refactor: remove tok types compatibility shim

.github/workflows/ci.yml

@@ -47,6 +47,8 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: true
+      - name: Boundary guard
+        run: bash ./scripts/check-ecosystem-boundaries.sh
       - name: gofumpt diff
         run: |
           go install mvdan.cc/gofumpt@v0.10.0
@@ -71,6 +73,8 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: true
+      - name: Boundary guard
+        run: bash ./scripts/check-ecosystem-boundaries.sh
       - uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v7.0.0
         with:
           version: v2.1.0
@@ -90,6 +94,8 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: true
+      - name: Boundary guard
+        run: bash ./scripts/check-ecosystem-boundaries.sh
       - name: Tidy check
         run: |
           go mod tidy

ARCHITECTURE.md

@@ -246,7 +246,6 @@ type PipelineContext struct {
 | `skills/` | 5 Claude-style agent skills (`tok`, `tok-commit`, `tok-compress`, `tok-help`, `tok-review`) | `SKILL.md` per skill |
 | `benchmarks/` | Benchmark harness (run.sh + results.md template) | `run.sh` |
 | `evals/` | Prompt-compression eval | `pipeline-bench.sh`, `prompts/en.txt` |
-| `types/` | Cross-eco exported types (mirrors hawk's `shared/types/`) | `finding.go`, `severity.go` |
 
 ---
 

Makefile

@@ -27,9 +27,12 @@ GOVULNCHECK := $(GOBIN_DIR)/govulncheck
 # ---------------------------------------------------------------------------
 # Phony declarations (alphabetical).
 # ---------------------------------------------------------------------------
-.PHONY: all bench build ci clean cover cover-new fmt help lint lint-fix \
+.PHONY: all bench boundaries build ci clean cover cover-new fmt help lint lint-fix \
         security test test-10x test-new test-race tidy version vet
 
+boundaries: ## Enforce support-repo import boundaries.
+	bash ./scripts/check-ecosystem-boundaries.sh
+
 # ---------------------------------------------------------------------------
 # Default target.
 # ---------------------------------------------------------------------------
@@ -99,7 +102,7 @@ tidy: ## Tidy go.mod / go.sum.
 # ---------------------------------------------------------------------------
 # Composite gate used by CI and pre-push.
 # ---------------------------------------------------------------------------
-ci: tidy fmt vet lint test-race security ## Run everything CI runs.
+ci: tidy fmt vet lint boundaries test-race security ## Run everything CI runs.
 	@echo "All CI checks passed."
 
 # ---------------------------------------------------------------------------

README.md

@@ -22,6 +22,14 @@ tok is a **library**, not a CLI. It exposes token-efficiency primitives as a cle
 
 It is consumed directly as a Go module, and it powers the `tok` commands inside [Hawk](https://github.com/GrayCodeAI/hawk) (`hawk tok ...`), which imports it as a library.
 
+## Ecosystem Boundaries
+
+tok is a Hawk support engine. Keep the dependency edge one-way:
+
+- depend on `hawk-core-contracts` when a stable cross-repo contract is needed
+- do not import `hawk/internal/*`
+- do not import removed legacy path `hawk/shared/types`; use `hawk-core-contracts/types`
+
 ---
 
 ## Install

lefthook.yml

@@ -110,3 +110,18 @@ commit-msg:
           echo "  full guide: https://www.conventionalcommits.org/"
           exit 1
         fi
+
+    strip-co-authored-by:
+      run: |
+        # Strip Co-authored-by: trailers that AI tools (Claude, Cursor, etc.) add.
+        # This enforces the rule that commits list only the human author.
+        sed '/^[Cc]o-[Aa]uthored-[Bb]y:/d' "{1}" > "{1}.tmp" && mv "{1}.tmp" "{1}"
+
+# ---------------------------------------------------------------------------
+# prepare-commit-msg — strip AI co-author trailers after tools inject them.
+# ---------------------------------------------------------------------------
+prepare-commit-msg:
+  commands:
+    strip-co-authored-by:
+      run: |
+        sed '/^[Cc]o-[Aa]uthored-[Bb]y:/d' "{1}" > "{1}.tmp" && mv "{1}.tmp" "{1}"

scripts/check-ecosystem-boundaries.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+
+if command -v rg >/dev/null 2>&1; then
+  violations="$(rg -n 'github\.com/GrayCodeAI/hawk/(internal/|shared/types)' --glob '*.go' . || true)"
+else
+  violations="$(grep -rn --include='*.go' -E 'github\.com/GrayCodeAI/hawk/(internal/|shared/types)' . || true)"
+fi
+
+if [[ -n "${violations}" ]]; then
+  echo "forbidden Hawk imports found:"
+  echo "${violations}"
+  echo
+  echo "support repos must use hawk-core-contracts or local contracts, not hawk/internal or removed hawk/shared/types"
+  exit 1
+fi
+
+echo "ecosystem boundary guard passed"