@soleur/opencode 0.0.0-stage → 1.0.0

package/scripts/write-kb-coverage.ts

@@ -0,0 +1,113 @@
+#!/usr/bin/env bun
+// CLI wrapper for the sync coverage summary (#7332, plan Phase 3). Pure logic lives
+// in ../lib/kb-coverage.ts; this file owns the filesystem and stdout.
+//
+// Writes knowledge-base/project/kb-coverage.md and prints the same
+// SOLEUR_KB_SYNC_PRODUCERS marker to stdout — observability layer 7
+// (`cli-stdout-artifact`). Both surfaces carry a byte-identical field set.
+//
+// ‼️ COUNTS ARE DERIVED FROM KB STATE, NOT PASSED IN AS FLAGS.
+//
+// The first version took `--c4-elements` / `--c4-relationships` /
+// `--domain-model-rows` and expected sync.md to thread them from the C4 producer's
+// marker. Two things were wrong with that. `parseIntFlag` returned 0 for an ABSENT
+// flag, so an unthreaded call emitted `c4_elements=0 c4_relationships=0` — byte
+// identical to the plan's headline failure mode, i.e. the exact state this artifact
+// exists to detect, forged by forgetting a flag. And sync.md never described the
+// hand-off at all, so the threading nobody documented was also the threading nobody
+// would do (five review agents independently found this script had no call site).
+//
+// Deriving removes the failure rather than documenting around it: there is no flag
+// to forget, and every field is a function of the tree, which is what makes the
+// artifact byte-stable across runs.
+//
+// `--degraded` is the one genuinely run-scoped input and stays a flag. Its absence
+// is honest (no degraded producers) rather than a fabricated zero.
+//
+// Usage:
+//   bun plugins/soleur/scripts/write-kb-coverage.ts [--root <repo>] [--degraded "<reason>"]...
+
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import {
+  type CoverageSources,
+  assessCoverage,
+  deriveCounts,
+  formatErrorMarker,
+  formatProducersMarker,
+  renderCoverageMarkdown,
+} from "../lib/kb-coverage";
+
+const KB_DIR = "knowledge-base";
+const OUT_REL = "project/kb-coverage.md";
+const MODEL_JSON_REL = "engineering/architecture/diagrams/model.likec4.json";
+const REGISTER_REL = "engineering/architecture/domain-model.md";
+
+/** Read a file, or null when absent. Absent is a normal state here, not an error. */
+function readOrNull(path: string): string | null {
+  try {
+    return readFileSync(path, "utf8");
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw err;
+  }
+}
+
+function parseDegraded(args: string[]): string[] {
+  const out: string[] = [];
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--degraded" && i + 1 < args.length) out.push(args[i + 1]);
+  }
+  return out;
+}
+
+export function writeCoverage(root: string, degraded: string[] = []): string {
+  const kbRoot = join(root, KB_DIR);
+  const entries = assessCoverage(kbRoot);
+
+  const sources: CoverageSources = {
+    modelJson: readOrNull(join(kbRoot, MODEL_JSON_REL)),
+    registerMarkdown: readOrNull(join(kbRoot, REGISTER_REL)),
+  };
+  const counts = deriveCounts(entries, sources);
+
+  const outPath = join(kbRoot, OUT_REL);
+  mkdirSync(join(outPath, ".."), { recursive: true });
+  writeFileSync(outPath, renderCoverageMarkdown(entries, counts, degraded));
+
+  return formatProducersMarker(counts);
+}
+
+if (import.meta.main) {
+  const args = process.argv.slice(2);
+  const rootIdx = args.indexOf("--root");
+  const root = rootIdx !== -1 && rootIdx + 1 < args.length ? args[rootIdx + 1] : process.cwd();
+  try {
+    console.log(writeCoverage(root, parseDegraded(args)));
+  } catch (err) {
+    const reason = String((err as Error)?.message ?? err);
+    console.log(formatErrorMarker("coverage", reason));
+    // The artifact must carry the failure too — stdout evaporates with the session,
+    // and layer 7's whole premise is that the durable half survives it. sync.md
+    // promised this and the first version did not do it: the write lived inside the
+    // try, so a throw left either no file at all or the PREVIOUS run's file still
+    // asserting a clean run.
+    try {
+      const kbRoot = join(root, KB_DIR);
+      const entries = assessCoverage(kbRoot);
+      const counts = deriveCounts(entries, { modelJson: null, registerMarkdown: null });
+      const outPath = join(kbRoot, OUT_REL);
+      mkdirSync(join(outPath, ".."), { recursive: true });
+      writeFileSync(
+        outPath,
+        renderCoverageMarkdown(entries, counts, [`coverage producer failed: ${reason}`]),
+      );
+    } catch {
+      // Best effort. If we cannot write the artifact either, the stdout marker above
+      // is the only signal left — but it has already been emitted, so the failure is
+      // never silent.
+    }
+    process.exit(1);
+  }
+}

package/skills/admin-ip-refresh/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: admin-ip-refresh
+description: "This skill should be used to refresh the prod SSH allowlist (Doppler ADMIN_IPS) after operator IP rotation. Detects drift, mutates Doppler with explicit ack."
+disable-model-invocation: true
+---
+
+<!-- soleur-cloud-mode:start -->
+**Cloud Mode (Devin):** before pipeline work run `bash "${CLAUDE_PLUGIN_ROOT}/scripts/cloud-detect.sh"`. If `CLAUDE_PLUGIN_ROOT` is unset (cloud exec shells do not export it), resolve the root by IDENTITY, never by script basename: for `d` in `"$HOME/.local/share/devin/cli/plugins/cache"` and `/opt/.devin/plugins`, skip unless `[ -d "$d" ]`, then `MANIFEST="$(find "$d" -path '*/.claude-plugin/plugin.json' -exec grep -l '"name"[[:space:]]*:[[:space:]]*"soleur"' {} + 2>/dev/null | head -1)"`, `ROOT="${MANIFEST%/.claude-plugin/plugin.json}"` — one resolution, two consumers: `$ROOT/scripts/cloud-detect.sh` and `$ROOT/scripts/precommit-guard.sh`. (Shape check, not authentication: a planted `{"name":"soleur"}` dir passes — ADR-179 A11.) `local` or `not-local:no-devin-env` proceeds normally; any other `not-local:<reason>` applies `<plugin-root>/devin/INSTRUCTIONS.md` §Cloud Mode: emit the `--banner`, fan out sequentially with `Reviewed-Coverage: sequential-fallback` disclosure (never claim an independent review ran), `message_user` ack before any secrets read or production mutation, and run `precommit-guard.sh` before any `git commit` — hooks do not fire in cloud.
+<!-- soleur-cloud-mode:end -->
+
+<!-- grok-harness-invoke:start -->
+**Grok Build (`plugins/soleur/lib/harness.ts` `invokeSkill()`):** Read this SKILL.md in this process and run it to completion. A one-segment `soleur:<name>` in this document names a SKILL — on Grok Build, Read `plugins/soleur/skills/<name>/SKILL.md` in this process; it is not a nested tool_use. A multi-segment id such as `soleur:<domain>:<name>` names an AGENT: spawn it, never Read it, and on Grok Build spawn_subagent takes the id with its colons replaced by hyphens (`agentIdToGrokSubagentType`). **Claude Code:** Skill tool for a skill (`soleur:<name>`), Task tool with `subagent_type` for an agent. Forbidden is executing a subset, not the Read.
+<!-- grok-harness-invoke:end -->
+
+# admin-ip-refresh
+
+Detects drift between the operator's current public IP and the Hetzner Cloud Firewall allow-list (`Doppler prd_terraform/ADMIN_IPS`), proposes a corrective Doppler mutation with explicit operator ack, and emits the exact `terraform apply` invocation for the operator to run. Does NOT call Terraform directly -- per AGENTS.md `hr-all-infrastructure-provisioning-servers`, infra apply stays operator-initiated.
+
+## When to use
+
+- Reactive: operator can no longer SSH into `soleur-web-platform`, and `admin-ip-drift.md` diagnosis points to a firewall-layer drop (no `journalctl -u ssh` entry for the operator IP).
+- Proactive: operator notices their IP may have rotated (router reboot, travel, ISP change). Run pre-emptively to update `ADMIN_IPS` before the next SSH attempt fails.
+
+## Arguments
+
+<arguments> #$ARGUMENTS </arguments>
+
+Accepted flags:
+
+- `--dry-run` -- run detect/read/diff/warn steps (1-4) only. No writes. Useful for pre-incident hygiene checks.
+- `--verify` -- re-run the diff step only (no mutation). Useful after an operator has run `terraform apply` to confirm the firewall rule matches.
+- `--fast` -- emit the narrow-target `terraform apply -target=hcloud_firewall.web` form alongside the full-graph form. Default output emits the full-graph form only, per HashiCorp guidance that `-target` is for rare/recovery cases.
+
+## Prerequisites
+
+- `doppler` CLI authenticated (`doppler configure get token --plain` returns a token).
+- `hcloud` CLI authenticated (for post-apply verification; optional for steps 1-6).
+- `curl` on PATH.
+- `terraform` on PATH (skill prints the invocation; operator runs it).
+
+If `doppler` or `curl` is missing, abort with an install hint. Do not attempt to install them from the skill -- per AGENTS.md, the Bash tool runs without sudo.
+
+## Procedure
+
+Read [admin-ip-refresh-procedure.md](./references/admin-ip-refresh-procedure.md) for the full step-by-step procedure, including the egress-IP detection fallback chain, Doppler mutation pattern, and `terraform apply` emission. The sequence below is the abbreviated form.
+
+1. **Detect egress IP** via three-service fallback (`ifconfig.me` -> `api.ipify.org` -> `icanhazip.com`) with strict timeouts (`--connect-timeout 5 --max-time 10`) and IPv4 regex + octet-range validation. Abort with exit 3 if all three fail.
+2. **Read current `ADMIN_IPS`** via `doppler secrets get ADMIN_IPS -p soleur -c prd_terraform --plain`. Parse as JSON list. Abort if the secret is missing.
+3. **Diff.** If `<current-egress>/32` is in the list, print "No drift." and exit 0. If absent, show the pre-image list and the proposed post-image list (current list with `<egress>/32` appended).
+4. **Warn on list-length invariants.** Post-image length == 1 triggers a P1 warning (no rotation margin). Post-image length > 10 triggers a P2 warning (stale residue, review-and-prune recommended).
+5. **Operator ack.** Print the exact `doppler secrets set` invocation the skill will run. Wait for literal `yes` per-command ack -- no `--yes`, no `-auto-approve`, per AGENTS.md `hr-menu-option-ack-not-prod-write-auth`. Under the length-1 warning in Step 4, also require a literal `understood` ack before reaching this step.
+6. **Write Doppler.** Stdin-piped from a 0600 temp file (no CLI-arg value, no `ps auxf` leak), `--silent` to prevent value echo per Doppler's setting-secrets guide. Re-read the secret and compare byte-for-byte. Print the Doppler dashboard activity URL.
+7. **Emit `terraform` invocations.** Print the exact `terraform plan` and `terraform apply` commands (and, under `--fast`, the `-target=hcloud_firewall.web` variants) for the operator to run. Do NOT execute them.
+8. **Verify prompt.** Ask whether the operator ran `terraform apply`. On "no", record the gap in the session output and suggest a follow-up `--verify` invocation.
+
+## Exit codes
+
+The skill exits non-zero on failure so cron/one-shot invocations do not silently no-op. Full contract in [admin-ip-refresh-procedure.md](./references/admin-ip-refresh-procedure.md) §"Exit codes".
+
+- `0` -- success (no drift OR drift corrected + operator acked + invocation emitted).
+- `3` -- all three IP-detection services failed.
+- `4` -- Doppler read or write failed.
+- `5` -- operator refused the mutation (rejected the `yes` prompt OR the `understood` single-entry prompt).
+
+## Sharp Edges
+
+- **Never run `terraform apply` from the skill.** Per AGENTS.md `hr-all-infrastructure-provisioning-servers`, infra writes are operator-initiated. The skill's job is detection + Doppler mutation + command emission.
+- **Nested `doppler run` when running Terraform.** The `apps/web-platform/infra/` root uses `doppler run --name-transformer tf-var` to hydrate `TF_VAR_*` variables from Doppler. The skill's emitted commands match this pattern (see AGENTS.md `cq-when-running-terraform-commands-locally`).
+- **The emitted apply fails three ways on this root unless prepared.** (1) The S3 backend sets `use_lockfile`, so the local binary must be the workflows' `TERRAFORM_VERSION` (≥1.10; a 1.9.x errors at `init`). (2) `--name-transformer tf-var` renames `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` too, so the R2 backend sees no credentials; export those two from `prd_terraform` directly, then run the single `tf-var` `doppler run` (a nested `doppler run` inherits a token that cannot read `prd_terraform`). (3) Run from a clean `origin/main` checkout, save a `-target=hcloud_firewall.web` plan with `-out`, and confirm its only change is the added port-22 rule before applying that saved plan. **Why:** #8511 — all three hit in one session.
+- **A local apply also needs credentials `prd_terraform` does not hold.** `terraform plan` on this root requires `hcloud_token` (a write-capable Hetzner token; `prd_terraform` carries only `HCLOUD_TOKEN_READONLY`), `cf_api_token_r2` and `doppler_token_tf`, all supplied in CI by the Tier-B credential loader. Without them the plan dies on `No value for required variable`, so the reliable path is `gh workflow run apply-web-platform-infra.yml -f apply_target=manual-rerun` (needs that workflow enabled and its environment approval), not a local apply. **Why:** #9372 — the firewall rule for the operator egress could only be applied through CI.
+- **VPN / Cloudflare WARP:** `ifconfig.me` returns the egress IP the internet sees, which IS what the firewall sees. If the operator is on a VPN, adding the VPN egress to `ADMIN_IPS` is the correct behavior -- do not attempt to detect the "real" home IP behind the VPN.
+- **Doppler value echo protection.** Every `doppler secrets set` uses `--silent` and stdin-piped values. Temp files are 0600 and `shred -u`'d on exit. `ADMIN_IPS` is a list of operator egress IPs -- PII-adjacent under most interpretations, and log aggregators must not capture it.
+- **IP-detection spoofing.** The three-service fallback defends against upstream-routing anomalies where one provider returns stale or non-IPv4 content. Validate every response against `^([0-9]{1,3}\.){3}[0-9]{1,3}$` AND octet-range (<= 255) before accepting.
+- **Single-entry allow-list.** A post-image list of length 1 has no rotation margin. The skill requires the operator to type `understood` to proceed, nudging toward 2-3 known-good CIDRs (home + mobile hotspot + travel).
+
+## Related
+
+- Runbook: `knowledge-base/engineering/operations/runbooks/admin-ip-drift.md`
+- Plan: `knowledge-base/project/plans/archive/20261013-003106-2026-04-19-ops-admin-ip-drift-prevention-plan.md`
+- Institutional learning: `knowledge-base/project/learnings/2026-03-19-ci-ssh-deploy-firewall-hidden-dependency.md`
+- AGENTS.md rules: `hr-ssh-diagnosis-verify-firewall`, `hr-all-infrastructure-provisioning-servers`, `hr-menu-option-ack-not-prod-write-auth`.

package/skills/admin-ip-refresh/references/admin-ip-refresh-procedure.md

@@ -0,0 +1,201 @@
+# admin-ip-refresh -- Procedure
+
+Detailed procedure for the `admin-ip-refresh` skill. Kept out of SKILL.md to preserve the skill-description token budget.
+
+## Inputs
+
+- Flags: `--dry-run`, `--verify`, `--fast` (see SKILL.md for semantics).
+- Environment: `doppler` and `curl` on PATH; `doppler` CLI must already be authenticated.
+
+## Outputs
+
+- On no-drift: exit 0, one line summary: `No drift. Current IP X.X.X.X/32 is in ADMIN_IPS (list length N).`
+- On drift detected + `--dry-run`: exit 0, diff printed, no writes.
+- On drift detected + operator ack: Doppler mutated, `terraform` invocation emitted, exit 0.
+- On detection failure (all three IP services failed): exit 3.
+- On Doppler read/write error: exit 4.
+- On operator refusal: exit 5.
+
+## Step 1 -- Detect egress IP (three-service fallback)
+
+Query IP providers in order, accept the first response that passes validation. Strict timeouts prevent the skill from hanging on a degraded service.
+
+```bash
+detect_egress_ip() {
+  local services=(
+    "https://ifconfig.me/ip"
+    "https://api.ipify.org"
+    "https://icanhazip.com"
+  )
+  # Strict IPv4 octet: 0-9, 10-99, 100-199, 200-249, 250-255 (no leading zeros).
+  local octet='(0|[1-9][0-9]{0,1}|1[0-9]{2}|2[0-4][0-9]|25[0-5])'
+  local ipv4="^${octet}\.${octet}\.${octet}\.${octet}$"
+  for svc in "${services[@]}"; do
+    local ip
+    # --max-filesize caps the body at 64 bytes to protect the regex from
+    # a hostile/degraded provider returning multi-MB HTML.
+    ip="$(curl -fsS --connect-timeout 5 --max-time 10 --max-filesize 64 "$svc" 2>/dev/null \
+         | head -c 64 \
+         | tr -d '[:space:]')" || continue
+    if [[ "$ip" =~ $ipv4 ]]; then
+      # Reject reserved / private / link-local ranges that should never be
+      # the operator's public egress IP (indicates a broken provider or
+      # misconfigured VPN returning a local address):
+      IFS=. read -r a b c _ <<<"$ip"
+      if (( a == 0 )) ; then continue; fi                  # 0.0.0.0/8
+      if (( a == 10 )) ; then continue; fi                 # 10.0.0.0/8
+      if (( a == 127 )) ; then continue; fi                # 127.0.0.0/8 loopback
+      if (( a == 169 && b == 254 )) ; then continue; fi    # 169.254.0.0/16 link-local
+      if (( a == 172 && b >= 16 && b <= 31 )) ; then continue; fi  # 172.16.0.0/12
+      if (( a == 192 && b == 168 )) ; then continue; fi    # 192.168.0.0/16
+      echo "$ip"
+      return 0
+    fi
+  done
+  return 1
+}
+```
+
+Exit 3 (fail-closed) if all three services fail. Do not silently no-op -- a scheduled invocation with a silent no-op would hide a genuine outage.
+
+## Step 2 -- Read current ADMIN_IPS
+
+```bash
+current_raw="$(doppler secrets get ADMIN_IPS -p soleur -c prd_terraform --plain 2>/dev/null)" || {
+  echo "error: failed to read ADMIN_IPS from Doppler prd_terraform" >&2
+  exit 4
+}
+```
+
+Parse `current_raw` as a JSON list. If empty or missing, abort with: "ADMIN_IPS is not set in Doppler prd_terraform. Bootstrap it before running this skill."
+
+## Step 3 -- Diff
+
+- Compose `candidate="${egress}/32"`.
+- If `candidate` is in the parsed list: print `No drift. Current IP ${candidate} is in ADMIN_IPS (list length N).` and exit 0.
+- If `candidate` is NOT in the parsed list:
+  - Print the pre-image list.
+  - Print the post-image list (current list with `candidate` appended).
+  - Continue to Step 4.
+
+## Step 4 -- Warn on list-length invariants
+
+- **Post-image length == 1 (P1 warning).** Print:
+  > WARNING: `ADMIN_IPS` will have a single entry after this refresh. A single-entry list has no rotation margin -- the next ISP/NAT rotation will lock SSH out. Recommend adding a second known-good CIDR (home + mobile hotspot + travel) before shipping.
+  >
+  > Type `understood` to acknowledge and proceed, or Ctrl-C to abort.
+
+  Require literal `understood` input before proceeding.
+
+- **Post-image length > 10 (P2 warning).** Print:
+  > NOTICE: `ADMIN_IPS` will have N entries. Stale entries should be pruned -- review and remove CIDRs you do not recognize in a follow-up pass.
+
+  Do not require acknowledgment; continue.
+
+## Step 5 -- Operator go-ahead prompt
+
+Print the exact invocation the skill will run:
+
+```bash
+# Skill will run:
+doppler secrets set ADMIN_IPS -p soleur -c prd_terraform --silent \
+  < <temp-file>
+```
+
+Prompt the operator: `Proceed with Doppler write? Type "yes" to confirm.` Accept only literal `yes`. On anything else, print "Aborted. No changes made." and exit 5.
+
+Per AGENTS.md `hr-menu-option-ack-not-prod-write-auth`: prod-scoped Doppler mutations do NOT take `--yes`/`--force`/`--auto-approve`. Operator ack is explicit and per-command.
+
+If running under `--dry-run`, skip Steps 5-7 entirely and exit 0 after Step 4.
+
+## Step 6 -- Write Doppler
+
+Compose the new JSON list, write to a 0600 temp file, pipe via stdin, `shred -u` the temp file on exit. Never pass the list as a CLI argument -- it would leak into `ps auxf` and shell history.
+
+```bash
+umask 077
+tmp="$(mktemp -p "$(mktemp -d -t soleur-run.$$.XXXXXXXX)" admin-ips.XXXXXX)"
+trap 'shred -u "$tmp" 2>/dev/null || rm -f "$tmp"; rmdir "$(dirname "$tmp")" 2>/dev/null' EXIT
+
+# Write the new list to the temp file:
+printf '%s\n' "$new_list_json" > "$tmp"
+
+# Mutate (--silent prevents value echo):
+doppler secrets set ADMIN_IPS -p soleur -c prd_terraform --silent < "$tmp" \
+  || { echo "error: Doppler write failed" >&2; exit 4; }
+```
+
+**Verify the write.** Re-read via `doppler secrets get ADMIN_IPS --plain` and compare byte-for-byte to `new_list_json`. Doppler's write-after-write consistency is strong for single-secret mutations, but the verify step is cheap insurance.
+
+**Audit-trail URL.** Print:
+
+```text
+Doppler activity log: https://dashboard.doppler.com/workplace/projects/soleur/configs/prd_terraform/activity
+```
+
+## Step 7 -- Emit Terraform invocations
+
+Default output (full-graph `plan` + `apply`):
+
+```bash
+cd apps/web-platform/infra
+
+# Preview the change:
+doppler run --project soleur --config prd_terraform \
+  --name-transformer tf-var -- \
+  terraform plan
+
+# Apply (Terraform will prompt for confirmation -- do NOT pass --auto-approve):
+doppler run --project soleur --config prd_terraform \
+  --name-transformer tf-var -- \
+  terraform apply
+```
+
+Under `--fast`, also emit the narrow-target form with a warning:
+
+```text
+# Fast-recovery form (skips dependency graph; use only for acute recovery):
+cd apps/web-platform/infra
+doppler run --project soleur --config prd_terraform \
+  --name-transformer tf-var -- \
+  terraform plan -target=hcloud_firewall.web
+doppler run --project soleur --config prd_terraform \
+  --name-transformer tf-var -- \
+  terraform apply -target=hcloud_firewall.web
+```
+
+Per HashiCorp guidance, `-target` is for rare/recovery cases, not habitual use.
+
+## Step 8 -- Verify prompt
+
+Ask: `Did you run terraform apply? [yes / no / skip]`.
+
+- `yes`: exit 0. Suggest running `soleur:admin-ip-refresh --verify` in a follow-up session to confirm the firewall rule matches.
+- `no`: print a reminder that Doppler and firewall are now out of sync; the scheduled drift check (tracked separately) will catch it within 24 hours.
+- `skip`: exit 0 without reminder. Recorded as a session gap.
+
+## Nested `doppler run` rationale
+
+The `apps/web-platform/infra/` Terraform root hydrates variables via `doppler run --name-transformer tf-var`. `TF_VAR_ADMIN_IPS` is the renamed form of `ADMIN_IPS`. Running `terraform apply` directly (without `doppler run`) leaves the variable undefined and the apply fails at plan time. See AGENTS.md `cq-when-running-terraform-commands-locally`.
+
+## Exit codes
+
+- `0` -- success (no drift OR drift corrected + operator acked + invocation emitted).
+- `3` -- all three IP-detection services failed.
+- `4` -- Doppler read or write failed.
+- `5` -- operator refused the mutation.
+
+Non-zero exit codes are intentional so a future scheduled cron invocation (tracked as a deferred issue) does not silently no-op.
+
+## CLI verification
+
+Per AGENTS.md `cq-docs-cli-verification`:
+
+- `curl -fsS --connect-timeout N --max-time N <url>` -- <!-- verified: 2026-04-19 source: curl --help all | grep -E "connect-timeout|max-time|fail|silent|show-error" -->
+- `doppler secrets get <KEY> -p <proj> -c <config> --plain` -- <!-- verified: 2026-04-19 source: https://docs.doppler.com/docs/accessing-secrets -->
+- `doppler secrets set <KEY> -p <proj> -c <config> --silent` (stdin form) -- <!-- verified: 2026-04-19 source: https://docs.doppler.com/docs/setting-secrets -->
+- `doppler run --project <proj> --config <config> --name-transformer tf-var -- <cmd>` -- <!-- verified: 2026-04-19 source: AGENTS.md cq-when-running-terraform-commands-locally -->
+- `doppler configure get token --plain` -- <!-- verified: 2026-04-19 source: doppler configure get --help -->
+- `hcloud firewall describe <name>` -- <!-- verified: 2026-04-19 source: hcloud firewall describe --help -->
+- `terraform plan [-target=<addr>]` -- <!-- verified: 2026-04-19 source: https://developer.hashicorp.com/terraform/cli/commands/plan -->
+- `terraform apply [-target=<addr>]` -- <!-- verified: 2026-04-19 source: https://developer.hashicorp.com/terraform/cli/commands/apply -->