fdeops 3.9.11 → 3.9.12

package/AGENTS.md

@@ -15,4 +15,4 @@ Route via **`@fde`** - read `skills/fde/SKILL.md` (the single source of truth),
 
 ## Boundaries
 
-The `fde` CLI never reaches the network. Data marked `<private>` in `trust-profile.md` never enters a model prompt. fdeops installs on the FDE's own machine, never on customer infrastructure.
+The `fde` CLI never reaches the network. `<private>` blocks are redacted from CLI/dashboard/hook outputs; do not load raw private blocks into a model via file tools or paste. fdeops installs on the FDE's own machine, never on customer infrastructure.

package/CLAUDE.md.template

@@ -22,4 +22,4 @@ Experienced FDE peer: direct, no fluff, no assumptions. Ask once if a fact chang
 
 ## Pause before
 
-Production changes, irreversible actions, surprises that affect trust. `<private>` in trust-profile never enters prompts.
+Production changes, irreversible actions, surprises that affect trust. `<private>` is redacted from CLI/hook context; do not paste raw private blocks into prompts.

package/README.md

@@ -163,7 +163,7 @@ Open the system of record in a browser - trust, phase, next action, and the full
 
 - **Local only.** Pure `git` + file reads - no network calls, no telemetry, no account. Works air-gapped.
 - **Plain markdown.** No database, no lock-in.
-- **No new data path.** The AI sees client code only when *you* point your agent at it; `<private>`-tagged data never enters the model's context.
+- **No new data path.** The AI sees client code only when *you* point your agent at it. `<private>` tags are redacted from CLI/dashboard/hook output; do not feed raw private blocks into the model (file tools bypass that redaction).
 - **Nothing enters the record unreviewed.** The model drafts, you confirm (`fde debrief --dry-run` shows the routing first); the hooks record only git facts. Your fieldbook stays yours to defend.
 - **Know your sync surface.** `~/fde-engagements` lives in your home directory - your backup and cloud-sync setup now covers client notes. `fde resume --init` warns if the folder sits in a synced path. Read [PRIVACY.md](PRIVACY.md) before your first NDA'd engagement.
 

package/adapters/AGENTS.md

@@ -21,4 +21,4 @@ A 20-year FDE peer: direct, no fluff, no assumptions. One sharp question when a
 
 ## Pause before
 
-Production changes, irreversible actions, anything that affects client trust. Data marked `<private>` in `trust-profile.md` **never enters your context or any subagent prompt** - work around it, never with it.
+Production changes, irreversible actions, anything that affects client trust. `<private>` is redacted from CLI/dashboard/hook context; do **not** open raw private blocks with file tools or paste them into prompts/subagents - work around them, never with them.

package/adapters/GEMINI.md

@@ -21,4 +21,4 @@ A 20-year FDE peer: direct, no fluff, no assumptions. One sharp question when a
 
 ## Pause before
 
-Production changes, irreversible actions, anything that affects client trust. Data marked `<private>` in `trust-profile.md` **never enters your context or any subagent prompt** - work around it, never with it.
+Production changes, irreversible actions, anything that affects client trust. `<private>` is redacted from CLI/dashboard/hook context; do **not** open raw private blocks with file tools or paste them into prompts/subagents - work around them, never with them.

package/adapters/copilot-instructions.md

@@ -21,4 +21,4 @@ A 20-year FDE peer: direct, no fluff, no assumptions. One sharp question when a
 
 ## Pause before
 
-Production changes, irreversible actions, anything that affects client trust. Data marked `<private>` in `trust-profile.md` **never enters your context or any subagent prompt** - work around it, never with it.
+Production changes, irreversible actions, anything that affects client trust. `<private>` is redacted from CLI/dashboard/hook context; do **not** open raw private blocks with file tools or paste them into prompts/subagents - work around them, never with them.

package/adapters/cursor.fde.mdc

@@ -35,4 +35,4 @@ A 20-year FDE peer: direct, no fluff, no assumptions. One sharp question when a
 
 ## Pause before
 
-Production changes, irreversible actions, anything that affects client trust. Data marked `<private>` in `trust-profile.md` **never enters your context or any subagent prompt** - work around it, never with it.
+Production changes, irreversible actions, anything that affects client trust. `<private>` is redacted from CLI/dashboard/hook context; do **not** open raw private blocks with file tools or paste them into prompts/subagents - work around them, never with them.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops",
-  "version": "3.9.11",
+  "version": "3.9.12",
   "description": "Field kit for engineers embedded in client work - a real CLI (recon, memory, portfolio), one @fde skill with field judgment on top, and hooks that make it automatic. Claude Code plugin and any agent that loads skills.",
   "bin": {
     "fdeops": "bin/install.js",

package/skills/fde/SKILL.md

@@ -59,7 +59,7 @@ When NOT to interrogate or challenge: unambiguous one-liners, mechanical ops, FD
 - The `fde` CLI is **local only** - `git` + file reads, no AI, no network. Safe in any environment.
 - **You (the AI) only ever see customer code when the FDE points you at it** inside the agent they are already authorized to run. fdeops adds no new data path.
 - **Before reading or generating against customer code, the AI policy must be known.** New engagement, policy unknown → ask it (land phase: "policy on AI-generated code? data that must never touch AI?") *before* loading their code into context. Default to "not permitted" until the FDE confirms.
-- Data tagged `<private>` in `trust-profile.md` (sacred data, PHI, cardholder, classified) **never enters your context or any subagent prompt** - work around it, never with it.
+- Data tagged `<private>` (sacred data, PHI, cardholder, classified) is **redacted from CLI, dashboard, and hook-injected context**. Do **not** open raw `<private>` blocks with file tools (that bypasses redaction) or paste them into prompts/subagents - work around them, never with them.
 - Locked-down engagement (no AI on their code)? Use the CLI + the fieldbook only. The memory layer is the FDE's own notes, not customer code.
 
 **Engagement path - zero ceremony.** Run `fde resume` (fallback: `node ~/.claude/fdeops/fde.js resume`). The **workspace registry** (written once by `fde resume --init <name>`) is the normal path; resolution order is env var override → registry → pointer file → workspace-name match (read-only) → `./.fde`. Writes require a bind (or `FDEOPS_ENGAGEMENT`), not folder name alone. It prints a **bounded** view of `context.md` - the curated head (state, next action) plus the most recent activity, with the older session log collapsed (use `fde resume --full` when you genuinely need the whole history). If it reports NO ENGAGEMENT: confirm the client name in conversation (one question), then run `fde resume --init <name>` yourself - the one setup step; the FDE never runs setup commands. Never install fdeops on infrastructure the FDE does not control.

package/skills/fde/references/healthcare.md

@@ -10,7 +10,7 @@ A PHI breach can end an operating licence; an audit-trail gap can invalidate a c
 
 > "Walk me through what patient data this system touches, stores, transmits - and who has access."
 
-PHI is broader than names: IPs, device identifiers, sub-state geography, and dates (other than year) can all qualify in context. When in doubt, treat as PHI. Tag everything in `trust-profile.md` under `<private>` - **PHI never enters AI context in plaintext: not prompts, not test fixtures, not dev logs.**
+PHI is broader than names: IPs, device identifiers, sub-state geography, and dates (other than year) can all qualify in context. When in doubt, treat as PHI. Tag it in `trust-profile.md` under `<private>`. Operational rule: **no PHI in prompts, test fixtures, or logs** - CLI/dashboard redact the tags; agent file tools do not.
 
 ## AI policy before a single line
 
@@ -38,7 +38,7 @@ Clinical systems need emergency override (a clinician must reach a record even w
 
 ## Principles
 
-- PHI never enters AI context in plaintext.
+- No PHI in prompts, fixtures, or logs (tag `<private>`; do not read raw private blocks into the model).
 - Audit trails before features.
 - Unclear AI policy = prohibited until confirmed.
 - De-identification is a legal definition (18 identifiers).

package/skills/fde/references/land.md

@@ -86,7 +86,7 @@ Before the end of day 1, ship one visible thing: a small bug fix, a cleanup the
 ```
 If `stakeholders.md` already has a `## Signal history` section (it does from the template), **never delete or overwrite it** when you rewrite this file - it holds the dated `[signal:...]` tokens `fde log contact --signal` and `fde debrief` write, and `fde status`/`fde receipts`/the dashboard read only from that section. Edit the table above it freely; keep the section below intact.
 
-**`trust-profile.md`** - sacred data (`<private>` tagged), fears heard, AI policy, approval chain. Sensitive: never loaded for status reads, never into subagent prompts.
+**`trust-profile.md`** - sacred data (`<private>` tagged), fears heard, AI policy, approval chain. Sensitive: skip for status reads; use CLI/redacted surfaces; never paste raw `<private>` into prompts or subagents.
 
 **`assumptions.md`** - seed every unverified claim from the brief (and the day-1 hypothesis) as rows with blast radius CRITICAL / LOAD-BEARING / CONVENIENCE and status `OPEN`. Do not wait for assumption-audit - land makes the register exist. Example:
 
@@ -107,7 +107,7 @@ If remote: trust-building takes ~40% longer - push for a short video call before
 ## Principles
 
 - Never start technical work before `success.md` exists.
-- Sacred data never enters AI context. Ever.
+- Sacred data tagged `<private>` stays out of model context: use CLI/redacted reads; never paste raw private blocks.
 - The brief is a hypothesis; discover confirms it. Seed `assumptions.md` on day one.
 - The passed-over internal team is the best source of truth, not an obstacle.
 - If the customer cannot define success, that is the first problem to solve.

package/templates/.fde/trust-profile.md

@@ -1,10 +1,10 @@
 # Trust profile
 
-<!-- Sacred data, AI policy, approvals. Use <private>...</private> for never-AI content. -->
+<!-- Sacred data, AI policy, approvals. Use <private>...</private> for content CLI/dashboard must redact; do not paste raw into prompts. -->
 
 **AI code policy:**
 **Approval chain:**
-**Data that must never enter AI context:**
+**Data kept out of model context (tag below; do not paste raw):**
 
 <private>
 <!-- Example: cardholder data scope, production credentials paths -->