Fix compact reset boundaries

Squash merge PR #14 after Repository Health Checks and CodeRabbit passed on 057a36a.

Author: eternalwaitt

.github/workflows/health.yml

@@ -0,0 +1,55 @@
+name: health
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - "release/**"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  repo-health:
+    name: Repository Health Checks
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          persist-credentials: false
+
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: "22"
+          # No package install runs in this job; keep setup-node package-manager caching disabled.
+          package-manager-cache: false
+
+      - name: Install CLI dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y jq fd-find ripgrep shellcheck python3.12
+          sudo ln -sf "$(command -v fdfind)" /usr/local/bin/fd
+          sudo ln -sf "$(command -v python3.12)" /usr/local/bin/python3
+
+      - name: Validate generated rule exports
+        run: node scripts/sync-rule-exports.mjs --check
+
+      - name: Hook tests
+        run: tests/test-hooks.sh
+
+      - name: Workflow tool tests
+        run: tests/test-workflow-tools.sh
+
+      - name: Install and rollback tests
+        run: tests/test-install.sh
+
+      - name: Doctor
+        run: scripts/doctor.sh --jobs 4

.gitignore

@@ -15,6 +15,9 @@ coverage/
 plans/
 docs/plans/
 docs/research/
+# Local privacy overlay is intentionally ignored without hiding all .eternal/ state.
+/.eternal/privacy-banned-tokens.local
+/rules-manifest.local.json
 
 # Never commit private Claude runtime data.
 settings.local.json

CHANGELOG.md

@@ -18,6 +18,37 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ### Deprecated
 
+## v0.5.2
+
+2026-06-16
+
+### Added
+
+- `.github/workflows/health.yml` — CI health workflow for rule export sync, hook tests, workflow tests, install/rollback tests, and doctor.
+- `scripts/doctor.sh` — health checks now cover ShellCheck, rule module export drift, privacy scan enforcement, and pending-release changelog validation.
+- `rules/eternal-saas/project/tcg-contract.md` — scoped TCG/card-domain contract rule module and generated Cursor export.
+
+### Changed
+
+- `scripts/sync-rule-exports.mjs` and `scripts/init-project-rules.sh` — manifest-driven rule sync now validates profile membership, generated Cursor exports, privacy overlays, and install-time Cursor checksums.
+- `scripts/init-project-rules.sh` — installs generated Cursor `.mdc` modules alongside Claude rules, validates Cursor exports, and tracks Cursor checksums in the install receipt.
+- `rules/eternal-saas/*` — rule host metadata now reflects Claude and Cursor support without claiming unsupported Codex nested context output.
+- Email triage runtime references now use the `etrnl-email` command pattern across guards, canaries, slash commands, and fixtures instead of legacy `vivaz-email` naming.
+- `hooks/cc-sessionstart-restore.sh`, `scripts/lib/etrnl-state-core.mjs`, and `scripts/workflow-health.mjs` — track session reset boundaries so `/new` and `/clear` isolate stale compact handoff state.
+- `scripts/bootstrap-tools.sh` and `scripts/tool-stack-check.mjs` — support validated `ETRNL_CODEGRAPH_NPM_SPEC` and `ETRNL_BEADS_NPM_SPEC` overrides for pinned global tool installs.
+- Bundled skill namespaces now align around `@example-suite`, `money-vo-discipline`, and `orpc-patterns` naming across policy skills, routing lists, and vendored bundles.
+- `skills/bundled/stripe-best-practices` — hardens Stripe guidance from advisory wording to explicit policy gates for API versions, payment-surface selection, test/migration expectations, and Connect settlement/dispute behavior.
+
+### Fixed
+
+- `scripts/install.sh` — validate source install inputs before any non-dry-run mutation.
+- `hooks/cc-stop-verifier.sh`, `hooks/cc-pretooluse-guard.sh`, and `scripts/code-health-ledger-check.mjs` — close enforcement gaps for invalid Stop JSON, live hook writes, and prompt-only code-health audits.
+- `scripts/update-check.mjs`, `scripts/skill-contract-check.mjs`, `scripts/tool-stack-check.mjs`, and `scripts/doctor.sh` — harden update trust, bundled skill contracts, pinned tool install specs, ShellCheck, privacy scanning, and rule export drift detection.
+
+### Security
+
+- `rules-manifest.json`, `scripts/privacy-banned-token-check.mjs`, and `scripts/doctor.sh` — remove tracked private project literals from the privacy gate and support standalone or doctor-integrated banned-token scans with gitignored local overlays and redacted diagnostics.
+
 ## v0.5.1
 
 2026-06-11
@@ -53,14 +84,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - `templates/AGENTS.global.md` — portable ~32-line cross-host agent baseline for Codex startup.
 - `templates/AGENTS.override.codex.md` — Codex-specific startup deltas (no slash commands, no hooks, byte budget, skills path).
 - `docs/rules.md` — cross-host rules reference: module catalog, host activation per tool, install and drift-check commands.
-- `docs/adr/0003-cross-host-rule-stack.md` — decision record for the Exodia cross-host rule architecture.
+- `docs/adr/0003-exodia-cross-host-rules.md` — decision record for the Exodia cross-host rule architecture.
 - Codex byte gate in `scripts/doctor.sh` — warns when `~/.codex/AGENTS.md` exceeds 75 % of the configured `project_doc_max_bytes` limit.
 - Manifest assertions in `scripts/doctor.sh` — validates `rules-manifest.json` schema version, `bannedTokens` non-empty, and `rules/eternal-saas/global/` module count.
 - Rollback now restores `rules/eternal-saas` global digest and backed-up Codex startup files (`AGENTS.md`, `AGENTS.override.md`).
 - `scripts/lib/skill-lists.sh` now includes `init-project-rules.sh` in `INSTALL_SCRIPTS` so it deploys to both Claude and Codex homes.
 - Prompt router extended: "prune AGENTS/claude/rules", "rule bloat", "AGENTS.md/CLAUDE.md too long", "trim AGENTS/CLAUDE.md", and "startup file/context too long" prompts now route to `etrnl-ops-agent-files`. Three new skill-triggering fixture cases added.
-- Six project pilots with the eternal-saas pack: core-suite, agency-tbd, tcg-collector, mimo-finance, vivaz-website, and sbcc-portal — each with project-specific `local-overrides.md`, pruned `AGENTS.md`, and removed old flat rule files.
-- sbcc-portal `.gitignore` updated to track `.claude/rules/` while keeping local session state ignored.
+- Six private project pilots with the eternal-saas pack, each with project-specific `local-overrides.md`, pruned `AGENTS.md`, and removed old flat rule files.
+- One private pilot `.gitignore` updated to track `.claude/rules/` while keeping local session state ignored.
 
 ### Changed
 
@@ -73,7 +104,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ### Fixed
 
-- `scripts/plan-readiness-check.mjs` no longer flags hyphenated proper names such as the `agency-tbd` repo as a `TBD` placeholder; standalone `TBD` markers still fail (regression tests in `tests/test-workflow-tools.sh`).
+- `scripts/plan-readiness-check.mjs` no longer flags hyphenated proper names such as the `example-agency` repo as a `TBD` placeholder; standalone `TBD` markers still fail (regression tests in `tests/test-workflow-tools.sh`).
 - `scripts/update-check.mjs` now correctly marks `sync-rule-exports.mjs` as source-only (not installed) to prevent false drift failures.
 - `scripts/update-check.mjs` renamed map includes `doctor.sh → doctor-etrnl.sh` to suppress stale-scripts drift false positives.
 
@@ -94,4 +125,3 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ### Security
 
 - Public repository boundary: no private identity, credentials, transcripts, or local planning artifacts in tracked files.
-

CREDITS.md

@@ -28,7 +28,9 @@ Eternal Stack is designed as a complete skill family. Policy, review, simplifica
 | `better-auth`, `tenant-isolation-patterns`, `money-vo-discipline` | Auth, tenancy, and money discipline | Community / upstream skill bundles |
 | `stripe-best-practices`, `abacatepay-integration` | Payments review | Community / upstream skill bundles |
 | `ci-cd` | CI helper scripts referenced by `/etrnl-dev-ci` | Community skill bundle |
-| `domain-*`, `i18n-localization`, and related domain skills | Domain-specific review gates | Community / upstream skill bundles |
+| `domain-cli`, `domain-cloud-native`, `domain-embedded`, `domain-fintech`, `domain-iot`, `domain-ml`, `domain-web`, `rules/eternal-saas/project/tcg-contract.md` | Domain-specific review gates and TCG project rule routing | Community / upstream skill bundles plus Eternal Stack rules |
+| `prisma-expert` | Prisma schema and query review | Community / upstream skill bundle |
+| `i18n-localization` | Locale and translation review | Community / upstream skill bundle |
 
 The full inventory and routing notes live in [docs/skills.md](docs/skills.md).
 
@@ -40,7 +42,7 @@ Eternal Stack reimplements useful mechanisms from public agent-tooling projects
 | --- | --- |
 | [colbymchenry/codegraph](https://github.com/colbymchenry/codegraph) | Optional local code-graph MCP; bootstrap and health checks in `full` profile |
 | [hyhmrright/brooks-lint](https://github.com/hyhmrright/brooks-lint) | Review finding shape (Symptom → Source → Consequence → Remedy); vendored Brooks modules |
-| [rtk-ai/rtk](https://github.com/rtk-ai/rtk) | Codex deterministic command rewrite via `codex-rtk-pre-tool-use.sh` |
+| [rtk-ai/rtk](https://github.com/rtk-ai/rtk) | Optional Codex command rewrite helper via `codex-rtk-pre-tool-use.sh`; separate from the Claude/Cursor rule pack |
 | [GitHub/spec-kit](https://github.com/github/spec-kit) | Plan/readiness executability gates |
 | [Chachamaru127/claude-code-harness](https://github.com/Chachamaru127/claude-code-harness) | Quality gates, browser artifact contracts, review plateau ideas |
 | [infinri/Writ](https://github.com/infinri/Writ) | Mandatory-rule mechanical enforcement |
@@ -49,7 +51,7 @@ Eternal Stack reimplements useful mechanisms from public agent-tooling projects
 
 ## Claude Code
 
-Eternal Stack targets [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook and skill surfaces. Codex parity helpers install under `~/.codex/etrnl/` when you use both hosts.
+Eternal Stack targets [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook and skill surfaces. The reusable rule pack exports to Claude and Cursor; optional Codex helper state installs under `~/.codex/etrnl/` when you use both hosts.
 
 ## Contributing upstream
 

README.md

@@ -53,7 +53,7 @@ tests/test-hooks.sh
 
 **Hooks** — enforcement at tool boundaries. Full catalog and lifecycle wiring: [docs/hooks.md](docs/hooks.md). Pretool and stop rules: [docs/guards.md](docs/guards.md). Regression: [tests/test-hooks.sh](tests/test-hooks.sh).
 
-**Skills** — repeatable workflows as `/etrnl-*` commands, grouped by namespace (`dev`, `audit`, `ops`, `comm`). Inventory: [docs/skills.md](docs/skills.md).
+**Skills** — repeatable workflows as `/etrnl-*` commands, grouped by namespace (`dev`, `audit`, `ops`, `comm`). Bundled domain skills include `domain-cli`, `domain-cloud-native`, `domain-embedded`, `domain-fintech`, `domain-iot`, `domain-ml`, and `domain-web`. Inventory: [docs/skills.md](docs/skills.md).
 
 **Scripts** — deterministic helpers for ledgers, browser QA, workflow health, code-health inventory, deep-audit validation, and release hygiene.
 
@@ -86,7 +86,7 @@ Don't skip those steps. Strict mode with untested hooks will interrupt things yo
 | [CLAUDE.md](CLAUDE.md) | Thin Claude Code wrapper that imports `AGENTS.md` |
 | [docs/hooks.md](docs/hooks.md) | Hook reference: every `cc-*` entrypoint, events, default vs strict |
 | [docs/guards.md](docs/guards.md) | Pretool deny catalog, stop-verifier gates, fail-open matrix |
-| [docs/rules.md](docs/rules.md) | Cross-host rule pack: module catalog, host activation, `init-project-rules.sh` |
+| [docs/rules.md](docs/rules.md) | Claude and Cursor rule pack: module catalog, host activation, `init-project-rules.sh` |
 | [docs/install.md](docs/install.md) | Install, update, uninstall, profiles, strict mode |
 | [docs/migration.md](docs/migration.md) | Rollout sequencing — safe migration order |
 | [docs/configuration.md](docs/configuration.md) | Profiles, strict mode, env var tuning |

VERSION

@@ -1 +1 @@
-0.5.1
+0.5.2

commands/email-triage.md

@@ -1,5 +1,5 @@
 ---
-description: Run VIVAZ email Inbox Zero triage for one account, then open the action queue.
+description: Run managed email Inbox Zero triage for one account, then open the action queue.
 argument-hint: <account-id>
 allowed-tools: Bash
 ---
@@ -8,41 +8,41 @@ Account argument from the slash command: `$ARGUMENTS`
 
 Treat the argument as the account id. If it is empty, ask the repository owner for the account id and stop.
 
-Do not handwrite Gmail commands. Do not send email. Do not mutate Gmail outside the VIVAZ email runtime.
-Do not run `vivaz-email triage run` for this slash command. That is a dry classification path and does not clear INBOX.
+Do not handwrite Gmail commands, send email, or mutate Gmail outside the managed email runtime.
+Avoid `etrnl-email triage run` for this slash command; it is a dry classification path and does not clear INBOX.
 
 Phase 1 is Inbox Zero. Triage every email in INBOX, archive known bad-quality emails, label action/waiting/manual-review items, remove them from INBOX, and provider-verify INBOX is zero:
 
 ```bash
-vivaz-email triage guarded-run --account <account-id> --max-inbox 500 --apply --require-insights
+etrnl-email triage guarded-run --account <account-id> --max-inbox 500 --apply --require-insights
 ```
 
 Verify the queue run before opening any queue:
 
 ```bash
-vivaz-email triage verify --latest --account <account-id>
+etrnl-email triage verify --latest --account <account-id>
 ```
 
 If verification does not show `inbox_zero_verified: true`, `inbox_count: 0`, and either `gmail_mutated: true` or `queue_ready_without_mutation: true`, do not show queue items. Continue Inbox Zero triage first or paste the runtime blocker.
 
 If `guarded-run` exits with `TRIAGE_GUARD_ML_DISAGREED`, do not ask the repository owner whether to continue. Inspect the runtime evidence, patch deterministic triage rules/cache when appropriate, then rerun the guarded command:
 
 ```bash
-vivaz-email triage guarded-run --account <account-id> --max-inbox 500 --apply --require-insights
-vivaz-email triage ml-reviews --latest --account <account-id> --limit 20
-vivaz-email triage report --latest --account <account-id> --include-failures --format markdown
+etrnl-email triage guarded-run --account <account-id> --max-inbox 500 --apply --require-insights
+etrnl-email triage ml-reviews --latest --account <account-id> --limit 20
+etrnl-email triage report --run-id <run-id> --format markdown
 ```
 
 Phase 2 starts only after Inbox Zero is verified. Use the queue run id emitted by the runtime, then show exactly one action/reply queue item:
 
 ```bash
-vivaz-email triage queue --run-id <run-id> --mode reply --format markdown --next
+etrnl-email triage queue --run-id <run-id> --mode reply --format markdown --next
 ```
 
 If the queue item shows a proposed reply with a draft id, run the outgoing reply checker before asking the repository owner to approve or send it:
 
 ```bash
-vivaz-email drafts check --draft-id <draft-id>
+etrnl-email drafts check --draft-id <draft-id>
 ```
 
 If the checker returns any issue, stop and surface the failed draft check with the exact issue list. Do not improvise manual rewrites, and do not ask the repository owner to approve or send a failed draft until the runtime provides a checked replacement draft.

docs/adr/0003-exodia-cross-host-rules.md

@@ -7,11 +7,11 @@ date: 2026-06-10
 
 ## Context
 
-Claude Code, Codex, and Cursor each provide native agent-context surfaces (`.claude/rules/` with `paths:` frontmatter, `AGENTS.md` nesting, and `.mdc` with `globs`), but the rule content is currently authored separately for each project. This creates drift, duplication, and inconsistent enforcement surfaces across repos.
+Claude Code, Codex, and Cursor each provide native agent-context surfaces (`.claude/rules/` with `paths:` frontmatter, global `AGENTS.md` startup context, and `.mdc` with `globs`), but the rule content is currently authored separately for each project. This creates drift, duplication, and inconsistent enforcement surfaces across repos.
 
 Host features verified on 2026-06-10:
 - **Claude Code** natively loads `.claude/rules/` and `~/.claude/rules/` with `paths:` frontmatter scoping; no hooks needed.
-- **Codex** reads `~/.codex/AGENTS.md` and `AGENTS.override.md`; nested `AGENTS.md` files are its only depth mechanism; no glob or import syntax.
+- **Codex** reads `~/.codex/AGENTS.md` and `AGENTS.override.md`; this repo installs the global startup digest and does not install project-depth rule modules for Codex.
 - **Cursor** `.mdc` files with `globs`, `description`, and `alwaysApply` are native; Cursor has no user-level rules directory (settings UI only).
 
 `scripts/install.sh` already syncs `rules/etrnl` to `~/.claude/rules/etrnl` with an atomic tmp/old swap and implements `ETRNL_INSTALL_STARTUP` gating for startup files. The bundled skill family already publishes Eternal-stack patterns publicly (`money-vo-discipline`, `abacatepay-integration`, `eternal-best-practices`).
@@ -24,11 +24,11 @@ This record is ADR 0003. ADR 0002 is taken by `etrnl-state-and-compact-handoff`.
 
 ### 2. Privacy boundary
 
-The `eternal-saas` rule pack ships publicly. Excluded from tracked rule files: client business names, account facts, credentials, transcripts, and personal identity. Client-repo rollout lists stay in local gitignored planning paths. Enforcement: `rules-manifest.json` carries `privacy.bannedTokens`; `sync-rule-exports.mjs --check` fails when a tracked rule file contains one.
+The `eternal-saas` rule pack ships publicly. Excluded from tracked rule files: client business names, account facts, credentials, transcripts, and personal identity. Client-repo rollout lists stay in local gitignored planning paths. Enforcement: `rules-manifest.json` carries generic privacy sentinel tokens plus optional untracked local token files; `sync-rule-exports.mjs --check` fails when a tracked rule file contains one.
 
-### 3. Codex scoped depth via nested AGENTS.md
+### 3. Codex uses the startup digest
 
-Each rule module may declare `codexNested: <relative-dir>`; `sync-rule-exports.mjs` emits a nested `AGENTS.md` for declared modules; undeclared modules ride the root digest only. No import syntax exists in Codex — `@` imports are never used in Codex files.
+The project rule pack installs to Claude Code and Cursor project surfaces. Codex receives the shared baseline through `~/.codex/AGENTS.md` and `AGENTS.override.md`; no nested project `AGENTS.md` files are generated by `sync-rule-exports.mjs` or `init-project-rules.sh`.
 
 ### 4. Byte budget is read, not assumed
 
@@ -48,7 +48,7 @@ All project-pack installs use file copies. Symlinks break for other clones, CI,
 
 ## Consequences
 
-- One source of truth for rule content; Claude `.claude/rules/`, Cursor `.mdc`, and Codex `AGENTS.md` files are generated or installed from the same module.
+- One source of truth for project rule content; Claude `.claude/rules/` and Cursor `.mdc` files are generated or installed from the same module. Codex receives the global baseline through startup files.
 - `sync-rule-exports.mjs --check` in the test suite prevents host-twin drift and banned-token leaks.
 - The byte-gate in `doctor.sh` keeps Codex context under the effective limit; the explicit fallback prevents silent overflow.
 - Checksum-tracked installs let pilot repos self-classify drift without re-running install.