name: G12 Leak-Guard

# Hard gate for INV-G12 (docs/spec/X15 §4 / R4): the intelligence layer
# (mcp-server/src) must stay free of Paperclip-specific symbols, and only
# web/agent_platform_port.py may import the Paperclip client. Pure-stdlib check
# (no venv) — fast, runs on every PR and on push to main.

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  leak-guard:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: G12 — Agent Platform Port leak-guard
        run: python3 scripts/leak_guard.py