diff --git a/.github/workflows/claude-card.yml b/.github/workflows/claude-card.yml
new file mode 100644
index 0000000..ca29bbb
--- /dev/null
+++ b/.github/workflows/claude-card.yml
@@ -0,0 +1,42 @@
+name: CLAUDE.md card
+
+# Checks the CLAUDE.md card against the card spec (documentation/claude-card.md in cosyte/config:
+# Gate, Hazard and Rules, within its line, width and byte limits) and every pointer into agent notes.
+# Both checkers are commands of `@cosyte/script-utils`, run through npx at the exact version below,
+# so nothing here restates a rule they hold. Moving to a new version means changing SCRIPT_UTILS here
+# and in `no-emdash.yml` together.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  SCRIPT_UTILS: "@cosyte/script-utils@0.1.4"
+
+jobs:
+  claude-card:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "24"
+
+      - name: The card follows the spec
+        run: npx -y "$SCRIPT_UTILS" claude-card
+
+      - name: Every agent-notes pointer resolves
+        run: npx -y "$SCRIPT_UTILS" agent-notes
diff --git a/.github/workflows/no-emdash.yml b/.github/workflows/no-emdash.yml
index 63cacdb..8eaac45 100644
--- a/.github/workflows/no-emdash.yml
+++ b/.github/workflows/no-emdash.yml
@@ -1,11 +1,15 @@
 name: Em-dash gate
 
-# The brand rule (founder directive 2026-07-24, knowledgebase 06-brand/voice-and-tone.md) bans
-# U+2014 outright across every Cosyte surface and names commit messages explicitly; this repository
-# also refuses the en dash (U+2013). The job scans every tracked file and, on a pull request, the
-# title, the body and the commit messages. A green run on a clean tree proves nothing on its own,
-# which is why the script it calls refuses to print OK from a scan that did not read everything.
-# The starters themselves are tested by `starters.yml`.
+# The brand rule (knowledgebase 06-brand/voice-and-tone.md) bans the em dash (U+2014) and the en dash
+# (U+2013) across every Cosyte surface, and names commit messages explicitly. The job scans every
+# tracked file and its name and, on a pull request, the title, the body and the commit messages. The
+# starters themselves are tested by `starters.yml`.
+#
+# THE GATE IS NOT IN THIS REPOSITORY. It is the one implementation every Cosyte repository runs, the
+# `no-emdash` command of `@cosyte/script-utils`, run through npx at the exact version below, since
+# this repository has no root package.json. Moving to a new version means changing SCRIPT_UTILS here
+# and in `claude-card.yml` together. A path the scan should leave out would go in
+# `scripts/check-no-emdash.exclude`; none does today.
 #
 # WHY A SEPARATE WORKFLOW, and not a job in `starters.yml`:
 #
@@ -13,17 +17,14 @@ name: Em-dash gate
 #   type, which is not a default: without it, a title or body edited after the last push is
 #   never re-checked, and since this repo squash-merges, the PR title and body ARE the commit
 #   message that lands on main. Re-running every starter on both Node lines each time someone
-#   fixes a typo in a PR description would be a large cost for no extra safety. Same call hl7
-#   made (hl7's own `no-emdash.yml`), and website before it, for the same reason.
+#   fixes a typo in a PR description would be a large cost for no extra safety.
 #
 #   Both halves live here rather than being split across two workflows: the file scan is a
-#   checkout and one grep, so it costs nothing to re-run on `edited`, and one file is one
-#   thing to read.
+#   checkout, one small download and one scan, so it costs little to re-run on `edited`, and
+#   one file is one thing to read.
 #
 # THE PR-TEXT HALF MUST NEVER BECOME A REQUIRED STATUS CHECK ON ITS OWN. It runs as a step of the
 # `no-emdash` job, so the job's single check covers both halves.
-#
-# Run it locally with `bash scripts/check-no-emdash.sh`.
 
 on:
   push:
@@ -40,6 +41,9 @@ concurrency:
 permissions:
   contents: read
 
+env:
+  SCRIPT_UTILS: "@cosyte/script-utils@0.1.4"
+
 jobs:
   no-emdash:
     runs-on: ubuntu-latest
@@ -50,9 +54,14 @@ jobs:
           # Full history: the commit-message step below reads the PR's commit range,
           # and the default shallow clone does not contain the base commit.
           fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "24"
 
-      - name: Check tracked files
-        run: bash scripts/check-no-emdash.sh
+      - name: Check tracked files and their names
+        run: npx -y "$SCRIPT_UTILS" no-emdash
 
       # The rule names commit messages explicitly, and a squash merge composes its message
       # from the PR title, the PR body, and the branch commits, so all three are checked.
@@ -78,5 +87,5 @@ jobs:
             printf '%s\n' "$PR_BODY"
             git log --format=%B "$BASE_SHA..$HEAD_SHA"
           } > "$RUNNER_TEMP/pr-messages.txt"
-          bash scripts/check-no-emdash.sh --stdin "the PR title, body, or commit messages" \
+          npx -y "$SCRIPT_UTILS" no-emdash --stdin "the PR title, body, or commit messages" \
             < "$RUNNER_TEMP/pr-messages.txt"
diff --git a/AGENTS.md b/AGENTS.md
index 239a36d..d44f2ed 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -20,7 +20,9 @@ npm test       # runs it again and asserts its key output, offline
 
 Run these from the repository root, in this order, before you push:
 
-1. `bash scripts/check-no-emdash.sh`
+1. The shared gates, at the version the workflows pin:
+   `npx -y @cosyte/script-utils@0.1.4 no-emdash`, then the same with `claude-card` and
+   `agent-notes` in place of `no-emdash`.
 2. In every starter, `npm ci`, then `npm test`. CI lists the starters this way:
    `git ls-files -- '*/package.json' | awk -F/ 'NF == 2 { print $1 }'`
 3. Step 2 again on Node 22, the floor, for each starter the change touches:
diff --git a/CLAUDE.md b/CLAUDE.md
index 2d8fbb4..0fffe71 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -7,9 +7,11 @@ what CI does with the gate, the hazard, and the rules that bind here.
 
 ## Gate
 
-The gate is the four steps in AGENTS.md. Step 1 is `no-emdash.yml`'s `no-emdash` check. On a pull
-request it also scans the title, the body, and the commit messages (the script's `--stdin` mode),
-since a squash merge makes them the commit on `main`, and editing the title or body runs it again.
+The gate is the four steps in AGENTS.md. Step 1 is `no-emdash.yml`'s `no-emdash` check and
+`claude-card.yml`, which run `@cosyte/script-utils` through npx at one pinned version; keep no gate
+script here. On a pull request `no-emdash` also scans the title, the body, and the commit messages
+(its `--stdin` mode), since a squash merge makes them the commit on `main`, and editing the title or
+body runs it again.
 Steps 2 and 3 are `starters.yml`: every starter on Node 22 and 24, and `All starters` is the one
 check that stands for the whole matrix, so a new starter folder is tested with no workflow edit.
 `starters.yml` also runs nightly on `main`, from the lockfiles. Step 4 is `actionlint.yml`;
diff --git a/scripts/check-no-emdash.sh b/scripts/check-no-emdash.sh
deleted file mode 100755
index 057a74c..0000000
--- a/scripts/check-no-emdash.sh
+++ /dev/null
@@ -1,140 +0,0 @@
-#!/usr/bin/env bash
-# scripts/check-no-emdash.sh
-# Brand rule: Cosyte never uses the em dash (U+2014), and this repository also
-# refuses the en dash (U+2013), in any tracked file and in any pull request
-# title, body or commit message. Source of truth:
-# knowledgebase/06-brand/voice-and-tone.md. Rewrite with a period, a colon, a
-# comma, parentheses or a plain hyphen.
-#
-# Usage:
-#   bash scripts/check-no-emdash.sh                  scan every tracked file
-#   bash scripts/check-no-emdash.sh --stdin <label>  scan standard input
-#
-# It needs no install, so it runs on a bare checkout. It refuses to report green
-# when the scanner cannot see a known dash or when the scan read nothing.
-
-set -euo pipefail
-
-# LOCALE PIN, load-bearing. `grep -P` compiles `\x{NNNN}` as a Unicode codepoint only
-# in PCRE's UTF-8 mode, which GNU grep enables from the locale. Under LC_CTYPE=POSIX
-# (a bare container, cron, `sh -c`, any shell that inherits no locale) GNU grep 3.8
-# instead ABORTS with "character code point value in \x{} or \o{} is too large".
-# The version this lineage was ported from discarded that on stderr and `|| true`d the
-# pipeline, so it printed OK having scanned nothing. Do not remove the pin, and do not
-# restore the stderr redirect.
-#
-# The pin cannot be traded for a raw-byte pattern: `\xe2\x80\x94` matches the em dash
-# under POSIX but NOT under a UTF-8 locale, where PCRE reads it as three characters.
-# One pattern cannot cover both, so the locale is fixed and the pattern follows it.
-export LC_ALL=C.UTF-8
-
-# Matches U+2014 as the literal character and as its encodings: %E2%80%94 (URL),
-# the JS backslash-u escape, and the &mdash; / &#8212; / &#x2014; HTML entities.
-PATTERN='\x{2014}|\x{2013}|%E2%80%94|%E2%80%93|\\u2014|\\u2013|&mdash;|&ndash;|&#8212;|&#8211;|&#x2014;|&#x2013;'
-
-# SELF-TEST: prove the scanner can still see what it is meant to catch before any
-# clean result is believed. `printf` emits U+2014 as its UTF-8 bytes, so this file
-# still never contains the literal character.
-if ! printf 'a\xe2\x80\x94b\n' | grep -qP "$PATTERN" || ! printf 'a\xe2\x80\x93b\n' | grep -qP "$PATTERN"; then
-  echo "ERROR: check-no-emdash: the scanner cannot match a known dash." >&2
-  echo "       grep -P is unavailable or not in UTF-8 mode (LC_ALL=${LC_ALL})." >&2
-  echo "       Refusing to report a clean tree on a scanner that cannot see." >&2
-  exit 1
-fi
-
-fail_with_hits() {
-  local what="$1" hits="$2"
-  echo "$hits" >&2
-  echo "" >&2
-  echo "ERROR: check-no-emdash: em or en dash (U+2014, U+2013, or an encoded form) found in ${what}." >&2
-  echo "       Cosyte never uses em or en dashes (06-brand/voice-and-tone.md)." >&2
-  echo "       Rewrite with a period, colon, comma, or parentheses." >&2
-  exit 1
-}
-
-# Anything the scanner writes to stderr means it did not read everything it was
-# given, and an incomplete scan must never print OK. Both modes route grep's stderr
-# here and refuse to continue if it is non-empty, because exit status cannot carry
-# that signal: grep exits 1 on "no match", which xargs in turn reports as 123, so
-# "clean" and "died part way through the batch" are indistinguishable by code.
-ERRLOG=$(mktemp)
-FILELIST=$(mktemp)
-trap 'rm -f "$ERRLOG" "$FILELIST"' EXIT
-
-refuse_if_incomplete() {
-  [ -s "$ERRLOG" ] || return 0
-  cat "$ERRLOG" >&2
-  echo "" >&2
-  echo "ERROR: check-no-emdash: the scan reported errors, so it did not read all of" >&2
-  echo "       its input. Refusing to report green from an incomplete scan." >&2
-  exit 1
-}
-
-# ---- stdin mode: text that is not a file (commit messages, PR title and body) ----
-if [ "${1:-}" = "--stdin" ]; then
-  LABEL="${2:-stdin}"
-  HITS=$(grep -nP -e "$PATTERN" - 2>>"$ERRLOG" || true)
-  refuse_if_incomplete
-  [ -n "$HITS" ] && fail_with_hits "$LABEL" "$HITS"
-  echo "check-no-emdash: OK (no em or en dashes in ${LABEL})"
-  exit 0
-fi
-
-# ---- default mode: every tracked file ----
-#
-# `git ls-files` is relative to the working directory, so from a subdirectory it
-# lists a subtree and the scan would report OK having skipped the rest of the repo.
-# Anchor at the top level, which also keeps the self-exclusion path below correct.
-cd "$(git rev-parse --show-toplevel)"
-
-# Four things this does deliberately, all of them closing a way for the scan to
-# report green without having looked:
-#
-#   -0 -r on xargs, fed by `git ls-files -z`: -r drops the grep invocation entirely
-#   when the file list is empty (without it, grep falls back to reading stdin and
-#   prints OK), and the NUL separator is what makes the list verbatim. Unseparated,
-#   `git ls-files` C-quotes any path holding a space, a quote, or a non-ASCII byte,
-#   and grep is then handed a name no file has.
-#
-#   the file list is built as its own command, not as the head of the pipeline, so a
-#   `git ls-files` that fails (an unreadable or corrupt index) stops the run. Piped,
-#   its status is erased by the `|| true` the no-match case needs, and the scan would
-#   report OK over an empty list. An empty list is refused for the same reason.
-#
-#   -e before the pattern and -- after the file list, so neither a pattern nor a
-#   tracked filename that starts with a dash is read as a grep option. A file named
-#   `-q` would otherwise silence the whole batch and the gate would print OK.
-#
-#   no -I: -I skips any file grep reads as binary, which includes a text file holding
-#   invalid UTF-8, so an em dash inside one would be skipped silently. This repo is
-#   markdown and a license today, with no binaries at all. Losing -I makes a future
-#   binary a loud false positive (grep prints "Binary file X matches", the gate goes
-#   red, a human looks) instead of a silent miss. Fail closed, not open.
-#
-#   KNOWN LIMIT, inherited from the hl7 copy and restated rather than dropped. The
-#   pattern above matches U+2014 as UTF-8 and as the five textual encodings listed
-#   with it. It does NOT match an em dash encoded in some other charset (CP1252 0x97,
-#   UTF-16). Such a file scans clean and this gate stays GREEN: GNU grep does classify
-#   it as binary, but only surfaces that as the "binary file matches" diagnostic when
-#   the pattern actually matches, and a UTF-8 pattern never matches a CP1252 byte, so
-#   nothing reaches refuse_if_incomplete. There is none today (both tracked files
-#   decode as UTF-8). This is accepted rather than fixed: the ban is a rule about prose
-#   that people write, and fixture bytes are grounded data, not brand copy. Do not
-#   widen the pattern to chase it, and do not re-add -I. A UTF-8 em dash on another
-#   line of the same file is still caught normally.
-git ls-files -z > "$FILELIST"
-
-if [ ! -s "$FILELIST" ]; then
-  echo "ERROR: check-no-emdash: no tracked files to scan. Refusing to report green" >&2
-  echo "       from a scan that read nothing." >&2
-  exit 1
-fi
-
-HITS=$(grep -zv -e '^scripts/check-no-emdash\.sh$' < "$FILELIST" |
-  xargs -0 -r grep -d skip -nP -e "$PATTERN" -- 2>>"$ERRLOG" || true)
-
-refuse_if_incomplete
-
-[ -n "$HITS" ] && fail_with_hits "the tracked files listed above" "$HITS"
-
-echo "check-no-emdash: OK (no em or en dashes in the tracked files; this script is excluded)"