@caddis/cli 0.4.24 → 0.4.26

package/bundles/antigravity-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "caddis",
-  "version": "1.3.113",
+  "version": "1.3.115",
   "description": "caddis — agent-agnostic dev harness as an Antigravity (agy) plugin: TDD skills + commands, single-sourced with the Claude Code plugin."
 }

package/bundles/antigravity-plugin/skills/_registry.md

@@ -36,6 +36,7 @@
 
 | Skill | Path | When to Use |
 |-------|------|-------------|
+| Adopt App | `adopt-app/` | Bring an app that was never scaffolded - a proof of concept that became real, a folder on a server, a checkout with no remote - up to the standard a generated app starts at. Inventories it without running it (local folder, network share, or a remote Windows box over WinRM), works out what stack each component is, measures it against an adoption standard with three verdicts (pass, gap, and question-only-a-person-can-answer), and writes an ordered plan whose steps cannot be done in the wrong order. Use when the user says "this app was never set up properly", "adopt this POC", "onboard this app", "it just runs from a folder on the server", "bring this up to standard", "what would it take to get this into CI", "nobody knows how this is deployed", or "it started as a prototype and now it is production". |
 | Ci Cd Pipeline | `ci-cd-pipeline/` | CI/CD pipeline design and implementation for GitHub Actions, Azure DevOps, and general pipeline architecture. Use when creating build pipelines, deployment workflows, quality gates, environment promotion strategies, or automating release processes. |
 | Gh Cli | `gh-cli/` | GitHub CLI operations — issues, PRs, releases, and repo management |
 | Git Commit | `git-commit/` | Create well-structured conventional commit messages following Conventional Commits standard. Use when committing changes, preparing PRs, or generating changelogs. |

package/bundles/{antigravity-plugin-extras → antigravity-plugin}/skills/adopt-app/scripts/AdoptCommon.ps1

@@ -146,6 +146,7 @@ $script:AdoptScanBlock = {
         healthHits    = @()
         totalFiles    = 0
         totalMB       = 0.0
+        trackedKnown  = $false
         probed        = 0
         git           = @{ isRepo = $false }
     }
@@ -232,6 +233,22 @@ $script:AdoptScanBlock = {
         else { $g.upstream = $null; $g.unpushed = $null }
     }
 
+    # ---- which files git actually tracks ---------------------------------------------
+    # PER FILE, not per folder. A folder is routinely BOTH: `reports/` carried 40 committed
+    # markdown documents and a gigabyte of correctly-ignored run output, and attributing the
+    # folder's whole size to its folder-level state reported "1018 MB of data exports are
+    # committed" when the real figure was 0.15 MB. That is not a rounding error, it is a
+    # different finding - and it would have sent someone to rewrite history for nothing.
+    $trackedSet = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
+    $trackedKnown = $false
+    if ($result.git.isRepo -and $gitAvailable) {
+        $ls = @(& git -c safe.directory=* -C $root ls-files 2>&1)
+        if ($LASTEXITCODE -eq 0) {
+            $trackedKnown = $true
+            foreach ($f in $ls) { [void]$trackedSet.Add(("$f" -replace '/', '\')) }
+        }
+    }
+
     # ---- one bounded walk per top-level folder --------------------------------------
     $tops = @()
     try { $tops = @(Get-ChildItem -LiteralPath $root -Force -ErrorAction Stop | Where-Object { $_.PSIsContainer }) }
@@ -301,7 +318,7 @@ $script:AdoptScanBlock = {
 
         foreach ($spec in $ExcludableSpecs) {
             if ($rel -match $spec.pattern) {
-                $result.excludable += @{ path = $rel; category = $spec.category; bytes = $file.Length }
+                $result.excludable += @{ path = $rel; category = $spec.category; bytes = $file.Length; tracked = $trackedSet.Contains($rel) }
                 break
             }
         }
@@ -345,7 +362,7 @@ $script:AdoptScanBlock = {
                 if ($rel -notmatch $SkipPattern) { & $classify $k $rel }
                 else {
                     foreach ($spec in $ExcludableSpecs) {
-                        if ($rel -match $spec.pattern) { $result.excludable += @{ path = $rel; category = $spec.category; bytes = $k.Length }; break }
+                        if ($rel -match $spec.pattern) { $result.excludable += @{ path = $rel; category = $spec.category; bytes = $k.Length; tracked = $trackedSet.Contains($rel) }; break }
                     }
                 }
 
@@ -416,6 +433,7 @@ $script:AdoptScanBlock = {
         }
     }
     $result.totalMB = [math]::Round($result.totalMB, 2)
+    $result.trackedKnown = $trackedKnown
     $result.paths = @($detectPaths)
     if ($detectPaths.Count -ge $DetectPathCap) {
         $result.partial = $true

package/bundles/{antigravity-plugin-extras → antigravity-plugin}/skills/adopt-app/scripts/Get-AppInventory.ps1

@@ -116,17 +116,23 @@ $inventory = [ordered]@{
 
 # Roll the excludable file list up per top folder. A list of 40,000 paths is unreadable and
 # the decision is taken per folder anyway.
+# Grouped by folder, category AND whether git tracks the file. A folder is routinely both:
+# committed documents beside a gigabyte of correctly-ignored output. Rolling those together
+# and labelling the total with the folder's state turned 0.15 MB of committed markdown into
+# a report of "1018 MB of data exports are committed".
 $byFolder = @{}
 foreach ($e in @($scan.excludable)) {
     $top = ($e.path -split '[\\/]')[0]
-    $key = "$top|$($e.category)"
-    if (-not $byFolder.ContainsKey($key)) { $byFolder[$key] = @{ folder = $top; category = $e.category; files = 0; bytes = [long]0 } }
+    $isTracked = [bool](Get-AdoptProp $e 'tracked' $false)
+    $key = "$top|$($e.category)|$isTracked"
+    if (-not $byFolder.ContainsKey($key)) { $byFolder[$key] = @{ folder = $top; category = $e.category; tracked = $isTracked; files = 0; bytes = [long]0 } }
     $byFolder[$key].files++
     $byFolder[$key].bytes += [long]$e.bytes
 }
 $inventory.excludableSummary = @($byFolder.Values |
-        ForEach-Object { [ordered]@{ folder = $_.folder; category = $_.category; files = $_.files; mb = [math]::Round($_.bytes / 1MB, 2) } } |
+        ForEach-Object { [ordered]@{ folder = $_.folder; category = $_.category; tracked = $_.tracked; files = $_.files; mb = [math]::Round($_.bytes / 1MB, 2) } } |
         Sort-Object { -1 * $_.mb })
+$inventory.trackedKnown = [bool](Get-AdoptProp $scan 'trackedKnown' $false)
 
 $out = Write-AdoptArtifact -Dir $dir -FileName 'inventory.json' -Object $inventory
 
@@ -181,8 +187,12 @@ if ($ignoredBig.Count -gt 0) {
 Write-AdoptHeading 'What the repository must not carry'
 if ($inventory.excludableSummary.Count -eq 0) { Write-Host "  nothing found" }
 foreach ($e in @($inventory.excludableSummary | Select-Object -First 15)) {
-    Write-Host ("    {0,10:N1} MB  {1,7} files  {2,-13} {3}" -f $e.mb, $e.files, $e.category, $e.folder)
+    $state = if ($e.tracked) { 'COMMITTED' } else { 'not committed' }
+    $colour = if ($e.tracked) { 'Yellow' } else { 'Gray' }
+    Write-Host ("    {0,10:N1} MB  {1,7} files  {2,-13} {3,-14} {4}" -f $e.mb, $e.files, $e.category, $state, $e.folder) -ForegroundColor $colour
 }
+Write-Host "  Only the COMMITTED rows need a history rewrite. The rest need a .gitignore line," -ForegroundColor DarkGray
+Write-Host "  or already have one." -ForegroundColor DarkGray
 
 Write-AdoptHeading 'Possible credentials'
 if ($inventory.secretsSuspected.Count -eq 0) { Write-Host "  none found by the heuristics - which is not the same as none present" }

package/bundles/{antigravity-plugin-extras → antigravity-plugin}/skills/adopt-app/scripts/New-AdoptionPlan.ps1

@@ -73,10 +73,8 @@ if ($so -and $so.verdict -eq 'GAP') {
         $lines += "$($f.path) - $($f.mb) MB, neither committed nor ignored: commit it, ignore it, or move it out of the tree"
     }
     foreach ($e in @($inv.excludableSummary | Select-Object -First 10)) {
-        $g = @($inv.size.folders | Where-Object { $_.path -eq $e.folder })
-        if ($g.Count -gt 0 -and $g[0].git -eq 'tracked') {
-            $lines += "$($e.folder) - $($e.mb) MB of $($e.category) is COMMITTED: needs a history rewrite, not a .gitignore line"
-        }
+        if (-not (Get-AdoptProp $e 'tracked' $false)) { continue }
+        $lines += "$($e.folder) - $($e.files) file(s), $($e.mb) MB of $($e.category) is COMMITTED: a .gitignore line does not remove it, only a history rewrite does"
     }
     Add-Step 'content-policy' 'Settle what the repository may hold' @('answers') `
         'A .gitignore added later does not remove what is already committed, and a folder that is neither committed nor ignored is one careless command away from being permanent.' `

package/bundles/{antigravity-plugin-extras → antigravity-plugin}/skills/adopt-app/scripts/Test-AppConformance.ps1

@@ -72,10 +72,12 @@ $componentProfiles = @($prof.components | ForEach-Object { $_.profile })
 $isBatchOnly = ($componentProfiles.Count -gt 0) -and (@($componentProfiles | Where-Object { $_ -notmatch 'batch' }).Count -eq 0)
 
 $untrackedBig = @($folders | Where-Object { $_.git -eq 'untracked' -and $_.path -ne '.git' -and $_.mb -ge $UntrackedThresholdMB })
+# Per FILE, from git itself - not "this folder is tracked, so all of its bytes are".
 $trackedJunk = @()
 foreach ($e in @($inv.excludableSummary)) {
-    $f = @($folders | Where-Object { $_.path -eq $e.folder })
-    if ($f.Count -gt 0 -and $f[0].git -eq 'tracked' -and $e.category -ne 'log') { $trackedJunk += $e }
+    if (-not (Get-AdoptProp $e 'tracked' $false)) { continue }
+    if ($e.category -eq 'log') { continue }
+    $trackedJunk += $e
 }
 $ignoredHeavy = @($folders | Where-Object { $_.git -eq 'ignored' -and $_.mb -ge 100 })
 

package/bundles/antigravity-plugin-extras/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "caddis-extras",
-  "version": "1.3.34",
+  "version": "1.3.35",
   "description": "caddis-extras — the long-tail skills for the Antigravity (agy) caddis plugin; install alongside caddis for the full set."
 }

package/bundles/antigravity-plugin-extras/skills/_registry.md

@@ -48,7 +48,6 @@
 
 | Skill | Path | When to Use |
 |-------|------|-------------|
-| Adopt App | `adopt-app/` | Bring an app that was never scaffolded - a proof of concept that became real, a folder on a server, a checkout with no remote - up to the standard a generated app starts at. Inventories it without running it (local folder, network share, or a remote Windows box over WinRM), works out what stack each component is, measures it against an adoption standard with three verdicts (pass, gap, and question-only-a-person-can-answer), and writes an ordered plan whose steps cannot be done in the wrong order. Use when the user says "this app was never set up properly", "adopt this POC", "onboard this app", "it just runs from a folder on the server", "bring this up to standard", "what would it take to get this into CI", "nobody knows how this is deployed", or "it started as a prototype and now it is production". |
 | Changelog Generator | `changelog-generator/` | Automatically creates user-facing changelogs from git commits by analyzing commit history, categorizing changes, and transforming technical commits into clear, customer-friendly release notes. Turns hours of manual changelog writing into minutes of automated generation. |
 | Deploy Local | `deploy-local/` | End-to-end local deployment loop for Gitea-hosted projects. Use when the user wants to commit on dev, push to remote, monitor the golden CI/build/deploy workflow, validate prod on the configured prod host, and fix lint/test/pipeline failures until deployment is healthy. |
 | Monorepo | `monorepo/` | Monorepo management with Turborepo and pnpm workspaces. Use for Turborepo setup, turbo.json task dependencies, remote caching, pnpm workspace protocol, shared packages (ui-library, config, types), affected-only CI/CD builds, or monorepo structure (apps/ vs packages/). Covers pitfalls like circular deps, version drift, and hoisting issues. |

package/bundles/codex/.codex/skills/devops/adopt-app/SKILL.md

@@ -0,0 +1,174 @@
+---
+name: adopt-app
+description: Bring an app that was never scaffolded - a proof of concept that became real, a folder on a server, a checkout with no remote - up to the standard a generated app starts at. Inventories it without running it (local folder, network share, or a remote Windows box over WinRM), works out what stack each component is, measures it against an adoption standard with three verdicts (pass, gap, and question-only-a-person-can-answer), and writes an ordered plan whose steps cannot be done in the wrong order. Use when the user says "this app was never set up properly", "adopt this POC", "onboard this app", "it just runs from a folder on the server", "bring this up to standard", "what would it take to get this into CI", "nobody knows how this is deployed", or "it started as a prototype and now it is production".
+---
+
+# adopt-app
+
+An app that was never scaffolded is missing things a generated app gets for free: a repository
+on the team's host, CI, a declared stack, a health signal, a rollback. This skill finds out
+exactly which of them are missing, what only a person can answer, and in what order to fix it.
+
+**It never runs the app.** It reads files, file metadata, git state and what the host has
+registered to start the folder. It does not execute an entry point, an installer, a build or a
+migration. The app is usually the only copy of something already in production.
+
+**It changes nothing outside its own output folder.** Every phase is read-only. The last phase
+writes a plan; a different, team-specific skill performs it.
+
+| Phase | Script | Writes |
+|---|---|---|
+| 1. Inventory | `Get-AppInventory.ps1` | `inventory.json` |
+| 2. Stack | `Resolve-AppProfile.ps1` | `profile.json` |
+| 3. Conformance | `Test-AppConformance.ps1` | `conformance.json`, `answers.json` |
+| 4. Plan | `New-AdoptionPlan.ps1` | `adoption-plan.md`, `adoption.json` |
+
+Output goes to `<outDir>/<name>/`, by default `.caddis/adopt/<name>/` under the current repo.
+Scripts are PowerShell 7 (`pwsh`); the code that runs on a remote box is Windows PowerShell 5.1
+compatible.
+
+## Before you start
+
+1. **Read the project config** if one exists: `.caddis/adopt-app.json`, or `$env:ADOPT_APP_CONFIG`.
+   Six keys, every one of them read by a named script: `outDir`, `fileBudget`, `skipFolders`,
+   `skipPattern`, `untrackedThresholdMB`, and `expectedRemotePattern` - the regex that says what
+   "the team's host" means here. Without that pattern the skill cannot tell a team repository from
+   a personal one, and it says so rather than assuming. Shape and per-key detail:
+   `references/config.example.json`.
+2. **Find out where the app really is.** A folder on a developer's machine may be a stale copy of
+   a server folder, or the only copy in existence. Phase 1 reports which, but ask as well.
+3. **Say up front that nothing will be run or changed.** People are right to be nervous about a
+   tool pointed at a production folder.
+
+## Phase 1 - inventory
+
+```powershell
+$s = '<path-to-this-skill>/scripts'
+& $s/Get-AppInventory.ps1 -Path <folder> [-Name <short-name>] [-ComputerName <box>]
+```
+
+| Where the app is | How to point at it |
+|---|---|
+| this machine | `-Path E:\legacy-app` |
+| a network share | `-Path \\fileserver\apps\legacy-app` |
+| a remote Windows box | `-Path G:\apps\legacy-app -ComputerName appserver01` |
+
+Prefer `-ComputerName` for anything on a server. A share scan works but is slow, and the host
+facts - services, scheduled tasks, web sites - can only be read on the box itself.
+
+**Read four things in the output before going on.**
+
+- **Is the scan complete?** A budget or an access denial makes it PARTIAL: sizes become MINIMUMS,
+  the script exits 1, and `-AllowPartial` is how you accept that on the record. Never treat a
+  partial scan's "nothing found" as "nothing there". Raise `-FileBudget`, or use
+  `-SkipFolder <name>` to spend the budget where the answer is still open. A skipped folder is
+  recorded as NOT SCANNED, never as empty, and it prevents later checks from passing.
+- **Neither committed nor ignored.** Folders in this state are the real hazard: one `git add -A`
+  puts them in the history for ever. A filename pattern cannot find them - only git can.
+- **Possible credentials.** The heuristics are tuned to be readable rather than exhaustive: they
+  skip comments, type declarations, template references and expressions. **Read every file they
+  flag yourself.** A credential that was ever committed must be ROTATED, not only deleted.
+- **What runs it.** If nothing on the host references the folder and the app is live, it runs
+  somewhere you have not looked. Find out where before planning anything.
+
+Junctions and symlinks are reported and never followed. A junction inside a tree that git manages
+is a data-loss hazard: git's recursive remove follows it and deletes the target's contents.
+
+## Phase 2 - what kind of app is it
+
+```powershell
+& $s/Resolve-AppProfile.ps1 -Name <short-name> [-ForceProfile <profile>]
+```
+
+A profile describes one KIND of component - how to detect it, its runtimes, build, services or
+schedule, routing, config, data, CI and deploy. `profiles/` holds the starting set; the contract
+is in `references/profile-contract.md`.
+
+An app is a SET of components. The script reports **every** profile that matches each component
+folder, not just the winner, because a folder can honestly be two things and picking one silently
+hides a decision. Anything in `alsoMatches` is a question for the owner - leftover scaffolding
+from an abandoned rewrite matches its own stack perfectly and is not part of the app.
+
+- **No profile matched** (exit 2) means the rules do not describe this stack yet, not that the app
+  has none. Copy `profiles/_template` into a new folder and fill it in. Set `status` to `draft`;
+  only a stack that something has actually automated end to end may be `proven`.
+- **A draft profile** is a description, not an automation. Follow it by hand and write down what
+  you did, so it can earn `proven` later.
+
+## Phase 3 - conformance
+
+```powershell
+& $s/Test-AppConformance.ps1 -Name <short-name>
+```
+
+Three verdicts, and the third is the point:
+
+| | means |
+|---|---|
+| `PASS` | observed true |
+| `GAP` | observed false, with the evidence named |
+| `ASK` | **not observable from files.** A person must answer it. |
+
+Who owns an app, which of 127 branches is the truth, how it is deployed today, whether the
+rollback has ever been run - none of these are in the files. A tool that forces them into
+pass-or-fail produces a confident wrong answer that nobody rechecks.
+
+**An unanswered ASK on a blocking item stops the adoption exactly as a GAP does** (exit 2, versus
+exit 1 for a gap). Record answers as they arrive; they persist in `answers.json`:
+
+```powershell
+& $s/Test-AppConformance.ps1 -Name app -Answer owner="Team Payments" -Answer canonical-branch=main
+```
+
+`-Waive <id>` records an accepted exception. It is stored as a waiver and never rewritten as a
+pass - six months later the difference is the whole value of the record.
+
+The standard, item by item and why each one is there: `references/standard.md`.
+
+## Phase 4 - the plan
+
+```powershell
+& $s/New-AdoptionPlan.ps1 -Name <short-name> [-HandoverSkill <team-skill>]
+```
+
+The order is the product. Doing these in the wrong order costs real work:
+
+- Create the repository before settling what may be in it, and removing it later means rewriting
+  history other people have already cloned.
+- Rotate a credential after publishing, and it was public in between.
+- Wire up CI before anyone says which branch is the truth, and CI builds the wrong branch.
+
+Each step carries why it is there, what to do, and the check that says it is done. Steps that
+cannot start yet are listed as blocked, with the reason - a plan that omits what it cannot do
+reads like a shorter job.
+
+Give `adoption-plan.md` to the owner. Agree it before anything is changed.
+
+## Handover
+
+This skill says WHAT must be true. It does not know your hosts, ports, routing or CI, so it does
+not perform the adoption. Pass the plan to the team-specific skill that does, and name that skill
+with `-HandoverSkill` so the plan does not end in mid-air.
+
+For the repository move itself, use the **port-to-github** skill: it stages the source read-only,
+keeps every branch and tag, verifies by SHA, and never pushes back to the source.
+
+Re-run phase 3 after each step. It is the same gate either way, so the work cannot quietly drift
+from the standard.
+
+## Rules that apply to every phase
+
+- **Never run the app.** Not the installer, not the build, not a migration, not "just the health
+  check". Reading is always enough to plan.
+- **A partial answer must not read as a clean one.** Every script says when it did not finish, and
+  reports a minimum rather than a wrong total.
+- **File contents never go into an artefact.** A config file holds credentials and a report gets
+  copied into tickets and chats. Paths, line numbers and key NAMES only.
+- **A check that cannot fail is worse than no check**, and so is one that cannot pass. Both
+  manufacture confidence. Every script here exits non-zero on the failure it exists for; do not
+  pipe one to `Out-Null` or read only its last line.
+- **Stage files by name.** The apps this skill is pointed at routinely hold gigabytes that are
+  neither committed nor ignored, so `git add -A` in one of them is how they become permanent.
+- Code that runs on a remote box runs under Windows PowerShell 5.1. There, with
+  `$ErrorActionPreference='Stop'`, a native command's stderr is a terminating error even with
+  `2>$null`. Use `'Continue'` and judge native commands by `$LASTEXITCODE`.

package/bundles/codex/.codex/skills/devops/adopt-app/profiles/_template/profile.json

@@ -0,0 +1,55 @@
+{
+  "name": "<stack-name>",
+  "status": "placeholder",
+  "description": "<one sentence: what kind of component this is>",
+  "detect": {
+    "allFiles": ["<file every such repo has>"],
+    "anyFiles": ["<file any of which indicates it>"],
+    "noneFiles": ["<file that rules it out>"],
+    "fileContains": [{ "file": "<file or glob>", "pattern": "<regex>" }],
+    "noneContain": [{ "file": "<file or glob>", "pattern": "<regex that rules it out>" }]
+  },
+  "runtimes": [
+    {
+      "kind": "<runtime>",
+      "version": "<exact, or where it is declared>",
+      "provision": "<how it gets onto a box, e.g. installed manually, or a provisioning script>"
+    }
+  ],
+  "build": [{ "what": "<step>", "command": "<command>", "cwd": "<folder, optional>" }],
+  "services": [
+    {
+      "role": "<api|web|worker|database>",
+      "port": "<the app's HTTP port>",
+      "start": "<start command>",
+      "manager": "<how the process is kept running, e.g. a service manager or a container runtime>",
+      "bind": "<the interface it binds - loopback-only unless a trusted edge forwards identity>",
+      "health": "<health check>"
+    }
+  ],
+  "schedule": {
+    "trigger": "<only for batch components: a scheduler, a file-arrival watcher, or a manual/CI trigger>"
+  },
+  "routing": {
+    "mode": "<reverse-proxy|rewrite-rule|dedicated-site|none>",
+    "staticRoot": "<built static files, optional>",
+    "apiPrefix": "</api>"
+  },
+  "config": {
+    "files": ["<per-environment config files>"],
+    "rule": "<how config is kept out of version control>"
+  },
+  "data": {
+    "migrations": "<tool or none>",
+    "state": "<where state lives and how it is restored>"
+  },
+  "ci": {
+    "workflow": "<CI workflow file>",
+    "requiredJobs": ["<job>"],
+    "deployJob": "<job>"
+  },
+  "deploy": {
+    "script": "<deploy script>",
+    "verify": ["<a check that would FAIL on a broken deploy>"]
+  }
+}

package/bundles/codex/.codex/skills/devops/adopt-app/profiles/batch-job/profile.json

@@ -0,0 +1,68 @@
+{
+  "name": "batch-job",
+  "status": "draft",
+  "description": "A scheduled or triggered batch engine with no web API: a CLI run by a scheduler, with inputs, outputs, a schedule and an audit trail rather than a port or a route.",
+  "detect": {
+    "anyFiles": ["pyproject.toml", "requirements.txt"],
+    "fileContains": [
+      {
+        "file": ["pyproject.toml", "requirements.txt"],
+        "pattern": "(?i)\\[project\\.scripts\\]|\\btyper\\b|\\bclick\\b|\\bargparse\\b"
+      }
+    ],
+    "noneContain": [
+      {
+        "file": ["pyproject.toml", "requirements.txt"],
+        "pattern": "(?i)\\b(fastapi|django|flask|starlette|aiohttp)\\b"
+      }
+    ]
+  },
+  "runtimes": [
+    {
+      "kind": "python",
+      "version": "<from pyproject.toml's requires-python>",
+      "provision": "<installed on the host that runs it; a per-app virtual environment>"
+    },
+    {
+      "kind": "<other, e.g. a native library or a licensed asset the job depends on>",
+      "version": "<exact>",
+      "provision": "<provisioned separately; licensed assets come from their licensed source, never from version control>"
+    }
+  ],
+  "build": [
+    {
+      "what": "Dependencies",
+      "command": "pip install -e .  (or pip install -r requirements.txt)"
+    }
+  ],
+  "services": [],
+  "schedule": {
+    "trigger": "<a task scheduler, a file-arrival watcher, or a manual/CI trigger>",
+    "account": "<a service account, never a person's own login>",
+    "command": "<the CLI entry point, e.g. python -m <package> run>",
+    "overlap": "<what happens if a run is still going when the next one is due>"
+  },
+  "routing": {
+    "mode": "none"
+  },
+  "config": {
+    "files": ["<the config file the CLI reads>"],
+    "rule": "kept out of version control; a committed example file"
+  },
+  "data": {
+    "migrations": "none",
+    "state": "<input, staging and output locations, kept outside the repo; a retention rule; never committed, especially real customer data>"
+  },
+  "ci": {
+    "workflow": "<CI workflow file: lint, tests, a dry run against sanitised sample data>",
+    "requiredJobs": ["<lint_and_test>"],
+    "deployJob": "<deploy_prod (updates code and dependencies; does not itself run a batch)>"
+  },
+  "deploy": {
+    "script": "<deploy script: stop the schedule, update, re-enable; never mid-run>",
+    "verify": [
+      "a dry run against sanitised sample data exits zero and writes the expected output artefact",
+      "the next scheduled run completes and writes its expected output artefact"
+    ]
+  }
+}

package/bundles/codex/.codex/skills/devops/adopt-app/profiles/dotnet-service/profile.json

@@ -0,0 +1,67 @@
+{
+  "name": "dotnet-service",
+  "status": "draft",
+  "description": "An ASP.NET Core web API or web app (.NET 6+), optionally serving a built frontend from the same process.",
+  "detect": {
+    "anyFiles": ["**/*.csproj", "**/*.sln"],
+    "fileContains": [
+      {
+        "file": "**/*.csproj",
+        "pattern": "(?i)Microsoft\\.NET\\.Sdk\\.Web|Microsoft\\.AspNetCore"
+      }
+    ]
+  },
+  "runtimes": [
+    {
+      "kind": "dotnet",
+      "version": "<the target framework moniker in the .csproj, e.g. net8.0>",
+      "provision": "<the matching .NET runtime/SDK installed on dev and prod hosts>"
+    }
+  ],
+  "build": [
+    {
+      "what": "Restore and publish",
+      "command": "dotnet publish -c Release -o <publish folder>"
+    },
+    {
+      "what": "Frontend bundle, if the app serves one",
+      "command": "npm ci && npm run build",
+      "cwd": "<the frontend folder, if any>"
+    }
+  ],
+  "services": [
+    {
+      "role": "api",
+      "port": "<the app's HTTP port>",
+      "start": "dotnet <published .dll>",
+      "manager": "<a service manager or a container runtime>",
+      "bind": "<loopback-only, unless a trusted edge forwards identity>",
+      "health": "<a real health endpoint, e.g. /health via a health-checks middleware>"
+    }
+  ],
+  "routing": {
+    "mode": "reverse-proxy",
+    "staticRoot": "<built frontend output folder, if any, or wwwroot>",
+    "apiPrefix": "/api"
+  },
+  "config": {
+    "files": ["<a per-environment settings file, kept out of version control for real environments>"],
+    "rule": "real settings files are gitignored; a committed example settings file shows the shape only"
+  },
+  "data": {
+    "migrations": "<the app's migration tool, e.g. an ORM's migrations feature, or none>",
+    "state": "<an external database; nothing durable lives on the app host itself>"
+  },
+  "ci": {
+    "workflow": "<CI workflow file: restore, build, test, publish>",
+    "requiredJobs": ["<lint_and_test>"],
+    "deployJob": "<deploy_prod>"
+  },
+  "deploy": {
+    "script": "<deploy script: publish, stop, swap, start>",
+    "verify": [
+      "the health endpoint returns a body with a status field, not just HTTP 200",
+      "a rendered page or the frontend bundle's hash changed, so an old bundle behind a new backend cannot pass"
+    ]
+  }
+}

package/bundles/codex/.codex/skills/devops/adopt-app/profiles/java-service/profile.json

@@ -0,0 +1,62 @@
+{
+  "name": "java-service",
+  "status": "draft",
+  "description": "A Java web service, most commonly Spring Boot, built with Maven or Gradle and packaged as an executable jar or war.",
+  "detect": {
+    "anyFiles": ["pom.xml", "build.gradle", "build.gradle.kts"],
+    "fileContains": [
+      {
+        "file": ["pom.xml", "build.gradle", "build.gradle.kts"],
+        "pattern": "(?i)spring-boot-starter"
+      }
+    ]
+  },
+  "runtimes": [
+    {
+      "kind": "java",
+      "version": "<the JDK version declared in the build file>",
+      "provision": "<the matching JDK installed on dev and prod hosts>"
+    }
+  ],
+  "build": [
+    {
+      "what": "Build the executable artefact",
+      "command": "mvn -DskipTests package  (or ./gradlew build)"
+    }
+  ],
+  "services": [
+    {
+      "role": "api",
+      "port": "<the app's HTTP port>",
+      "start": "java -jar <built jar>",
+      "manager": "<a service manager or a container runtime>",
+      "bind": "<loopback-only, unless a trusted edge forwards identity>",
+      "health": "<a real health endpoint, e.g. /actuator/health>"
+    }
+  ],
+  "routing": {
+    "mode": "reverse-proxy",
+    "staticRoot": "<built frontend output folder, if the service also serves static assets>",
+    "apiPrefix": "/api"
+  },
+  "config": {
+    "files": ["<a per-environment application config file, kept out of version control for real environments>"],
+    "rule": "real settings files are gitignored; a committed example config file shows the shape only"
+  },
+  "data": {
+    "migrations": "<the app's migration tool, e.g. Flyway or Liquibase, or none>",
+    "state": "<an external database; nothing durable lives on the app host itself>"
+  },
+  "ci": {
+    "workflow": "<CI workflow file: build, test, package>",
+    "requiredJobs": ["<lint_and_test>"],
+    "deployJob": "<deploy_prod>"
+  },
+  "deploy": {
+    "script": "<deploy script: build, stop, swap the jar, start>",
+    "verify": [
+      "the health endpoint returns a body with a status field, not just HTTP 200",
+      "a rendered page or response payload changed, so an old artefact behind a restarted process cannot pass"
+    ]
+  }
+}