chore(privacy): stop publishing absolute home paths

config/portfolio-catalog.yaml

@@ -86,7 +86,7 @@ repos:
     maturity_program: maintain
     target_maturity: operating
     doctor_standard: full
-    notes: Owns Raycast script commands, active-project verification routing, read-only ops snapshots, and mirrored Codex operating-layer prompt/eval snapshots for /Users/d.
+    notes: Owns Raycast script commands, active-project verification routing, read-only ops snapshots, and mirrored Codex operating-layer prompt/eval snapshots for ~.
   agent-bridge:
     owner: d
     purpose: local SQLite-backed MCP shared-state bus for coordinating coding agents
@@ -644,7 +644,7 @@ repos:
     operating_path: maintain
     tool_provenance: claude-code
     maturity_program: maintain
-    notes: Archived from active operator attention on 2026-06-13. The corrupt local checkout was preserved at /Users/d/Projects/GhostRoutes.corrupt-20260613T124820Z and /Users/d/Projects/GhostRoutes was restored from a fresh origin clone. Keep this repo archived/deferred unless explicitly reactivated.
+    notes: Archived from active operator attention on 2026-06-13. The corrupt local checkout was preserved at ~/Projects/GhostRoutes.corrupt-20260613T124820Z and ~/Projects/GhostRoutes was restored from a fresh origin clone. Keep this repo archived/deferred unless explicitly reactivated.
   Liminal:
     owner: d
     purpose: focused atmospheric iOS experience being finished as an Oddworks release

config/project-registry-overrides.json

@@ -20,7 +20,7 @@
 			"repo_full_name": null,
 			"group_key": "operator_infra",
 			"lifecycle_state": "manual-only",
-			"note": "Machine-wide Claude Code harness operating surface under /Users/d/.claude; tracked as shipped/monitor-only, not a standalone repo."
+			"note": "Machine-wide Claude Code harness operating surface under ~/.claude; tracked as shipped/monitor-only, not a standalone repo."
 		},
 		{
 			"canonical_key": "supp:personal-ops",
@@ -36,15 +36,15 @@
 			"repo_full_name": "saagpatel/operator-scripts",
 			"group_key": "operator_infra",
 			"lifecycle_state": "active",
-			"note": "Private scheduled-job scripts repository rooted at /Users/d/scripts, outside the default /Users/d/Projects audit scan."
+			"note": "Private scheduled-job scripts repository rooted at ~/scripts, outside the default ~/Projects audit scan."
 		},
 		{
 			"canonical_key": "supp:SecondBrain",
 			"display_name": "SecondBrain",
 			"repo_full_name": null,
 			"group_key": "operator_infra",
 			"lifecycle_state": "active",
-			"note": "4-layer knowledge vault at /Users/d/Documents/SecondBrain (engraph-indexed). Not a git repo; absent from auditor."
+			"note": "4-layer knowledge vault at ~/Documents/SecondBrain (engraph-indexed). Not a git repo; absent from auditor."
 		}
 	],
 	"memory_meta": {
@@ -79,7 +79,7 @@
 		"app": "local runtime/app shell placeholder; not a portfolio-truth repo",
 		"RAG Knowledge Base": "notion planning row; not a portfolio-truth repo",
 		"Sandbox Local Portfolio Project": "actuation sandbox fixture row",
-		"SecondBrain": "knowledge vault under /Users/d/Documents; not a /Users/d/Projects repo"
+		"SecondBrain": "knowledge vault under ~/Documents; not a ~/Projects repo"
 	},
 	"notion_truth_shadow_rows": {
 		"agent-bridge-launch": "agent-bridge",

docs/demo-proof/2026-06-07/README.md

@@ -2,7 +2,7 @@
 
 Durable screenshot proof for the five-tab local PortfolioCommandCenter demo.
 
-Captured from `/Users/d/Projects/PortfolioCommandCenter` with:
+Captured from `~/Projects/PortfolioCommandCenter` with:
 
 ```sh
 pnpm demo:desktop

docs/demo-proof/2026-06-07/RECORDING-CHECKLIST.md

@@ -33,7 +33,7 @@ jq '{generated_at,decision}' "$latest_weekly"
 
 ## Preflight
 
-- [ ] Run from `/Users/d/Projects/PortfolioCommandCenter`:
+- [ ] Run from `~/Projects/PortfolioCommandCenter`:
   ```sh
   pnpm demo:desktop
   ```

docs/machine-wide-consolidation.md

@@ -1,21 +1,21 @@
 # Machine-Wide Consolidation
 
 This is the operating plan for reducing portfolio-scale attention drag across
-`/Users/d/Projects` and adjacent Codex operating repos.
+`~/Projects` and adjacent Codex operating repos.
 
 ## Current Packet
 
 Run this first in new Codex sessions:
 
 ```sh
-cd /Users/d/Projects/GithubRepoAuditor
+cd ~/Projects/GithubRepoAuditor
 python -m github_repo_auditor.codex_restart_packet --workspace-root "$HOME/Projects"
 ```
 
 The packet combines:
 
 - latest `output/portfolio-truth-latest.json`
-- live git state for `/Users/d/Projects`
+- live git state for `~/Projects`
 - live git state for adjacent operating repos such as `personal-ops` and
   `.codex/codexkit`
 - archive/dependency/temp exclusions so old cleanup waves do not reappear as
@@ -37,14 +37,14 @@ jq '{generated_at,total:(.projects|length),counts:.source_summary.attention_stat
    forensics or fixture maintenance.
 3. Resolve dirty operating repos before lower-signal product drift. The usual
    operating set is:
-   - `/Users/d/.local/share/personal-ops`
-   - `/Users/d/.codex/codexkit`
-   - `/Users/d/Projects/GithubRepoAuditor`
-   - `/Users/d/Projects/PortfolioCommandCenter`
-   - `/Users/d/Projects/Notion`
-   - `/Users/d/Projects/bridge-db`
-   - `/Users/d/Projects/notification-hub`
-   - `/Users/d/Projects/mcpforge`
+   - `~/.local/share/personal-ops`
+   - `~/.codex/codexkit`
+   - `~/Projects/GithubRepoAuditor`
+   - `~/Projects/PortfolioCommandCenter`
+   - `~/Projects/Notion`
+   - `~/Projects/bridge-db`
+   - `~/Projects/notification-hub`
+   - `~/Projects/mcpforge`
 4. Convert broad repo drift into decisions:
    - active now
    - verify and land

docs/plans/2026-05-29-run-instructions-external-audit-plan.md

@@ -291,9 +291,9 @@ def test_build_record_resolves_path_and_primary():
             "run_instructions_present": False,
         },
     }
-    record = build_record(project, "/Users/d/Projects")
+    record = build_record(project, "~/Projects")
 
-    assert record["abs_path"] == "/Users/d/Projects/Fun:GamePrjs/BattleGrid"
+    assert record["abs_path"] == "~/Projects/Fun:GamePrjs/BattleGrid"
     assert record["primary_file_name"] == "AGENTS.md"   # no CLAUDE.md → AGENTS.md
     assert record["snapshot_claim"] is False
     assert record["context_files"] == ["AGENTS.md", "README.md"]

docs/plans/2026-05-29-run-instructions-external-audit.md

@@ -57,7 +57,7 @@ are exactly what an LLM reading the prose catches and a regex never will.
 
 - `schema_version`: `0.4.0`
 - `generated_at`: `2026-05-17T05:01:39Z` (**12 days stale as of this spec — drift is real, see §8**)
-- `workspace_root`: `/Users/d/Projects`
+- `workspace_root`: `~/Projects`
 - `projects`: 132 (a list; key on `identity.project_key`, **not** `display_name` — dupes exist:
   `IncidentWorkbench`, `OrbitForge`, `StatusPage`)
 - `context_quality_counts`: `none: 3, boilerplate: 17, minimum-viable: 66, standard: 27, full: 19`
@@ -168,7 +168,7 @@ Main session writes the report to `output/run-instructions-audit-2026-05-29.md`.
 {
   "project_key": "Fun:GamePrjs/BattleGrid",
   "display_name": "BattleGrid",
-  "abs_path": "/Users/d/Projects/Fun:GamePrjs/BattleGrid",
+  "abs_path": "~/Projects/Fun:GamePrjs/BattleGrid",
   "primary_file_name": "AGENTS.md",
   "snapshot_claim": false,
   "tool_today": false,

docs/plans/2026-06-14-portfolio-attention-reconciliation.md

@@ -8,12 +8,12 @@ This note records the narrow truth update from the 2026-06-14 portfolio attentio
 
 - `bridge-db` is cataloged as `infrastructure` so generated portfolio truth resolves it as `active-infra`. Its repo-local docs still define it as scope-closed steady maintenance, so weekly attention should surface only concrete bridge, sync, health, or cross-system state decisions.
 - `notification-hub` is cataloged as `infrastructure` so generated portfolio truth resolves it as `active-infra`. Runtime or operator-signal claims still require fresh read-only verification before they drive work.
-- `AIGCCore` repo-local canonical paths were aligned to `/Users/d/Projects/MoneyPRJsViaGPT/AIGCCore`, matching the live checkout and the portfolio truth path.
+- `AIGCCore` repo-local canonical paths were aligned to `~/Projects/MoneyPRJsViaGPT/AIGCCore`, matching the live checkout and the portfolio truth path.
 
 ## Deferred Decisions
 
 - `AIGCCore` remains active infrastructure. The snapshot's Notion advisory still says `Archive` / `Archived`, but archiving or changing lifecycle/disposition requires explicit operator approval.
-- `personal-ops` remains supplementary registry evidence, not a first-class portfolio truth row. Adding it to portfolio truth requires explicit operator approval because it lives outside `/Users/d/Projects` and would widen the registry contract.
+- `personal-ops` remains supplementary registry evidence, not a first-class portfolio truth row. Adding it to portfolio truth requires explicit operator approval because it lives outside `~/Projects` and would widen the registry contract.
 
 ## Verification
 
@@ -42,7 +42,7 @@ Expected state:
 - A non-publishing build with `include_notion=False` validated the catalog logic: `bridge-db`, `notification-hub`, and `AIGCCore` all resolved to `category=infrastructure` and `attention_state=active-infra`; snapshot validation reported no warnings.
 - `uv run pytest -q tests/test_portfolio_truth.py tests/test_catalog_validator.py`: 56 passed, 1 deprecation warning from a legacy CLI invocation test.
 - `uv run ruff check .`: passed.
-- AIGCCore path cleanup was checked with `rg -n "/Users/d/Projects/AIGCCore" /Users/d/Projects/MoneyPRJsViaGPT/AIGCCore/AGENTS.md`; no stale matches remained.
+- AIGCCore path cleanup was checked with `rg -n "~/Projects/AIGCCore" ~/Projects/MoneyPRJsViaGPT/AIGCCore/AGENTS.md`; no stale matches remained.
 
 ## 2026-06-19 Publish Result
 

docs/plans/2026-06-19-notion-projection-reconciliation.md

@@ -9,7 +9,7 @@
 - Legacy audit report: `output/audit-report-saagpatel-2026-06-19.json`
   - `generated_at`: `2026-06-19T07:46:41.857483+00:00`
   - audited repo count: 149
-- Local Notion projection snapshot after approved row creation: `/Users/d/.local/share/notion-os/project-snapshot.json`
+- Local Notion projection snapshot after approved row creation: `~/.local/share/notion-os/project-snapshot.json`
   - generated on 2026-06-19
   - project count: 143
 - `cross-system-smoke` `contract-health` now passes.
@@ -107,14 +107,14 @@ from portfolio truth's repo set. They are not all the same kind of drift.
 
 | Audit-only repo | Verified evidence | Classification | Recommended disposition |
 | --- | --- | --- | --- |
-| `saagpatel/ApplyKit-private-archive-20260517` | Local `/Users/d/Projects/ApplyKit` exists. Local `origin` points to `ApplyKit-private-archive-20260517`; `legacy-origin` points to `ApplyKit`. Portfolio truth now tracks `saagpatel/ApplyKit`, so the remaining audit-only repo is the private archive identity. | private archive mirror | Keep outside portfolio truth. Optional future repo-config cleanup: rename or demote the archive remote so local git configuration is less misleading, but do not create a Local Portfolio Project row. |
-| `saagpatel/GithubRepoAuditor-private-archive-20260518` | Local `/Users/d/Projects/GithubRepoAuditor` exists. Local `canonical` points to `GithubRepoAuditor`; `origin` points to `GithubRepoAuditor-private-archive-20260518`. Portfolio truth now tracks `saagpatel/GithubRepoAuditor`, so the remaining audit-only repo is the private archive identity. | private archive mirror | Keep outside portfolio truth. Optional future repo-config cleanup: make the public canonical remote the less surprising local default if approved, but no truth or Notion row action is needed. |
+| `saagpatel/ApplyKit-private-archive-20260517` | Local `~/Projects/ApplyKit` exists. Local `origin` points to `ApplyKit-private-archive-20260517`; `legacy-origin` points to `ApplyKit`. Portfolio truth now tracks `saagpatel/ApplyKit`, so the remaining audit-only repo is the private archive identity. | private archive mirror | Keep outside portfolio truth. Optional future repo-config cleanup: rename or demote the archive remote so local git configuration is less misleading, but do not create a Local Portfolio Project row. |
+| `saagpatel/GithubRepoAuditor-private-archive-20260518` | Local `~/Projects/GithubRepoAuditor` exists. Local `canonical` points to `GithubRepoAuditor`; `origin` points to `GithubRepoAuditor-private-archive-20260518`. Portfolio truth now tracks `saagpatel/GithubRepoAuditor`, so the remaining audit-only repo is the private archive identity. | private archive mirror | Keep outside portfolio truth. Optional future repo-config cleanup: make the public canonical remote the less surprising local default if approved, but no truth or Notion row action is needed. |
 | `saagpatel/GithubRepoAuditor-scrubbed-import-20260518` | No direct local path. Private repo, no explicit catalog entry, same description/topics as GithubRepoAuditor. | import/scrub mirror | Keep outside portfolio truth. Consider upstream archive after confirming it is no longer needed for import provenance. |
-| `saagpatel/SecondBrain` | Local path is `/Users/d/Documents/SecondBrain`, outside `/Users/d/Projects`. Project registry already has `supp:SecondBrain` and Notion projection-only treatment. | supplementary non-Projects knowledge vault | Keep outside portfolio truth unless the operator explicitly widens truth beyond `/Users/d/Projects`. Optional future registry cleanup: add repo metadata to supplementary evidence without making it first-class truth. |
-| `saagpatel/personal-ops` | Local path is `/Users/d/.local/share/personal-ops`, outside `/Users/d/Projects`. Prior reconciliation explicitly keeps it supplementary unless approved. | supplementary non-Projects control plane | Keep outside portfolio truth without explicit operator approval. It can remain supplementary registry evidence. |
-| `saagpatel/codexkit` | Local path is `/Users/d/.codex/codexkit`, outside `/Users/d/Projects`; dirty local operating-layer repo. | supplementary Codex operating surface | Keep outside portfolio truth by default. If promoted later, treat as local operating-system state, not normal product work. |
-| `saagpatel/claude-code-workstation-bootstrap` | Local path is `/Users/d/claude-code-workstation-bootstrap`, outside `/Users/d/Projects`; bootstrap branch. | workstation bootstrap/support repo | Keep outside portfolio truth. Archive or mark manual-only upstream if it should stop appearing in legacy audit attention. |
-| `saagpatel/portfolio-actuation-sandbox` | Local path is `/Users/d/portfolio-actuation-sandbox`, outside `/Users/d/Projects`; sandbox fixture repo with local dirty files. | actuation sandbox fixture | Keep outside portfolio truth. It is already represented as a Notion projection-only sandbox row, not a portfolio project. |
+| `saagpatel/SecondBrain` | Local path is `~/Documents/SecondBrain`, outside `~/Projects`. Project registry already has `supp:SecondBrain` and Notion projection-only treatment. | supplementary non-Projects knowledge vault | Keep outside portfolio truth unless the operator explicitly widens truth beyond `~/Projects`. Optional future registry cleanup: add repo metadata to supplementary evidence without making it first-class truth. |
+| `saagpatel/personal-ops` | Local path is `~/.local/share/personal-ops`, outside `~/Projects`. Prior reconciliation explicitly keeps it supplementary unless approved. | supplementary non-Projects control plane | Keep outside portfolio truth without explicit operator approval. It can remain supplementary registry evidence. |
+| `saagpatel/codexkit` | Local path is `~/.codex/codexkit`, outside `~/Projects`; dirty local operating-layer repo. | supplementary Codex operating surface | Keep outside portfolio truth by default. If promoted later, treat as local operating-system state, not normal product work. |
+| `saagpatel/claude-code-workstation-bootstrap` | Local path is `~/claude-code-workstation-bootstrap`, outside `~/Projects`; bootstrap branch. | workstation bootstrap/support repo | Keep outside portfolio truth. Archive or mark manual-only upstream if it should stop appearing in legacy audit attention. |
+| `saagpatel/portfolio-actuation-sandbox` | Local path is `~/portfolio-actuation-sandbox`, outside `~/Projects`; sandbox fixture repo with local dirty files. | actuation sandbox fixture | Keep outside portfolio truth. It is already represented as a Notion projection-only sandbox row, not a portfolio project. |
 | `saagpatel/app` | GitHub repo is private and archived; no local direct path. Name collides with existing projection-only Local Portfolio placeholder `app`, but audit description is an archived SwiftUI app. | archived generic app repo | Keep outside portfolio truth. No Local Portfolio row; no action unless upstream archive hygiene is being cleaned. |
 | `saagpatel/hermes-agent` | GitHub audit marks it as a fork; no local direct path; no explicit catalog entry. | fork/upstream-derived repo | Keep outside portfolio truth. Archive/delete decision is upstream GitHub hygiene, not portfolio truth work. |
 | `saagpatel/agent-harness-hardening` | Public repo, no direct local path, no explicit catalog entry; sanitized hardening artifact. | published support artifact | Keep outside portfolio truth unless it becomes an active infra project with a local operating root. |
@@ -190,7 +190,7 @@ Approval-gated:
 3. If more approved rows are needed later, use the scoped Notion command:
 
 ```bash
-cd /Users/d/Projects/Notion
+cd ~/Projects/Notion
 npm run portfolio-audit:create-local-project-rows-from-truth -- \
   --today 2026-06-19 \
   --project-title <exact truth display name>

output/doc-truth-up-full-2026-05-30.log

@@ -81,5 +81,5 @@ doc-truth-up batch · 80 repo(s) · tier=2 · model=sonnet · concurrency=8 · E
 [80/80] mcpforge → ran
 
 Done. {'skipped': 31, 'already_done': 6, 'ran': 43}
-Results: /Users/d/Projects/GithubRepoAuditor/output/doc-truth-up-run-2026-05-30.json
+Results: ~/Projects/GithubRepoAuditor/output/doc-truth-up-run-2026-05-30.json
 Review each repo's docs/truth-up-* branch, then merge or delete. Nothing was pushed.