@rashidee/co2 1.3.15 → 1.3.17

package/dist/index.js

@@ -6809,7 +6809,7 @@ var {
 // package.json
 var package_default = {
   name: "@rashidee/co2",
-  version: "1.3.15",
+  version: "1.3.17",
   description: "Compound Context Studio \u2014 self-hosted team context authoring for CO2 projects",
   type: "module",
   license: "MIT",
@@ -14735,6 +14735,10 @@ var cicdSetups = sqliteTable(
     // project_configs.updatedAt at generation
     appPort: integer("app_port"),
     // last spawned port of the generated app
+    // Guard token issued to the last spawned app (also kept in memory). Persisted so an app
+    // that outlives a studio restart still passes /api/cicd-guard — otherwise its develop
+    // gate reads "studio unreachable" and every control stays disabled until a manual bounce.
+    guardToken: text("guard_token"),
     createdBy: integer("created_by").notNull(),
     // soft ref → users.id
     createdAt: text("created_at").notNull(),
@@ -22015,6 +22019,46 @@ function stopCicdApp(projectId) {
 }
 
 // ../server/src/features/cicd/app-proxy.ts
+var PROXY_BASE_SHIM = `<script data-co2-proxy-base-shim>(function () {
+  var m = location.pathname.match(/^(.*?\\/app-proxy)(?:\\/|$)/)
+  if (!m) return
+  var prefix = m[1]
+  function reroot(p) {
+    return p.charAt(0) === '/' && p.charAt(1) !== '/' && p.indexOf(prefix + '/') !== 0 && p !== prefix ? prefix + p : p
+  }
+  var origFetch = window.fetch.bind(window)
+  window.fetch = function (input, init) {
+    if (typeof input === 'string') input = reroot(input)
+    else if (input instanceof URL && input.host === location.host)
+      input = new URL(reroot(input.pathname) + input.search + input.hash, location.origin)
+    return origFetch(input, init)
+  }
+  var OrigWS = window.WebSocket
+  function PatchedWS(url, protocols) {
+    try {
+      var u = new URL(url, location.href)
+      if (u.host === location.host) {
+        u.pathname = reroot(u.pathname)
+        u.protocol = location.protocol === 'https:' ? 'wss:' : 'ws:'
+        url = u.toString()
+      }
+    } catch (e) { /* malformed URL \u2014 let the real constructor throw */ }
+    return protocols === undefined ? new OrigWS(url) : new OrigWS(url, protocols)
+  }
+  PatchedWS.prototype = OrigWS.prototype
+  PatchedWS.CONNECTING = OrigWS.CONNECTING
+  PatchedWS.OPEN = OrigWS.OPEN
+  PatchedWS.CLOSING = OrigWS.CLOSING
+  PatchedWS.CLOSED = OrigWS.CLOSED
+  window.WebSocket = PatchedWS
+  document.addEventListener('click', function (e) {
+    var t = e.target
+    var a = t && t.closest ? t.closest('a[href]') : null
+    if (!a) return
+    var href = a.getAttribute('href')
+    if (href) a.setAttribute('href', reroot(href))
+  }, true)
+})()</script>`;
 async function proxyCicdAppRequest(db, workspacePath, projectId, prefix, subPath, req) {
   const location = resolveCicdApp(db, workspacePath, projectId);
   if (!location.present) throw svcError6("CICD_APP_MISSING", 404);
@@ -22047,6 +22091,13 @@ async function proxyCicdAppRequest(db, workspacePath, projectId, prefix, subPath
   if (redirectTo?.startsWith("/") && redirectTo !== prefix && !redirectTo.startsWith(`${prefix}/`)) {
     responseHeaders.set("location", `${prefix}${redirectTo}`);
   }
+  const contentType = upstream.headers.get("content-type") ?? "";
+  if (contentType.includes("text/html")) {
+    const html = await upstream.text();
+    const headTag = html.match(/<head[^>]*>/i);
+    const patched = headTag ? html.replace(headTag[0], `${headTag[0]}${PROXY_BASE_SHIM}`) : `${PROXY_BASE_SHIM}${html}`;
+    return new Response(patched, { status: upstream.status, headers: responseHeaders });
+  }
   return new Response(upstream.body, { status: upstream.status, headers: responseHeaders });
 }
 var CICD_PROXY_UPGRADE_RE = /^\/api\/cicd\/(\d+)\/app-proxy(\/.*)$/;

package/drizzle/0020_cicd_guard_token.sql

@@ -0,0 +1,4 @@
+-- v2.3.1: Persist the generated CI/CD app's guard token. The token was in-memory only, so a
+-- studio restart orphaned a still-running app: its spawn-env token no longer validated against
+-- /api/cicd-guard, the develop gate read "studio unreachable" and every control stayed disabled.
+ALTER TABLE `cicd_setups` ADD `guard_token` text;

package/drizzle/meta/_journal.json

@@ -141,6 +141,13 @@
       "when": 1785000000000,
       "tag": "0019_git_provider",
       "breakpoints": true
+    },
+    {
+      "idx": 20,
+      "version": "6",
+      "when": 1785100000000,
+      "tag": "0020_cicd_guard_token",
+      "breakpoints": true
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rashidee/co2",
-  "version": "1.3.15",
+  "version": "1.3.17",
   "description": "Compound Context Studio — self-hosted team context authoring for CO2 projects",
   "type": "module",
   "license": "MIT",

package/plugin/skills/util-gencicdscript/SKILL.md

@@ -21,12 +21,12 @@ description: >
   copy, docker run or kubectl apply, or none). Controls are disabled for any application that
   has never completed a conductor-develop workflow run (checked against the studio's
   /api/cicd-guard endpoint using the spawn-env token). Health/port probing marks apps already
-  running — even ones started outside this app. The top bar carries a version selector (fed by
-  the studio guard's versions, latest preselected) whose choice replaces the {VERSION} token in
-  commands — docker images are tagged <repo>/<app>:<version> when the plan's Docker section is
-  active (managed Dockerfiles materialized before Build when missing; Build never pushes) — and
-  Build All / Start All / Stop All buttons operating every eligible application at once
-  (sequential builds). When the approved plan declares an `## Infrastructure` list, the
+  running — even ones started outside this app. There is NO version selector — every control
+  operates on the current working tree, and the {VERSION} token in commands auto-resolves to
+  the project's current version (studio guard's latest semver, fallback `latest`) — docker
+  images are tagged <repo>/<app>:<version> when the plan's Docker section is active (managed
+  Dockerfiles materialized before Build when missing; Build never pushes) — and Build All /
+  Start All / Stop All buttons operate every eligible application at once (sequential builds). When the approved plan declares an `## Infrastructure` list, the
   main page shows an "Infrastructure" link that opens a separate status-only page listing every
   supporting 3rd-party service with a live TCP-reachability indicator and a console link. Writes cicd/CICD_GENERATION.md with `**Status**:` IN PROGRESS →
   COMPLETED so the studio watcher detects completion. Idempotent — re-running regenerates
@@ -76,7 +76,8 @@ Read `references/cicd-app-template.md` for the complete file templates. Produce:
    `## Dockerfiles` section, or `{ "path": "Dockerfile", "content": null }` for an `existing`
    one (`null` entirely when the app has no image). Copy managed Dockerfile bodies verbatim.
    Commands may carry the literal `{VERSION}` token — copy it verbatim; the generated app
-   substitutes it at execution. `deployMethod` is the plan's Deploy Method column
+   substitutes it at execution with the project's CURRENT version (studio guard's latest
+   semver, `v` prefix stripped, fallback `latest`) — never via any user-facing selector. `deployMethod` is the plan's Deploy Method column
    (`none|web-server|docker|kubernetes`) and `deploy` its command (`null` when the method is
    `none`). The `infra` array comes from the plan's `## Infrastructure` table (one entry per
    row); `url` is `null` when the Console URL cell is `-`. Emit `"infra": []` when the plan's
@@ -111,18 +112,49 @@ port, application count) and STOP — the studio starts/embeds the app.
   once at boot). Never cache the parsed config in a top-level `const`.
 - The page is bare: no header, sidebar or footer (it is iframed by the studio). Light theme,
   one nav tab per application; the tab body is that application's live log.
-- **Path-prefix proxy awareness (MANDATORY)**: the studio embeds the page through its
-  same-origin reverse proxy at `/api/cicd/<projectId>/app-proxy/` — root-absolute client URLs
-  (`fetch('/api/state')`, `href="/infra"`, `ws://host/ws`) escape the prefix, hit the studio
-  instead of this app and render an empty page. The client script MUST derive a base path once —
-  `const BASE = location.pathname.endsWith('/') ? location.pathname.slice(0,-1) : location.pathname`
-  (on the `/infra` page additionally strip the trailing `/infra`) — and prefix EVERY fetch
-  (`fetch(BASE+'/api/state')`), the Infrastructure link (`BASE+'/infra'`) and the log WebSocket.
-  The WebSocket URL must also follow the page scheme:
-  `(location.protocol==='https:'?'wss://':'ws://')+location.host+BASE+'/ws?app=...'` — a
-  hardcoded `ws://` is blocked as mixed content when the studio is served over HTTPS.
+- **Path-prefix proxy awareness (MANDATORY — copy the template below verbatim)**: the studio
+  embeds the page through its same-origin reverse proxy at `/api/cicd/<projectId>/app-proxy/` —
+  root-absolute client URLs (`fetch('/api/state')`, `href="/infra"`, `ws://host/ws`) escape the
+  prefix, hit the studio instead of this app and render an EMPTY BLACK PAGE in the studio.
+  Every generated page's client `<script>` MUST begin with this exact bootstrap block:
+
+  ```js
+  // Proxy-aware base path — the studio serves this page at /api/cicd/<id>/app-proxy/ (main)
+  // and .../app-proxy/infra; direct access serves / and /infra. All client URLs derive from it.
+  // Regex-free ON PURPOSE — see the template-literal escaping rule below.
+  var _p = location.pathname
+  if (_p.endsWith('/infra')) _p = _p.slice(0, -6)
+  if (_p.endsWith('/')) _p = _p.slice(0, -1)
+  var BASE = _p
+  function apiUrl(path) { return BASE + path }                 // apiUrl('/api/state')
+  function wsUrl(path) {                                       // wsUrl('/ws?app=x')
+    return (location.protocol === 'https:' ? 'wss://' : 'ws://') + location.host + BASE + path
+  }
+  ```
+
+  and then NEVER write a root-absolute URL anywhere in client code:
+  - every fetch goes through `apiUrl(...)` — `fetch(apiUrl('/api/state'))`, never `fetch('/api/state')`;
+  - the log stream socket is `new WebSocket(wsUrl('/ws?app='+encodeURIComponent(name)))` —
+    never a hardcoded `ws://` (mixed-content-blocked when the studio is served over HTTPS);
+  - the Infrastructure link is set from script (`infralink.href = BASE + '/infra'`), never a
+    literal `href="/infra"`.
   Server-side routes stay unprefixed (`/api/state`, `/ws`, `/infra`) — the studio proxy strips
   the prefix before forwarding.
+- **Template-literal escaping in client code (MANDATORY)**: the page HTML/JS is emitted from a
+  template literal inside `server.js`, where every backslash is consumed once when the template
+  cooks — a client-side regex like `.replace(/\/$/, '')` reaches the browser as
+  `.replace(//$/, '')`, the `//` starts a comment, and the WHOLE client script dies with a
+  SyntaxError (blank page both direct AND embedded; this exact regression has shipped before).
+  Client code inside the template must therefore contain NO backslashes at all: use string
+  methods (`endsWith`, `slice`, `split`, `indexOf`) instead of regex literals, and avoid `\n`
+  in client strings (concatenate with real newlines or use `String.fromCharCode(10)`).
+- **Syntax self-check gate (MANDATORY before flipping the generation COMPLETED)**:
+  1. `node --check server.js` (validates the server code);
+  2. start the server briefly, fetch `/` and `/infra`, extract every `<script>…</script>` block
+     and run `new Function(script)` on each — any SyntaxError means the page renders blank;
+  3. grep the client sections — any remaining `fetch('/`, `href="/`, `'ws://'` or backslash
+     inside the page template is a defect; fix via `apiUrl`/`wsUrl`/`BASE` and the escaping
+     rule first. Only then flip `CICD_GENERATION.md` to COMPLETED.
 - Infrastructure page: when `infra` is non-empty the main page shows an "Infrastructure" link
   that opens the separate `/infra` page in a new tab — a status-only list of supporting
   3rd-party services, each with a live TCP-reachability dot (polled) and a console link when a
@@ -132,12 +164,13 @@ port, application count) and STOP — the studio starts/embeds the app.
   (`<project>/<folder>`) as working directory — command paths are relative to the application
   folder (e.g. `java -jar target\app.jar`), never to the project root. Deploy renders only
   when the plan assigned a deploy method other than `none`.
-- **Version selector (topbar)**: the page's top bar carries a version dropdown fed by the
-  studio guard response's `versions` array (already polled every 30 s; latest first —
-  preselected). When the studio is unreachable the selector holds a single `latest` entry.
-  The selected semver, minus its `v` prefix, replaces every literal `{VERSION}` in
-  build/start/stop/deploy commands at execution time (fallback `latest`). Tag-only
-  semantics: the code built is always the working tree — the selector never checks out code.
+- **NO version selector — current codebase only**: the page carries NO version dropdown or
+  any other version choice. Build/Start/Stop/Deploy (and the All buttons) always operate on
+  the CURRENT working tree — there is nothing else they could build. The literal `{VERSION}`
+  token in commands is resolved AUTOMATICALLY at execution time to the project's current
+  version: the FIRST entry of the studio guard response's `versions` array (already polled
+  every 30 s; latest first), minus its `v` prefix, falling back to `latest` when the studio
+  is unreachable. Never render a UI control for it and never check out code.
 - **Dockerfile materialization**: before Build, when an app's `dockerfile.content` is set and
   no file exists at its path in the application folder, the server writes it (never
   overwriting an existing Dockerfile — mirror of the managed-config rule). Build never

package/plugin/skills/util-plancicd/SKILL.md

@@ -1,310 +1,312 @@
----
-name: util-plancicd
-model: claude-opus-4-8
-effort: high
-description: >
-  Infer a local-deployment plan for every custom application of a CO2 project and write it to
-  cicd/CICD_PLAN.md for human review in Compound Context Studio. Reads the project's
-  ENVIRONMENT.md and DEVTOOL.md, CLAUDE.md (# Custom Applications, # Port Allocation) and each
-  application's context/specification/SPECIFICATION.md, then decides per application: deployment
-  method (container vs bare process), build command (e.g. Spring Boot jar vs Docker image),
-  start command, stop mechanism, deploy method + command (none / web-server copy / docker run /
-  kubectl apply — only when the environment calls for one), port and health-check URL, plus a
-  port for the generated CI/CD app itself. When Docker AND a docker repo/registry are both
-  configured (DEVTOOL.md + ENVIRONMENT.md), it additionally plans the docker-image build path:
-  per-application image names under the repo, Build commands extended with
-  `docker build -t <image>:{VERSION}` (the {VERSION} token is resolved by the generated CI/CD
-  app from its topbar version selector), and a managed Dockerfile authored into the plan's
-  `## Dockerfiles` section for any dockerized application lacking one (materialized before
-  Build, never overwriting an existing file). It also infers each application's RUNTIME CONFIG — the
-  config files its start command reads (e.g. `.env`), deciding per file whether the values come
-  from ENVIRONMENT.md or from an existing `.env` / `.env-*` file already in the app folder, listing
-  the required keys and, for ENVIRONMENT.md-sourced files, the resolved content — so the generated
-  CI/CD app can complete the config before start (guaranteeing the app comes up) and show it in a
-  per-application Config modal for troubleshooting. It also enumerates the project's supporting
-  infrastructure (3rd-party services from CLAUDE.md's `# Supporting 3rd Party Applications` and
-  ENVIRONMENT.md — host, port and optional console URL) into an `## Infrastructure` section so
-  the generated CI/CD app can surface a status-only Infrastructure page. The plan carries a
-  top-level
-  `**Status**: IN PROGRESS` header flipped to `COMPLETED` when done — the studio's watcher reads
-  it. This skill NEVER generates the CI/CD app (that is util-gencicdscript, which runs only
-  after the studio stamps an **Approved**: line into the plan). Trigger on keywords: "plan
-  cicd", "plan deployment", "cicd plan", "infer deployment", "deployment plan", "plan ci/cd".
-  Accepts one MANDATORY argument: the project-relative path of the plan-request markdown the
-  studio generated (e.g., /util-plancicd execution/cicd-plan-3-1753000000000.md).
----
-
-# Util Plan CI/CD
-
-## Inputs
-
-```
-/util-plancicd <path-to-plan-request-md>
-```
-
-| Argument | Required | Description |
-|---|---|---|
-| path | yes | Project-relative path of the studio-generated plan-request markdown under `execution/` |
-
-If the argument is missing or the file does not exist, STOP and tell the user to click
-**Plan deployment** in the studio's CI/CD screen first.
-
-### Auto-Resolved Paths
-
-| Logical file | Path |
-|---|---|
-| Plan request | `<argument>` |
-| Environment | `ENVIRONMENT.md` (project root) |
-| Dev tools | `DEVTOOL.md` (project root) |
-| Project context | `CLAUDE.md` (project root; `source/CLAUDE.md` fallback) |
-| App specification | `<app_folder>/context/specification/SPECIFICATION.md` |
-| App config files | `<app_folder>/.env`, `<app_folder>/.env-*` (and stack-conventional config files) |
-| Infrastructure | `CLAUDE.md` `# Supporting 3rd Party Applications` + `ENVIRONMENT.md` |
-| Output plan | `cicd/CICD_PLAN.md` |
-
-## Phase 1 — Gather
-
-1. Read the plan-request markdown; its `## Applications` list is the authoritative application set.
-2. Read `ENVIRONMENT.md` (registries, credentials, external services) and `DEVTOOL.md`
-   (installed tools + paths: node/pnpm/docker/kubectl/python versions).
-2a. **Docker facts**: record whether Docker is installed (DEVTOOL.md) AND whether
-   ENVIRONMENT.md names a **docker repo/registry** — a registry URL or namespace the images
-   are tagged for (e.g. `registry.example.com/team`, a Docker Hub org, an ECR/GCR path).
-   The docker-image build path (below) activates ONLY when BOTH are present; Docker without
-   a configured repo keeps today's behavior (no image builds).
-3. Read `CLAUDE.md`: `# Custom Applications` (folder names, Depends on), `# Port Allocation`
-   (per-application ports), and `# Supporting 3rd Party Applications` (the infrastructure the
-   applications depend on — databases, caches, object storage, SSO, mail, message brokers, etc.).
-4. For each application, read its SPECIFICATION.md tech-stack section if present; otherwise
-   infer the stack from build files (`package.json` → node, `pom.xml` → spring-boot,
-   `composer.json` → laravel).
-4a. For each application, discover its RUNTIME CONFIG files: list any existing `.env` / `.env-*`
-   in the application folder AND the stack-conventional config the start command reads (node/
-   laravel → `.env`; Spring Boot → `application.properties` / `application-<profile>.yml` or a
-   `.env` when the app loads one). Read the content of each existing file (values may be reused).
-   Cross-reference ENVIRONMENT.md for the per-application config values (DB/cache/broker hosts and
-   ports, external-service URLs, credentials, secrets, the app's own PORT) and the Infrastructure
-   list from step 5 for the hosts/ports the app must point at.
-5. Build the **infrastructure list**: one entry per supporting 3rd-party service the project
-   declares. For each, resolve `host` (default `127.0.0.1`), `port` and — when it exposes a web
-   console/UI — a `url`, cross-referencing ENVIRONMENT.md for the actual host/port/endpoint. A
-   service with no host:port to probe (or a purely external SaaS with no local endpoint) is
-   omitted. If the project declares no supporting 3rd-party services, the infrastructure list is
-   empty and the plan's `## Infrastructure` section is written empty.
-
-## Phase 2 — Decide (per application)
-
-- **Working directory (CRITICAL)**: the generated CI/CD app executes every command with the
-  **application folder** (`<project>/<folder>`) as its working directory — NEVER the project
-  root. All paths inside build/start/stop/deploy commands must therefore be relative to the
-  application folder (`mvn -q package`, `java -jar target\app.jar`) — never prefixed with the
-  application folder itself (`skolafund_middleware\target\...` is WRONG).
-- **Method**: `container` only when Docker appears in DEVTOOL.md AND the stack has a sensible
-  container path; otherwise `process` (bare local process — the default for a dev VM).
-- **Build command**: from the stack (e.g. `pnpm install && pnpm build`, `mvn -q package`,
-  `composer install`). Use tool paths from DEVTOOL.md when the tool is not on PATH.
-- **Start command**: the stack's production-ish local start (e.g. `node dist/index.js`,
-  `java -jar target/<artifact>.jar`, `php artisan serve --port <port>`); `docker build`/
-  `docker run` pair when method=container. For jar-based stacks, resolve the EXACT artifact
-  filename — read the pom/gradle build config: a Maven `<finalName>` means
-  `target/<finalName>.jar` with NO version suffix (Spring Boot repackage keeps that name and
-  leaves a `.jar.original` beside it — never reference the `.original`). Never guess
-  `<app>-<version>.jar` and never use a `target/*.jar` glob (shell-dependent, breaks on
-  Windows cmd).
-- **Stop**: `process-kill` for bare processes; `docker stop <name>` for containers.
-- **Deploy** (method + command): only when ENVIRONMENT.md/DEVTOOL.md show a deployment target —
-  `kubernetes` (`kubectl apply -f <app>/k8s/` when kubectl + a cluster/kubeconfig appear),
-  `docker` (`docker run`/`docker compose up -d` when the image is the deliverable),
-  `web-server` (copy the built artifact into the configured web/app server, e.g. nginx html
-  root or Tomcat webapps, when one is configured). Default **`none`** — a bare local process
-  needs no deploy step beyond Start; never invent a target the config does not name.
-- **Docker image** (only when Gather 2a found Docker + a docker repo — otherwise skip this
-  bullet entirely):
-  - **Image name**: `<repo>/<app_folder>` — the application folder name, lowercased, with
-    any character docker rejects replaced by `-` (keep a leading `<number>_` prefix as-is;
-    e.g. `registry.example.com/team/skolafund_web`).
-  - **Build**: append the image build to the app build —
-    `<app build> && docker build -t <image>:{VERSION} .` The literal `{VERSION}` token is
-    the contract: the generated CI/CD app substitutes the version selected in its topbar
-    (semver without the `v` prefix; `latest` fallback) into commands at execution time.
-    Build never pushes — pushing belongs to a `docker` Deploy method.
-  - **Container start/deploy**: when method=container, reference `<image>:{VERSION}` in the
-    start/deploy commands too, so the selected tag is what runs.
-  - **Dockerfile**: if the application folder already has a `Dockerfile`, use it as-is
-    (`existing`). Otherwise author a stack-appropriate Dockerfile (node / spring-boot /
-    laravel — same stack detection as depgen-k8s) into the plan's `## Dockerfiles` section
-    (`managed`); the generated CI/CD app materializes it before Build only when the file is
-    still missing on disk.
-- **Port**: from `# Port Allocation`; if absent, assign sequentially from 3000 avoiding
-  collisions with the studio (3001) and the CI/CD app port.
-- **Health / running-detection**: the endpoint the generated CI/CD app uses to tell whether the
-  application is already running. Detection is a **raw TCP connect to the app's port on loopback**
-  — the generated app probes BOTH IPv4 (`127.0.0.1`) and IPv6 (`::1`) loopback, plus the host
-  named in this Health value — so it does not matter which family the framework binds. This
-  matters because dev servers differ: Spring Boot binds `127.0.0.1`, but **Vite / Next preview
-  servers bind IPv6 `::1` (localhost) only** and are invisible to an IPv4-only probe. Therefore
-  set the Health host to **`localhost`** (not `127.0.0.1`) for any Node/Vite/Next dev-server app
-  so the detection host set includes the interface it actually binds; use `127.0.0.1` for JVM
-  apps. Value form: `http://localhost:<port>/` or a documented health path from the spec (the
-  path is informational — detection keys on the port, not the path).
-- **CI/CD app port**: 5000 unless taken in `# Port Allocation`; record it in the plan.
-
-### Application config (per application)
-
-Decide the runtime config the application needs so it STARTS SUCCESSFULLY, and where each value
-comes from. For every config file the start command reads (`path`, relative to the application
-folder):
-
-- **source** — classify each file:
-  - `env-file` — an existing `.env` / `.env-*` in the app folder already holds the runtime values;
-    use it as-is on disk (do NOT re-materialize it). Set `managed: no`, no resolved content.
-  - `environment` — there is no complete runtime file; resolve the required values from
-    ENVIRONMENT.md (and the Infrastructure hosts/ports) and record the fully-resolved file content.
-    Set `managed: yes` so the CI/CD app writes it before Build/Start when missing.
-  - `derived` — the runtime file is chosen/combined from existing material (e.g. copy the target
-    env's `.env-<env>` to the canonical `.env` the start command reads, or merge an existing
-    `.env-*` with ENVIRONMENT.md values). Set `managed: yes` and record the resolved content.
-- **required keys** — enumerate every key the app must have to boot: its own PORT, datastore/cache/
-  broker connection strings, external-service URLs, credentials/secrets. Cross-check them against
-  ENVIRONMENT.md and the Infrastructure list.
-- **completeness (the point of this)** — every required key MUST be satisfiable from ENVIRONMENT.md
-  or an existing env file. If a required key cannot be resolved, still emit the config entry but
-  call out the unresolved key in that application's Rationale as a GAP (so the human fixes
-  ENVIRONMENT.md before approving) — never silently drop it.
-- **managed content** — for a `managed: yes` file, write the resolved body verbatim into the plan
-  as a fenced block (`path=<file>`). Values (including credentials) are emitted verbatim under the
-  dev-environment plaintext rule; they must never appear in the Rationale narrative.
-
-Only list files the app actually reads at runtime — do not invent config files. An app that needs
-no config file gets an empty config list.
-
-### Infrastructure (status-only)
-
-Supporting 3rd-party services are **not** built/started/deployed by the CI/CD app — they are
-surfaced status-only. For each service resolved in Gather step 5, decide:
-
-- **id**: a stable kebab-case key unique within the plan (e.g. `postgres-main`, `keycloak`).
-- **name**: display name (e.g. `PostgreSQL (skf_main)`, `Keycloak`).
-- **host** / **port**: the address the CI/CD app TCP-probes for reachability; default host
-  `127.0.0.1`. Use the values ENVIRONMENT.md documents.
-- **url**: the web console/UI opened in a new tab, when the service has one (Keycloak admin,
-  MinIO console, Mailcatcher inbox); `-` for headless services (PostgreSQL, Redis).
-- **description**: a short blurb (e.g. `Shared app database`, `S3-compatible object storage`).
-
-Never emit credentials into the infrastructure entries — status and links only.
-
-## Phase 3 — Write the plan
-
-Create `cicd/` if missing and write `cicd/CICD_PLAN.md` (shown here in a 4-backtick fence so the
-inner ```env config block renders — the plan file itself uses a normal 3-backtick env fence):
-
-````markdown
-# CI/CD Deployment Plan — <Project Name>
-
-**Generated**: <ISO date>
-**Status**: IN PROGRESS
-
-## CI/CD App
-
-- **Port**: <port>
-- **Folder**: cicd/app
-
-## Deployment Decisions
-
-| Application | Folder | Method | Port | Build | Start | Stop | Deploy Method | Deploy | Health |
-|---|---|---|---|---|---|---|---|---|---|
-| <name> | <folder> | process|container | <port> | `<cmd>` | `<cmd>` | process-kill|docker stop | none|web-server|docker|kubernetes | `<cmd or ->` | <url> |
-
-> **Running-detection**: the generated CI/CD app determines "is it running?" by a TCP connect to
-> each application's **Port** on both IPv4 (`127.0.0.1`) and IPv6 (`::1`) loopback plus the
-> **Health** host — so an app is detected whichever family it binds. Use a `localhost` Health host
-> for Node/Vite/Next apps (they bind IPv6 `::1`) and `127.0.0.1` for JVM apps.
-
-> **`{VERSION}` token**: Build/Start/Deploy commands may contain the literal `{VERSION}`;
-> the generated CI/CD app replaces it with the version selected in its topbar (semver
-> without the `v` prefix, `latest` when unknown) at execution time. Used by the docker-image
-> path to tag images; tag-only — the code built is always the working tree.
-
-## Docker
-
-Written only from Gather 2a. When Docker or a docker repo is absent, write the section as:
-`_Not dockerized — Docker and/or a docker repo are not configured in DEVTOOL.md/ENVIRONMENT.md._`
-
-**Registry**: <repo, e.g. `registry.example.com/team`>
-
-| Application | Image | Dockerfile |
-|---|---|---|
-| <name> | `<repo>/<app_folder>` | existing \| managed |
-
-## Dockerfiles
-
-One fenced block per `managed` Dockerfile (omit the section body — `_All Dockerfiles exist._`
-— when every dockerized app already has one; `_Not dockerized._` when the Docker section is
-inactive). The generated CI/CD app writes each body to `<app_folder>/Dockerfile` before Build
-only when the file is missing on disk — an existing Dockerfile is never overwritten.
-
-```dockerfile path=<app_folder>/Dockerfile
-FROM node:22-slim
-WORKDIR /app
-COPY package*.json ./
-RUN npm ci --omit=dev
-COPY . .
-EXPOSE <port>
-CMD ["node", "dist/index.js"]
-```
-
-## Application Configs
-
-The runtime config each application needs to START SUCCESSFULLY. The generated CI/CD app writes any
-`managed=yes` file into the application folder before Build/Start when it is missing, and shows
-every file (source, status, required keys, live content) in the per-application Config modal for
-troubleshooting. One table per application; `Path` is relative to the application folder.
-
-### <App Name> (<folder>)
-
-| Path | Source | Managed | Required Keys |
-|---|---|---|---|
-| .env | environment | yes | DATABASE_URL, REDIS_HOST, PORT |
-| .env-uat | env-file | no | DATABASE_URL, REDIS_HOST |
-
-For each `Managed=yes` row, follow it with the resolved file body (verbatim — credentials allowed
-under the dev-plaintext rule):
-
-```env path=.env
-DATABASE_URL=postgres://app:app@127.0.0.1:5432/appdb
-REDIS_HOST=127.0.0.1
-PORT=3000
-```
-
-Omit the fenced block for `env-file` rows (the file is used as-is on disk). If an application needs
-no config file, write `_No runtime config files._` under its heading.
-
-## Infrastructure
-
-Supporting 3rd-party services shown status-only (TCP reachability) on the CI/CD app's
-Infrastructure page. Leave the table body empty when the project declares no supporting services.
-
-| Id | Service | Host | Port | Console URL | Description |
-|---|---|---|---|---|---|
-| <id> | <name> | <host> | <port> | `<url or ->` | <blurb> |
-
-## Rationale
-
-- <per-application: why this method/commands, citing ENVIRONMENT.md/DEVTOOL.md evidence>
-````
-
-Then flip `**Status**: IN PROGRESS` to `**Status**: COMPLETED`. The studio watcher advances
-only on COMPLETED.
-
-## STOP — Hand Back to the Human
-
-Print a one-paragraph summary and STOP. Never invoke util-gencicdscript or any other skill —
-the human reviews and approves the plan in the studio's CI/CD screen first.
-
-## Important Rules
-
-- Never write the CI/CD app; never modify PRD.md/CLAUDE.md/BUG.md.
-- Never delete an existing `**Approved**:` line if re-planning over a previous plan — overwrite
-  the whole file WITHOUT any Approved line (a re-plan always requires fresh approval).
-- Credentials from ENVIRONMENT.md may be referenced in commands verbatim (dev-environment
-  plaintext rule) but never echoed into the Rationale narrative.
+---
+name: util-plancicd
+model: claude-opus-4-8
+effort: high
+description: >
+  Infer a local-deployment plan for every custom application of a CO2 project and write it to
+  cicd/CICD_PLAN.md for human review in Compound Context Studio. Reads the project's
+  ENVIRONMENT.md and DEVTOOL.md, CLAUDE.md (# Custom Applications, # Port Allocation) and each
+  application's context/specification/SPECIFICATION.md, then decides per application: deployment
+  method (container vs bare process), build command (e.g. Spring Boot jar vs Docker image),
+  start command, stop mechanism, deploy method + command (none / web-server copy / docker run /
+  kubectl apply — only when the environment calls for one), port and health-check URL, plus a
+  port for the generated CI/CD app itself. When Docker AND a docker repo/registry are both
+  configured (DEVTOOL.md + ENVIRONMENT.md), it additionally plans the docker-image build path:
+  per-application image names under the repo, Build commands extended with
+  `docker build -t <image>:{VERSION}` (the {VERSION} token is auto-resolved by the generated
+  CI/CD app to the project's current version), and a managed Dockerfile authored into the plan's
+  `## Dockerfiles` section for any dockerized application lacking one (materialized before
+  Build, never overwriting an existing file). It also infers each application's RUNTIME CONFIG — the
+  config files its start command reads (e.g. `.env`), deciding per file whether the values come
+  from ENVIRONMENT.md or from an existing `.env` / `.env-*` file already in the app folder, listing
+  the required keys and, for ENVIRONMENT.md-sourced files, the resolved content — so the generated
+  CI/CD app can complete the config before start (guaranteeing the app comes up) and show it in a
+  per-application Config modal for troubleshooting. It also enumerates the project's supporting
+  infrastructure (3rd-party services from CLAUDE.md's `# Supporting 3rd Party Applications` and
+  ENVIRONMENT.md — host, port and optional console URL) into an `## Infrastructure` section so
+  the generated CI/CD app can surface a status-only Infrastructure page. The plan carries a
+  top-level
+  `**Status**: IN PROGRESS` header flipped to `COMPLETED` when done — the studio's watcher reads
+  it. This skill NEVER generates the CI/CD app (that is util-gencicdscript, which runs only
+  after the studio stamps an **Approved**: line into the plan). Trigger on keywords: "plan
+  cicd", "plan deployment", "cicd plan", "infer deployment", "deployment plan", "plan ci/cd".
+  Accepts one MANDATORY argument: the project-relative path of the plan-request markdown the
+  studio generated (e.g., /util-plancicd execution/cicd-plan-3-1753000000000.md).
+---
+
+# Util Plan CI/CD
+
+## Inputs
+
+```
+/util-plancicd <path-to-plan-request-md>
+```
+
+| Argument | Required | Description |
+|---|---|---|
+| path | yes | Project-relative path of the studio-generated plan-request markdown under `execution/` |
+
+If the argument is missing or the file does not exist, STOP and tell the user to click
+**Plan deployment** in the studio's CI/CD screen first.
+
+### Auto-Resolved Paths
+
+| Logical file | Path |
+|---|---|
+| Plan request | `<argument>` |
+| Environment | `ENVIRONMENT.md` (project root) |
+| Dev tools | `DEVTOOL.md` (project root) |
+| Project context | `CLAUDE.md` (project root; `source/CLAUDE.md` fallback) |
+| App specification | `<app_folder>/context/specification/SPECIFICATION.md` |
+| App config files | `<app_folder>/.env`, `<app_folder>/.env-*` (and stack-conventional config files) |
+| Infrastructure | `CLAUDE.md` `# Supporting 3rd Party Applications` + `ENVIRONMENT.md` |
+| Output plan | `cicd/CICD_PLAN.md` |
+
+## Phase 1 — Gather
+
+1. Read the plan-request markdown; its `## Applications` list is the authoritative application set.
+2. Read `ENVIRONMENT.md` (registries, credentials, external services) and `DEVTOOL.md`
+   (installed tools + paths: node/pnpm/docker/kubectl/python versions).
+2a. **Docker facts**: record whether Docker is installed (DEVTOOL.md) AND whether
+   ENVIRONMENT.md names a **docker repo/registry** — a registry URL or namespace the images
+   are tagged for (e.g. `registry.example.com/team`, a Docker Hub org, an ECR/GCR path).
+   The docker-image build path (below) activates ONLY when BOTH are present; Docker without
+   a configured repo keeps today's behavior (no image builds).
+3. Read `CLAUDE.md`: `# Custom Applications` (folder names, Depends on), `# Port Allocation`
+   (per-application ports), and `# Supporting 3rd Party Applications` (the infrastructure the
+   applications depend on — databases, caches, object storage, SSO, mail, message brokers, etc.).
+4. For each application, read its SPECIFICATION.md tech-stack section if present; otherwise
+   infer the stack from build files (`package.json` → node, `pom.xml` → spring-boot,
+   `composer.json` → laravel).
+4a. For each application, discover its RUNTIME CONFIG files: list any existing `.env` / `.env-*`
+   in the application folder AND the stack-conventional config the start command reads (node/
+   laravel → `.env`; Spring Boot → `application.properties` / `application-<profile>.yml` or a
+   `.env` when the app loads one). Read the content of each existing file (values may be reused).
+   Cross-reference ENVIRONMENT.md for the per-application config values (DB/cache/broker hosts and
+   ports, external-service URLs, credentials, secrets, the app's own PORT) and the Infrastructure
+   list from step 5 for the hosts/ports the app must point at.
+5. Build the **infrastructure list**: one entry per supporting 3rd-party service the project
+   declares. For each, resolve `host` (default `127.0.0.1`), `port` and — when it exposes a web
+   console/UI — a `url`, cross-referencing ENVIRONMENT.md for the actual host/port/endpoint. A
+   service with no host:port to probe (or a purely external SaaS with no local endpoint) is
+   omitted. If the project declares no supporting 3rd-party services, the infrastructure list is
+   empty and the plan's `## Infrastructure` section is written empty.
+
+## Phase 2 — Decide (per application)
+
+- **Working directory (CRITICAL)**: the generated CI/CD app executes every command with the
+  **application folder** (`<project>/<folder>`) as its working directory — NEVER the project
+  root. All paths inside build/start/stop/deploy commands must therefore be relative to the
+  application folder (`mvn -q package`, `java -jar target\app.jar`) — never prefixed with the
+  application folder itself (`skolafund_middleware\target\...` is WRONG).
+- **Method**: `container` only when Docker appears in DEVTOOL.md AND the stack has a sensible
+  container path; otherwise `process` (bare local process — the default for a dev VM).
+- **Build command**: from the stack (e.g. `pnpm install && pnpm build`, `mvn -q package`,
+  `composer install`). Use tool paths from DEVTOOL.md when the tool is not on PATH.
+- **Start command**: the stack's production-ish local start (e.g. `node dist/index.js`,
+  `java -jar target/<artifact>.jar`, `php artisan serve --port <port>`); `docker build`/
+  `docker run` pair when method=container. For jar-based stacks, resolve the EXACT artifact
+  filename — read the pom/gradle build config: a Maven `<finalName>` means
+  `target/<finalName>.jar` with NO version suffix (Spring Boot repackage keeps that name and
+  leaves a `.jar.original` beside it — never reference the `.original`). Never guess
+  `<app>-<version>.jar` and never use a `target/*.jar` glob (shell-dependent, breaks on
+  Windows cmd).
+- **Stop**: `process-kill` for bare processes; `docker stop <name>` for containers.
+- **Deploy** (method + command): only when ENVIRONMENT.md/DEVTOOL.md show a deployment target —
+  `kubernetes` (`kubectl apply -f <app>/k8s/` when kubectl + a cluster/kubeconfig appear),
+  `docker` (`docker run`/`docker compose up -d` when the image is the deliverable),
+  `web-server` (copy the built artifact into the configured web/app server, e.g. nginx html
+  root or Tomcat webapps, when one is configured). Default **`none`** — a bare local process
+  needs no deploy step beyond Start; never invent a target the config does not name.
+- **Docker image** (only when Gather 2a found Docker + a docker repo — otherwise skip this
+  bullet entirely):
+  - **Image name**: `<repo>/<app_folder>` — the application folder name, lowercased, with
+    any character docker rejects replaced by `-` (keep a leading `<number>_` prefix as-is;
+    e.g. `registry.example.com/team/skolafund_web`).
+  - **Build**: append the image build to the app build —
+    `<app build> && docker build -t <image>:{VERSION} .` The literal `{VERSION}` token is
+    the contract: the generated CI/CD app substitutes the project's CURRENT version
+    (semver without the `v` prefix; `latest` fallback) into commands at execution time —
+    there is no user-facing version selector; only the current codebase is ever built.
+    Build never pushes — pushing belongs to a `docker` Deploy method.
+  - **Container start/deploy**: when method=container, reference `<image>:{VERSION}` in the
+    start/deploy commands too, so the current version's tag is what runs.
+  - **Dockerfile**: if the application folder already has a `Dockerfile`, use it as-is
+    (`existing`). Otherwise author a stack-appropriate Dockerfile (node / spring-boot /
+    laravel — same stack detection as depgen-k8s) into the plan's `## Dockerfiles` section
+    (`managed`); the generated CI/CD app materializes it before Build only when the file is
+    still missing on disk.
+- **Port**: from `# Port Allocation`; if absent, assign sequentially from 3000 avoiding
+  collisions with the studio (3001) and the CI/CD app port.
+- **Health / running-detection**: the endpoint the generated CI/CD app uses to tell whether the
+  application is already running. Detection is a **raw TCP connect to the app's port on loopback**
+  — the generated app probes BOTH IPv4 (`127.0.0.1`) and IPv6 (`::1`) loopback, plus the host
+  named in this Health value — so it does not matter which family the framework binds. This
+  matters because dev servers differ: Spring Boot binds `127.0.0.1`, but **Vite / Next preview
+  servers bind IPv6 `::1` (localhost) only** and are invisible to an IPv4-only probe. Therefore
+  set the Health host to **`localhost`** (not `127.0.0.1`) for any Node/Vite/Next dev-server app
+  so the detection host set includes the interface it actually binds; use `127.0.0.1` for JVM
+  apps. Value form: `http://localhost:<port>/` or a documented health path from the spec (the
+  path is informational — detection keys on the port, not the path).
+- **CI/CD app port**: 5000 unless taken in `# Port Allocation`; record it in the plan.
+
+### Application config (per application)
+
+Decide the runtime config the application needs so it STARTS SUCCESSFULLY, and where each value
+comes from. For every config file the start command reads (`path`, relative to the application
+folder):
+
+- **source** — classify each file:
+  - `env-file` — an existing `.env` / `.env-*` in the app folder already holds the runtime values;
+    use it as-is on disk (do NOT re-materialize it). Set `managed: no`, no resolved content.
+  - `environment` — there is no complete runtime file; resolve the required values from
+    ENVIRONMENT.md (and the Infrastructure hosts/ports) and record the fully-resolved file content.
+    Set `managed: yes` so the CI/CD app writes it before Build/Start when missing.
+  - `derived` — the runtime file is chosen/combined from existing material (e.g. copy the target
+    env's `.env-<env>` to the canonical `.env` the start command reads, or merge an existing
+    `.env-*` with ENVIRONMENT.md values). Set `managed: yes` and record the resolved content.
+- **required keys** — enumerate every key the app must have to boot: its own PORT, datastore/cache/
+  broker connection strings, external-service URLs, credentials/secrets. Cross-check them against
+  ENVIRONMENT.md and the Infrastructure list.
+- **completeness (the point of this)** — every required key MUST be satisfiable from ENVIRONMENT.md
+  or an existing env file. If a required key cannot be resolved, still emit the config entry but
+  call out the unresolved key in that application's Rationale as a GAP (so the human fixes
+  ENVIRONMENT.md before approving) — never silently drop it.
+- **managed content** — for a `managed: yes` file, write the resolved body verbatim into the plan
+  as a fenced block (`path=<file>`). Values (including credentials) are emitted verbatim under the
+  dev-environment plaintext rule; they must never appear in the Rationale narrative.
+
+Only list files the app actually reads at runtime — do not invent config files. An app that needs
+no config file gets an empty config list.
+
+### Infrastructure (status-only)
+
+Supporting 3rd-party services are **not** built/started/deployed by the CI/CD app — they are
+surfaced status-only. For each service resolved in Gather step 5, decide:
+
+- **id**: a stable kebab-case key unique within the plan (e.g. `postgres-main`, `keycloak`).
+- **name**: display name (e.g. `PostgreSQL (skf_main)`, `Keycloak`).
+- **host** / **port**: the address the CI/CD app TCP-probes for reachability; default host
+  `127.0.0.1`. Use the values ENVIRONMENT.md documents.
+- **url**: the web console/UI opened in a new tab, when the service has one (Keycloak admin,
+  MinIO console, Mailcatcher inbox); `-` for headless services (PostgreSQL, Redis).
+- **description**: a short blurb (e.g. `Shared app database`, `S3-compatible object storage`).
+
+Never emit credentials into the infrastructure entries — status and links only.
+
+## Phase 3 — Write the plan
+
+Create `cicd/` if missing and write `cicd/CICD_PLAN.md` (shown here in a 4-backtick fence so the
+inner ```env config block renders — the plan file itself uses a normal 3-backtick env fence):
+
+````markdown
+# CI/CD Deployment Plan — <Project Name>
+
+**Generated**: <ISO date>
+**Status**: IN PROGRESS
+
+## CI/CD App
+
+- **Port**: <port>
+- **Folder**: cicd/app
+
+## Deployment Decisions
+
+| Application | Folder | Method | Port | Build | Start | Stop | Deploy Method | Deploy | Health |
+|---|---|---|---|---|---|---|---|---|---|
+| <name> | <folder> | process|container | <port> | `<cmd>` | `<cmd>` | process-kill|docker stop | none|web-server|docker|kubernetes | `<cmd or ->` | <url> |
+
+> **Running-detection**: the generated CI/CD app determines "is it running?" by a TCP connect to
+> each application's **Port** on both IPv4 (`127.0.0.1`) and IPv6 (`::1`) loopback plus the
+> **Health** host — so an app is detected whichever family it binds. Use a `localhost` Health host
+> for Node/Vite/Next apps (they bind IPv6 `::1`) and `127.0.0.1` for JVM apps.
+
+> **`{VERSION}` token**: Build/Start/Deploy commands may contain the literal `{VERSION}`;
+> the generated CI/CD app replaces it with the project's CURRENT version (semver without
+> the `v` prefix, `latest` when unknown) at execution time — no user-facing selector.
+> Used by the docker-image path to tag images; tag-only — the code built is always the
+> working tree.
+
+## Docker
+
+Written only from Gather 2a. When Docker or a docker repo is absent, write the section as:
+`_Not dockerized — Docker and/or a docker repo are not configured in DEVTOOL.md/ENVIRONMENT.md._`
+
+**Registry**: <repo, e.g. `registry.example.com/team`>
+
+| Application | Image | Dockerfile |
+|---|---|---|
+| <name> | `<repo>/<app_folder>` | existing \| managed |
+
+## Dockerfiles
+
+One fenced block per `managed` Dockerfile (omit the section body — `_All Dockerfiles exist._`
+— when every dockerized app already has one; `_Not dockerized._` when the Docker section is
+inactive). The generated CI/CD app writes each body to `<app_folder>/Dockerfile` before Build
+only when the file is missing on disk — an existing Dockerfile is never overwritten.
+
+```dockerfile path=<app_folder>/Dockerfile
+FROM node:22-slim
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --omit=dev
+COPY . .
+EXPOSE <port>
+CMD ["node", "dist/index.js"]
+```
+
+## Application Configs
+
+The runtime config each application needs to START SUCCESSFULLY. The generated CI/CD app writes any
+`managed=yes` file into the application folder before Build/Start when it is missing, and shows
+every file (source, status, required keys, live content) in the per-application Config modal for
+troubleshooting. One table per application; `Path` is relative to the application folder.
+
+### <App Name> (<folder>)
+
+| Path | Source | Managed | Required Keys |
+|---|---|---|---|
+| .env | environment | yes | DATABASE_URL, REDIS_HOST, PORT |
+| .env-uat | env-file | no | DATABASE_URL, REDIS_HOST |
+
+For each `Managed=yes` row, follow it with the resolved file body (verbatim — credentials allowed
+under the dev-plaintext rule):
+
+```env path=.env
+DATABASE_URL=postgres://app:app@127.0.0.1:5432/appdb
+REDIS_HOST=127.0.0.1
+PORT=3000
+```
+
+Omit the fenced block for `env-file` rows (the file is used as-is on disk). If an application needs
+no config file, write `_No runtime config files._` under its heading.
+
+## Infrastructure
+
+Supporting 3rd-party services shown status-only (TCP reachability) on the CI/CD app's
+Infrastructure page. Leave the table body empty when the project declares no supporting services.
+
+| Id | Service | Host | Port | Console URL | Description |
+|---|---|---|---|---|---|
+| <id> | <name> | <host> | <port> | `<url or ->` | <blurb> |
+
+## Rationale
+
+- <per-application: why this method/commands, citing ENVIRONMENT.md/DEVTOOL.md evidence>
+````
+
+Then flip `**Status**: IN PROGRESS` to `**Status**: COMPLETED`. The studio watcher advances
+only on COMPLETED.
+
+## STOP — Hand Back to the Human
+
+Print a one-paragraph summary and STOP. Never invoke util-gencicdscript or any other skill —
+the human reviews and approves the plan in the studio's CI/CD screen first.
+
+## Important Rules
+
+- Never write the CI/CD app; never modify PRD.md/CLAUDE.md/BUG.md.
+- Never delete an existing `**Approved**:` line if re-planning over a previous plan — overwrite
+  the whole file WITHOUT any Approved line (a re-plan always requires fresh approval).
+- Credentials from ENVIRONMENT.md may be referenced in commands verbatim (dev-environment
+  plaintext rule) but never echoed into the Rationale narrative.