Keep BINCLUSIVE.md in sync in CI

b8e gen renders BINCLUSIVE.md from binclusive.json and injects a pointer to it into AGENTS.md/CLAUDE.md. Because BINCLUSIVE.md is generated, it drifts the moment someone edits binclusive.json and forgets to regenerate — or hand-edits the generated file directly.

gen needs a credential, the same as every other b8e command. Sign in with b8e auth login locally; on a runner the credential is BINCLUSIVE_API_KEY. Without one the command exits 7 and never renders anything to compare.

If you want CI to catch that drift, run b8e gen --check as a build step:

b8e gen --check

--check re-renders the contract in memory, compares it against BINCLUSIVE.md and the injected pointer on disk, writes nothing, and exits non-zero if either has drifted. A passing check proves the committed files match binclusive.json — a failing one does not, on its own, prove drift: read the exit code first.

Wire it into a workflow

Add it as its own step so a red check names drift specifically, and give it the credential:

- run: b8e gen --check
  env:
    BINCLUSIVE_API_KEY: ${{ secrets.BINCLUSIVE_API_KEY }}

Omit that env block and the step exits 7 — “not authenticated”, not “your docs drifted”. The two failures look alike from a red check mark and have nothing to do with each other, so read the exit code before you go regenerate anything:

• 7 — no credential. The check never ran; add the secret.
• 1 — real drift. The committed files no longer match what gen produces. The fix is below.
• 2 or higher — gen itself failed. Nothing was compared; read the error.

When the check fails on real drift, the fix is local — regenerate and commit:

b8e gen
git add BINCLUSIVE.md AGENTS.md CLAUDE.md
git commit -m "chore: regenerate BINCLUSIVE.md"

Point b8e gen --check at a subdirectory by passing its path if binclusive.json does not live at the repository root:

b8e gen --check ./packages/app

For the owned-file and pointer model, see the gen reference.