@caddis/cli 0.4.23 → 0.4.24

package/bundles/antigravity-plugin-extras/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "caddis-extras",
-  "version": "1.3.33",
+  "version": "1.3.34",
   "description": "caddis-extras — the long-tail skills for the Antigravity (agy) caddis plugin; install alongside caddis for the full set."
 }

package/bundles/antigravity-plugin-extras/skills/_registry.md

@@ -48,6 +48,7 @@
 
 | Skill | Path | When to Use |
 |-------|------|-------------|
+| Adopt App | `adopt-app/` | Bring an app that was never scaffolded - a proof of concept that became real, a folder on a server, a checkout with no remote - up to the standard a generated app starts at. Inventories it without running it (local folder, network share, or a remote Windows box over WinRM), works out what stack each component is, measures it against an adoption standard with three verdicts (pass, gap, and question-only-a-person-can-answer), and writes an ordered plan whose steps cannot be done in the wrong order. Use when the user says "this app was never set up properly", "adopt this POC", "onboard this app", "it just runs from a folder on the server", "bring this up to standard", "what would it take to get this into CI", "nobody knows how this is deployed", or "it started as a prototype and now it is production". |
 | Changelog Generator | `changelog-generator/` | Automatically creates user-facing changelogs from git commits by analyzing commit history, categorizing changes, and transforming technical commits into clear, customer-friendly release notes. Turns hours of manual changelog writing into minutes of automated generation. |
 | Deploy Local | `deploy-local/` | End-to-end local deployment loop for Gitea-hosted projects. Use when the user wants to commit on dev, push to remote, monitor the golden CI/build/deploy workflow, validate prod on the configured prod host, and fix lint/test/pipeline failures until deployment is healthy. |
 | Monorepo | `monorepo/` | Monorepo management with Turborepo and pnpm workspaces. Use for Turborepo setup, turbo.json task dependencies, remote caching, pnpm workspace protocol, shared packages (ui-library, config, types), affected-only CI/CD builds, or monorepo structure (apps/ vs packages/). Covers pitfalls like circular deps, version drift, and hoisting issues. |

package/bundles/antigravity-plugin-extras/skills/adopt-app/SKILL.md

@@ -0,0 +1,174 @@
+---
+name: adopt-app
+description: Bring an app that was never scaffolded - a proof of concept that became real, a folder on a server, a checkout with no remote - up to the standard a generated app starts at. Inventories it without running it (local folder, network share, or a remote Windows box over WinRM), works out what stack each component is, measures it against an adoption standard with three verdicts (pass, gap, and question-only-a-person-can-answer), and writes an ordered plan whose steps cannot be done in the wrong order. Use when the user says "this app was never set up properly", "adopt this POC", "onboard this app", "it just runs from a folder on the server", "bring this up to standard", "what would it take to get this into CI", "nobody knows how this is deployed", or "it started as a prototype and now it is production".
+---
+
+# adopt-app
+
+An app that was never scaffolded is missing things a generated app gets for free: a repository
+on the team's host, CI, a declared stack, a health signal, a rollback. This skill finds out
+exactly which of them are missing, what only a person can answer, and in what order to fix it.
+
+**It never runs the app.** It reads files, file metadata, git state and what the host has
+registered to start the folder. It does not execute an entry point, an installer, a build or a
+migration. The app is usually the only copy of something already in production.
+
+**It changes nothing outside its own output folder.** Every phase is read-only. The last phase
+writes a plan; a different, team-specific skill performs it.
+
+| Phase | Script | Writes |
+|---|---|---|
+| 1. Inventory | `Get-AppInventory.ps1` | `inventory.json` |
+| 2. Stack | `Resolve-AppProfile.ps1` | `profile.json` |
+| 3. Conformance | `Test-AppConformance.ps1` | `conformance.json`, `answers.json` |
+| 4. Plan | `New-AdoptionPlan.ps1` | `adoption-plan.md`, `adoption.json` |
+
+Output goes to `<outDir>/<name>/`, by default `.caddis/adopt/<name>/` under the current repo.
+Scripts are PowerShell 7 (`pwsh`); the code that runs on a remote box is Windows PowerShell 5.1
+compatible.
+
+## Before you start
+
+1. **Read the project config** if one exists: `.caddis/adopt-app.json`, or `$env:ADOPT_APP_CONFIG`.
+   Six keys, every one of them read by a named script: `outDir`, `fileBudget`, `skipFolders`,
+   `skipPattern`, `untrackedThresholdMB`, and `expectedRemotePattern` - the regex that says what
+   "the team's host" means here. Without that pattern the skill cannot tell a team repository from
+   a personal one, and it says so rather than assuming. Shape and per-key detail:
+   `references/config.example.json`.
+2. **Find out where the app really is.** A folder on a developer's machine may be a stale copy of
+   a server folder, or the only copy in existence. Phase 1 reports which, but ask as well.
+3. **Say up front that nothing will be run or changed.** People are right to be nervous about a
+   tool pointed at a production folder.
+
+## Phase 1 - inventory
+
+```powershell
+$s = '<path-to-this-skill>/scripts'
+& $s/Get-AppInventory.ps1 -Path <folder> [-Name <short-name>] [-ComputerName <box>]
+```
+
+| Where the app is | How to point at it |
+|---|---|
+| this machine | `-Path E:\legacy-app` |
+| a network share | `-Path \\fileserver\apps\legacy-app` |
+| a remote Windows box | `-Path G:\apps\legacy-app -ComputerName appserver01` |
+
+Prefer `-ComputerName` for anything on a server. A share scan works but is slow, and the host
+facts - services, scheduled tasks, web sites - can only be read on the box itself.
+
+**Read four things in the output before going on.**
+
+- **Is the scan complete?** A budget or an access denial makes it PARTIAL: sizes become MINIMUMS,
+  the script exits 1, and `-AllowPartial` is how you accept that on the record. Never treat a
+  partial scan's "nothing found" as "nothing there". Raise `-FileBudget`, or use
+  `-SkipFolder <name>` to spend the budget where the answer is still open. A skipped folder is
+  recorded as NOT SCANNED, never as empty, and it prevents later checks from passing.
+- **Neither committed nor ignored.** Folders in this state are the real hazard: one `git add -A`
+  puts them in the history for ever. A filename pattern cannot find them - only git can.
+- **Possible credentials.** The heuristics are tuned to be readable rather than exhaustive: they
+  skip comments, type declarations, template references and expressions. **Read every file they
+  flag yourself.** A credential that was ever committed must be ROTATED, not only deleted.
+- **What runs it.** If nothing on the host references the folder and the app is live, it runs
+  somewhere you have not looked. Find out where before planning anything.
+
+Junctions and symlinks are reported and never followed. A junction inside a tree that git manages
+is a data-loss hazard: git's recursive remove follows it and deletes the target's contents.
+
+## Phase 2 - what kind of app is it
+
+```powershell
+& $s/Resolve-AppProfile.ps1 -Name <short-name> [-ForceProfile <profile>]
+```
+
+A profile describes one KIND of component - how to detect it, its runtimes, build, services or
+schedule, routing, config, data, CI and deploy. `profiles/` holds the starting set; the contract
+is in `references/profile-contract.md`.
+
+An app is a SET of components. The script reports **every** profile that matches each component
+folder, not just the winner, because a folder can honestly be two things and picking one silently
+hides a decision. Anything in `alsoMatches` is a question for the owner - leftover scaffolding
+from an abandoned rewrite matches its own stack perfectly and is not part of the app.
+
+- **No profile matched** (exit 2) means the rules do not describe this stack yet, not that the app
+  has none. Copy `profiles/_template` into a new folder and fill it in. Set `status` to `draft`;
+  only a stack that something has actually automated end to end may be `proven`.
+- **A draft profile** is a description, not an automation. Follow it by hand and write down what
+  you did, so it can earn `proven` later.
+
+## Phase 3 - conformance
+
+```powershell
+& $s/Test-AppConformance.ps1 -Name <short-name>
+```
+
+Three verdicts, and the third is the point:
+
+| | means |
+|---|---|
+| `PASS` | observed true |
+| `GAP` | observed false, with the evidence named |
+| `ASK` | **not observable from files.** A person must answer it. |
+
+Who owns an app, which of 127 branches is the truth, how it is deployed today, whether the
+rollback has ever been run - none of these are in the files. A tool that forces them into
+pass-or-fail produces a confident wrong answer that nobody rechecks.
+
+**An unanswered ASK on a blocking item stops the adoption exactly as a GAP does** (exit 2, versus
+exit 1 for a gap). Record answers as they arrive; they persist in `answers.json`:
+
+```powershell
+& $s/Test-AppConformance.ps1 -Name app -Answer owner="Team Payments" -Answer canonical-branch=main
+```
+
+`-Waive <id>` records an accepted exception. It is stored as a waiver and never rewritten as a
+pass - six months later the difference is the whole value of the record.
+
+The standard, item by item and why each one is there: `references/standard.md`.
+
+## Phase 4 - the plan
+
+```powershell
+& $s/New-AdoptionPlan.ps1 -Name <short-name> [-HandoverSkill <team-skill>]
+```
+
+The order is the product. Doing these in the wrong order costs real work:
+
+- Create the repository before settling what may be in it, and removing it later means rewriting
+  history other people have already cloned.
+- Rotate a credential after publishing, and it was public in between.
+- Wire up CI before anyone says which branch is the truth, and CI builds the wrong branch.
+
+Each step carries why it is there, what to do, and the check that says it is done. Steps that
+cannot start yet are listed as blocked, with the reason - a plan that omits what it cannot do
+reads like a shorter job.
+
+Give `adoption-plan.md` to the owner. Agree it before anything is changed.
+
+## Handover
+
+This skill says WHAT must be true. It does not know your hosts, ports, routing or CI, so it does
+not perform the adoption. Pass the plan to the team-specific skill that does, and name that skill
+with `-HandoverSkill` so the plan does not end in mid-air.
+
+For the repository move itself, use the **port-to-github** skill: it stages the source read-only,
+keeps every branch and tag, verifies by SHA, and never pushes back to the source.
+
+Re-run phase 3 after each step. It is the same gate either way, so the work cannot quietly drift
+from the standard.
+
+## Rules that apply to every phase
+
+- **Never run the app.** Not the installer, not the build, not a migration, not "just the health
+  check". Reading is always enough to plan.
+- **A partial answer must not read as a clean one.** Every script says when it did not finish, and
+  reports a minimum rather than a wrong total.
+- **File contents never go into an artefact.** A config file holds credentials and a report gets
+  copied into tickets and chats. Paths, line numbers and key NAMES only.
+- **A check that cannot fail is worse than no check**, and so is one that cannot pass. Both
+  manufacture confidence. Every script here exits non-zero on the failure it exists for; do not
+  pipe one to `Out-Null` or read only its last line.
+- **Stage files by name.** The apps this skill is pointed at routinely hold gigabytes that are
+  neither committed nor ignored, so `git add -A` in one of them is how they become permanent.
+- Code that runs on a remote box runs under Windows PowerShell 5.1. There, with
+  `$ErrorActionPreference='Stop'`, a native command's stderr is a terminating error even with
+  `2>$null`. Use `'Continue'` and judge native commands by `$LASTEXITCODE`.

package/bundles/antigravity-plugin-extras/skills/adopt-app/profiles/_template/profile.json

@@ -0,0 +1,55 @@
+{
+  "name": "<stack-name>",
+  "status": "placeholder",
+  "description": "<one sentence: what kind of component this is>",
+  "detect": {
+    "allFiles": ["<file every such repo has>"],
+    "anyFiles": ["<file any of which indicates it>"],
+    "noneFiles": ["<file that rules it out>"],
+    "fileContains": [{ "file": "<file or glob>", "pattern": "<regex>" }],
+    "noneContain": [{ "file": "<file or glob>", "pattern": "<regex that rules it out>" }]
+  },
+  "runtimes": [
+    {
+      "kind": "<runtime>",
+      "version": "<exact, or where it is declared>",
+      "provision": "<how it gets onto a box, e.g. installed manually, or a provisioning script>"
+    }
+  ],
+  "build": [{ "what": "<step>", "command": "<command>", "cwd": "<folder, optional>" }],
+  "services": [
+    {
+      "role": "<api|web|worker|database>",
+      "port": "<the app's HTTP port>",
+      "start": "<start command>",
+      "manager": "<how the process is kept running, e.g. a service manager or a container runtime>",
+      "bind": "<the interface it binds - loopback-only unless a trusted edge forwards identity>",
+      "health": "<health check>"
+    }
+  ],
+  "schedule": {
+    "trigger": "<only for batch components: a scheduler, a file-arrival watcher, or a manual/CI trigger>"
+  },
+  "routing": {
+    "mode": "<reverse-proxy|rewrite-rule|dedicated-site|none>",
+    "staticRoot": "<built static files, optional>",
+    "apiPrefix": "</api>"
+  },
+  "config": {
+    "files": ["<per-environment config files>"],
+    "rule": "<how config is kept out of version control>"
+  },
+  "data": {
+    "migrations": "<tool or none>",
+    "state": "<where state lives and how it is restored>"
+  },
+  "ci": {
+    "workflow": "<CI workflow file>",
+    "requiredJobs": ["<job>"],
+    "deployJob": "<job>"
+  },
+  "deploy": {
+    "script": "<deploy script>",
+    "verify": ["<a check that would FAIL on a broken deploy>"]
+  }
+}

package/bundles/antigravity-plugin-extras/skills/adopt-app/profiles/batch-job/profile.json

@@ -0,0 +1,68 @@
+{
+  "name": "batch-job",
+  "status": "draft",
+  "description": "A scheduled or triggered batch engine with no web API: a CLI run by a scheduler, with inputs, outputs, a schedule and an audit trail rather than a port or a route.",
+  "detect": {
+    "anyFiles": ["pyproject.toml", "requirements.txt"],
+    "fileContains": [
+      {
+        "file": ["pyproject.toml", "requirements.txt"],
+        "pattern": "(?i)\\[project\\.scripts\\]|\\btyper\\b|\\bclick\\b|\\bargparse\\b"
+      }
+    ],
+    "noneContain": [
+      {
+        "file": ["pyproject.toml", "requirements.txt"],
+        "pattern": "(?i)\\b(fastapi|django|flask|starlette|aiohttp)\\b"
+      }
+    ]
+  },
+  "runtimes": [
+    {
+      "kind": "python",
+      "version": "<from pyproject.toml's requires-python>",
+      "provision": "<installed on the host that runs it; a per-app virtual environment>"
+    },
+    {
+      "kind": "<other, e.g. a native library or a licensed asset the job depends on>",
+      "version": "<exact>",
+      "provision": "<provisioned separately; licensed assets come from their licensed source, never from version control>"
+    }
+  ],
+  "build": [
+    {
+      "what": "Dependencies",
+      "command": "pip install -e .  (or pip install -r requirements.txt)"
+    }
+  ],
+  "services": [],
+  "schedule": {
+    "trigger": "<a task scheduler, a file-arrival watcher, or a manual/CI trigger>",
+    "account": "<a service account, never a person's own login>",
+    "command": "<the CLI entry point, e.g. python -m <package> run>",
+    "overlap": "<what happens if a run is still going when the next one is due>"
+  },
+  "routing": {
+    "mode": "none"
+  },
+  "config": {
+    "files": ["<the config file the CLI reads>"],
+    "rule": "kept out of version control; a committed example file"
+  },
+  "data": {
+    "migrations": "none",
+    "state": "<input, staging and output locations, kept outside the repo; a retention rule; never committed, especially real customer data>"
+  },
+  "ci": {
+    "workflow": "<CI workflow file: lint, tests, a dry run against sanitised sample data>",
+    "requiredJobs": ["<lint_and_test>"],
+    "deployJob": "<deploy_prod (updates code and dependencies; does not itself run a batch)>"
+  },
+  "deploy": {
+    "script": "<deploy script: stop the schedule, update, re-enable; never mid-run>",
+    "verify": [
+      "a dry run against sanitised sample data exits zero and writes the expected output artefact",
+      "the next scheduled run completes and writes its expected output artefact"
+    ]
+  }
+}

package/bundles/antigravity-plugin-extras/skills/adopt-app/profiles/dotnet-service/profile.json

@@ -0,0 +1,67 @@
+{
+  "name": "dotnet-service",
+  "status": "draft",
+  "description": "An ASP.NET Core web API or web app (.NET 6+), optionally serving a built frontend from the same process.",
+  "detect": {
+    "anyFiles": ["**/*.csproj", "**/*.sln"],
+    "fileContains": [
+      {
+        "file": "**/*.csproj",
+        "pattern": "(?i)Microsoft\\.NET\\.Sdk\\.Web|Microsoft\\.AspNetCore"
+      }
+    ]
+  },
+  "runtimes": [
+    {
+      "kind": "dotnet",
+      "version": "<the target framework moniker in the .csproj, e.g. net8.0>",
+      "provision": "<the matching .NET runtime/SDK installed on dev and prod hosts>"
+    }
+  ],
+  "build": [
+    {
+      "what": "Restore and publish",
+      "command": "dotnet publish -c Release -o <publish folder>"
+    },
+    {
+      "what": "Frontend bundle, if the app serves one",
+      "command": "npm ci && npm run build",
+      "cwd": "<the frontend folder, if any>"
+    }
+  ],
+  "services": [
+    {
+      "role": "api",
+      "port": "<the app's HTTP port>",
+      "start": "dotnet <published .dll>",
+      "manager": "<a service manager or a container runtime>",
+      "bind": "<loopback-only, unless a trusted edge forwards identity>",
+      "health": "<a real health endpoint, e.g. /health via a health-checks middleware>"
+    }
+  ],
+  "routing": {
+    "mode": "reverse-proxy",
+    "staticRoot": "<built frontend output folder, if any, or wwwroot>",
+    "apiPrefix": "/api"
+  },
+  "config": {
+    "files": ["<a per-environment settings file, kept out of version control for real environments>"],
+    "rule": "real settings files are gitignored; a committed example settings file shows the shape only"
+  },
+  "data": {
+    "migrations": "<the app's migration tool, e.g. an ORM's migrations feature, or none>",
+    "state": "<an external database; nothing durable lives on the app host itself>"
+  },
+  "ci": {
+    "workflow": "<CI workflow file: restore, build, test, publish>",
+    "requiredJobs": ["<lint_and_test>"],
+    "deployJob": "<deploy_prod>"
+  },
+  "deploy": {
+    "script": "<deploy script: publish, stop, swap, start>",
+    "verify": [
+      "the health endpoint returns a body with a status field, not just HTTP 200",
+      "a rendered page or the frontend bundle's hash changed, so an old bundle behind a new backend cannot pass"
+    ]
+  }
+}

package/bundles/antigravity-plugin-extras/skills/adopt-app/profiles/java-service/profile.json

@@ -0,0 +1,62 @@
+{
+  "name": "java-service",
+  "status": "draft",
+  "description": "A Java web service, most commonly Spring Boot, built with Maven or Gradle and packaged as an executable jar or war.",
+  "detect": {
+    "anyFiles": ["pom.xml", "build.gradle", "build.gradle.kts"],
+    "fileContains": [
+      {
+        "file": ["pom.xml", "build.gradle", "build.gradle.kts"],
+        "pattern": "(?i)spring-boot-starter"
+      }
+    ]
+  },
+  "runtimes": [
+    {
+      "kind": "java",
+      "version": "<the JDK version declared in the build file>",
+      "provision": "<the matching JDK installed on dev and prod hosts>"
+    }
+  ],
+  "build": [
+    {
+      "what": "Build the executable artefact",
+      "command": "mvn -DskipTests package  (or ./gradlew build)"
+    }
+  ],
+  "services": [
+    {
+      "role": "api",
+      "port": "<the app's HTTP port>",
+      "start": "java -jar <built jar>",
+      "manager": "<a service manager or a container runtime>",
+      "bind": "<loopback-only, unless a trusted edge forwards identity>",
+      "health": "<a real health endpoint, e.g. /actuator/health>"
+    }
+  ],
+  "routing": {
+    "mode": "reverse-proxy",
+    "staticRoot": "<built frontend output folder, if the service also serves static assets>",
+    "apiPrefix": "/api"
+  },
+  "config": {
+    "files": ["<a per-environment application config file, kept out of version control for real environments>"],
+    "rule": "real settings files are gitignored; a committed example config file shows the shape only"
+  },
+  "data": {
+    "migrations": "<the app's migration tool, e.g. Flyway or Liquibase, or none>",
+    "state": "<an external database; nothing durable lives on the app host itself>"
+  },
+  "ci": {
+    "workflow": "<CI workflow file: build, test, package>",
+    "requiredJobs": ["<lint_and_test>"],
+    "deployJob": "<deploy_prod>"
+  },
+  "deploy": {
+    "script": "<deploy script: build, stop, swap the jar, start>",
+    "verify": [
+      "the health endpoint returns a body with a status field, not just HTTP 200",
+      "a rendered page or response payload changed, so an old artefact behind a restarted process cannot pass"
+    ]
+  }
+}

package/bundles/antigravity-plugin-extras/skills/adopt-app/profiles/node-service/profile.json

@@ -0,0 +1,66 @@
+{
+  "name": "node-service",
+  "status": "draft",
+  "description": "A Node.js/TypeScript API (for example Express, Fastify, Hono or NestJS), optionally with a built web frontend, often organised as an npm workspace.",
+  "detect": {
+    "allFiles": ["package.json"],
+    "fileContains": [
+      {
+        "file": "package.json",
+        "pattern": "\"(express|fastify|hono|@nestjs/core|koa)\""
+      }
+    ]
+  },
+  "runtimes": [
+    {
+      "kind": "node",
+      "version": "<from package.json engines, or an .nvmrc>",
+      "provision": "<installed on dev and prod hosts; confirm the installed version actually matches what's declared>"
+    }
+  ],
+  "build": [
+    {
+      "what": "Dependencies",
+      "command": "npm ci  (at the workspace root)"
+    },
+    {
+      "what": "Compile / bundle",
+      "command": "npm run build  (in each workspace package that has one)"
+    }
+  ],
+  "services": [
+    {
+      "role": "api",
+      "port": "<the app's HTTP port>",
+      "start": "<node <built entry point>, e.g. dist/server.js>",
+      "manager": "<a service manager or a container runtime>",
+      "bind": "<loopback-only, unless a trusted edge forwards identity>",
+      "health": "<the app's real health route - confirm it, do not assume a default path>"
+    }
+  ],
+  "routing": {
+    "mode": "reverse-proxy",
+    "staticRoot": "<built web frontend output folder, if any>",
+    "apiPrefix": "/api"
+  },
+  "config": {
+    "files": ["<the env file the API reads, per environment>"],
+    "rule": "kept out of version control; a committed example file with placeholder values"
+  },
+  "data": {
+    "migrations": "<the app's migration tool, if any, e.g. Prisma or Knex>",
+    "state": "<where persistent data actually lives>"
+  },
+  "ci": {
+    "workflow": "<CI workflow file: lint (eslint), typecheck (tsc), test, build>",
+    "requiredJobs": ["<lint_and_test>"],
+    "deployJob": "<deploy_prod>"
+  },
+  "deploy": {
+    "script": "<deploy script: build in a staging copy, stop, swap, start>",
+    "verify": [
+      "the health route returns a body with a status field, not just HTTP 200",
+      "a rendered page changed, so an old build behind a redeployed API cannot pass"
+    ]
+  }
+}

package/bundles/antigravity-plugin-extras/skills/adopt-app/profiles/php-db/profile.json

@@ -0,0 +1,75 @@
+{
+  "name": "php-db",
+  "status": "draft",
+  "description": "A PHP application or packaged product with its own relational database (for example MariaDB or MySQL), served through a web server's PHP handler.",
+  "detect": {
+    "anyFiles": ["composer.json", "index.php"]
+  },
+  "runtimes": [
+    {
+      "kind": "php",
+      "version": "<exact version the app needs>",
+      "provision": "<installed on dev and prod hosts; never committed to the repo>"
+    },
+    {
+      "kind": "database",
+      "version": "<exact engine and version, e.g. MariaDB 10.x>",
+      "provision": "<installed separately; its data directory is state, restored from backup, never committed>"
+    }
+  ],
+  "build": [
+    {
+      "what": "PHP dependencies",
+      "command": "composer install --no-dev  (only if the app uses composer)"
+    },
+    {
+      "what": "Application customisation",
+      "command": "<copy the app's own extensions or config templates into place>"
+    }
+  ],
+  "services": [
+    {
+      "role": "database",
+      "port": "<the database's port; keep it out of the web app's own port range>",
+      "start": "<the database server as a managed service, with its data directory outside the repo>",
+      "manager": "<a service manager>",
+      "bind": "<loopback-only, unless the app tier runs on a different host>",
+      "health": "<a database connectivity check>"
+    },
+    {
+      "role": "web",
+      "port": "<the app's HTTP port>",
+      "start": "<PHP under the web server's own PHP handler, or a PHP-served web process under a service manager>",
+      "manager": "<a service manager or the web server itself>",
+      "bind": "<loopback-only, unless a trusted edge forwards identity>",
+      "health": "<a page that exercises PHP and the database together>"
+    }
+  ],
+  "routing": {
+    "mode": "<reverse-proxy|dedicated-site>",
+    "staticRoot": "<none - PHP serves its own pages>",
+    "apiPrefix": "<n/a>",
+    "note": "decide the login design before anything else: an in-app login sitting behind a shared authenticating edge can loop unless the app has its own routing prefix that bypasses that edge"
+  },
+  "config": {
+    "files": ["<the product's config file, e.g. a config-*.php or .env>"],
+    "rule": "holds database credentials: template it with placeholders, never commit the real one"
+  },
+  "data": {
+    "migrations": "<the product's own upgrade path, or hand-written SQL migrations>",
+    "state": "the database itself: a backup and restore plan is required before go-live"
+  },
+  "ci": {
+    "workflow": "<CI workflow file: PHP lint, the app's own tests, package the customisation>",
+    "requiredJobs": ["<to decide, based on what the app already tests>"],
+    "deployJob": "<deploy_prod>"
+  },
+  "deploy": {
+    "script": "<deploy script>",
+    "verify": [
+      "the database is reachable",
+      "a page that exercises PHP and the database returns real content, not a generic error page",
+      "the login flow reaches the app"
+    ]
+  }
+}

package/bundles/antigravity-plugin-extras/skills/adopt-app/profiles/python-web/profile.json

@@ -0,0 +1,73 @@
+{
+  "name": "python-web",
+  "status": "draft",
+  "description": "A Python web application (for example FastAPI, Django or Flask) that serves an API and, often, a built single-page-app frontend from one process.",
+  "detect": {
+    "anyFiles": ["pyproject.toml", "requirements.txt"],
+    "fileContains": [
+      {
+        "file": ["pyproject.toml", "requirements.txt"],
+        "pattern": "(?i)\\b(fastapi|django|flask|starlette|aiohttp)\\b"
+      }
+    ],
+    "noneFiles": ["composer.json"]
+  },
+  "runtimes": [
+    {
+      "kind": "python",
+      "version": "<from pyproject.toml's requires-python, or a pinned version file>",
+      "provision": "<installed on dev and prod hosts; a per-app virtual environment>"
+    },
+    {
+      "kind": "node",
+      "version": "<from the frontend's package.json engines field, if a frontend is built>",
+      "provision": "<installed on hosts that build the frontend; not needed at runtime>"
+    }
+  ],
+  "build": [
+    {
+      "what": "Python dependencies",
+      "command": "pip install -e .[dev]  (or pip install -r requirements.txt)"
+    },
+    {
+      "what": "Frontend bundle, if the app serves one",
+      "command": "npm ci && npm run build",
+      "cwd": "<the frontend folder, e.g. frontend>"
+    }
+  ],
+  "services": [
+    {
+      "role": "api",
+      "port": "<the app's HTTP port>",
+      "start": "<e.g. a uvicorn/gunicorn command, or the framework's own server run behind a real process manager>",
+      "manager": "<a service manager or a container runtime>",
+      "bind": "<loopback-only, unless a trusted edge forwards identity>",
+      "health": "<a real health endpoint, e.g. /health>"
+    }
+  ],
+  "routing": {
+    "mode": "reverse-proxy",
+    "staticRoot": "<built frontend output folder, if any>",
+    "apiPrefix": "/api"
+  },
+  "config": {
+    "files": ["<a per-environment env file, e.g. .env.<env>>"],
+    "rule": "kept out of version control; seeded from a committed example file; real values set by hand per environment"
+  },
+  "data": {
+    "migrations": "<the app's migration tool, e.g. alembic or Django migrations>",
+    "state": "<an external database; nothing durable lives on the app host itself>"
+  },
+  "ci": {
+    "workflow": "<CI workflow file, e.g. .github/workflows/ci.yml>",
+    "requiredJobs": ["<lint_and_test>", "<frontend_checks, if a frontend is built>"],
+    "deployJob": "<deploy_prod>"
+  },
+  "deploy": {
+    "script": "<deploy script: build first, swap second>",
+    "verify": [
+      "the health endpoint returns a body with a status field, not just HTTP 200",
+      "a rendered page or the frontend bundle's hash changed, so an old bundle behind a new backend cannot pass"
+    ]
+  }
+}