Good question. The checkpoint script runs `git add -A && git commit` on the workspace — so it stages everything that's tracked or new. The guardrails are in .gitignore (logs/, /tmp files, .env, credentials) and the workspace structure itself: secrets live in 1Password, not files. Logs go to a dedi...