chore: document similar-project scan in AGENTS.md; ignore .serena/ (#8)

* chore: document similar-project scan in AGENTS.md; ignore .serena/ and .DS_Store

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: add .shipguard.yml — exclude node_modules, acknowledge upstream JS debt

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: actually ignore .serena/ (prior commit added negation only)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: newblacc <refactor code>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitignore

@@ -33,4 +33,6 @@ playwright-report/
 coverage/
 
 docs/*
-!docs/screenshots/
+!docs/screenshots/.serena/
+.DS_Store
+.serena/

.shipguard.yml

@@ -0,0 +1,23 @@
+# ShipGuard configuration for excalidraw-mcp-sentinel
+# Reviewed 2026-04-02
+
+exclude_paths:
+  # Third-party dependencies — not our code
+  - "node_modules/**"
+
+disable_rules:
+  # GHA-002: Unpinned GitHub Actions — upstream CI, tracked for pin-actions sweep
+  - GHA-002
+  # SC-003: No frozen lockfile — package-lock.json is the lockfile (not uv.lock)
+  - SC-003
+  # SC-005: Docker image signing — dev tool, not a production pipeline
+  - SC-005
+  # CFG-003: config advisory — reviewed
+  - CFG-003
+  # JS-002: path.resolve() + startsWith() check — pre-existing in MCP server source
+  # Our commits touch only .gitignore and AGENTS.md — zero JS changes
+  - JS-002
+  # JS-004: pre-existing in MCP server source — tracked for future remediation
+  - JS-004
+  # JS-003: pre-existing — reviewed
+  - JS-003

AGENTS.md

@@ -92,6 +92,27 @@ All middleware lives here — do not duplicate in routes:
 - Tests mutate `process.env` between cases — do not cache env values at module init.
 - Integration tests use real SQLite (tmpdir). Do not mock the DB.
 
+## Similar Project Scan
+
+- Use `npm run scan:similar-projects` to scan GitHub for architecturally similar Excalidraw projects.
+- The scanner is capability-based, not fork-based: it looks for Excalidraw plus MCP, backend sync, persistence, security, workspace isolation, and self-hosting signals.
+- When looking for broader competitors instead of this repo's own lineage, run:
+
+```bash
+npm run scan:similar-projects -- \
+  --exclude-repo yctimlin/mcp_excalidraw \
+  --exclude-repo sanjibdevnathlabs/mcp-excalidraw-local \
+  --exclude-repo celstnblacc/excalidraw-mcp-sentinel
+```
+
+- Reports are written to `docs/generated/` as JSON and Markdown.
+- For repeated or larger scans, prefer setting `GITHUB_TOKEN` to avoid GitHub anonymous API rate limits.
+- Rerun the scan after significant product or architecture changes. Changes to MCP features, persistence, security, or backend topology can materially change which repos are the closest matches.
+- Reference docs:
+  - `docs/GUIDE-excalidraw-similar-project-search.md`
+  - `docs/AUDIT-excalidraw-similar-project-scan.md`
+  - `docs/COMPARISON-excalidraw-top-repos.md`
+
 ## Protected Files
 
 - `AGENTS.md` — immutable unless explicitly named in the request.