fix: restore memory-parity guardrails and internal boundaries

Author: omoshola-o

.github/workflows/canonical-sister-guardrails.yml

@@ -0,0 +1,37 @@
+name: Canonical Sister Guardrails
+
+on:
+  push:
+    paths:
+      - "README.md"
+      - "INSTALL.md"
+      - "install.sh"
+      - "scripts/**"
+      - "docs/**"
+      - "src/**"
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/canonical-sister-guardrails.yml"
+  pull_request:
+    paths:
+      - "README.md"
+      - "INSTALL.md"
+      - "install.sh"
+      - "scripts/**"
+      - "docs/**"
+      - "src/**"
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/canonical-sister-guardrails.yml"
+
+jobs:
+  validate-canonical-sister:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install command guardrails
+        run: ./scripts/check-install-commands.sh
+      - name: Canonical sister guardrails
+        run: ./scripts/check-canonical-sister.sh

.github/workflows/canonical.yml

@@ -27,3 +27,17 @@ jobs:
         with:
           components: rustfmt
       - run: cargo fmt --all -- --check
+
+  guardrails:
+    name: Guardrails
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install command guardrails
+        run: bash scripts/check-install-commands.sh
+      - name: Canonical sister guardrails
+        run: bash scripts/check-canonical-sister.sh
+      - name: Runtime hardening guardrails
+        run: bash scripts/check-runtime-hardening.sh
+      - name: Primary problem regression
+        run: bash scripts/test-primary-problems.sh

.github/workflows/ci.yml

@@ -0,0 +1,37 @@
+name: Install Command Guardrails
+
+on:
+  push:
+    paths:
+      - "README.md"
+      - "INSTALL.md"
+      - "install.sh"
+      - "scripts/install.sh"
+      - "scripts/check-install-commands.sh"
+      - "docs/**"
+      - "src/**"
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/install-command-guardrails.yml"
+  pull_request:
+    paths:
+      - "README.md"
+      - "INSTALL.md"
+      - "install.sh"
+      - "scripts/install.sh"
+      - "scripts/check-install-commands.sh"
+      - "docs/**"
+      - "src/**"
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/install-command-guardrails.yml"
+
+jobs:
+  validate-install-surface:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run install guardrails
+        run: ./scripts/check-install-commands.sh

.github/workflows/hardening.yml

@@ -0,0 +1,33 @@
+name: Runtime Hardening Guardrails
+
+on:
+  push:
+    paths:
+      - "scripts/install.sh"
+      - "scripts/check-runtime-hardening.sh"
+      - "docs/ecosystem/CANONICAL_SISTER_KIT.md"
+      - "docs/public/ecosystem/CANONICAL_SISTER_KIT.md"
+      - "src/**"
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/runtime-hardening-guardrails.yml"
+  pull_request:
+    paths:
+      - "scripts/install.sh"
+      - "scripts/check-runtime-hardening.sh"
+      - "docs/ecosystem/CANONICAL_SISTER_KIT.md"
+      - "docs/public/ecosystem/CANONICAL_SISTER_KIT.md"
+      - "src/**"
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/runtime-hardening-guardrails.yml"
+
+jobs:
+  validate-runtime-hardening:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Runtime hardening guardrails
+        run: ./scripts/check-runtime-hardening.sh

.github/workflows/install-command-guardrails.yml

@@ -60,6 +60,8 @@ crates/agentic-forge-mcp/docs/
 crates/agentic-forge-mcp/scripts/
 
 # Internal / not for public repo
+CLAUDE.md
+sister.manifest.json
 
 # Claude Code
 .claude/

.github/workflows/install-test.yml

@@ -302,6 +302,7 @@ Profile variants:
 curl -fsSL https://agentralabs.tech/install/forge/desktop | bash    # Claude Desktop + Cursor
 curl -fsSL https://agentralabs.tech/install/forge/terminal | bash   # CLI only
 curl -fsSL https://agentralabs.tech/install/forge/server | bash     # Server mode with auth
+npm install @agenticamem/forge
 ```
 
 **Standalone guarantee:** AgenticForge operates fully standalone. No other sister, external service, or orchestrator is required.