@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/flag-delete/SKILL.md

@@ -0,0 +1,167 @@
+---
+name: flag-delete
+description: "This skill should be used to delete a runtime feature flag end-to-end (the inverse of flag-create): removes it from Flagsmith, server.ts RUNTIME_FLAGS, .env.example, the flag-set-role flip.sh map, and Doppler dev+prd, with a WORM audit and typed-yes guardrail."
+disable-model-invocation: true
+---
+
+<!-- soleur-cloud-mode:start -->
+**Cloud Mode (Devin):** before pipeline work run `bash "${CLAUDE_PLUGIN_ROOT}/scripts/cloud-detect.sh"`. If `CLAUDE_PLUGIN_ROOT` is unset (cloud exec shells do not export it), resolve the root by IDENTITY, never by script basename: for `d` in `"$HOME/.local/share/devin/cli/plugins/cache"` and `/opt/.devin/plugins`, skip unless `[ -d "$d" ]`, then `MANIFEST="$(find "$d" -path '*/.claude-plugin/plugin.json' -exec grep -l '"name"[[:space:]]*:[[:space:]]*"soleur"' {} + 2>/dev/null | head -1)"`, `ROOT="${MANIFEST%/.claude-plugin/plugin.json}"` — one resolution, two consumers: `$ROOT/scripts/cloud-detect.sh` and `$ROOT/scripts/precommit-guard.sh`. (Shape check, not authentication: a planted `{"name":"soleur"}` dir passes — ADR-179 A11.) `local` or `not-local:no-devin-env` proceeds normally; any other `not-local:<reason>` applies `<plugin-root>/devin/INSTRUCTIONS.md` §Cloud Mode: emit the `--banner`, fan out sequentially with `Reviewed-Coverage: sequential-fallback` disclosure (never claim an independent review ran), `message_user` ack before any secrets read or production mutation, and run `precommit-guard.sh` before any `git commit` — hooks do not fire in cloud.
+<!-- soleur-cloud-mode:end -->
+
+<!-- grok-harness-invoke:start -->
+**Grok Build (`plugins/soleur/lib/harness.ts` `invokeSkill()`):** Read this SKILL.md in this process and run it to completion. A one-segment `soleur:<name>` in this document names a SKILL — on Grok Build, Read `plugins/soleur/skills/<name>/SKILL.md` in this process; it is not a nested tool_use. A multi-segment id such as `soleur:<domain>:<name>` names an AGENT: spawn it, never Read it, and on Grok Build spawn_subagent takes the id with its colons replaced by hyphens (`agentIdToGrokSubagentType`). **Claude Code:** Skill tool for a skill (`soleur:<name>`), Task tool with `subagent_type` for an agent. Forbidden is executing a subset, not the Read.
+<!-- grok-harness-invoke:end -->
+
+# flag-delete
+
+Removes a runtime feature flag from **all five** sites — the exact inverse of
+`flag-create`, the **Delete** verb of the flag CRUD set. Destructive: gated by a
+dry-run, a typed-`yes` confirmation, and a WORM audit row written before any
+mutation.
+
+## When to use
+
+- Retiring a runtime flag whose rollout is complete (or was abandoned).
+- Before deleting, run `soleur:flag-list` to see the flag's blast radius
+  (which segments/roles/orgs it targets — all destroyed by the Flagsmith
+  cascade).
+
+## When NOT to use
+
+- Turning a flag off without removing it → `soleur:flag-set-role <flag> <env> off`.
+- Removing a build-time DCE flag (`dev-signin`) → hand-edit `ENV_FLAGS` in
+  `server.ts` + `.env.example` (it has no Flagsmith feature).
+
+## When to use this skill vs other flag skills
+
+The flag CRUD set: `soleur:flag-create` (Create), `soleur:flag-set-role`
+(Update — per-role/per-org), `soleur:flag-list` (Read),
+**`soleur:flag-delete` (Delete — this)**. Initial wiring is the
+`${CLAUDE_PLUGIN_ROOT}/skills/flag-bootstrap/SETUP.md` runbook (operator documentation, not an invocable
+skill).
+
+## Arguments
+
+<arguments> #$ARGUMENTS </arguments>
+
+Required positional: `<kebab-flag-name>`.
+Optional: `--dry-run` (enumerate the 5 mutations and exit before any change).
+
+There is intentionally **no** `--yes`/`--force` bypass — the typed-`yes` prompt
+always gates a real delete, and it needs a person at a terminal, because the audit row accepts only that
+acknowledgement (ADR-249; staged-gate migration is tracked in #9387).
+
+## Prerequisites
+
+- Doppler authed with access to `soleur` configs `dev`, `prd`, `cli_ops`.
+- Worktree of the soleur repo (the script edits `apps/web-platform/` + `flip.sh`).
+- `curl` + `python3` + `jq` on PATH.
+
+## Procedure
+
+The agent runs only the preview:
+
+```bash
+bash "${CLAUDE_PLUGIN_ROOT}/skills/flag-delete/scripts/delete.sh" <flag-name> --dry-run
+```
+
+## The write is the one typed-`yes` handoff (ADR-249)
+
+The write path asks for a typed `yes` through the operator-script library's TTY
+acknowledgement, because the audit row this script writes records only that kind of
+acknowledgement (ADR-249); moving it to the staged agent-run approval gate that
+generated operator scripts use is tracked in #9387. It has no skip variable and no
+flag. An agent's shell has no TTY, so a write run there stops with exit `64` and `SOLEUR_BOOTSTRAP_INPUT_REQUIRED` on
+stdout, before any credential is fetched. Exit `64` is a refusal, never a success.
+The agent therefore does every other step itself (reads, the dry-run preview,
+preflight, verification) and hands over only the typed-`yes` write:
+
+1. Runs the script with `--dry-run` and shows the preview. That mode needs no TTY
+   and makes no writes.
+2. Prints the exact write command below, in a fenced block, for the operator to type
+   at a terminal prompt (Warp), the one step an agent cannot take. It replaces `<WORKTREE>` with the absolute path of
+   the worktree that holds this change (`git rev-parse --show-toplevel`) and
+   `<ARGS>` with `<flag-name>`, without `--dry-run`. It never prints a
+   `${CLAUDE_PLUGIN_ROOT}` or repo-relative form. The script also edits repo files in the directory it runs from, so an operator running it from the main checkout or another worktree would land the code wiring in the wrong tree while Flagsmith and Doppler change.
+3. Does not run the command, and does not run it through Claude Code's `!` prefix
+   either (whether that gives the command a TTY is unmeasured, ADR-249). The
+   printed command is an undone operator step under
+   `wg-block-pr-ready-on-undeferred-operator-steps`: record it where the pipeline
+   tracks operator steps, and do not mark a PR ready until the operator says it ran.
+
+<!-- operator-write-command -->
+```bash
+cd <WORKTREE> && bash <WORKTREE>/plugins/soleur/skills/flag-delete/scripts/delete.sh <ARGS>
+```
+
+The operator types `yes` at the prompt. Any other answer stops the script with exit
+`1` and `SOLEUR_BOOTSTRAP_ABORTED stage=ack`, before anything is written.
+
+The script (full in [scripts/delete.sh](./scripts/delete.sh)) deletes from **5
+sites** (the issue's 4-site framing misses the `flip.sh` map):
+
+1. **Flagsmith feature** — `DELETE /api/v1/projects/39082/features/{id}/` →
+   HTTP 204. The DB cascade removes all segment + identity overrides; no manual
+   pre-deletion needed. The feature_id is resolved by an **exact** `name ==`
+   match (the `?q=` filter is substring, so a bare pick could delete the wrong
+   feature).
+2. **server.ts** — strip the `"<name>": "FLAG_<X>"` entry from `RUNTIME_FLAGS`.
+3. **.env.example** — remove the `FLAG_<X>=` line.
+4. **flip.sh** — remove the `["<name>"]="FLAG_<X>"` entry from the
+   `flag-set-role` `FLAG_ENV_VARS` map (a stale entry lets `flag-set-role` try
+   to flip a deleted flag).
+5. **Doppler** — delete the secret in `soleur/dev` AND `soleur/prd` (each delete
+   line redirects stdout to `/dev/null` — the Doppler delete command otherwise
+   prints the full remaining config).
+
+Order: name-validate → confirm flag present in `RUNTIME_FLAGS` → resolve
+Flagsmith id → propose/dry-run/typed-`yes` → **WORM audit (action `archive`)
+before any mutation** → Flagsmith DELETE → code edits → Doppler deletes →
+verify deletion.
+
+## Exit codes
+
+- `0` — success / dry-run.
+- `1` — name validation failure (or flag not in `RUNTIME_FLAGS`), or the operator
+  did not type `yes` (`SOLEUR_BOOTSTRAP_ABORTED stage=ack`; nothing mutated).
+- `2` — prerequisite missing.
+- `3` — Flagsmith API error (non-204 DELETE).
+- `4` — file edit or audit append failed.
+- `5` — Doppler delete failed.
+- `64` — a write run with no TTY (`SOLEUR_BOOTSTRAP_INPUT_REQUIRED`): nothing was
+  fetched or changed; hand the command to the operator (above).
+
+## Recovery from a partial delete
+
+The 5 sites fail independently. The exit code + stderr message identify how far
+the delete got, so a partial state is recoverable:
+
+- **exit 3** — nothing mutated (Flagsmith DELETE is the first mutation; a
+  non-204 means no code/Doppler change). Re-run is safe.
+- **exit 4, "FATAL: audit RPC …"** — pre-mutation: the WORM append failed
+  before the Flagsmith DELETE, so nothing changed. Re-run is safe.
+- **exit 4, server.ts/.env.example/flip.sh edit message** — the Flagsmith
+  feature is gone but a code edit failed. Half-deleted: finish the remaining
+  edits + Doppler deletes by hand, or re-run (the code-cleanup steps are
+  idempotent — each is a no-op if already removed).
+- **exit 5** — Flagsmith + all code files done; a Doppler delete failed. Re-run
+  (idempotent) or remove `FLAG_<X>` from Doppler dev/prd by hand.
+
+A clean exit `0` is the full-delete signal. The WORM `action` enum (migration
+071: `on`/`off`/`create`/`archive`) has no "delete" value — `archive` is the
+sanctioned flag-removed action, so no schema change is needed.
+
+## Sharp edges
+
+- **Destructive + edits source files.** Run from a clean worktree and review
+  the diff (server.ts + .env.example + flip.sh) before committing.
+- The Flagsmith name is **reusable** after delete (the soft-delete unique index
+  ignores deleted rows — verified live 2026-06-15), so a create→delete→recreate
+  round-trip works.
+- The management API key is read via `doppler secrets get … -c cli_ops --plain`
+  and passed only on curl's stdin config — never echoed.
+
+## Cross-references
+
+- ADR: `knowledge-base/engineering/architecture/decisions/ADR-038-feature-flags-flagsmith.md`
+- Inverse skill: `soleur:flag-create`. Sibling skills: `soleur:flag-list`, `soleur:flag-set-role`.

package/skills/flag-delete/scripts/delete.sh

@@ -0,0 +1,288 @@
+#!/usr/bin/env bash
+# Delete a runtime feature flag end-to-end — the exact inverse of flag-create.
+# Removes the flag from ALL FIVE sites:
+#   1. Flagsmith feature (DELETE → 204; DB cascade removes all segment/identity overrides)
+#   2. server.ts RUNTIME_FLAGS entry
+#   3. .env.example FLAG_<X>= line
+#   4. flag-set-role/scripts/flip.sh FLAG_ENV_VARS map entry (the 5th site the
+#      issue's 4-site framing misses — a stale entry lets flag-set-role try to
+#      flip a deleted flag)
+#   5. Doppler secret in soleur/dev AND soleur/prd
+#
+# Contract: SKILL.md in the parent directory. Inverse of flag-create/scripts/create.sh.
+#
+# Usage: bash delete.sh <kebab-name> [--dry-run]
+#
+# Run the write in your OWN terminal: the ack below needs a person to type yes.
+# An agent runs only `--dry-run` and prints this command for the operator.
+#
+# Exit codes (same map as create.sh):
+#   0 — success / dry-run
+#   1 — name validation failure, or the operator did not type yes at the ack
+#       (stdout: SOLEUR_BOOTSTRAP_ABORTED stage=ack; nothing mutated)
+#   2 — prerequisite missing
+#  64 — no TTY on stdin for a write run (stdout: SOLEUR_BOOTSTRAP_INPUT_REQUIRED);
+#       refused before any credential fetch or network call (#8486)
+#   3 — Flagsmith API error
+#   4 — file edit / audit append failed
+#   5 — Doppler delete failed
+#
+# Per-exit-code recovery state (a destructive op's audit trail must distinguish
+# full from partial delete — see SKILL.md "Recovery from a partial delete").
+# The stderr message disambiguates the two exit-4 sub-cases:
+#   exit 3 → nothing mutated (Flagsmith DELETE was the first mutation; a non-204
+#            means no code/Doppler change happened). Re-run is safe.
+#   exit 4 (audit message "FATAL: audit RPC …") → pre-mutation: the WORM append
+#            failed BEFORE the Flagsmith DELETE, so nothing was mutated. Re-run safe.
+#   exit 4 (server.ts/.env.example/flip.sh edit message) → Flagsmith feature is
+#            GONE but a code-file edit failed. Half-deleted: finish the remaining
+#            edits + Doppler deletes by hand (or re-run — the code-cleanup steps
+#            are idempotent: each is a no-op if already removed).
+#   exit 5 → Flagsmith + all code files done; a Doppler delete failed. Re-run
+#            (idempotent) or remove FLAG_<X> from Doppler dev/prd by hand.
+#
+# Audit action: 'archive' (migration 071's WORM check constraint allows
+# on/off/create/archive — 'archive' is the sanctioned flag-removed action; no
+# schema change needed). before=current default_enabled, after=null.
+
+set -euo pipefail
+
+# (#7797) Refuse to run under shell tracing. UNCONDITIONAL — deliberately NOT
+# gated on a non-emptiness test of the credential variable, because
+# every credential this script handles (the Flagsmith management key, and the
+# soleur/prd SUPABASE_SERVICE_ROLE_KEY the audit helper binds) is acquired by
+# `doppler secrets get` BELOW this point, so a conditional arm would test an empty
+# variable at guard time, open, and then trace the acquisition itself. The refusal
+# prints on STDOUT because agent runtimes surface stdout and swallow stderr
+# (knowledge-base/project/constitution.md > Code Style).
+case "$-" in
+  *x*)
+    printf '[FATAL] refusing to run under xtrace: this script handles a live credential and -x would print it (see #7797)\n'
+    exit 78
+    ;;
+esac
+
+# (#7873) `--disable` closes ~/.curlrc and `--noproxy '*'` closes the proxy vars,
+# but neither touches the env that subverts TLS ITSELF. SSLKEYLOGFILE writes the
+# session keys and the CA vars substitute the trust store, so a CURL_CA_BUNDLE
+# MITM of these credentials works with every other guard fully intact.
+unset SSLKEYLOGFILE CURL_CA_BUNDLE SSL_CERT_FILE SSL_CERT_DIR CURL_HOME \
+      HOSTALIASES LOCALDOMAIN RES_OPTIONS
+
+# Shared WORM audit-append helper (PostgREST RPC). See #4581 PR-1.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../../../scripts/audit-flag-flip.sh"
+
+# Human-presence gate (#8486, ADR-249). Every production write below waits on the
+# operator-script library's class-2 ack, which has NO skip variable and no flag:
+# it needs a person typing `yes` at a terminal, so an agent's tool subprocess
+# (no TTY) is refused with exit 64 before any credential fetch. Clear anything an
+# inherited environment could use to pre-empt the library's double-source guard
+# or to stand in for its ack before sourcing it. (BASH_ENV runs before this
+# script and cannot be cleared from inside it — recorded in ADR-249 as a
+# hijack-class residual.)
+unset _SOLEUR_OPERATOR_SCRIPT_LOADED SOLEUR_OP_ACKED
+unset -f soleur_op_ack_or_die soleur_op_input_required soleur_op_aborted
+# shellcheck source=../../../scripts/lib/operator-script.sh
+source "$SCRIPT_DIR/../../../scripts/lib/operator-script.sh"
+[[ ${SOLEUR_OP_LIB_API:-0} -eq 1 ]] || {
+  printf 'SOLEUR_BOOTSTRAP_LIB_INCOMPATIBLE need=1 got=%s\n' "${SOLEUR_OP_LIB_API:-0}"
+  exit 64
+}
+
+readonly FLAGSMITH_PROJECT_ID=39082
+readonly FLAGSMITH_API="https://api.flagsmith.com/api/v1"
+readonly SERVER_TS="apps/web-platform/lib/feature-flags/server.ts"
+readonly ENV_EXAMPLE="apps/web-platform/.env.example"
+readonly FLIP_SH="plugins/soleur/skills/flag-set-role/scripts/flip.sh"
+
+DRY_RUN=0
+NAME=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run) DRY_RUN=1; shift ;;
+    --*)       echo "unknown flag: $1" >&2; exit 1 ;;
+    *)         NAME="$1"; shift ;;
+  esac
+done
+
+# --- name validation FIRST, before ANY interpolation (security P0-2) --------
+# $NAME is later interpolated into python3 source, the ?q= URL, and grep/sed
+# patterns; an unvalidated name with a quote/newline/regex metachar is an
+# injection vector. This is the first executable line after arg parse.
+[[ -z "$NAME" ]] && { echo "Usage: delete.sh <kebab-name> [--dry-run]" >&2; exit 1; }
+[[ ! "$NAME" =~ ^[a-z][a-z0-9-]*[a-z0-9]$ ]] && { echo "name must be lowercase kebab-case (got: $NAME)" >&2; exit 1; }
+
+ENV_VAR="FLAG_$(echo "$NAME" | tr 'a-z-' 'A-Z_')"
+
+# --- no TTY, no write: refuse before any credential fetch or network call ---
+if [[ $DRY_RUN -eq 0 ]]; then [[ -t 0 ]] || soleur_op_input_required "destructive-write-ack(no-skip-variable-by-design)" ack; fi
+
+# --- prerequisites ----------------------------------------------------------
+command -v curl >/dev/null    || { echo "missing: curl" >&2; exit 2; }
+command -v python3 >/dev/null || { echo "missing: python3" >&2; exit 2; }
+command -v doppler >/dev/null || { echo "missing: doppler" >&2; exit 2; }
+[[ -f "$SERVER_TS" ]]   || { echo "missing $SERVER_TS (run from repo root / worktree)" >&2; exit 2; }
+[[ -f "$ENV_EXAMPLE" ]] || { echo "missing $ENV_EXAMPLE" >&2; exit 2; }
+[[ -f "$FLIP_SH" ]]     || { echo "missing $FLIP_SH" >&2; exit 2; }
+
+# --- validate the flag EXISTS (inverse of create's "already registered") ----
+if ! grep -qE "\"${NAME}\"" "$SERVER_TS"; then
+  echo "'$NAME' is not in $SERVER_TS RUNTIME_FLAGS — nothing to delete (use flag-list to see active flags)" >&2
+  exit 1
+fi
+
+TOKEN=$(doppler secrets get FLAGSMITH_MANAGEMENT_API_KEY -p soleur -c cli_ops --plain 2>/dev/null || true)
+[[ -z "$TOKEN" ]] && { echo "FLAGSMITH_MANAGEMENT_API_KEY not in Doppler soleur/cli_ops" >&2; exit 2; }
+
+# Token-shape guard: a newline in the key would inject a curl config directive on the stdin
+# channel below. Never echoes the value.
+_bearer_ok() { local LC_ALL=C; case "${1:-}" in ''|*[!A-Za-z0-9._~+/=-]*) return 1 ;; esac; }
+_bearer_ok "$TOKEN" || { echo "FLAGSMITH_MANAGEMENT_API_KEY has an unexpected shape" >&2; exit 2; }
+
+# The Flagsmith management key travels on curl's stdin config channel, never on argv.
+fs_api() {
+  curl --disable --noproxy '*' -sS -H "Content-Type: application/json" "$@" --config - \
+    < <(printf 'header = "Authorization: Api-Key %s"\n' "$TOKEN")
+}
+
+# --- resolve Flagsmith feature_id via EXACT-name filter (security P2-2) ------
+# ?q= is substring (name__icontains) — a bare pick could DELETE the wrong
+# feature, so filter to f['name'] == NAME exactly (create.sh's EXISTING= shape).
+RESOLVED=$(fs_api "${FLAGSMITH_API}/projects/${FLAGSMITH_PROJECT_ID}/features/?q=${NAME}&page_size=100" \
+  | python3 -c "
+import json, sys
+d = json.load(sys.stdin)
+for f in d.get('results', []):
+    if f['name'] == '$NAME':
+        print(f\"{f['id']}\t{str(bool(f.get('default_enabled'))).lower()}\"); sys.exit(0)
+" 2>/dev/null || true)
+FEATURE_ID="${RESOLVED%%$'\t'*}"
+DEFAULT_ENABLED="${RESOLVED##*$'\t'}"
+[[ "$RESOLVED" != *$'\t'* ]] && { FEATURE_ID=""; DEFAULT_ENABLED=""; }
+
+# --- propose ----------------------------------------------------------------
+echo "→ Proposed deletion of flag '$NAME' (5 sites):"
+if [[ -n "$FEATURE_ID" ]]; then
+  echo "  1. Flagsmith: DELETE feature '$NAME' (id=$FEATURE_ID; cascade removes all segment/identity overrides)"
+else
+  echo "  1. Flagsmith: feature '$NAME' NOT FOUND — skipping (code-side cleanup continues; drift recovery)"
+fi
+echo "  2. $SERVER_TS: remove \"$NAME\": \"$ENV_VAR\" from RUNTIME_FLAGS"
+echo "  3. $ENV_EXAMPLE: remove $ENV_VAR= line"
+echo "  4. $FLIP_SH: remove [\"$NAME\"]=\"$ENV_VAR\" from FLAG_ENV_VARS map"
+echo "  5. Doppler: delete $ENV_VAR in soleur/dev AND soleur/prd"
+
+if [[ $DRY_RUN -eq 1 ]]; then
+  echo "(dry-run — exiting 0 before any mutation)"
+  exit 0
+fi
+
+soleur_op_ack_or_die "Delete flag '${NAME}' from Flagsmith, the code and Doppler (dev + prd) now? Type yes: "
+
+# --- audit append (WORM) BEFORE any mutation --------------------------------
+# Records intent: action=archive (migration 071's sanctioned flag-removed
+# action), target=global, before=current enablement, after=null. Abort (exit 4)
+# on audit failure — destructive ops must be audited.
+ACTOR=$(doppler secrets get OPERATOR_EMAIL -p soleur -c cli_ops --plain 2>/dev/null | tr '[:upper:]' '[:lower:]')
+[[ -z "$ACTOR" ]] && { echo "FATAL: OPERATOR_EMAIL not in Doppler soleur/cli_ops" >&2; exit 4; }
+AUDIT_URL=$(doppler secrets get SUPABASE_URL -p soleur -c dev --plain 2>/dev/null) || true
+AUDIT_SRK=$(doppler secrets get SUPABASE_SERVICE_ROLE_KEY -p soleur -c dev --plain 2>/dev/null) || true
+[[ -z "$AUDIT_URL" || -z "$AUDIT_SRK" ]] && { echo "FATAL: SUPABASE_URL / SUPABASE_SERVICE_ROLE_KEY not in Doppler soleur/dev" >&2; exit 4; }
+BEFORE_BOOL=$([[ "$DEFAULT_ENABLED" == "true" || "$DEFAULT_ENABLED" == "false" ]] && echo "$DEFAULT_ENABLED" || echo null)
+AUDIT_ID=$(audit_flag_flip_rpc "$AUDIT_URL" "$AUDIT_SRK" "$NAME" "dev" "global" "archive" "$BEFORE_BOOL" null "$ACTOR") || exit 4
+echo "  audit_id=$AUDIT_ID"
+
+# --- 1. DELETE Flagsmith feature (first mutation) ---------------------------
+if [[ -n "$FEATURE_ID" ]]; then
+  echo "→ Deleting Flagsmith feature '$NAME' (id=$FEATURE_ID)…"
+  CODE=$(fs_api -o /dev/null -w '%{http_code}' -X DELETE "${FLAGSMITH_API}/projects/${FLAGSMITH_PROJECT_ID}/features/${FEATURE_ID}/")
+  [[ "$CODE" == "204" ]] || { echo "Flagsmith DELETE returned HTTP $CODE (expected 204)" >&2; exit 3; }
+  echo "  deleted (HTTP 204; cascade removed all overrides)"
+else
+  echo "→ Flagsmith: feature absent, skipping (code-side cleanup continues)"
+fi
+
+# --- 2. strip server.ts RUNTIME_FLAGS entry --------------------------------
+echo "→ Editing $SERVER_TS…"
+NAME="$NAME" python3 <<'PY' || exit 4
+import os, re, sys
+p = "apps/web-platform/lib/feature-flags/server.ts"
+name = os.environ["NAME"]
+with open(p) as f: src = f.read()
+m = re.search(r'(const RUNTIME_FLAGS = \{)(.*?)(\}[ \t]*as const;)', src, re.DOTALL)
+if not m:
+    print('RUNTIME_FLAGS block not found in', p, file=sys.stderr); sys.exit(1)
+body = m.group(2)
+# Remove the "<name>": "FLAG_<X>", line (with surrounding indentation/newline).
+new_body, n = re.subn(r'\n[ \t]*"' + re.escape(name) + r'"\s*:\s*"[A-Z0-9_]+"\s*,?', '', body)
+if n == 0:
+    print(f'no RUNTIME_FLAGS entry for "{name}" found', file=sys.stderr); sys.exit(1)
+src = src[:m.start(2)] + new_body + src[m.end(2):]
+with open(p, 'w') as f: f.write(src)
+print(f'  removed {n} RUNTIME_FLAGS entr{"y" if n==1 else "ies"} for "{name}"')
+PY
+
+# --- 3. remove .env.example FLAG_<X>= line ---------------------------------
+echo "→ Editing $ENV_EXAMPLE…"
+ENV_VAR="$ENV_VAR" python3 <<'PY' || exit 4
+import os, sys
+p = "apps/web-platform/.env.example"
+ev = os.environ["ENV_VAR"]
+with open(p) as f: lines = f.readlines()
+out = [l for l in lines if not l.startswith(ev + "=")]
+if len(out) == len(lines):
+    print(f'  (no {ev}= line in {p} — already absent)')
+else:
+    with open(p, 'w') as f: f.writelines(out)
+    print(f'  removed {ev}= line')
+PY
+
+# --- 4. remove flip.sh FLAG_ENV_VARS map entry (the 5th site) ---------------
+echo "→ Editing $FLIP_SH FLAG_ENV_VARS map…"
+NAME="$NAME" python3 <<'PY' || exit 4
+import os, re, sys
+p = "plugins/soleur/skills/flag-set-role/scripts/flip.sh"
+name = os.environ["NAME"]
+with open(p) as f: lines = f.readlines()
+pat = re.compile(r'^\s*\["' + re.escape(name) + r'"\]="[A-Z0-9_]+"\s*$')
+out = [l for l in lines if not pat.match(l.rstrip('\n'))]
+if len(out) == len(lines):
+    print(f'  (no FLAG_ENV_VARS entry for "{name}" — already absent)')
+else:
+    with open(p, 'w') as f: f.writelines(out)
+    print(f'  removed FLAG_ENV_VARS["{name}"] entry')
+PY
+
+# --- 5. delete Doppler secrets (dev + prd) ----------------------------------
+# `> /dev/null` is MANDATORY on each delete line: the Doppler delete command
+# prints the full remaining config to stdout (2026-05-26 learning). Never
+# echo/tee the delete output.
+echo "→ Doppler dev: delete $ENV_VAR…"
+doppler secrets delete "$ENV_VAR" -p soleur -c dev --yes > /dev/null || exit 5
+echo "→ Doppler prd: delete $ENV_VAR…"
+doppler secrets delete "$ENV_VAR" -p soleur -c prd --yes > /dev/null || exit 5
+
+# Verify deletion. The missing-key message is "Could not find requested secret"
+# (NOT "not found") with a non-zero exit — verified live 2026-06-15. `2>&1 | grep
+# -q` is safe (-q discards output; no config dump risk on the read path).
+for cfg in dev prd; do
+  if doppler secrets get "$ENV_VAR" -p soleur -c "$cfg" --plain >/dev/null 2>&1; then
+    echo "  ⚠ $ENV_VAR still present in soleur/$cfg after delete — investigate" >&2
+  else
+    echo "  ✓ $ENV_VAR gone from soleur/$cfg"
+  fi
+done
+
+# --- outcome signal (P1-1) --------------------------------------------------
+# The pre-mutation WORM row recorded intent (action=archive). Reaching this line
+# means all 5 sites succeeded — a clean exit 0 IS the full-delete signal, and the
+# per-exit-code recovery doc (header + SKILL.md) distinguishes any partial outcome
+# (non-zero exit). The WORM action enum (071) has no "complete" value, so a second
+# row would duplicate the archive action without adding signal; the exit code is
+# the authoritative full-vs-partial discriminator.
+
+echo
+echo "✓ Done. '$NAME' removed from all 5 sites. Review + commit:"
+echo "    git add $SERVER_TS $ENV_EXAMPLE $FLIP_SH && git commit -m 'feat(flags): delete $NAME runtime flag'"
+exit 0

package/skills/flag-list/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: flag-list
+description: "This skill should be used to read and audit all runtime feature flags before a promotion or delete decision: Flagsmith state, server.ts code-wiring, live Doppler dev/prd values, and per-segment overrides, with drift detection."
+---
+
+<!-- soleur-cloud-mode:start -->
+**Cloud Mode (Devin):** before pipeline work run `bash "${CLAUDE_PLUGIN_ROOT}/scripts/cloud-detect.sh"`. If `CLAUDE_PLUGIN_ROOT` is unset (cloud exec shells do not export it), resolve the root by IDENTITY, never by script basename: for `d` in `"$HOME/.local/share/devin/cli/plugins/cache"` and `/opt/.devin/plugins`, skip unless `[ -d "$d" ]`, then `MANIFEST="$(find "$d" -path '*/.claude-plugin/plugin.json' -exec grep -l '"name"[[:space:]]*:[[:space:]]*"soleur"' {} + 2>/dev/null | head -1)"`, `ROOT="${MANIFEST%/.claude-plugin/plugin.json}"` — one resolution, two consumers: `$ROOT/scripts/cloud-detect.sh` and `$ROOT/scripts/precommit-guard.sh`. (Shape check, not authentication: a planted `{"name":"soleur"}` dir passes — ADR-179 A11.) `local` or `not-local:no-devin-env` proceeds normally; any other `not-local:<reason>` applies `<plugin-root>/devin/INSTRUCTIONS.md` §Cloud Mode: emit the `--banner`, fan out sequentially with `Reviewed-Coverage: sequential-fallback` disclosure (never claim an independent review ran), `message_user` ack before any secrets read or production mutation, and run `precommit-guard.sh` before any `git commit` — hooks do not fire in cloud.
+<!-- soleur-cloud-mode:end -->
+
+<!-- grok-harness-invoke:start -->
+**Grok Build (`plugins/soleur/lib/harness.ts` `invokeSkill()`):** Read this SKILL.md in this process and run it to completion. A one-segment `soleur:<name>` in this document names a SKILL — on Grok Build, Read `plugins/soleur/skills/<name>/SKILL.md` in this process; it is not a nested tool_use. A multi-segment id such as `soleur:<domain>:<name>` names an AGENT: spawn it, never Read it, and on Grok Build spawn_subagent takes the id with its colons replaced by hyphens (`agentIdToGrokSubagentType`). **Claude Code:** Skill tool for a skill (`soleur:<name>`), Task tool with `subagent_type` for an agent. Forbidden is executing a subset, not the Read.
+<!-- grok-harness-invoke:end -->
+
+# flag-list
+
+Reads every runtime feature flag across all three sources of truth and shows
+them side by side — the **Read** verb of the flag CRUD set. Use it to audit
+active flags before a promotion (`flag-set-role`) or a delete (`flag-delete`).
+
+## When to use
+
+- Auditing active flags before promoting one dev→prd, or before deleting one.
+- Detecting drift: a Flagsmith feature with no `RUNTIME_FLAGS` entry, or a
+  code-wired flag missing from Flagsmith.
+- Seeing a flag's blast radius (which segments/roles/orgs it targets) before a
+  destructive change.
+
+## When NOT to use
+
+- Creating a flag → `soleur:flag-create`.
+- Toggling a flag per role/org → `soleur:flag-set-role`.
+- Removing a flag → the operator types `soleur:flag-delete` (user-invoked, ADR-236: the model cannot
+  run it, so hand over the exact command, rendered per `formatSkillInvocation`).
+
+## When to use this skill vs other flag skills
+
+The flag CRUD set: `soleur:flag-create` (Create), `soleur:flag-set-role`
+(Update — per-role/per-org), **`soleur:flag-list` (Read — this)**,
+`soleur:flag-delete` (Delete). Initial wiring is the `${CLAUDE_PLUGIN_ROOT}/skills/flag-bootstrap/SETUP.md`
+runbook (operator documentation, not an invocable skill).
+
+## Arguments
+
+<arguments> #$ARGUMENTS </arguments>
+
+Optional: `--json` (emit a JSON array instead of the formatted table).
+
+## Prerequisites
+
+- Doppler authed with access to `soleur` configs `dev`, `prd`, `cli_ops`.
+- Worktree of the soleur repo (the script reads `server.ts`).
+- `curl` + `python3` on PATH.
+
+## Procedure
+
+```bash
+bash "${CLAUDE_PLUGIN_ROOT}/skills/flag-list/scripts/list.sh" [--json]
+```
+
+The script (full in [scripts/list.sh](./scripts/list.sh)):
+
+1. **Fetch Flagsmith features** — `GET /api/v1/projects/39082/features/`
+   (paginated while `next` is present).
+2. **Parse code-wiring** — extract `RUNTIME_FLAGS` (and `ENV_FLAGS`) keys from
+   `apps/web-platform/lib/feature-flags/server.ts`.
+3. **Read live Doppler values** — a single targeted `FLAG_<X>` read per flag in
+   both `soleur/dev` and `soleur/prd` (never `doppler secrets download` /
+   `doppler secrets`, which dump the whole config). Always on — the dev→prd
+   value comparison is the audit's headline data, not an optional extra.
+4. **Enumerate segment overrides** — per flag, per env, resolve which segments
+   (`role-dev`, `<flag>-orgs`, …) carry an ON/OFF override (mirrors
+   `flag-set-role`'s feature-state read shape).
+5. **Flag drift** — Flagsmith-only features and code-only flags are surfaced
+   distinctly.
+6. **Render** — formatted table, or `--json` array with fields `name`,
+   `env_var`, `flagsmith_id`, `default_enabled`, `code_wired`, `doppler_dev`,
+   `doppler_prd`, `segments`.
+
+`ENV_FLAGS` (build-time DCE flags like `dev-signin`) are listed under a
+separate heading — they are not runtime/Flagsmith flags.
+
+## Exit codes
+
+- `0` — success.
+- `2` — prerequisite missing (token / binaries / `server.ts`).
+- `3` — Flagsmith API error.
+
+## Sharp edges
+
+- **Read-only.** No mutations, no WORM audit append, no `--dry-run` needed.
+- The management API key is read via `doppler secrets get … -c cli_ops --plain`
+  and passed only on curl's stdin config — never echoed.
+- A `doppler_dev`/`doppler_prd` of `unset` means the `FLAG_<X>` key is absent
+  from that Doppler config (legitimate for flags wired but not yet mirrored).
+
+## Cross-references
+
+- ADR: `knowledge-base/engineering/architecture/decisions/ADR-038-feature-flags-flagsmith.md`
+- Sibling skills: `soleur:flag-create`, `soleur:flag-set-role`, `soleur:flag-delete`