@smartsoft001-mobilems/claude-plugins 2.88.0 → 2.90.0

package/plugins/mobilems/skills/mobilems-devops-config/references/env-and-lint.md

@@ -0,0 +1,59 @@
+# Env / lint / node
+
+## `.env.dev`
+
+The CI build copies this to `.env` (`cp .env.dev .env`) before `nx build web --prod`. The values
+are **project-specific** — collect them in step 1 (from an existing `.env*`, from
+`apps/web/src/environments/environment.prod.ts`, or by prompting). Do not commit a real `.env`
+(only `.env.dev`); `.env` should already be git-ignored by the base.
+
+Template (replace the `{{...}}` placeholders):
+
+```dotenv
+APP_VERSION={{APP_VERSION}}
+
+API_URL={{API_URL}}
+SITE_URL={{SITE_URL}}
+MULTIMEDIA_URL={{MULTIMEDIA_URL}}
+```
+
+Shape of the values, using `<museum>` for the client's own slug — these are patterns to follow, not
+values to paste:
+
+```dotenv
+APP_VERSION=0.0.2
+
+API_URL=https://muza-api.<museum-domain>/
+SITE_URL=https://mobilems-muzeum-<museum>-qa.smartsoft.biz.pl/
+MULTIMEDIA_URL=https://muza-serwer-cdn.<museum-domain>/
+```
+
+`SITE_URL` is the one to get right: it drives `og:url`, `sitemap.xml` and `robots.txt`, so a value
+carried over from another project ships that project's domain in this app's SEO. Pass this project's
+expected host as the third argument to `verify-devops.sh` to have it checked.
+
+These keys map to the `/env.js` runtime-env template that `mobilems-project-init` sets up in
+`server.ts` (`API_URL`/`SITE_URL`/`APP_VERSION` are the base set; `MULTIMEDIA_URL` is the MobilEMS
+addition). If a project is missing `MULTIMEDIA_URL` handling in `server.ts`, that's a project-init
+gap — flag it, don't fix it here.
+
+## `.eslintignore`
+
+```gitignore
+node_modules
+**/tailwind.config.js
+```
+
+## `.nvmrc`
+
+A single line with the node version from step 1 — keep it identical to the Dockerfile base image
+and every workflow `node-version`:
+
+```
+{{NODE_VERSION}}
+```
+
+If a project already has a `.nvmrc` with a different version (e.g. `24.16.0` vs the team's
+`24.5.0`), treat the existing value as the source of truth for `{{NODE_VERSION}}` unless the user
+asks to bump it — then thread that one version everywhere and re-run `verify-devops.sh` to confirm
+consistency.

package/plugins/mobilems/skills/mobilems-devops-config/references/github-hygiene.md

@@ -0,0 +1,54 @@
+# `.github` hygiene — agent config does not live in `.github`
+
+`.github/` is for GitHub itself: **workflows, composite actions, and GitHub's own metadata**
+(`CODEOWNERS`, issue/PR templates, `dependabot.yml`, `git-commit-instructions.md`).
+
+Agent configuration targets the **Claude Code architecture** and belongs under `.claude/`:
+
+| Artifact           | Location                                                       |
+| ------------------ | -------------------------------------------------------------- |
+| Skills             | `.claude/skills/<name>/SKILL.md` (+ its references/scripts)    |
+| Subagents          | `.claude/agents/<name>.md`                                     |
+| Prompts / commands | `.claude/commands/<name>.md`                                   |
+| Settings, plugins  | `.claude/settings.json` (`enabledPlugins`, permissions, hooks) |
+
+Scaffolding tools drop agent config into `.github/` in the GitHub-Copilot layout instead — Nx's AI
+setup writes `.github/skills/`, `.github/agents/`, `.github/prompts/`; other tools add
+`.github/instructions/`, `.github/chatmodes/`, `.github/copilot-instructions.md`. Those files are not
+read by Claude Code, so they are inert at best. At worst they are a second, stale copy of something a
+plugin already provides: the `nx-*` skill family and `monitor-ci` (with its `ci-monitor-subagent`
+agent and `monitor-ci.prompt.md`) ship with `nx@nx-claude-plugins`, so a project that enables that
+plugin and keeps the `.github` copies maintains two versions that drift apart, with the unused one
+invisible in review.
+
+## Rule
+
+For every entry under `.github/{skills,agents,prompts,instructions,chatmodes}` and
+`.github/copilot-instructions.md`:
+
+| Case                                                                                                                                    | Action                                                                                                                                            |
+| --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Duplicate** of a plugin enabled in `.claude/settings.json` (`nx@nx-claude-plugins`, `smart@smartsoft`, `flow@*`, `mobilems@mobilems`) | **Delete** — the plugin is the single source                                                                                                      |
+| **Bespoke** to this project (no plugin ships it)                                                                                        | **Move** into `.claude/` per the table above, converting to the Claude Code layout (`.agent.md` / `.prompt.md` suffixes become plain `<name>.md`) |
+| GitHub's own metadata (`workflows`, `actions`, `CODEOWNERS`, templates, `dependabot.yml`, `git-commit-instructions.md`)                 | **Keep**                                                                                                                                          |
+
+Deciding "duplicate": compare the skill/agent name against the plugins enabled in
+`.claude/settings.json`. When a name is ambiguous, diff it against the plugin's copy under
+`node_modules` / the plugin cache; if it is materially customized, treat it as bespoke and move it.
+
+## How to apply
+
+1. List what is there — do not assume:
+   ```bash
+   ls -d .github/skills .github/agents .github/prompts .github/instructions \
+         .github/chatmodes .github/copilot-instructions.md 2>/dev/null
+   ```
+2. Classify each entry with the table above and **show the user the plan** (delete list + move list)
+   before touching anything. Deleting files is not reversible from the skill's side — ask.
+3. Apply with `git mv` / `git rm` so the history follows the move.
+4. If anything moved into `.claude/`, name it in the final summary — a project-local skill or agent
+   is a candidate for upstreaming into a plugin.
+5. Leave `.github` containing only `workflows/`, `actions/`, and GitHub metadata.
+
+> If the plugin that duplicates a deleted skill is **not** enabled in `.claude/settings.json`, enable
+> it there (`nx@nx-claude-plugins` for the Nx skills) instead of keeping the `.github` copy.

package/plugins/mobilems/skills/mobilems-devops-config/references/tooling.md

@@ -0,0 +1,105 @@
+# Update tooling
+
+`npm run update` refreshes the `@smartsoft001*` packages to `@latest`, syncs the smartsoft Claude
+plugins, and re-merges their permissions. This is generic across all museum projects — write it
+verbatim.
+
+## `tools/scripts/update.js`
+
+```js
+const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+// Clear npm cache with force
+console.log('Clearing npm cache...');
+try {
+  execSync('npm cache clean --force', { stdio: 'inherit' });
+  console.log('npm cache cleared successfully');
+} catch (error) {
+  console.error('Failed to clear npm cache:', error.message);
+}
+
+// Read package.json
+const packageJsonPath = path.join(process.cwd(), 'package.json');
+const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+
+// Get all @smartsoft001 packages
+const dependencies = packageJson.dependencies || {};
+const devDependencies = packageJson.devDependencies || {};
+const allDeps = { ...dependencies, ...devDependencies };
+
+const smartsoftPackages = Object.keys(allDeps).filter((pkg) =>
+  pkg.startsWith('@smartsoft001'),
+);
+
+if (smartsoftPackages.length === 0) {
+  console.log('No @smartsoft001 packages found');
+  process.exit(0);
+}
+
+console.log('Found @smartsoft001 packages:', smartsoftPackages);
+
+// Update all packages with single npm install command
+const packagesWithLatest = smartsoftPackages
+  .map((pkg) => `${pkg}@latest`)
+  .join(' ');
+console.log(`Updating all @smartsoft001 packages to latest...`);
+
+try {
+  execSync(`npm install ${packagesWithLatest}`, { stdio: 'inherit' });
+  console.log('All @smartsoft001 packages updated successfully!');
+} catch (error) {
+  console.error('Failed to update packages:', error.message);
+}
+
+try {
+  execSync(`claude plugin update smart@smartsoft --scope project || true`, {
+    stdio: 'inherit',
+  });
+  execSync(`claude plugin update flow@smart-pro --scope project || true`, {
+    stdio: 'inherit',
+  });
+  console.log('Claude plugins updated successfully!');
+} catch (error) {
+  console.error('Failed to update Claude plugins:', error.message);
+}
+
+try {
+  execSync(
+    `node node_modules/@smartsoft001/claude-plugins/plugins/smart/.claude-plugin/merge-permissions.js `,
+    {
+      stdio: 'inherit',
+    },
+  );
+  execSync(
+    `node node_modules/@smartsoft001/pro-claude-plugins/plugins/flow/.claude-plugin/merge-permissions.js `,
+    {
+      stdio: 'inherit',
+    },
+  );
+  console.log('Claude plugin permissions merged successfully!');
+} catch (error) {
+  console.error('Failed to merge Claude plugin permissions:', error.message);
+}
+
+console.log('Update complete!');
+```
+
+## `package.json` scripts
+
+Merge these into the existing `scripts` block (keep any scripts already there):
+
+```json
+{
+  "scripts": {
+    "update": "node ./tools/scripts/update.js",
+    "postinstall": "husky install"
+  }
+}
+```
+
+- `update` — the script above.
+- `postinstall: husky install` — installs the Husky git hooks (`.husky/commit-msg`, `pre-push`,
+  `post-merge`). Some projects use `"prepare": "husky install"` instead; if `prepare` already runs
+  `husky install`, leave it and do **not** add a duplicate `postinstall`.

package/plugins/mobilems/skills/mobilems-devops-config/references/workflows.md

@@ -0,0 +1,410 @@
+# GitHub Actions
+
+Write each file under `.github/`. `{{NODE_VERSION}}` = the node version from step 1 (keep it
+identical to `.nvmrc` and the Dockerfile). All client-specific values are GitHub Actions
+**secrets** — the files contain only `${{ secrets.* }}` references, never literals.
+
+The branch model: `development` → CI build + Docker push + dispatch QA deploy; `main` →
+push-to-client (GitLab mirror + SSH production deploy).
+
+---
+
+## `.github/actions/cached-deps/action.yml`
+
+```yaml
+name: 'Get & Cache Dependencies'
+description: 'Get the dependencies (via npm) and cache them.'
+inputs:
+  caching:
+    description: 'Whether to cache dependencies or not.'
+    required: false
+    default: 'true'
+  node-version:
+    description: 'Node version.'
+    required: false
+    default: '18'
+outputs:
+  used-cache:
+    description: 'Whether the cache was used.'
+    value: ${{ steps.install.outputs.cache }}
+runs:
+  using: 'composite'
+  steps:
+    - name: Install NodeJS
+      uses: actions/setup-node@v3
+      with:
+        node-version: ${{ inputs.node-version }}
+    - name: Cache dependencies
+      if: inputs.caching == 'true'
+      id: cache
+      uses: actions/cache@v3
+      with:
+        path: node_modules
+        key: deps-node-modules-${{ hashFiles('**/package-lock.json') }}
+    - name: Install dependencies
+      id: install
+      if: steps.cache.outputs.cache-hit != 'true' || inputs.caching != 'true'
+      run: |
+        npm ci
+        echo "cache='${{ inputs.caching }}'" >> $GITHUB_OUTPUT
+      shell: bash
+```
+
+---
+
+## `.github/workflows/development.yml`
+
+```yaml
+name: Development
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - development
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: 'write'
+      actions: 'read'
+    steps:
+      - name: Checkout git
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Setup node
+        uses: actions/setup-node@v6
+        with:
+          node-version: { { NODE_VERSION } }
+          cache: 'npm'
+      - name: Load & cache dependencies
+        id: cache-deps
+        uses: ./.github/actions/cached-deps
+        with:
+          node-version: '{{NODE_VERSION}}'
+      - name: Set version
+        run: npm version minor --no-git-tag-version
+      - id: package
+        run: |
+          echo "::set-output name=version::$(node -p "require('./package.json').version")"
+      - name: Copy .env.dev to .env
+        run: cp .env.dev .env
+      - name: Build NX
+        run: |
+          npx nx build web --prod --verbose
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to DockerHub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.GITLAB_USERNAME }}
+          password: ${{ secrets.GITLAB_TOKEN }}
+          registry: dockerregistry.mobilems.pl
+      - name: Build and push docker
+        run: |
+          docker buildx build -f apps/web/Dockerfile --build-arg VERSION=${{ steps.package.outputs.version }} -t dockerregistry.mobilems.pl/${{ secrets.GITLAB_REPO_PATH }}:${{ steps.package.outputs.version }} --push .
+      - name: Commit git
+        uses: stefanzweifel/git-auto-commit-action@v4
+        with:
+          commit_message: 'build(github): publish ${{ steps.package.outputs.version }} [skip ci]'
+          tagging_message: 'v${{ steps.package.outputs.version }}'
+
+      - uses: lasith-kg/dispatch-workflow@v1
+        id: workflow-dispatch
+        name: 'Deploy to qa'
+        with:
+          dispatch-method: workflow_dispatch
+          repo: ${{ secrets.DEPLOY_REPO }}
+          owner: smartsoft001
+          ref: main
+          workflow: deploy.yml
+          token: ${{ secrets.DEPLOY_TOKEN }}
+          workflow-inputs: |
+            {
+              "version": "${{ steps.package.outputs.version }}",
+              "env": "qa"
+            }
+```
+
+---
+
+## `.github/workflows/e2e.yml`
+
+```yaml
+name: E2E Tests
+on:
+  workflow_dispatch:
+
+jobs:
+  e2e:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: 'read'
+    steps:
+      - name: Checkout git
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Setup node
+        uses: actions/setup-node@v6
+        with:
+          node-version: { { NODE_VERSION } }
+          cache: 'npm'
+      - name: Load & cache dependencies
+        id: cache-deps
+        uses: ./.github/actions/cached-deps
+        with:
+          node-version: '{{NODE_VERSION}}'
+      - name: Copy .env.dev to .env
+        run: cp .env.dev .env
+      - name: Build NX
+        run: npx nx build web --prod --verbose
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium webkit
+      - name: Run E2E tests
+        run: npx nx e2e web-e2e
+      - name: Upload Playwright report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: |
+            dist/.playwright/apps/web-e2e/
+            apps/web-e2e/test-results/
+            lighthouse-results/
+            audit-results/
+          retention-days: 30
+```
+
+---
+
+## `.github/workflows/push-to-client.yml`
+
+```yaml
+name: Push to client
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+jobs:
+  push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Set up user
+        run: |
+          git config --global user.name "${{ secrets.GITLAB_USERNAME }}"
+          git config --global user.email "${{ secrets.GITLAB_USERNAME }}"
+
+      - name: Add remote and push
+        run: |
+          git remote add client https://${{ secrets.GITLAB_USERNAME }}:${{ secrets.GITLAB_TOKEN }}@git.mobilems.pl/${{ secrets.GITLAB_REPO_PATH }}
+          git push client --force
+
+      - name: Get package version
+        id: package
+        run: |
+          echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
+
+      - name: Install OpenVPN
+        run: sudo apt-get update && sudo apt-get install -y openvpn
+
+      - name: Create OpenVPN config file
+        run: echo "${{ secrets.OPENVPN_CONFIG }}" > /tmp/openvpn.ovpn
+
+      - name: Connect to OpenVPN
+        uses: kota65535/github-openvpn-connect-action@v3
+        with:
+          config_file: /tmp/openvpn.ovpn
+
+      - name: Deploy to production server
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.PROD_SSH_HOST }}
+          username: ${{ secrets.PROD_SSH_USERNAME }}
+          key: ${{ secrets.PROD_SSH_KEY }}
+          passphrase: ${{ secrets.PROD_SSH_PASSPHRASE }}
+          port: ${{ secrets.PROD_SSH_PORT }}
+          envs: VERSION,DOCKER_USER,DOCKER_PASS
+          script: |
+            cd ~/front
+            cp docker-front-stack.yml.template docker-front-stack.yml
+            sed -i "s/\$VERSION/$VERSION/g" docker-front-stack.yml
+            docker logout dockerregistry.mobilems.pl || true
+            docker login -u "$DOCKER_USER" -p "$DOCKER_PASS" dockerregistry.mobilems.pl
+            docker stack deploy -c docker-front-stack.yml front --with-registry-auth
+            docker logout dockerregistry.mobilems.pl
+        env:
+          VERSION: ${{ steps.package.outputs.version }}
+          DOCKER_USER: ${{ secrets.GITLAB_USERNAME }}
+          DOCKER_PASS: ${{ secrets.GITLAB_TOKEN }}
+```
+
+---
+
+## `.github/workflows/ai-plan.yml`
+
+```yaml
+name: AI Plan
+
+on:
+  repository_dispatch:
+    types: [linear-ai-plan]
+  workflow_dispatch:
+    inputs:
+      issue_id:
+        description: 'Linear issue identifier (e.g. GAL-123)'
+        required: true
+        type: string
+
+concurrency:
+  group: ai-plan-${{ github.event.client_payload.issue_id || github.event.inputs.issue_id }}
+  cancel-in-progress: false
+
+jobs:
+  plan:
+    uses: smartsoft001/github-actions-shared/.github/workflows/ai-plan.yml@v1
+    with:
+      issue_id: ${{ github.event.client_payload.issue_id || github.event.inputs.issue_id }}
+    secrets:
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+```
+
+---
+
+## `.github/workflows/ai-impl.yml`
+
+```yaml
+name: AI Impl
+
+on:
+  repository_dispatch:
+    types: [linear-ai-impl]
+  workflow_dispatch:
+    inputs:
+      issue_id:
+        description: 'Linear issue identifier (e.g. GAL-123). The branch will be created with this exact name.'
+        required: true
+        type: string
+      base_branch:
+        description: 'Override PR target (default: development)'
+        required: false
+        type: string
+      ai_size:
+        description: 'Manual override for AI gate classification (S/M/L). Leave empty for default M.'
+        required: false
+        type: choice
+        default: ''
+        options: ['', 'S', 'M', 'L']
+      ai_complexity:
+        description: 'Manual override for AI gate classification (S/M/L). Leave empty for default M.'
+        required: false
+        type: choice
+        default: ''
+        options: ['', 'S', 'M', 'L']
+
+concurrency:
+  group: ai-impl-${{ github.event.client_payload.issue_id || github.event.inputs.issue_id }}
+  cancel-in-progress: false
+
+jobs:
+  impl:
+    uses: smartsoft001/github-actions-shared/.github/workflows/ai-impl.yml@v1
+    with:
+      issue_id: ${{ github.event.client_payload.issue_id || github.event.inputs.issue_id }}
+      base_branch: ${{ github.event.client_payload.base_branch || github.event.inputs.base_branch || 'development' }}
+      ai_size: ${{ github.event.client_payload.ai_size || github.event.inputs.ai_size || '' }}
+      ai_complexity: ${{ github.event.client_payload.ai_complexity || github.event.inputs.ai_complexity || '' }}
+    secrets:
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+```
+
+---
+
+## `.github/workflows/ci.yml.disabled`
+
+Kept **disabled** (the `.disabled` suffix means GitHub never runs it). It's the Nx-Cloud template;
+the team enables it by renaming to `ci.yml` and uncommenting the distribution line.
+
+```yaml
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  actions: read
+  contents: read
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          filter: tree:0
+          fetch-depth: 0
+
+      # This enables task distribution via Nx Cloud
+      # Run this command as early as possible, before dependencies are installed
+      # Learn more at https://nx.dev/ci/reference/nx-cloud-cli#npx-nxcloud-startcirun
+      # Uncomment this line to enable task distribution
+      # - run: npx nx start-ci-run --distribute-on="3 linux-medium-js" --stop-agents-after="e2e-ci"
+
+      # Cache node_modules
+      - uses: actions/setup-node@v4
+        with:
+          node-version: { { NODE_VERSION } }
+          cache: 'npm'
+
+      - run: npm ci
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium
+
+      # Prepend any command with "nx-cloud record --" to record its logs to Nx Cloud
+      # - run: npx nx-cloud record -- echo Hello World
+      - run: npx nx run-many -t lint test build e2e
+      # Nx Cloud recommends fixes for failures to help you get CI green faster. Learn more: https://nx.dev/ci/features/self-healing-ci
+      - run: npx nx fix-ci
+        if: always()
+```
+
+> Note: the reference's `ci.yml.disabled` pins Node 20. We thread `{{NODE_VERSION}}` here so the
+> disabled template matches the rest of the project. If a project has a live `ci.yml` on a stale
+> node version, report the drift and ask before changing it.
+
+---
+
+## Required GitHub Actions secrets
+
+Configured in the repo's **Settings → Secrets and variables → Actions** — never committed. Print
+this table for the user after writing the workflows:
+
+| Secret                    | Used by                     | Purpose                                           |
+| ------------------------- | --------------------------- | ------------------------------------------------- |
+| `GITLAB_USERNAME`         | development, push-to-client | Docker registry + GitLab mirror user              |
+| `GITLAB_TOKEN`            | development, push-to-client | Docker registry + GitLab mirror token             |
+| `GITLAB_REPO_PATH`        | development, push-to-client | Image path / GitLab repo path                     |
+| `DEPLOY_REPO`             | development                 | Companion `<project>-deploy` repo name            |
+| `DEPLOY_TOKEN`            | development                 | Token to dispatch `deploy.yml` in the deploy repo |
+| `OPENVPN_CONFIG`          | push-to-client              | OpenVPN `.ovpn` config content                    |
+| `PROD_SSH_HOST`           | push-to-client              | Production server host                            |
+| `PROD_SSH_USERNAME`       | push-to-client              | Production SSH user                               |
+| `PROD_SSH_KEY`            | push-to-client              | Production SSH private key                        |
+| `PROD_SSH_PASSPHRASE`     | push-to-client              | SSH key passphrase                                |
+| `PROD_SSH_PORT`           | push-to-client              | SSH port                                          |
+| `CLAUDE_CODE_OAUTH_TOKEN` | ai-plan, ai-impl            | Claude Code OAuth token                           |
+| `LINEAR_API_KEY`          | ai-plan, ai-impl            | Linear API key                                    |

package/plugins/mobilems/skills/mobilems-devops-config/scripts/detect-foundation.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+#
+# detect-foundation.sh <workspace-root>
+#
+# Precondition gate for mobilems-devops-config. Confirms the target is a MobilEMS museum app whose
+# app-runtime foundation (built by mobilems-project-init) is already in place — this skill only adds
+# the ops/deployment layer on top, it does NOT set up SSR / translations / app.config.
+# Portable to the macOS system bash (3.2) — no bash-4 features.
+#
+# Exit 0  → MobilEMS foundation detected, OK to add the ops layer.
+# Exit 2  → bad workspace path.
+# Exit 3  → not a MobilEMS foundation (tell the user to run /mobilems:mobilems-project-init first).
+set -eu
+
+ROOT="${1:?usage: detect-foundation.sh <workspace-root>}"
+cd "$ROOT" 2>/dev/null || { echo "ERROR: no such dir: $ROOT" >&2; exit 2; }
+
+fail_no_foundation() {
+  echo "NOT A MOBILEMS FOUNDATION: $1" >&2
+  echo "Run /mobilems:mobilems-project-init first (this skill only adds the ops/deployment layer)." >&2
+  exit 3
+}
+
+# --- museum app + SSR foundation signals ---
+[ -f apps/web/src/server.ts ]                 || fail_no_foundation "apps/web/src/server.ts missing (no SSR)"
+[ -f package.json ]                           || fail_no_foundation "package.json missing"
+grep -q "@smartsoft001-mobilems" package.json || fail_no_foundation "@smartsoft001-mobilems/* not in package.json"
+grep -q "/api/translations" apps/web/src/server.ts || fail_no_foundation "/api/translations endpoint missing in server.ts"
+[ -f apps/web/public/translations.json ]      || fail_no_foundation "apps/web/public/translations.json missing"
+
+echo "MOBILEMS FOUNDATION OK."
+
+# --- report which ops artifacts are already present (informational; this skill fills the gaps) ---
+have() { if [ -e "$1" ]; then echo "  have: $1"; else echo "  MISSING: $1"; fi; }
+echo "Existing ops artifacts:"
+have apps/web/Dockerfile
+have .github/actions/cached-deps/action.yml
+have .github/workflows/development.yml
+have .github/workflows/e2e.yml
+have .github/workflows/push-to-client.yml
+have .github/workflows/ai-plan.yml
+have .github/workflows/ai-impl.yml
+have tools/scripts/update.js
+have .env.dev
+have .eslintignore
+have .nvmrc
+exit 0