Repository navigation
Every member's own .gitignore now keeps an agent tool's local settings out of the repository. Such a tool writes each command a person allowed it to run unasked into .claude/settings.local.json, and a command allowed with a secret on its line keeps the secret there; an ignore kept on one machine does not travel with a clone. sync appends **/.claude/settings.local.json to the member's .gitignore under one comment and leaves the rest of the file the member's, and check fails where the line is missing or the file is tracked, naming the file and saying to rotate what it held (#129). WORKING.md adds that a secret is never written into a command; the command reads it from the environment or the keychain. The reusable check's marker and the AGENTS.md header name v1.57.0 (#130).
What breaks. Nothing for a member that re-syncs: the sync writes the line. A member that has committed the settings file fails check until it is removed with git rm --cached and its secrets are rotated; no member has.
How to take it. conventions.json to v1.57.0, the workflow reference check.yml@v1.57.0, and sh conventions/conventions-sync sync, then commit the .gitignore change with the rest. On the owner's word, every member re-syncs to it.
Verified: sh test/run.sh, conventions-check and conventions-format pass on the release commit.