ecoportal-api-graphql 1.3.5 → 1.3.9

data/.ai-assistance/conventions/permission-guidance.md

@@ -0,0 +1,120 @@
+# AI Agent Permission Guidance
+
+How Claude Code should help the developer reduce permission prompts over time,
+without requiring them to watch the screen for confirmations on routine operations.
+
+---
+
+## When to suggest a new allowlist entry
+
+Suggest adding a permission when **any** of these is true:
+
+- A command pattern has prompted for confirmation **2+ times in the current session**
+- The command is part of a **defined workflow** in this repo (e.g. bridge lock release,
+  running specs, rubocop checks) — suggest on first occurrence
+- The command is clearly **read-only or reversible via git** and will recur regularly
+
+Do **not** suggest permissions for:
+- One-off exploratory commands unlikely to recur
+- Interpreter invocations with arbitrary inline code (`ruby -e`, `python3 -c`, `node -e`)
+- Anything that pushes to remote, modifies gem publish config, or touches main/master
+
+---
+
+## How to phrase the suggestion
+
+Inline, at the end of the turn (never mid-task). One sentence:
+
+> "Tip: add `Bash(bundle exec rspec *)` to `.claude/settings.json` → `permissions.allow`
+> to skip this prompt in future sessions."
+
+If it's a compound command (`cd path && cmd`), note that the bare pattern won't match
+and explain the scope choice:
+
+> "This command starts with `cd`, so `Bash(git commit *)` won't cover it.
+> Add `Bash(cd C:/ruby_scripts/git/ecoportal-api-v2 && git commit *)` to that repo's
+> `.claude/settings.json`, or add `Bash(git commit *)` to `~/.claude/settings.json`
+> to cover all repos globally."
+
+---
+
+## Project vs global scope
+
+| Rule type | Where to add | When |
+|-----------|-------------|------|
+| Repo-specific test/lint runners | `.claude/settings.json` (this repo) | When working only in this repo |
+| Cross-repo git operations (`cd sibling && git *`) | Sibling repo's `.claude/settings.json` OR `~/.claude/settings.json` | When the sibling is a regular work target |
+| Universal read/check operations | `~/.claude/settings.json` | When the same pattern recurs across multiple repos |
+| `defaultMode: acceptEdits` | `.claude/settings.json` per repo, or global | When the developer is comfortable with auto-accepted edits in that scope |
+
+---
+
+## Permission pattern format
+
+```
+Bash(<prefix>*)          # prefix match — note the space before * for subcommands
+Bash(<exact command>)    # exact match — no wildcard
+Read(<glob>)             # file read allow/deny
+WebFetch(domain:<host>)  # network allow
+```
+
+Compound command example:
+```
+Bash(cd C:/ruby_scripts/git/ecoportal-api-v2 && git commit *)
+```
+
+**Never** suggest wildcard patterns that grant arbitrary code execution:
+`Bash(ruby *)`, `Bash(python3 *)`, `Bash(node *)`, `Bash(bundle exec *)` (too broad),
+`Bash(bash *)`, `Bash(npm run *)`, etc.
+
+`Bash(bundle exec rspec *)` and `Bash(bundle exec rubocop *)` are acceptable because
+they are specific named tools, not arbitrary script runners.
+
+---
+
+## Autonomy zones — what Code can do without asking
+
+These apply regardless of what is in `settings.json`. Follow them to avoid unnecessary
+confirmation requests in conversation.
+
+### Zone 1 — Never prompt (fully autonomous)
+- All file **reads** (any repo, any path)
+- `git status`, `git log`, `git diff`, `git branch`, `git show` (already auto-allowed)
+- `bundle exec rspec *`, `bundle exec rubocop *` (now in allowlist)
+- Writing/editing files in `.ai-assistance/` (docs, logs, skills, specs)
+- Reading bridge STATUS and LOCK files
+
+### Zone 2 — Act, then notify in the same turn
+- Edit + commit any file in **this repo** on a non-main branch (follow working-tree protocol)
+- Update `.ai-assistance/` docs in any local repo clone
+
+### Zone 3 — State intent, proceed unless told to stop
+- First commit to a **sibling repo** in the current session — report the current branch,
+  state the intended commit, wait one exchange for objection before proceeding
+- Creating a new branch — name it, state why, proceed unless redirected
+
+### Zone 4 — Always confirm before acting
+- `git push` to any remote
+- Any change to `main`/`master` directly
+- Gemspec or Gemfile modifications
+- Changes that affect the public API of this gem
+
+---
+
+## Suggesting workflow improvements
+
+As the developer becomes familiar with routine tasks, proactively suggest improvements
+to the agentic workflow — but only when:
+
+1. The same friction point has appeared **3+ times** across sessions (check memory)
+2. The suggestion is **safe** (versioned, recoverable via git, no external side effects)
+3. There is a **clear instruction file** where the improvement would live
+
+Example triggers and suggestions:
+
+| Friction observed | Suggested improvement |
+|------------------|-----------------------|
+| Repeated `cd sibling && git commit` prompts | Add pattern to sibling repo's `.claude/settings.json` |
+| Repeated rubocop runs on same file | Offer to add a post-edit rubocop hook in `settings.json` |
+| Repeated bridge LOCK release prompts | Already resolved — in allowlist |
+| Cross-repo branch check on every session | Offer to add a session-start branch-summary script to bridge-init.sh |

data/.ai-assistance/integrations/README.md

@@ -0,0 +1,70 @@
+# Optional Dev Integrations
+
+This folder documents optional tool integrations that enhance AI-assisted development for this project. None are required to work on the codebase — but each one meaningfully reduces token usage, speeds up the project cycle, and gives AI agents richer context without manual copy-pasting.
+
+---
+
+## Available Integrations
+
+| Integration | What it provides | Setup effort | Token savings |
+|-------------|-----------------|--------------|---------------|
+| [Local git diff](#local-git-no-setup) | Branch vs main diff, current branch detection | None — works today | Medium |
+| [GitKraken MCP](./gitkraken-mcp.md) | Local git history, branches, commits, GitLab issue/MR context | Low (CLI + login) | High |
+| [GitLab MCP](./gitlab-mcp.md) | Remote MR diffs, pipeline status, issue management, semantic code search | Medium (requires GitLab Duo) | High |
+
+---
+
+## Local Git (No Setup)
+
+The simplest integration is already available: any AI agent can run `git` commands via the shell to understand the current branch state.
+
+**What I use this for automatically:**
+- Detecting whether you're on a feature branch or main
+- Running `git diff main...HEAD --stat` at session start to understand what's in flight
+- Checking `git log --oneline -10` to see recent commit history
+- Updating project TODO/DECISIONS when a commit lands
+
+**No configuration needed.** See [local-git.md](./local-git.md) for the full command reference I use.
+
+---
+
+## Lifecycle Benefits Summary
+
+### Without any integrations
+Every session starts cold. I read files to understand what changed, ask you what branch we're on, and can't see pipeline or MR status without you pasting it in.
+
+### With GitKraken MCP
+I can answer "what's the diff since main?", "what commits are on this branch?", and "what GitLab issues are open?" without any copy-pasting. Git context is live and accurate. Works entirely from local repos — no remote API calls needed for git operations.
+
+### With GitLab MCP
+I can read MR diffs directly, check CI pipeline results, add inline review comments, create issues, and run semantic code searches against your GitLab instance. Closes the loop between local work and remote review without context switching.
+
+### Combined
+At the start of a session: I check the branch, pull the diff vs main, cross-reference against the active project TODO, and know exactly where we left off — in seconds, with no prompting from you.
+
+---
+
+## Collaborator Setup
+
+**The fast path — run the setup script:**
+
+```bash
+npx ts-node .ai-assistance/scripts/setup-mcps.ts
+```
+
+This handles GitKraken + GitLab in one go. It reads your GitLab PAT from `.env` as a
+default so you usually just press Enter. Then restart Claude Desktop.
+
+Prerequisites before running:
+- GitKraken CLI installed and authenticated (`gk auth login`) — https://www.gitkraken.com/cli
+- A GitLab PAT for `gitlab.ecoportal.co.nz` with scopes:
+  `read_api`, `read_repository`, `create_runner`, `ai_features`
+  Enable token rotation. Create at: https://gitlab.ecoportal.co.nz/-/user_settings/personal_access_tokens
+
+**Why global config, not per-project?**
+Claude Desktop MCP servers must be configured globally (`claude_desktop_config.json`).
+The script writes to that file but is driven from this repo — teammates run it once per
+machine and the repo docs explain what and why. Credentials are per-user and never committed.
+
+**Manual setup:** See [gitkraken-mcp.md](./gitkraken-mcp.md) and [gitlab-mcp.md](./gitlab-mcp.md)
+for full details if you prefer to configure by hand or need to troubleshoot.

data/.ai-assistance/integrations/gitkraken-mcp.md

@@ -0,0 +1,107 @@
+# GitKraken MCP — Local Git Context for AI Agents
+
+**What it is:** An MCP server bundled with GitLens (v17.5+) that gives AI agents live access to local Git operations, branch history, commit details, and GitLab issue/MR context — without exposing credentials or requiring per-repo configuration.
+
+**Why it's useful here:** Works entirely from local clones. Every repo in our stack (`ecoportal-api`, `ecoportal-api-v2`, `graphlient`, `eco-helpers`) is cloned locally, so GitKraken MCP can read all of them without any remote API calls for git operations.
+
+---
+
+## Lifecycle Benefits
+
+| Without | With |
+|---------|------|
+| "What branch are we on?" requires manual answer | Agent checks automatically |
+| Commit history requires `git log` bash calls | Agent queries GitKraken MCP directly |
+| GitLab issue context requires copy-paste | Agent fetches via MCP |
+| Branch comparison requires reading multiple files | Agent diffs branches instantly |
+
+**Token saving:** GitKraken MCP returns structured data for git queries, replacing bash output parsing and file reads. Estimated saving: 20–40% on session orientation tasks.
+
+---
+
+## Prerequisites
+
+- GitLens 17.5 or later installed in VS Code / Cursor
+- GitKraken account (your existing license covers this)
+- GitKraken CLI (`gk`) installed and authenticated
+
+**No API key needed.** Authentication is via your GitKraken account (browser OAuth).
+
+---
+
+## Setup: Claude Code (CLI)
+
+```bash
+# 1. Install and authenticate the GitKraken CLI
+gk auth login          # opens browser for OAuth
+
+# 2. Add the MCP server to Claude Code
+claude mcp add -t stdio gitkraken gk mcp
+
+# 3. Verify
+claude mcp list        # should show gitkraken
+```
+
+---
+
+## Setup: Cowork / Claude Desktop
+
+1. Open Claude Desktop → **Settings** → **Developer** → **Edit Config**
+2. Add to `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "gitkraken": {
+      "command": "gk",
+      "args": ["mcp"]
+    }
+  }
+}
+```
+
+3. Save and restart Claude Desktop.
+
+> **Note on args:** Gemini suggests `["mcp", "start"]` — the official GitKraken docs use `["mcp"]`. Both have been reported working; if one fails, try the other. The `gk mcp` command is the authoritative form per https://help.gitkraken.com/mcp/mcp-getting-started/
+4. On first use, a browser window will open for GitKraken OAuth — approve it.
+
+---
+
+## Setup: VS Code / Cursor (via GitLens)
+
+The fastest path if you have GitLens installed:
+
+1. Open the Command Palette (`Ctrl/Cmd+Shift+P`)
+2. Run: `GitLens: Install GitKraken MCP Server`
+3. Done — no JSON editing required.
+
+Alternatively use the deep link: https://gitkraken.dev/deeplink?product=gitlens&path=/link/command/install-mcp&ide=vscode
+
+---
+
+## Note on Local-Only Repos
+
+The GitKraken MCP reads local git state directly via the `gk` CLI — it does **not** require the repo to be pushed to a remote to read branches, commits, or diffs. For GitLab-specific operations (issues, MRs), it connects through GitKraken's cloud service using your linked GitLab account.
+
+If your repos are only local (not yet pushed): git history, branches, diffs, and commits all work. GitLab issue/MR features require the repo to exist on GitLab.
+
+---
+
+## Key Tools Available
+
+- Branch listing and comparison
+- Commit history and diff by commit
+- Stash inspection
+- GitLab issues assigned to you
+- GitLab MR status and diffs (requires GitLab linked in GitKraken)
+
+Full reference: https://help.gitkraken.com/mcp/mcp-tools-reference/
+
+---
+
+## Verify It's Working
+
+In Claude Code or Cowork, ask:
+> "What branch am I on in ecoportal-api-graphql and how many commits ahead of main is it?"
+
+A working integration will answer immediately without a bash call.

data/.ai-assistance/integrations/gitlab-mcp.md

@@ -0,0 +1,123 @@
+# GitLab MCP — Remote Repository & MR Integration
+
+> ⚠️ **Instance note:** `gitlab.ecoportal.co.nz` runs **Community Edition v18.10.1**.
+> The official GitLab MCP server (requires Premium/Ultimate + GitLab Duo) is **not available**.
+> This guide covers the community alternative, which works with any GitLab instance via a PAT.
+
+---
+
+## Community Alternative: `gitlab-mr-mcp`
+
+**Repo:** https://github.com/kopfrechner/gitlab-mr-mcp
+
+Works with GitLab CE/EE on any version. Provides the core MR workflow tools via the GitLab REST API and a personal access token.
+
+### What it provides
+
+| Tool | What it does |
+|------|-------------|
+| List MRs for a project | See open/merged MRs |
+| Get MR details | Title, status, reviewers, description |
+| Get MR diffs | Full code diff for an MR — key for cycle-end review |
+| Add MR comments | Post review comments without leaving the agent |
+| List/get issues | Read issue details |
+
+### What it doesn't provide (vs official MCP)
+- Semantic code search (requires Duo)
+- Pipeline management
+- Workitem notes (uses simpler comment API instead)
+
+---
+
+## Prerequisites
+
+- Node.js installed
+- A GitLab **personal access token** with the following scopes:
+
+| Scope | Why |
+|-------|-----|
+| `read_api` | Read MRs, issues, diffs |
+| `write_repository` | Post MR comments (notes) |
+
+**Create a PAT:** GitLab → User avatar → Preferences → Access Tokens → Add new token.
+Minimum scopes: `read_api`. Add `write_repository` only if you want to post comments.
+
+Store the token in `.env` at repo root (already git-ignored):
+```
+GITLAB_TOKEN=glpat-xxxxxxxxxxxxxxxxxxxx
+GITLAB_URL=https://gitlab.ecoportal.co.nz
+```
+
+---
+
+## Setup: Claude Code (CLI)
+
+```bash
+claude mcp add --transport stdio gitlab-mr \
+  npx -- -y @kopfrechner/gitlab-mr-mcp
+```
+
+Then set environment variables in your shell profile or pass them inline:
+```bash
+export GITLAB_TOKEN=glpat-xxxx
+export GITLAB_URL=https://gitlab.ecoportal.co.nz
+```
+
+---
+
+## Setup: Cowork / Claude Desktop
+
+Add to `claude_desktop_config.json`
+(Windows: `%APPDATA%\Claude\claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "gitlab-mr": {
+      "command": "npx",
+      "args": ["-y", "@kopfrechner/gitlab-mr-mcp"],
+      "env": {
+        "GITLAB_TOKEN": "glpat-xxxxxxxxxxxxxxxxxxxx",
+        "GITLAB_URL": "https://gitlab.ecoportal.co.nz"
+      }
+    }
+  }
+}
+```
+
+Save and restart Claude Desktop.
+
+---
+
+## Lifecycle Benefits
+
+| Task | Without | With |
+|------|---------|------|
+| Check MR diff | Open browser, copy-paste | Agent fetches diff directly |
+| Post review comment | Switch to browser | Agent posts inline |
+| List open MRs | Manual | Agent queries directly |
+| Cycle-end check | Manual MR review | Agent reads diff + confirms coverage |
+
+**Token saving:** MR diffs arrive as structured data instead of requiring browser copy-paste or file reads. Particularly useful at cycle-end when confirming all TODO items made it into the MR.
+
+---
+
+## How AI Agents Use This in the Project Cycle
+
+**At cycle-end (before merge):**
+1. Fetch MR diff — compare against project `TODO.md` to confirm all items are addressed.
+2. Post a structured summary comment to the MR.
+3. Flag any changed files not covered by a TODO item.
+
+**During development:**
+- List open MRs to check if a related change is already in review.
+- Read MR descriptions when picking up a paused project.
+
+---
+
+## Verify It's Working
+
+After setup, in Claude:
+> "List open merge requests in project `oscar/ecoportal-api-graphql`"
+
+Should return MR titles and status without any manual input.

data/.ai-assistance/integrations/local-git.md

@@ -0,0 +1,60 @@
+# Local Git — No Setup Required
+
+Git commands are available in any session via the shell. No API keys, no accounts, no configuration. This is the baseline git integration every AI agent should use by default.
+
+---
+
+## Commands Used Automatically
+
+### Session start — orientation
+```bash
+# What branch am I on?
+git branch --show-current
+
+# Is this branch ahead of main? How far?
+git rev-list --count main..HEAD
+
+# What files have changed vs main?
+git diff main...HEAD --stat
+
+# Last 10 commits on this branch
+git log --oneline -10
+```
+
+### Project cycle — understanding changes
+```bash
+# Full diff of this branch vs main (code changes)
+git diff main...HEAD
+
+# Only changed file paths (cheaper — use this first)
+git diff main...HEAD --name-only
+
+# Diff of a specific file
+git diff main...HEAD -- lib/ecoportal/api/graphql/model/action.rb
+
+# What's staged but not committed?
+git diff --cached --stat
+```
+
+### Cycle-end — before raising MR
+```bash
+# Clean summary of all commits on this branch
+git log main..HEAD --oneline
+
+# Check for any uncommitted changes
+git status --short
+
+# Confirm target branch
+git remote show origin | grep "HEAD branch"
+```
+
+---
+
+## How AI Agents Should Use This
+
+1. **At the start of every session** — run branch + diff stat to orient without reading files.
+2. **When updating project TODO** — check `git log` to see what's been committed since last session.
+3. **Before cycle-end Gemini review** — pull `git diff main...HEAD --name-only` to know exactly which files to pass to Gemini.
+4. **When unsure of current state** — `git status` is free. Use it.
+
+This approach saves significant tokens: a `--stat` diff is ~20 lines; reading the same information from files could cost hundreds of lines of context.

data/.ai-assistance/local_paths.example.md

@@ -0,0 +1,17 @@
+# Local Paths — Developer-Specific
+
+Copy this file to `.ai-assistance/local_paths.md` and fill in your own paths.
+`.ai-assistance/local_paths.md` is git-ignored — never commit it.
+
+## My Local Clones
+
+| Gem | Local path |
+|-----|------------|
+| `ecoportal-api` | /your/path/to/ecoportal-api |
+| `ecoportal-api-v2` | /your/path/to/ecoportal-api-v2 |
+| `graphlient` | /your/path/to/graphlient |
+| `graphql-client` | /your/path/to/graphql-client |
+| `eco-helpers` | /your/path/to/eco-helpers |
+
+## Notes
+Add any machine-specific notes here (e.g. which repos you have checked out, branch notes, etc.)

data/.ai-assistance/projects/TODO.md

@@ -0,0 +1,97 @@
+# Project TODO
+
+## Pending
+
+- [x] **Builder::Register** — `createRegister`, `updateRegister`, `destroyRegister` mutations.
+  `Base::Register`, `Model::Register`, `Input::Register::Create/Update`, `Payload::Register`.
+  `Builder::Register` with `create`, `update`, `destroy`, and `preset_view` sub-builder.
+  `GraphQL#register` exposed (singular, distinct from `#registers` compat layer).
+  *Done 2026-06-08*
+
+- [ ] **Dashboards / Charts** — `Register.defaultDashboardId` and dashboard queries/mutations
+  are not yet wrapped. Backend has dashboard configuration tied to registers and organisations.
+  Scope: `Base::Dashboard` model, `Query::Dashboard(s)`, `Builder::Register#set_default_dashboard`.
+  Priority: medium — needed when scripts need to manage register dashboard configs.
+
+- [x] **AI field mutations** — `generateAiSummary`, `generateSmartFill`,
+  `submitAiSummaryFeedback`, `submitSmartFillFeedback` fully wrapped.
+  `Mutation::AiSummary::Generate/SubmitFeedback`, `Mutation::SmartFill::Generate/SubmitFeedback`,
+  `Payload::AiSummaryGenerate`, `Payload::OkPayload`, `Base::AiSummaryVersion`.
+  `Builder::Page` wired: `generate_ai_summary`, `submit_ai_summary_feedback`,
+  `generate_smart_fill`, `submit_smart_fill_feedback`.
+  *Done 2026-06-08*
+
+- [ ] **AI prompt review workflow** — AiSummary and SmartFill fields store an `instructions`
+  field (the AI prompt, template-configured by humans). No audit/review workflow exists.
+  The gem can read `field.instructions` on AiSummary/SmartFill instances already.
+  What's needed: a way to scan pages/templates for these instructions and surface them
+  for review. Possibly: `Query::PagesWithAiFields` + a review report script.
+  See `.ai-assistance/code/ecoPortal_architecture/13_ai_infrastructure.md` for context.
+  Priority: low/design — the need is real but the right interface is TBD.
+
+- [x] **eP Meta AI scaffolding project** — Standalone template repo at
+  `C:\ruby_scripts\git\ecoPortal_ai_standards`. Bridge protocol, all scripts
+  (lock-acquire, task-read, task-create, setup-mcps, etc.), all skills, conventions,
+  integrations, capabilities registry, CLAUDE.md template ({{PLACEHOLDER}} vars),
+  ONBOARDING.md (15-min setup guide), `init-project.ts` bootstrap script.
+  Push to GitLab to share: `git@gitlab.ecoportal.co.nz:oscar/ecoPortal_ai_standards.git`
+  *Done 2026-06-08*
+
+- [ ] **Commit unstaged changes** — Large set of modified files on `ai_dev_process` branch
+  not yet staged or committed. Review and commit once session is fully restored.
+
+## Bridge improvements (from Gemini review 2026-06-04)
+
+- [x] **Security: Code must prompt before executing bridge-requested shell commands** —
+  Rule added to `.ai-assistance/bridge/CLAUDE.md` "Running Code non-interactively" section.
+  Code must surface any shell command to the user before running it, even in
+  skip-permissions mode. User denial → mark task FAILED.
+  *Done 2026-06-08*
+
+- [x] **Atomic LOCK acquisition** — `scripts/lock-acquire.sh` implemented.
+  Uses temp-file + hard-link (atomic on POSIX/NTFS); falls back to bash `noclobber`.
+  Reports held-by agent/intent on contention. Auto-detects stale locks by mtime.
+  `bridge/CLAUDE.md` updated to reference it as the preferred acquisition method.
+  *Done 2026-06-08*
+
+- [x] **Stale IN_PROGRESS recovery** — `bridge-init.sh` updated: scans for IN_PROGRESS
+  tasks older than 1 hour (via `stat` mtime), reports them in `stale_tasks` + `stale`
+  count in STATUS JSON. `bridge/CLAUDE.md` updated with Code's required response:
+  report to user, ask to reset to PENDING or mark FAILED.
+  *Done 2026-06-08*
+
+- [x] **`task-read.ts` script** — `scripts/task-read.ts` implemented.
+  Parses all sections (title, status, created, from, to, context, request, expected,
+  result, notes) from inbox/outbox/archive files. Searches all bridge dirs automatically.
+  Output: structured JSON. Saves ~200 tokens per task read vs raw Markdown.
+  *Done 2026-06-08*
+
+- [x] **Archive pruning convention** — Documented in `bridge/CLAUDE.md` "Archive pruning"
+  section: keep last 90 days or last 50 task pairs; git history is the audit trail;
+  prune manually when folder gets unwieldy.
+  *Done 2026-06-08*
+
+## File upload
+
+- [ ] **File upload** — Support uploading files to attach to `File` and `ImageGallery`
+  data fields (and potentially Action file attachments at a later stage).
+  This is distinct from the `attach` operation (which links existing resources to
+  a target model). Upload requires direct multipart/form-data HTTP to a separate
+  endpoint before the GraphQL mutation references the resulting file ID.
+  Scope:
+  - Identify the upload endpoint and auth pattern (likely REST, not GraphQL)
+  - Create `HttpClient#upload(file_path:, ...)` or similar
+  - Create `Input::FileAttachment` to carry the resulting file container ID into mutations
+  - Wire into data field update inputs (Phase E concern for fields, sooner for Actions)
+  Priority: Medium — needed before data field updates can be fully functional.
+  Note: Actions file attachment may be needed sooner — track separately if it becomes urgent.
+
+## Completed
+
+- [x] **Gemini design review of bridge architecture** — Done 2026-06-04. Response in
+  `.ai-assistance/bridge/context/gemini-review-response.md`.
+- [x] **Regenerate GitLab PAT** — New token generated, April 2027 expiry, rotation enabled.
+  Updated in `.env` and documented in `integrations/gitlab-mcp.md`.
+- [x] **Rename `.claude/` to `.ai-assistance/`** — Done 2026-06-04. All references updated
+  across scripts, CLAUDE.md, gitignore, and capabilities docs.
+- [x] **MCP setup script** — `setup-mcps.ts` + tests written. Teammates run once per machine.