ci: guard sdk-python consumer boundaries

.github/workflows/ci.yml

@@ -56,6 +56,8 @@ jobs:
         run: ruff check .
       - name: ruff format --check
         run: ruff format --check .
+      - name: consumer boundary guard
+        run: bash ./scripts/check-consumer-boundaries.sh
       - name: examples compile (anti-rot)
         run: python -m compileall examples
 

Makefile

@@ -19,7 +19,7 @@ PIP     ?= $(PYTHON) -m pip
 # ---------------------------------------------------------------------------
 # Phony declarations (alphabetical).
 # ---------------------------------------------------------------------------
-.PHONY: all bench build ci clean cover fmt help install lint lint-fix \
+.PHONY: all bench boundary-guard build ci clean cover fmt help install lint lint-fix \
         release security test test-race tidy version vet
 
 # ---------------------------------------------------------------------------
@@ -63,6 +63,9 @@ fmt: ## Format with ruff.
 vet: ## Type-check with mypy.
 	$(PYTHON) -m mypy src/
 
+boundary-guard: ## Fail if the SDK references support engines or Hawk private packages.
+	bash ./scripts/check-consumer-boundaries.sh
+
 lint: ## Lint with ruff.
 	$(PYTHON) -m ruff check .
 
@@ -84,7 +87,7 @@ tidy: ## No-op for Python (lockfile management is via pyproject.toml).
 # ---------------------------------------------------------------------------
 # Composite gate used by CI and pre-push.
 # ---------------------------------------------------------------------------
-ci: fmt vet lint test security ## Run everything CI runs.
+ci: fmt vet boundary-guard lint test security ## Run everything CI runs.
 	@echo "All CI checks passed."
 
 # ---------------------------------------------------------------------------

README.md

@@ -66,6 +66,13 @@ with HawkClient() as client:
 
 See the [examples/](examples/) directory for complete runnable examples.
 
+## Ecosystem Boundaries
+
+- `hawk-sdk-python` is a consumer of Hawk public APIs and contracts.
+- Do not couple the SDK to support engine repos such as `eyrie`, `yaad`, `tok`, `trace`, `sight`, or `inspect`.
+- Do not reference `hawk/internal/*` or removed legacy path `hawk/shared/types`.
+- If a capability is needed across repos, expose it through Hawk or `hawk-core-contracts`, not engine internals.
+
 ## Contributing
 
 Contributions are welcome — please read [CONTRIBUTING.md](CONTRIBUTING.md) before opening a pull request.

lefthook.yml

@@ -0,0 +1,14 @@
+# Install: lefthook install
+# Skip once: LEFTHOOK=0 git commit -m "..."
+
+prepare-commit-msg:
+  commands:
+    strip-co-authored-by:
+      run: |
+        sed '/^[Cc]o-[Aa]uthored-[Bb]y:/d' "{1}" > "{1}.tmp" && mv "{1}.tmp" "{1}"
+
+commit-msg:
+  commands:
+    strip-co-authored-by:
+      run: |
+        sed '/^[Cc]o-[Aa]uthored-[Bb]y:/d' "{1}" > "{1}.tmp" && mv "{1}.tmp" "{1}"

scripts/check-consumer-boundaries.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+
+violations="$(
+  grep -RInE \
+    --include='*.py' --include='*.md' --include='*.yaml' --include='*.yml' --include='*.toml' \
+    'github\.com/GrayCodeAI/(eyrie|inspect|sight|tok|trace|yaad)(/|")|github\.com/GrayCodeAI/hawk/(internal/|shared/types)' \
+    src tests README.md docs api pyproject.toml 2>/dev/null || true
+)"
+
+if [[ -n "${violations}" ]]; then
+  echo "forbidden Hawk consumer references found:"
+  echo "${violations}"
+  echo
+  echo "hawk-sdk-python must depend on Hawk public APIs/contracts only; do not reference support engine repos, hawk/internal, or removed hawk/shared/types"
+  exit 1
+fi
+
+echo "consumer boundary guard passed"