chore: align ecosystem architecture

.github/PULL_REQUEST_TEMPLATE.md

@@ -34,8 +34,8 @@
 
 <!--
   falcon must never import hawk-eco dependencies. Confirm this PR
-  does not add any imports of `hawk`, `eyrie`, `yaad`, `tok`, `trace`,
-  `sight`, `inspect`, `eagle`, or any SDK.
+  does not add any imports of `hawk`, `eyrie`, `harrier`, `shrike`, `swift`,
+  `kestrel`, `merlin`, `eagle`, or any SDK.
 -->
 
 ## Testing

.github/workflows/scorecard.yml

@@ -0,0 +1,42 @@
+name: Scorecard
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '37 9 * * 1'
+  push:
+    branches: [main]
+
+permissions:
+  security-events: write
+  id-token: write
+  contents: read
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: scorecard-results.sarif
+          results_format: sarif
+          publish_results: false
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: SARIF file
+          path: scorecard-results.sarif
+          retention-days: 5
+
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        with:
+          sarif_file: scorecard-results.sarif

AGENTS.md

@@ -59,7 +59,7 @@ This project is indexed by GitNexus as **falcon** (106 symbols, 207 relationship
 | `gitnexus://repo/falcon/context` | Codebase overview, check index freshness |
 | `gitnexus://repo/falcon/clusters` | All functional areas |
 | `gitnexus://repo/falcon/processes` | All execution flows |
-| `gitnexus://repo/falcon/process/{name}` | Step-by-step execution trace |
+| `gitnexus://repo/falcon/process/{name}` | Step-by-step execution swift |
 
 ## CLI
 

CHANGELOG.md

@@ -13,7 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
-- Dead `MCPGraph`, `MCPNode`, `MCPEdge`, and `NewMCPGraph` graph types (`graph.go`): zero references in mcpkit or any ecosystem consumer (yaad, sight, inspect, hawk). `AddGraphResource`/`GraphMIMEType` are unaffected.
+- Dead `MCPGraph`, `MCPNode`, `MCPEdge`, and `NewMCPGraph` graph types (`graph.go`): zero references in mcpkit or any ecosystem consumer (harrier, kestrel, merlin, hawk). `AddGraphResource`/`GraphMIMEType` are unaffected.
 - Unused `fmt` import held alive by a `var _ = fmt.Sprintf` placeholder in `vault.go`.
 
 ### Changed

CLAUDE.md

@@ -28,7 +28,7 @@ This project is indexed by GitNexus as **falcon** (106 symbols, 207 relationship
 | `gitnexus://repo/falcon/context` | Codebase overview, check index freshness |
 | `gitnexus://repo/falcon/clusters` | All functional areas |
 | `gitnexus://repo/falcon/processes` | All execution flows |
-| `gitnexus://repo/falcon/process/{name}` | Step-by-step execution trace |
+| `gitnexus://repo/falcon/process/{name}` | Step-by-step execution swift |
 
 ## CLI
 

CONTRIBUTING.md

@@ -69,7 +69,7 @@ CHANGE:` in the footer. This triggers a major version bump.
 ## Ecosystem boundaries
 
 falcon is a **foundation repo** — it must never import `hawk`, any
-engine (`eyrie`, `yaad`, `tok`, `trace`, `sight`, `inspect`), any SDK, or
+engine (`eyrie`, `harrier`, `shrike`, `swift`, `kestrel`, `merlin`), any SDK, or
 `eagle`. Its only non-stdlib dependency is upstream
 `mark3labs/mcp-go`. Run `make boundaries` (also run in CI) to verify.
 

Makefile

@@ -1,6 +1,6 @@
 # Canonical hawk-eco Makefile for Go LIBRARY repos.
 # Source of truth: https://github.com/GrayCodeAI/hawk/blob/main/.shared-templates/Makefile.library.tmpl
-# falcon is a foundation library consumed by engines (sight, inspect);
+# falcon is a foundation library consumed by engines (kestrel, merlin);
 # no standalone binary, no release beyond tagging.
 
 # ---------------------------------------------------------------------------

README.md

@@ -4,7 +4,7 @@ Shared MCP server scaffolding for the hawk ecosystem.
 
 `mcpkit` wraps [`mark3labs/mcp-go`](https://github.com/mark3labs/mcp-go) with
 the construction, transports, and handler helpers that every hawk-ecosystem
-engine (`inspect`, `sight`, ...) would otherwise duplicate. Repos declare their
+engine (`merlin`, `kestrel`, ...) would otherwise duplicate. Repos declare their
 tools and handlers; mcpkit does the rest.
 
 **Tagline:** Shared MCP server scaffolding for the hawk ecosystem.
@@ -152,29 +152,29 @@ falcon is a **foundation repo** in the hawk-eco mono-ecosystem:
 | **falcon** | Shared MCP server scaffolding (this repo) |
 | **eagle** | Shared cross-repo contracts (types, tools, events, policy, review, verify, sessions) |
 | **eyrie** | LLM provider runtime — routing, streaming, retries, caching |
-| **yaad** | Graph-based persistent memory for coding agents |
-| **tok** | Tokenizer, compression, secrets scanning, rate limiting |
-| **sight** | Diff-based code review and static analysis |
-| **inspect** | Security audit library (CVE, API security, CI output) |
-| **trace** | Session capture and replay CLI |
+| **harrier** | Graph-based persistent memory for coding agents |
+| **shrike** | Tokenizer, compression, secrets scanning, rate limiting |
+| **kestrel** | Diff-based code review and static analysis |
+| **merlin** | Security audit library (CVE, API security, CI output) |
+| **swift** | Session capture and replay CLI |
 | **hawk** | AI coding agent (this repo) |
 
-Engines that serve MCP (`sight`, `inspect`) import `falcon`; it never
+Engines that serve MCP (`kestrel`, `merlin`) import `falcon`; it never
 imports them back.
 
 ## Ecosystem Boundaries
 
 Rules that keep this repo at the foundation layer:
 
 - **Zero hawk-eco dependencies.** This repo must never import `hawk`, any
-  engine (`eyrie`, `yaad`, `tok`, `trace`, `sight`, `inspect`), any SDK, or
+  engine (`eyrie`, `harrier`, `shrike`, `swift`, `kestrel`, `merlin`), any SDK, or
   `eagle`. Its only non-stdlib dependency is upstream
   `mark3labs/mcp-go`. `make boundaries` (also run in CI) enforces this with
   `scripts/check-ecosystem-boundaries.sh`.
 - **Implementation-free of product logic.** This repo holds MCP server
   scaffolding only — no hawk orchestration, no engine-specific behavior, no
   provider logic.
-- **Consumers, not dependents.** Engines that serve MCP (`sight`, `inspect`)
+- **Consumers, not dependents.** Engines that serve MCP (`kestrel`, `merlin`)
   import `falcon`; it never imports them back.
 
 If you need a hawk-ecosystem type here, that's a sign it belongs in the

docs/design/tool-catalog-notes.md

@@ -61,7 +61,7 @@ Key decisions, mapped onto existing code:
 
 Per the ecosystem architecture note, provider/protocol work lands in the
 shared library first and hawk consumes it. Every mcpkit consumer
-(`inspect`, `sight`) gets governed external tools for free; hawk adds only
+(`merlin`, `kestrel`) gets governed external tools for free; hawk adds only
 host UX (approval prompts, policy editing).
 
 ## Adoption path

mcpkit.go

@@ -1,5 +1,5 @@
 // Package mcpkit provides the shared scaffolding used by hawk-ecosystem
-// libraries (inspect, sight, ...) to expose their functionality as MCP
+// libraries (merlin, kestrel, ...) to expose their functionality as MCP
 // servers. It wraps github.com/mark3labs/mcp-go with the ecosystem's
 // standard construction, transports, and small handler helpers so that
 // individual repos only declare their tools and handlers.
@@ -40,7 +40,7 @@ type Server struct {
 // convention (tool + prompt + read-only, no resource-list-changed
 // updates). Pass extra mcpserver.ServerOptions to override — they are
 // applied after the defaults, so a later option wins over an earlier one.
-// This lets repos like yaad (which expose a resource *list* rather than a
+// This lets repos like harrier (which expose a resource *list* rather than a
 // set of subscribable resources) tailor behavior without forks.
 func New(name, version string, opts ...mcpserver.ServerOption) *Server {
 	base := []mcpserver.ServerOption{