Initialize FileMaker AI core

docs/ddr-workflow.md

@@ -0,0 +1,19 @@
+# DDR Workflow
+
+Raw DDR is generated input and belongs beside the client project, outside the AI workspace Git repository. Parsed DDR is useful for diffs and analysis, but only after a security review.
+
+## Portable project layout
+
+```text
+<client>/<project>/
+  ddr/
+    dev/
+    prod/
+    archive/
+  <project>-ai/
+    DDR-Parsed/
+```
+
+Projects should store relative source definitions, not absolute workstation paths. A future parser wrapper must validate the source, parse into a temporary directory, run redaction checks, and only then update `DDR-Parsed/`.
+
+Do not enable automatic commits from the parser. Review the sanitized diff before committing it.

docs/project-contract.md

@@ -0,0 +1,23 @@
+# Project Contract
+
+Every client AI workspace owns its client context. Keep the project root small, explicit, and safe to open directly in VS Code.
+
+## Project-owned material
+
+- client name and project scope
+- confirmed business rules and decisions
+- tickets, project notes, and approved analysis
+- sanitized parsed DDR
+- FileMaker work scripts and project-specific prompts
+- the location and environment names of raw DDR exports
+
+## Core-owned material
+
+- generic FileMaker analysis and scripting workflow
+- reusable prompts and templates
+- generic DDR handling and secret-safety guidance
+- client-neutral helper scripts
+
+## Instruction precedence
+
+When guidance conflicts, preserve project evidence and confirmed client decisions. A project may opt into an additional organization-specific standard without applying it to other clients.

docs/security-and-redaction.md

@@ -0,0 +1,13 @@
+# Security and Redaction
+
+Private Git hosting does not make secrets safe to commit. FileMaker DDR can expose credentials through custom functions, calculations, scripts, data sources, and integration settings.
+
+Before a parsed DDR is committed or shared:
+
+1. Scan for private keys, tokens, passwords, client secrets, API keys, and connection strings.
+2. Redact values deterministically while retaining the object name and enough structure for analysis.
+3. Review the resulting diff.
+4. Rotate any active credential that may have entered Git history.
+5. Keep raw DDR and original secret-bearing exports outside Git.
+
+Never add a real secret to this core repository, examples included.