fdeops 3.9.10 → 3.9.12

package/AGENTS.md

@@ -15,4 +15,4 @@ Route via **`@fde`** - read `skills/fde/SKILL.md` (the single source of truth),
 
 ## Boundaries
 
-The `fde` CLI never reaches the network. Data marked `<private>` in `trust-profile.md` never enters a model prompt. fdeops installs on the FDE's own machine, never on customer infrastructure.
+The `fde` CLI never reaches the network. `<private>` blocks are redacted from CLI/dashboard/hook outputs; do not load raw private blocks into a model via file tools or paste. fdeops installs on the FDE's own machine, never on customer infrastructure.

package/CLAUDE.md.template

@@ -22,4 +22,4 @@ Experienced FDE peer: direct, no fluff, no assumptions. Ask once if a fact chang
 
 ## Pause before
 
-Production changes, irreversible actions, surprises that affect trust. `<private>` in trust-profile never enters prompts.
+Production changes, irreversible actions, surprises that affect trust. `<private>` is redacted from CLI/hook context; do not paste raw private blocks into prompts.

package/README.md

@@ -163,7 +163,7 @@ Open the system of record in a browser - trust, phase, next action, and the full
 
 - **Local only.** Pure `git` + file reads - no network calls, no telemetry, no account. Works air-gapped.
 - **Plain markdown.** No database, no lock-in.
-- **No new data path.** The AI sees client code only when *you* point your agent at it; `<private>`-tagged data never enters the model's context.
+- **No new data path.** The AI sees client code only when *you* point your agent at it. `<private>` tags are redacted from CLI/dashboard/hook output; do not feed raw private blocks into the model (file tools bypass that redaction).
 - **Nothing enters the record unreviewed.** The model drafts, you confirm (`fde debrief --dry-run` shows the routing first); the hooks record only git facts. Your fieldbook stays yours to defend.
 - **Know your sync surface.** `~/fde-engagements` lives in your home directory - your backup and cloud-sync setup now covers client notes. `fde resume --init` warns if the folder sits in a synced path. Read [PRIVACY.md](PRIVACY.md) before your first NDA'd engagement.
 

package/adapters/AGENTS.md

@@ -21,4 +21,4 @@ A 20-year FDE peer: direct, no fluff, no assumptions. One sharp question when a
 
 ## Pause before
 
-Production changes, irreversible actions, anything that affects client trust. Data marked `<private>` in `trust-profile.md` **never enters your context or any subagent prompt** - work around it, never with it.
+Production changes, irreversible actions, anything that affects client trust. `<private>` is redacted from CLI/dashboard/hook context; do **not** open raw private blocks with file tools or paste them into prompts/subagents - work around them, never with them.

package/adapters/GEMINI.md

@@ -21,4 +21,4 @@ A 20-year FDE peer: direct, no fluff, no assumptions. One sharp question when a
 
 ## Pause before
 
-Production changes, irreversible actions, anything that affects client trust. Data marked `<private>` in `trust-profile.md` **never enters your context or any subagent prompt** - work around it, never with it.
+Production changes, irreversible actions, anything that affects client trust. `<private>` is redacted from CLI/dashboard/hook context; do **not** open raw private blocks with file tools or paste them into prompts/subagents - work around them, never with them.

package/adapters/copilot-instructions.md

@@ -21,4 +21,4 @@ A 20-year FDE peer: direct, no fluff, no assumptions. One sharp question when a
 
 ## Pause before
 
-Production changes, irreversible actions, anything that affects client trust. Data marked `<private>` in `trust-profile.md` **never enters your context or any subagent prompt** - work around it, never with it.
+Production changes, irreversible actions, anything that affects client trust. `<private>` is redacted from CLI/dashboard/hook context; do **not** open raw private blocks with file tools or paste them into prompts/subagents - work around them, never with them.

package/adapters/cursor.fde.mdc

@@ -35,4 +35,4 @@ A 20-year FDE peer: direct, no fluff, no assumptions. One sharp question when a
 
 ## Pause before
 
-Production changes, irreversible actions, anything that affects client trust. Data marked `<private>` in `trust-profile.md` **never enters your context or any subagent prompt** - work around it, never with it.
+Production changes, irreversible actions, anything that affects client trust. `<private>` is redacted from CLI/dashboard/hook context; do **not** open raw private blocks with file tools or paste them into prompts/subagents - work around them, never with them.

package/bin/check.js

@@ -202,12 +202,16 @@ if (fs.existsSync(pmf) && !read('docs/internal/PMF_360_REVIEW.md').includes('INT
 } else if (fs.existsSync(pmf)) ok('internal PMF banner')
 
 const hook = read('hooks/session-start')
+const hookCode = hook.replace(/^[ \t]*#.*$/gm, '')
 if (!hook.includes('FDEOPS_ENGAGEMENT')) {
   fail('session-start hook must read FDEOPS_ENGAGEMENT env var')
 } else ok('hook FDEOPS_ENGAGEMENT')
+if (!hookCode.includes('FDEOPS_ENGAGEMENT="$ENG_DIR" fde triage') ||
+    !hookCode.includes('FDEOPS_ENGAGEMENT="$ENG_DIR" node "$FDE_CMD" triage')) {
+  fail('session-start must run triage with its resolved engagement')
+}
 // Token discipline: SessionStart must not dump the full skill (L1 progressive disclosure).
 // Strip comments before scanning for a real `cat …SKILL.md` / BOOTSTRAP inject.
-const hookCode = hook.replace(/^[ \t]*#.*$/gm, '')
 if (/\$\(cat\s+"\$BOOTSTRAP"\)|cat\s+"\$BOOTSTRAP"|cat\s+[^\n]*SKILL\.md/.test(hookCode)) {
   fail('session-start must not cat SKILL.md - inject TRIAGE + bounded context + pointer only')
 }
@@ -240,10 +244,35 @@ if (!fs.existsSync(path.join(root, 'hooks', 'session-stop'))) {
   fail('hooks/session-stop missing (write-side memory backstop)')
 } else {
   const stopHook = read('hooks/session-stop')
+  const stopHookCode = stopHook.replace(/^[ \t]*#.*$/gm, '')
   if (!stopHook.includes('FDEOPS_ENGAGEMENT')) fail('session-stop must resolve FDEOPS_ENGAGEMENT')
-  if (!stopHook.includes('context.md')) fail('session-stop must append to context.md')
+  if (!stopHookCode.includes('resolve_fde') || !stopHookCode.includes('command -v fde')) {
+    fail('session-stop must resolve PATH fde before plugin copies')
+  }
+  if (!/FDEOPS_ENGAGEMENT="\$ENG_DIR" (?:fde|node "\$FDE_CMD") capture/.test(stopHookCode)
+    && !stopHookCode.includes('run_fde "$FDE_CMD" capture')) {
+    fail('session-stop must delegate capture with its resolved engagement')
+  }
   ok('session-stop write side')
 }
+const compactHook = read('hooks/pre-compact')
+const compactHookCode = compactHook.replace(/^[ \t]*#.*$/gm, '')
+if (!compactHookCode.includes('resolve_fde') || !compactHookCode.includes('command -v fde')) {
+  fail('pre-compact must resolve PATH fde before plugin copies')
+}
+if (!/FDEOPS_ENGAGEMENT="\$ENG_DIR" (?:fde|node "\$FDE_CMD") preserve/.test(compactHookCode)) {
+  fail('pre-compact must delegate preserve with its resolved engagement')
+}
+for (const h of ['session-stop', 'pre-compact']) {
+  const body = read('hooks/' + h).replace(/^[ \t]*#.*$/gm, '')
+  const contextTarget = /(?:"?\$(?:\{)?CONTEXT_FILE(?:\})?"?|"?\$(?:\{)?ENG_DIR(?:\})?\/context\.md"?)/.source
+  const redirectsToContext = new RegExp(`>{1,2}\\s*${contextTarget}`)
+  const teesToContext = new RegExp(`\\btee\\b[^\\n]*${contextTarget}`)
+  if (redirectsToContext.test(body) || teesToContext.test(body)) {
+    fail(`hooks/${h} must not append context.md directly`)
+  }
+}
+ok('mutation hooks delegate CLI writes')
 for (const h of ['session-start', 'session-stop', 'pre-compact']) {
   const mode = fs.statSync(path.join(root, 'hooks', h)).mode
   if (!(mode & 0o111)) fail(`hooks/${h} lost its executable bit`)

package/bin/fde.js

@@ -22,6 +22,7 @@
  *   fde owner [set …]       who keeps this engagement record
  *   fde receipts <term>     "what did we agree?" - search memory with dates
  *   fde capture             session-end snapshot → context.md (hooks use this)
+ *   fde preserve            pre-compaction context snapshot (hook-internal; hooks use this)
  *   fde status [--all]      current engagement (default) or full portfolio (--all)
  *   fde dashboard [--all]   current engagement fieldbook (default) or all (--all)
  */
@@ -559,7 +560,7 @@ function parseSignalHistoryEntries(eng) {
   // Format-agnostic on token position: CLI writes "[date] [signal:x] text";
   // debrief may put the token at the end. Author tags [@x] are stripped for matching.
   const md = readClean(eng, 'stakeholders.md')
-  const histText = sectionBody(md, 'Signal history') + '\n' + readEng(eng, SIGNAL_LEDGER)
+  const histText = sectionBody(md, 'Signal history') + '\n' + readClean(eng, SIGNAL_LEDGER)
   const history = []
   histText.split('\n').forEach(l => {
     const dm = l.trim().match(/^-\s*\[(\d{4}-\d{2}-\d{2})\]\s*(.*)$/i)
@@ -1181,6 +1182,11 @@ function routeDebriefInput(eng, input, { dry, force }) {
     if (m) {
       const type = m[1].toLowerCase()
       let body = m[2]
+      const hit = findSecretHit(body)
+      if (hit && !force) {
+        console.error(`skipped ${type} line - looks like a ${hit}. Redact it, or re-run with --force.`)
+        continue
+      }
       if (type === 'next') {
         if (dry) console.log(`→ context.md ## Next action  - ${body}`)
         else nextAction = body
@@ -1189,11 +1195,6 @@ function routeDebriefInput(eng, input, { dry, force }) {
       }
       const sigInline = (body.match(/\[signal:(red|amber|green)\]/i) || [])[1]
       if (sigInline) body = body.replace(/\[signal:(red|amber|green)\]/i, '').trim()
-      const hit = findSecretHit(body)
-      if (hit && !force) {
-        console.error(`skipped ${type} line - looks like a ${hit}. Redact it, or re-run with --force.`)
-        continue
-      }
       const entry = datedEntry(eng, date, body, type === 'contact' && sigInline ? sigInline.toLowerCase() : '')
       if (dry) console.log(`→ ${LOG_FILES[type]}  ${entry}`)
       else appendLogEntry(eng, type, entry, { skipCommit: true })
@@ -1335,7 +1336,12 @@ function cmdCapture() {
   }).join(' ')
   if (!changed && !updated) process.exit(0) // idle session - keep memory clean
   const d = new Date()
-  const stamp = `${d.toISOString().slice(0, 10)} ${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`
+  const localDate = [
+    d.getFullYear(),
+    String(d.getMonth() + 1).padStart(2, '0'),
+    String(d.getDate()).padStart(2, '0'),
+  ].join('-')
+  const stamp = `${localDate} ${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`
   let block = `\n<!-- fdeops auto-capture -->\n## Session end - ${stamp}\n`
   if (branch) block += `- workspace: \`${branch}\` @ ${lastCommit || 'no commits yet'}\n`
   if (changed) block += `- uncommitted: ${changed}\n`
@@ -1347,6 +1353,36 @@ function cmdCapture() {
   } catch (_) {}
 }
 
+function cmdPreserve() {
+  try {
+    const eng = resolveEngagement({ forWrite: true })
+    if (!eng || !fs.existsSync(path.join(eng, 'context.md'))) return
+    const marker = '[fdeops context preserved'
+    const today = new Date().toISOString().slice(0, 10)
+    const decisionLines = readClean(eng, 'decisions.md').split('\n')
+    if (decisionLines[decisionLines.length - 1] === '') decisionLines.pop()
+    const recentDecisions = decisionLines.slice(-20).join('\n')
+    const openRisks = readClean(eng, 'risks.md').split('\n')
+      .filter(line => /open|active|unresolved/i.test(line))
+      .slice(0, 8)
+      .join('\n')
+    const timestamp = new Date().toISOString().replace(/\.\d{3}Z$/, 'Z')
+    const block = `\n---\n${marker} at ${timestamp}]\nRecent decisions (tail):\n${recentDecisions}\n\nOpen risks:\n${openRisks}\n---\n`
+
+    ensureMemoryGit(eng)
+    const contextPath = path.join(eng, 'context.md')
+    const blocked = refuseSymlinkWrite(contextPath, { soft: true })
+    if (blocked) throw Object.assign(new Error(blocked), { code: 'ESYMLINK' })
+    withFileLock(contextPath, () => {
+      const context = readEng(eng, 'context.md')
+      const preservedToday = context.split('\n')
+        .some(line => line.includes(marker) && line.includes(today))
+      if (!preservedToday) fs.appendFileSync(contextPath, block)
+    }, { soft: true })
+    commitMemory(eng, 'context preserve', { files: ['context.md'] })
+  } catch (_) {}
+}
+
 function cmdTriage() {
   const eng = resolveEngagement()
   if (!eng) {
@@ -1830,8 +1866,7 @@ function cmdDashboard(args) {
 
   try {
     fs.mkdirSync(path.dirname(outPath), { recursive: true })
-    refuseSymlinkWrite(outPath)
-    fs.writeFileSync(outPath, html)
+    atomicWriteFile(outPath, html)
   } catch (e) {
     failFs(e, 'write fieldbook', outPath)
   }
@@ -1868,6 +1903,7 @@ function printUsage() {
   fde owner [set email]    who keeps this engagement record
   fde receipts <term>      "what did we agree?" with dates
   fde capture              session-end memory snapshot (hooks use this)
+  fde preserve             pre-compaction context snapshot (hook-internal; hooks use this)
   fde status [--all]       current engagement status (pass --all for full portfolio)
   fde dashboard [--all]    current engagement fieldbook (pass --all for every client)
   env FDEOPS_ENGAGEMENTS_ROOT  override ~/fde-engagements (init/status/dashboard/registry)
@@ -1889,6 +1925,7 @@ switch (cmd) {
   case 'owner': cmdOwner(args); break
   case 'receipts': cmdReceipts(args); break
   case 'capture': cmdCapture(); break
+  case 'preserve': cmdPreserve(); break
   case 'status': cmdStatus(args); break
   case 'dashboard': cmdDashboard(args); break
   case 'help':

package/hooks/pre-compact

@@ -36,6 +36,25 @@ registry_engagement_dir() {
   return 1
 }
 
+# Prefer PATH `fde`, then plugin/repo copies - same order as session-start.
+resolve_fde() {
+  if command -v fde >/dev/null 2>&1; then
+    printf '%s\n' "fde"
+    return 0
+  fi
+  for candidate in \
+    "${CLAUDE_PLUGIN_ROOT:+$CLAUDE_PLUGIN_ROOT/bin/fde.js}" \
+    "$(dirname "$0")/../bin/fde.js" \
+    "$HOME/.claude/fdeops/fde.js" \
+    "$HOME/.claude/plugins/fdeops/bin/fde.js"; do
+    if [ -n "$candidate" ] && [ -f "$candidate" ]; then
+      printf '%s\n' "$candidate"
+      return 0
+    fi
+  done
+  return 1
+}
+
 ENG_DIR=$(resolve_engagement_dir "${FDEOPS_ENGAGEMENT:-${FDEOS_ENGAGEMENT:-}}")
 
 if [ -z "$ENG_DIR" ]; then
@@ -58,59 +77,13 @@ fi
 
 [ -z "$ENG_DIR" ] && exit 0
 
-CONTEXT_FILE="$ENG_DIR/context.md"
-DECISIONS_FILE="$ENG_DIR/decisions.md"
-RISKS_FILE="$ENG_DIR/risks.md"
-MARKER="[fdeops context preserved"
-
-[ -f "$CONTEXT_FILE" ] || exit 0
-
-# Avoid unbounded growth: skip if we already preserved today.
-if grep -Fq "$MARKER" "$CONTEXT_FILE" 2>/dev/null; then
-  LAST=$(grep -F "$MARKER" "$CONTEXT_FILE" | tail -1)
-  if echo "$LAST" | grep -q "$(date -u +%Y-%m-%d)"; then
-    exit 0
+FDE_CMD=$(resolve_fde || true)
+if [ -n "$FDE_CMD" ]; then
+  if [ "$FDE_CMD" = "fde" ]; then
+    FDEOPS_ENGAGEMENT="$ENG_DIR" fde preserve >/dev/null 2>&1 || true
+  else
+    FDEOPS_ENGAGEMENT="$ENG_DIR" node "$FDE_CMD" preserve >/dev/null 2>&1 || true
   fi
 fi
 
-# Redact <private> before extracting lines - this content is appended to
-# context.md, which session-start loads into the model. A closed private block
-# collapses to one placeholder line, so its inner text can't be tail'd or
-# grepped out tag-stripped. Case-insensitive, mirrors the JS /gi redactor.
-strip_private() {
-  awk '
-    BEGIN { inblock = 0 }
-    {
-      line = $0
-      lc = tolower(line)
-      if (inblock) { if (index(lc, "</private>") > 0) { inblock = 0 } next }
-      if (index(lc, "<private>") > 0) {
-        print "(private - redacted)"
-        if (index(lc, "</private>") == 0) { inblock = 1 }
-        next
-      }
-      print line
-    }
-  ' "$1"
-}
-
-TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-LAST_DECISIONS=""
-OPEN_RISKS=""
-
-[ -f "$DECISIONS_FILE" ] && LAST_DECISIONS=$(strip_private "$DECISIONS_FILE" 2>/dev/null | tail -20)
-[ -f "$RISKS_FILE" ] && OPEN_RISKS=$(strip_private "$RISKS_FILE" 2>/dev/null | grep -iE "open|active|unresolved" | head -8)
-
-cat >> "$CONTEXT_FILE" 2>/dev/null << EOF
-
----
-$MARKER at $TIMESTAMP]
-Recent decisions (tail):
-$LAST_DECISIONS
-
-Open risks:
-$OPEN_RISKS
----
-EOF
-
 exit 0

package/hooks/session-start

@@ -68,6 +68,7 @@ fi
 
 # 5) Optional in-repo .fde (customer-approved only)
 if [ -z "$CONTEXT_FILE" ] && [ -f ".fde/context.md" ]; then
+  ENG_DIR=".fde"
   CONTEXT_FILE=".fde/context.md"
 fi
 
@@ -164,9 +165,9 @@ if [ -n "$CONTEXT_FILE" ] && [ -f "$CONTEXT_FILE" ]; then
   FDE_CMD=$(resolve_fde || true)
   if [ -n "$FDE_CMD" ]; then
     if [ "$FDE_CMD" = "fde" ]; then
-      TRIAGE=$(fde triage 2>/dev/null || true)
+      TRIAGE=$(FDEOPS_ENGAGEMENT="$ENG_DIR" fde triage 2>/dev/null || true)
     else
-      TRIAGE=$(node "$FDE_CMD" triage 2>/dev/null || true)
+      TRIAGE=$(FDEOPS_ENGAGEMENT="$ENG_DIR" node "$FDE_CMD" triage 2>/dev/null || true)
     fi
     if [ -n "$TRIAGE" ]; then
       CONTENT="$CONTENT---\n$TRIAGE\n\n"

package/hooks/session-stop

@@ -2,11 +2,10 @@
 # fdeops SessionEnd - write-side memory backstop.
 #
 # The skill's memory contract says the agent appends a meaningful
-# "where we left off" to context.md before the session ends. This hook
-# guarantees a deterministic floor when it doesn't: date, workspace state,
-# and which engagement artifacts moved. Next session-start loads it back.
+# "where we left off" to context.md before the session ends. This hook delegates
+# the deterministic floor to the CLI, then refreshes the local dashboard.
 #
-# Deliberately dumb: no model calls, no network, append-only, exits silently.
+# No model calls, no network, exits silently.
 
 cat >/dev/null 2>&1 || true  # drain hook stdin; payload unused
 
@@ -44,6 +43,35 @@ registry_engagement_dir() {
   return 1
 }
 
+# Prefer PATH `fde`, then plugin/repo copies - same order as session-start.
+resolve_fde() {
+  if command -v fde >/dev/null 2>&1; then
+    printf '%s\n' "fde"
+    return 0
+  fi
+  for candidate in \
+    "${CLAUDE_PLUGIN_ROOT:+$CLAUDE_PLUGIN_ROOT/bin/fde.js}" \
+    "$(dirname "$0")/../bin/fde.js" \
+    "$HOME/.claude/fdeops/fde.js" \
+    "$HOME/.claude/plugins/fdeops/bin/fde.js"; do
+    if [ -n "$candidate" ] && [ -f "$candidate" ]; then
+      printf '%s\n' "$candidate"
+      return 0
+    fi
+  done
+  return 1
+}
+
+run_fde() {
+  local cmd="$1"
+  shift
+  if [ "$cmd" = "fde" ]; then
+    FDEOPS_ENGAGEMENT="$ENG_DIR" fde "$@" >/dev/null 2>&1 || true
+  else
+    FDEOPS_ENGAGEMENT="$ENG_DIR" node "$cmd" "$@" >/dev/null 2>&1 || true
+  fi
+}
+
 ENG_DIR=""
 
 # 1) Environment variable (any agent)
@@ -72,45 +100,11 @@ if [ -z "$ENG_DIR" ] && [ -d ".fde" ]; then
 fi
 
 [ -z "$ENG_DIR" ] && exit 0
-CONTEXT_FILE="$ENG_DIR/context.md"
 
-TODAY=$(date +%F)
-NOW=$(date +%H:%M)
-
-# Workspace state (only if the cwd is a git repo)
-BRANCH=$(git -C "$PWD" branch --show-current 2>/dev/null)
-LAST_COMMIT=$(git -C "$PWD" log -1 --format="%h %s" 2>/dev/null | head -c 100)
-CHANGED=$(git -C "$PWD" status --porcelain 2>/dev/null | head -8 | sed 's/^...//' | tr '\n' ' ')
-
-# Engagement artifacts updated in the last 12h (the deliverable=memory trail)
-UPDATED=$(find "$ENG_DIR" -maxdepth 1 -name "*.md" ! -name "context.md" -mmin -720 2>/dev/null \
-  | while read -r f; do basename "$f"; done | tr '\n' ' ')
-
-# Idle session (no edits, no artifact updates) → leave the memory clean.
-# LAST_COMMIT alone is not "movement": it exists in any repo with history.
-[ -z "$CHANGED" ] && [ -z "$UPDATED" ] && exit 0
-
-{
-  printf '\n<!-- fdeops auto-capture -->\n'
-  printf '## Session end - %s %s\n' "$TODAY" "$NOW"
-  [ -n "$BRANCH" ] && printf -- '- workspace: `%s` @ %s\n' "$BRANCH" "${LAST_COMMIT:-no commits yet}"
-  [ -n "$CHANGED" ] && printf -- '- uncommitted: %s\n' "$CHANGED"
-  [ -n "$UPDATED" ] && printf -- '- engagement files updated: %s\n' "$UPDATED"
-} 2>/dev/null >> "$CONTEXT_FILE" || true
-
-# Refresh the local fieldbook.html so the portfolio view is current next time
-# it's opened. Deterministic render of .fde/ - zero tokens, best-effort, never
-# allowed to break the session.
-if command -v node >/dev/null 2>&1; then
-  for FDE_CLI in \
-    "${CLAUDE_PLUGIN_ROOT:+$CLAUDE_PLUGIN_ROOT/bin/fde.js}" \
-    "$(dirname "$0")/../bin/fde.js" \
-    "$HOME/.claude/fdeops/fde.js"; do
-    if [ -n "$FDE_CLI" ] && [ -f "$FDE_CLI" ]; then
-      node "$FDE_CLI" dashboard >/dev/null 2>&1 || true
-      break
-    fi
-  done
+FDE_CMD=$(resolve_fde || true)
+if [ -n "$FDE_CMD" ]; then
+  run_fde "$FDE_CMD" capture
+  run_fde "$FDE_CMD" dashboard
 fi
 
 exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops",
-  "version": "3.9.10",
+  "version": "3.9.12",
   "description": "Field kit for engineers embedded in client work - a real CLI (recon, memory, portfolio), one @fde skill with field judgment on top, and hooks that make it automatic. Claude Code plugin and any agent that loads skills.",
   "bin": {
     "fdeops": "bin/install.js",

package/skills/fde/SKILL.md

@@ -59,7 +59,7 @@ When NOT to interrogate or challenge: unambiguous one-liners, mechanical ops, FD
 - The `fde` CLI is **local only** - `git` + file reads, no AI, no network. Safe in any environment.
 - **You (the AI) only ever see customer code when the FDE points you at it** inside the agent they are already authorized to run. fdeops adds no new data path.
 - **Before reading or generating against customer code, the AI policy must be known.** New engagement, policy unknown → ask it (land phase: "policy on AI-generated code? data that must never touch AI?") *before* loading their code into context. Default to "not permitted" until the FDE confirms.
-- Data tagged `<private>` in `trust-profile.md` (sacred data, PHI, cardholder, classified) **never enters your context or any subagent prompt** - work around it, never with it.
+- Data tagged `<private>` (sacred data, PHI, cardholder, classified) is **redacted from CLI, dashboard, and hook-injected context**. Do **not** open raw `<private>` blocks with file tools (that bypasses redaction) or paste them into prompts/subagents - work around them, never with them.
 - Locked-down engagement (no AI on their code)? Use the CLI + the fieldbook only. The memory layer is the FDE's own notes, not customer code.
 
 **Engagement path - zero ceremony.** Run `fde resume` (fallback: `node ~/.claude/fdeops/fde.js resume`). The **workspace registry** (written once by `fde resume --init <name>`) is the normal path; resolution order is env var override → registry → pointer file → workspace-name match (read-only) → `./.fde`. Writes require a bind (or `FDEOPS_ENGAGEMENT`), not folder name alone. It prints a **bounded** view of `context.md` - the curated head (state, next action) plus the most recent activity, with the older session log collapsed (use `fde resume --full` when you genuinely need the whole history). If it reports NO ENGAGEMENT: confirm the client name in conversation (one question), then run `fde resume --init <name>` yourself - the one setup step; the FDE never runs setup commands. Never install fdeops on infrastructure the FDE does not control.

package/skills/fde/references/healthcare.md

@@ -10,7 +10,7 @@ A PHI breach can end an operating licence; an audit-trail gap can invalidate a c
 
 > "Walk me through what patient data this system touches, stores, transmits - and who has access."
 
-PHI is broader than names: IPs, device identifiers, sub-state geography, and dates (other than year) can all qualify in context. When in doubt, treat as PHI. Tag everything in `trust-profile.md` under `<private>` - **PHI never enters AI context in plaintext: not prompts, not test fixtures, not dev logs.**
+PHI is broader than names: IPs, device identifiers, sub-state geography, and dates (other than year) can all qualify in context. When in doubt, treat as PHI. Tag it in `trust-profile.md` under `<private>`. Operational rule: **no PHI in prompts, test fixtures, or logs** - CLI/dashboard redact the tags; agent file tools do not.
 
 ## AI policy before a single line
 
@@ -38,7 +38,7 @@ Clinical systems need emergency override (a clinician must reach a record even w
 
 ## Principles
 
-- PHI never enters AI context in plaintext.
+- No PHI in prompts, fixtures, or logs (tag `<private>`; do not read raw private blocks into the model).
 - Audit trails before features.
 - Unclear AI policy = prohibited until confirmed.
 - De-identification is a legal definition (18 identifiers).

package/skills/fde/references/land.md

@@ -86,7 +86,7 @@ Before the end of day 1, ship one visible thing: a small bug fix, a cleanup the
 ```
 If `stakeholders.md` already has a `## Signal history` section (it does from the template), **never delete or overwrite it** when you rewrite this file - it holds the dated `[signal:...]` tokens `fde log contact --signal` and `fde debrief` write, and `fde status`/`fde receipts`/the dashboard read only from that section. Edit the table above it freely; keep the section below intact.
 
-**`trust-profile.md`** - sacred data (`<private>` tagged), fears heard, AI policy, approval chain. Sensitive: never loaded for status reads, never into subagent prompts.
+**`trust-profile.md`** - sacred data (`<private>` tagged), fears heard, AI policy, approval chain. Sensitive: skip for status reads; use CLI/redacted surfaces; never paste raw `<private>` into prompts or subagents.
 
 **`assumptions.md`** - seed every unverified claim from the brief (and the day-1 hypothesis) as rows with blast radius CRITICAL / LOAD-BEARING / CONVENIENCE and status `OPEN`. Do not wait for assumption-audit - land makes the register exist. Example:
 
@@ -107,7 +107,7 @@ If remote: trust-building takes ~40% longer - push for a short video call before
 ## Principles
 
 - Never start technical work before `success.md` exists.
-- Sacred data never enters AI context. Ever.
+- Sacred data tagged `<private>` stays out of model context: use CLI/redacted reads; never paste raw private blocks.
 - The brief is a hypothesis; discover confirms it. Seed `assumptions.md` on day one.
 - The passed-over internal team is the best source of truth, not an obstacle.
 - If the customer cannot define success, that is the first problem to solve.

package/templates/.fde/trust-profile.md

@@ -1,10 +1,10 @@
 # Trust profile
 
-<!-- Sacred data, AI policy, approvals. Use <private>...</private> for never-AI content. -->
+<!-- Sacred data, AI policy, approvals. Use <private>...</private> for content CLI/dashboard must redact; do not paste raw into prompts. -->
 
 **AI code policy:**
 **Approval chain:**
-**Data that must never enter AI context:**
+**Data kept out of model context (tag below; do not paste raw):**
 
 <private>
 <!-- Example: cardholder data scope, production credentials paths -->