+- Do not edit generated projections; change the declared canonical input and
+  regenerate.
+
+## Safety
+
+- External writes require explicit approval: `true`.
+- Generated projection edits: `forbidden`.
+- Private parent context persistence: `forbidden`.
+- Visibility: `public`; data: `public`.
+
+## Verification commands
+
+- Test: `python3 -m json.tool config/nddev-contract.json`.
+
+## Claude workflow routing
+
+- Start here: run `gds-orient` (or `gds context --json`) to resolve scope before
+  any cross-repository work.
+- Active skill profiles: `core, module`. Five profiles exist in total
+  (`core`, `estate-admin`, `module`, `device`, `portfolio`); only the listed ones
+  are active for this repository. The catalog is `skills/registry.yaml`, and each
+  skill lives under `skills/canonical/<name>/SKILL.md`.
+- Load procedural detail from the applicable installed GDS skill projection or
+  plugin only when the task matches it.
+- Destructive workflows remain explicit-only and still require their concrete
+  plan and approval gates.
+- Treat documentation and Serena memories as derived evidence, never mutation
+  authority.
+
+## Done
+
+- Required checks pass or are explicitly reported `NOT_PROVEN`.
+- Every affected Git boundary and remote result is classified.
+- No secret, private-context leak, unrelated change, or unapproved projection
+  drift is introduced.

.gds/bundle.lock.yaml

@@ -5,16 +5,16 @@ bundle:
   version: "0.1.0-dev"
   release_sequence: 0
   channel: "development"
-  source_commit: "d15c43e21fd5667ea7178ba901d92fff6c78c6e3"
-  digest: "sha256:9a4b1394d8e0a27f7d83ffa4859ccf99ddcbd82ec31b2cc9bc645c094ecbd761"
+  source_commit: "97e8bbaa3a0734b156b03bad704503bc46d7575b"
+  digest: "sha256:fd66beb15c847e94b68a00083df5f218c22f4e1174d39d4bd10ed7fb321b13bc"
 
 projection:
-  input_digest: "sha256:da1757520e2910b092cd49d42d308fb60669868841f2a12ff907cfe8204884a6"
-  output_digest: "sha256:b2c22ba2ed830bab6ed90c98b0089abf339557bd7fbccc10cfc71ea7fdb68b4f"
+  input_digest: "sha256:e759457c95ddb0f0506dc807acac650fd860690a42ff24fb9e19bd737d1159df"
+  output_digest: "sha256:90b4b79f660a7ff8e64b00f763c4f7739633bef7bf531adc0988c9755bba96a5"
   files:
     - path: ".claude/CLAUDE.md"
-      digest: "sha256:7b50d15feae7b63b94d845b2fa6e19e3220527c5b0cac69303b7fc19bd7484a8"
+      digest: "sha256:ef79553133301d3e5f3c4fb80b99c21e22aec56a3450973aa34a3ed4b8336dd0"
     - path: ".gds/compiled-policy.json"
       digest: "sha256:d65fe8ea43f60e8c61e6724974b0855c31e096516ce0e713d1d15fa7c1d4ffd5"
     - path: "AGENTS.md"
-      digest: "sha256:37a41633f771e7a95804071538e67836c47c36a142237a2fb8097297b34113d8"
+      digest: "sha256:e7a46931e072f293a8d30abb634159d436d3e303b7179a03c1762425c50ccda2"

AGENTS.md

@@ -1,11 +1,60 @@
-# Repository instructions
+<!--
+GENERATED FILE - DO NOT EDIT DIRECTLY
+generator: gds
+bundle: 0.1.0-dev
+source-commit: 97e8bbaa3a0734b156b03bad704503bc46d7575b
+input-digest: sha256:e759457c95ddb0f0506dc807acac650fd860690a42ff24fb9e19bd737d1159df
+output-digest: sha256:8bacbbd747b6262c34335321b80d4fd3c3c9c6eab2c6e858d6622b685d5ef681
+edit-source:
+  - .gds/repository.yaml
+  - policies/base/repository-default.yaml
+  - policies/owners/organization-default.yaml
+  - policies/roles/public-module.yaml
+  - templates/agents/repository.md.tmpl
+  - templates/github-actions/go.yml.tmpl
+  - templates/harnesses/claude.md.tmpl
+-->
+# GDS repository contract
 
-- Treat this clone as one independent Git mutation boundary.
+## Scope
+
+- Repository ID: `repo_01KYFD7H750WXQ7NW4YGZDXH7N`.
+- Roles: `module`.
+- Canonical repository facts: `.gds/repository.yaml`.
+- Applied bundle: `.gds/bundle.lock.yaml` (`0.1.0-dev`).
+- Compiled policy: `.gds/compiled-policy.json`.
+
+## Boundaries
+
+- This Git repository is one independent mutation boundary.
 - Preserve unrelated branches, worktrees, submodules, and dirty changes.
-- Follow the repository's local documentation and source-owned contracts.
-- Keep secrets, credentials, runtime state, caches, logs, and generated evidence
-  out of version control.
+- Resolve cross-repository work with `gds context --json` before acting.
+- Generated files are projections; change their canonical inputs and regenerate.
+
+## Safety
+
+- External writes require explicit approval: `true`.
+- Generated projection edits: `forbidden`.
+- Private parent context persistence: `forbidden`.
+- Visibility contract: `public`; data classification: `public`.
 
-## Verification
+## Development
 
 - Test: `python3 -m json.tool config/nddev-contract.json`.
+
+## Agent routing
+
+- Start here: run `gds-orient` (or `gds context --json`) to resolve scope before
+  any cross-repository work. It is the orientation entry point.
+- Active skill profiles: `core, module`. Five profiles exist in total
+  (`core`, `estate-admin`, `module`, `device`, `portfolio`); only the listed ones
+  are active for this repository. The catalog is `skills/registry.yaml`, and each
+  skill lives under `skills/canonical/<name>/SKILL.md`.
+- Use on-demand skills for procedures; do not duplicate them here.
+- Treat docs and memories as derived evidence, not mutation authority.
+
+## Done
+
+- Required verification is complete or explicitly `NOT_PROVEN`.
+- Git state and every affected repository boundary are classified.
+- No private data, secret, or unapproved generated drift is introduced.