diff --git a/.gitignore b/.gitignore
index 6aaa1c5..febb753 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,26 @@
+# Agent runtime artifacts (transient, not worth tracking)
+.claude/
+.claude.json
+.cache/
+.config/
+.local/
+.npm/
+.profile
+.zshrc
+.gitconfig
+.kube/
+
+# Editor swap files
+*.swp
+*.swo
+
+# Secrets (never commit)
 secrets/
 *.pem
+
+# Sync state (local only)
 .last-synced-sha
+
+# Node artifacts
+node_modules/
+bun.lock
diff --git a/ceo/HEARTBEAT.md b/ceo/HEARTBEAT.md
index f744c8c..ecf4f42 100644
--- a/ceo/HEARTBEAT.md
+++ b/ceo/HEARTBEAT.md
@@ -74,7 +74,11 @@ This repo (`/paperclip/privilegedescalation/agents`) is the canonical source of
 #### 5a. Authenticate with GitHub and pull latest
 
     export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)
-    git -C /paperclip/privilegedescalation/agents pull origin main
+    cd /paperclip/privilegedescalation/agents
+    git add -A
+    git diff --cached --quiet || git commit -m "agent: memory and runtime updates $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    git pull --rebase origin main
+    git push origin main
 
 #### 5b. Detect changes since last sync