docs: add sensitive data protection rule + tool evaluation draft

- CLAUDE.md: add Sensitive Data Protection section documenting
  the hook-based private tag behavior for .env reads
- drafts/tool-evaluation/linkedin.md: LinkedIn post draft from
  claude-mem evaluation session (stochastic consensus + council methodology)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: nammnjoshii

CLAUDE.md

@@ -8,6 +8,17 @@ Your job is to implement, maintain, and extend this pipeline correctly. Every ac
 
 ---
 
+## Sensitive Data Protection (Automatic)
+
+A Claude Code hook fires automatically before any `.env` file read and emits a `SENSITIVE FILE DETECTED` warning. When that warning appears:
+
+- Wrap ALL displayed content in `<private>...</private>` tags immediately.
+- Do not echo raw API key values in responses, diffs, or logs.
+- Keys in scope: `ANTHROPIC_API_KEY`, `RESEND_API_KEY`, `SERPAPI_KEY`, `HUNTER_API_KEY`.
+- This applies even when no warning fires — treat `.env` content as private by default.
+
+---
+
 ## Non-Negotiable Rules
 
 **Read `docs/operation/antipatterns.md` before any code change. It overrides all other files on conflict.**

drafts/tool-evaluation/linkedin.md

@@ -0,0 +1,59 @@
+# Draft: Tool Evaluation via Stochastic Multi-Agent Consensus + Consciousness Council
+
+**Platform:** LinkedIn
+**Target:** Technical operators, AI engineers, senior PMs running AI-assisted workflows
+**Hook:** Most people install dev tools in 5 minutes. I used 11 AI agents first.
+
+---
+
+## Post Draft
+
+Most engineers evaluate a new dev tool the same way: read the README, skim the issues, run the install command.
+
+That works fine for low-stakes tools. Not for tools that touch every session, capture everything you do, and inject context into every future conversation.
+
+For claude-mem — a persistent memory compression system for Claude Code — I ran two rounds of structured AI deliberation before installing anything.
+
+**Round 1: Stochastic Multi-Agent Consensus**
+
+Five independent agents. Same question. Different temperature framings. Zero shared context between them.
+
+Operational Efficiency Analyst. Systems Architect. Developer Experience Expert. Risk Analyst. Creative Explorer.
+
+Each generated its own take on the value of the tool. Then I aggregated by semantic clustering — which ideas appeared across multiple agents independently?
+
+Two use cases hit 0.80 confidence (4 of 5 agents agreed without seeing each other):
+- Cold-start elimination: every session currently wastes 10-15 minutes re-establishing context that died at the last session boundary
+- Automatic incident context capture: when a test breaks in session N+1, the observation log from session N is recoverable
+
+One insight hit 0.60: the tool creates a two-layer memory architecture (episodic + semantic) that didn't exist before.
+
+**Round 2: Consciousness Council**
+
+Six roles. Tech and business. Genuine conflict required.
+
+Security Engineer. Platform Lead. DevOps Engineer. Token Budget Analyst. Program Manager. Staff Engineer/Skeptic.
+
+The consensus had missed something the Security Engineer caught immediately: the default posture of the tool is capture-everything unless you opt out. Nobody had asked "what's the sensitive perimeter and how do you exclude it?"
+
+That's the Blind Spot the council is designed to surface — the question behind the question.
+
+The council produced a 7-step install path with a core tension named: do you trust third-party AI summaries of your work enough to let them influence your session context automatically, or do you use the search tools explicitly and keep automatic injection off?
+
+**What this changes:**
+
+Tool evaluation isn't a README read. It's a structured decision with technical, security, and business dimensions that don't all show up in the same place.
+
+The stochastic consensus tells you what the tool is actually good for — with a confidence score.
+
+The council tells you how to implement it safely — with a named tension and a blind spot.
+
+Neither alone is sufficient. Together they cost about 20 minutes and surface everything a solo assessment misses.
+
+The install took 3 minutes. The evaluation took 20. The evaluation was worth it.
+
+---
+
+**Title:** How I evaluated a new dev tool with 11 AI agents before installing it
+**Hook:** Most people install dev tools in 5 minutes. I used 11 AI agents first.
+**Why it matters:** Reusable methodology for any tool evaluation with multi-dimensional trade-offs — applicable well beyond AI tooling