diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index b0ea624450..d9f02c0efb 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -379,11 +379,11 @@ encapsulate the correct stop/restart/env-injection flow.
 | `docker compose up -d` | `make -C pmoves up-<service>` | `/deploy:up` |
 | `docker compose restart` | `make -C pmoves secrets-funnel && make -C pmoves up` | `/deploy:secrets-funnel` |
 | `netsh interface portproxy` | `make -C pmoves z890-host-setup` | — |
-| `gh workflow run sync-secrets-local` | `make -C pmoves secrets-sync-trigger` | `/deploy:secrets-funnel` |
+| Missing `requirements.lock` | `uv pip compile <svc>/requirements.txt --generate-hashes -o <svc>/requirements.lock` | — |
 
 **volume-reset SERVICE values:** `neo4j`, `tensorzero-clickhouse`, `meilisearch`, `qdrant`, `minio`, `supabase-db`, `nats`
 
-**secrets-sync-trigger**: Triggers the `sync-secrets-local.yml` GitHub Actions workflow (runs on `self-hosted, ai-lab`), waits for completion, then hydrates `local.env` → `env.shared` and runs `brand-defaults`. The containerized runner mounts `$APPDATA/pmoves` (Windows) or `~/.config/pmoves` (Linux) so secrets persist to the host. If `GOOGLE_CLIENT_ID` or other creds are missing after sync, check that the runner container has the volume mount (see `local_cert_runners.py`).
+**requirements.lock generation:** Every service under `pmoves/services/` that uses `-r requirements.lock` in its `requirements.txt` must have a hash-verified lock file generated with `uv pip compile --generate-hashes`. Pattern matches `grayjay-plugin-host`, `graph-linker`, `consciousness-service`, `comfy-watcher`.
 
 **docker-prune variants:**
 - `docker-prune` — safe: stopped containers + dangling images only, volumes untouched
diff --git a/pmoves/services/langextract/requirements.lock b/pmoves/services/langextract/requirements.lock
new file mode 100644
index 0000000000..281b95686d
--- /dev/null
+++ b/pmoves/services/langextract/requirements.lock
@@ -0,0 +1,6 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile pmoves/services/langextract/requirements.txt --generate-hashes -o pmoves/services/langextract/requirements.lock
+prometheus-client==0.21.0 \
+    --hash=sha256:4fa6b4dd0ac16d58bb587c04b1caae65b8c5043e85f778f42f5f632f6af2e166 \
+    --hash=sha256:96c83c606b71ff2b0a433c98889d275f51ffec6c5e267de37c7a2b5c9aa9233e
+    # via -r pmoves/services/langextract/requirements.txt
diff --git a/pmoves/services/presign/requirements.lock b/pmoves/services/presign/requirements.lock
new file mode 100644
index 0000000000..c177472c21
--- /dev/null
+++ b/pmoves/services/presign/requirements.lock
@@ -0,0 +1,6 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile pmoves/services/presign/requirements.txt --generate-hashes -o pmoves/services/presign/requirements.lock
+prometheus-client==0.21.0 \
+    --hash=sha256:4fa6b4dd0ac16d58bb587c04b1caae65b8c5043e85f778f42f5f632f6af2e166 \
+    --hash=sha256:96c83c606b71ff2b0a433c98889d275f51ffec6c5e267de37c7a2b5c9aa9233e
+    # via -r pmoves/services/presign/requirements.txt