ci(boundary): add ecosystem boundary guard

trace is a Hawk support engine whose trace/redaction event types are
trace-local, so it stays contract-free. Add the one-way ecosystem boundary
guard:

- add scripts/check-ecosystem-boundaries.sh (forbids hawk/internal and
  hawk/shared/types imports)
- wire the guard into the Makefile and CI
- document the boundary rule in the README

Scoped to the boundary guard only; unrelated in-progress changes in the working
tree are intentionally left uncommitted.

Author: Patel230

.github/workflows/ci.yml

@@ -48,6 +48,8 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: true
+      - name: Boundary guard
+        run: bash ./scripts/check-ecosystem-boundaries.sh
       - name: gofumpt diff
         run: |
           go install mvdan.cc/gofumpt@v0.10.0
@@ -72,6 +74,8 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: true
+      - name: Boundary guard
+        run: bash ./scripts/check-ecosystem-boundaries.sh
       - uses: golangci/golangci-lint-action@v9.2.1
         with:
           version: v2.11.3
@@ -91,6 +95,8 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: true
+      - name: Boundary guard
+        run: bash ./scripts/check-ecosystem-boundaries.sh
       - name: Tidy check
         run: |
           go mod tidy

Makefile

@@ -31,9 +31,12 @@ GOVULNCHECK  := $(GOBIN_DIR)/govulncheck
 # ---------------------------------------------------------------------------
 # Phony declarations (alphabetical).
 # ---------------------------------------------------------------------------
-.PHONY: all bench build ci clean cover fmt help lint lint-fix \
+.PHONY: all bench boundaries build ci clean cover fmt help lint lint-fix \
         security test test-10x test-race tidy version vet
 
+boundaries: ## Enforce support-repo import boundaries.
+	bash ./scripts/check-ecosystem-boundaries.sh
+
 # ---------------------------------------------------------------------------
 # Default target.
 # ---------------------------------------------------------------------------
@@ -100,7 +103,7 @@ tidy: ## Tidy go.mod / go.sum.
 # ---------------------------------------------------------------------------
 # Composite gate used by CI and pre-push.
 # ---------------------------------------------------------------------------
-ci: tidy fmt vet lint test-race security ## Run everything CI runs.
+ci: tidy fmt vet lint boundaries test-race security ## Run everything CI runs.
 	@echo "All CI checks passed."
 
 # ---------------------------------------------------------------------------

README.md

@@ -16,6 +16,14 @@
 
 Trace hooks into your Git workflow to capture AI agent sessions as you work. Sessions are indexed alongside commits, creating a searchable record of *how* code was written — not just *what* changed.
 
+## Ecosystem Boundaries
+
+Trace is a Hawk support engine. Keep the dependency edge one-way:
+
+- depend on `hawk-core-contracts` when a stable cross-repo contract is needed
+- do not import `hawk/internal/*`
+- do not add new imports of `hawk/shared/types`; that path is compatibility-only
+
 ### What you get
 
 | Capability | Description |

scripts/check-ecosystem-boundaries.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+
+violations="$(
+  rg -n 'github\.com/GrayCodeAI/hawk/(internal/|shared/types)' \
+    --glob '*.go' \
+    . || true
+)"
+
+if [[ -n "${violations}" ]]; then
+  echo "forbidden Hawk imports found:"
+  echo "${violations}"
+  echo
+  echo "support repos must use hawk-core-contracts or local contracts, not hawk/internal or hawk/shared/types"
+  exit 1
+fi
+
+echo "ecosystem boundary guard passed"