chore(gds): resync projections

.claude/CLAUDE.md

@@ -1 +1,67 @@
-@../AGENTS.md
+<!--
+GENERATED FILE - DO NOT EDIT DIRECTLY
+generator: gds
+bundle: 0.1.0-dev
+source-commit: 97e8bbaa3a0734b156b03bad704503bc46d7575b
+input-digest: sha256:ae14c8f33893068b3b380a1e2644fda6b654b3bdeb5f976537942d694c189218
+output-digest: sha256:6355d13f7ebbc2f399c98e172c2e92bb6ad300b0b75181a27fd35e7df1b60427
+edit-source:
+  - .gds/repository.yaml
+  - policies/base/repository-default.yaml
+  - policies/owners/organization-default.yaml
+  - policies/roles/public-module.yaml
+  - templates/agents/repository.md.tmpl
+  - templates/github-actions/go.yml.tmpl
+  - templates/harnesses/claude.md.tmpl
+-->
+# Claude Code repository contract
+
+## Scope
+
+- GDS repository ID: `repo_01KYFD7GQWFYMPYQQRST62ZTG1`.
+- Roles: `module`.
+- Canonical repository facts: `.gds/repository.yaml`.
+- Applied policy bundle: `.gds/bundle.lock.yaml` (`0.1.0-dev`).
+- This is a first-class Claude Code projection compiled from the same typed
+  inputs as `AGENTS.md`; neither projection is a manual policy source.
+
+## Repository boundaries
+
+- Treat this Git repository as one independent mutation boundary.
+- Preserve unrelated dirty changes, branches, worktrees, and submodules.
+- Run `gds context --json` before work crosses repository boundaries.
+- Do not edit generated projections; change the declared canonical input and
+  regenerate.
+
+## Safety
+
+- External writes require explicit approval: `true`.
+- Generated projection edits: `forbidden`.
+- Private parent context persistence: `forbidden`.
+- Visibility: `public`; data: `public`.
+
+## Verification commands
+
+- Test: `python3 -m json.tool config/nddev-contract.json`.
+
+## Claude workflow routing
+
+- Start here: run `gds-orient` (or `gds context --json`) to resolve scope before
+  any cross-repository work.
+- Active skill profiles: `core, module`. Five profiles exist in total
+  (`core`, `estate-admin`, `module`, `device`, `portfolio`); only the listed ones
+  are active for this repository. The catalog is `skills/registry.yaml`, and each
+  skill lives under `skills/canonical/<name>/SKILL.md`.
+- Load procedural detail from the applicable installed GDS skill projection or
+  plugin only when the task matches it.
+- Destructive workflows remain explicit-only and still require their concrete
+  plan and approval gates.
+- Treat documentation and Serena memories as derived evidence, never mutation
+  authority.
+
+## Done
+
+- Required checks pass or are explicitly reported `NOT_PROVEN`.
+- Every affected Git boundary and remote result is classified.
+- No secret, private-context leak, unrelated change, or unapproved projection
+  drift is introduced.

.gds/bundle.lock.yaml

@@ -0,0 +1,20 @@
+# GENERATED FILE - DO NOT EDIT DIRECTLY
+schema_version: 1
+
+bundle:
+  version: "0.1.0-dev"
+  release_sequence: 0
+  channel: "development"
+  source_commit: "97e8bbaa3a0734b156b03bad704503bc46d7575b"
+  digest: "sha256:fd66beb15c847e94b68a00083df5f218c22f4e1174d39d4bd10ed7fb321b13bc"
+
+projection:
+  input_digest: "sha256:ae14c8f33893068b3b380a1e2644fda6b654b3bdeb5f976537942d694c189218"
+  output_digest: "sha256:e11ae30cd50f4226e1d4bbc1db71a59a2a331fe6df76c334d44bfffd1bd9661d"
+  files:
+    - path: ".claude/CLAUDE.md"
+      digest: "sha256:b7893a647347afdb1de798faf15296f17e7d8a9d2d71a863ba58f989ef545d47"
+    - path: ".gds/compiled-policy.json"
+      digest: "sha256:4989b5e6e277480e1fc154ff78088dc153954f2557086e2cda46c876a92e1d2b"
+    - path: "AGENTS.md"
+      digest: "sha256:1b8e9f9b1b05cbdb3f2f49ef2ae8f07ae160f584808b2cb16a3a9ea573e71c1d"