chore: tighten org profile policy checks

.github/workflows/policy-check.yml

@@ -0,0 +1,14 @@
+name: Profile Policy Check
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  policy-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run profile policy checks
+        run: bash scripts/check-policy.sh

AGENTS.md

@@ -37,7 +37,7 @@ or infrastructure change.
 ## Backend Quick Reference
 
 - API base: `https://loop-api.urbnia.com`
-- Health: `/api/health`
+- Health: `/health`
 - Metrics: `/api/metrics`
 - Interest list: `/api/interest`
 - Interest SSE: `/api/interest/stream`
@@ -135,4 +135,3 @@ only `alpha912` should merge.
 ## Security
 
 Never commit secrets or credentials. Keep `.env` files local only.
-

CLAUDE.md

@@ -14,7 +14,7 @@ Keep it in sync with AGENTS.md.
 
 - Public site: `https://local-loop-io.github.io`
 - Backend API: `https://loop-api.urbnia.com`
-- Deprecated / invalid: `api.local-loop.io`
+- `api.local-loop.io` does not exist
 
 ## VPS / Traefik
 
@@ -30,7 +30,7 @@ docker compose up -d --build
 
 ## API Endpoints
 
-- `/api/health`
+- `/health`
 - `/api/metrics`
 - `/api/interest`
 - `/api/interest/stream` (SSE)
@@ -60,4 +60,3 @@ Update `DOMAIN-POLICY.md` and domain check scripts if domains change.
 ## Claims Policy
 
 No public pilots or deployments. Keep all outward messaging “lab demo only.”
-

scripts/check-policy.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT_DIR"
+
+fail=0
+
+if rg -n "/api/health" AGENTS.md CLAUDE.md README.md profile/README.md; then
+  echo "Found stale /api/health reference; use /health." >&2
+  fail=1
+fi
+
+if rg -n "api\\.local-loop\\.io" AGENTS.md CLAUDE.md README.md profile/README.md | rg -vi "not.*exist|does not exist"; then
+  echo "Found non-canonical api.local-loop.io wording." >&2
+  fail=1
+fi
+
+exit "$fail"