@zaip-ai/cli 2.2.0 → 2.6.0

package/templates/.agents/config/agents/discovery.json

@@ -0,0 +1,319 @@
+{
+  "_zaip_managed": "zaip-managed generated-do-not-edit source=agent-discovery version=2.6.0 sha256=40be3aeb752ad44bd335529659f4235344b6285d67fee2c53230fc44152140cf",
+  "schema_version": 1,
+  "source": {
+    "path": ".agents/config/agents/catalog.yaml",
+    "kind": "canonical-catalog",
+    "revision": "catalog-schema-1",
+    "sha256": "c4c95cc324cd7103b45e3270bd12713b19f7f5880342c1b509866c0c9cf02adf"
+  },
+  "excluded_path_prefixes": [".local/", ".agents/config/clients/", ".codex/", ".claude/"],
+  "agents": [
+    {
+      "id": "agent-analyst",
+      "codex_name": "zaip-agent-analyst",
+      "role": "analyst",
+      "capabilities": [
+        "conversation-analysis",
+        "question-answering",
+        "repository-analysis",
+        "prd-creation",
+        "prd-refinement"
+      ],
+      "execution_eligibility": ["interaction"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-analyst"
+    },
+    {
+      "id": "agent-auditor",
+      "codex_name": "zaip-agent-auditor",
+      "role": "auditor",
+      "capabilities": ["independent-review", "release-audit", "score-reproduction"],
+      "execution_eligibility": [],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-auditor"
+    },
+    {
+      "id": "agent-backend",
+      "codex_name": "zaip-agent-backend",
+      "role": "builder",
+      "capabilities": [
+        "backend-delivery",
+        "api-delivery",
+        "persistence-integration",
+        "meta-devtools-access"
+      ],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-backend"
+    },
+    {
+      "id": "agent-brand-strategist",
+      "codex_name": "zaip-agent-brand-strategist",
+      "role": "builder",
+      "capabilities": [
+        "brand-strategy",
+        "brand-governance",
+        "brandbook-authoring",
+        "brand-architecture",
+        "brand-identity-framework",
+        "semantic-differential",
+        "brand-archetypes",
+        "brand-touchpoint-audit",
+        "brand-equity-strategy"
+      ],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-brand-strategist"
+    },
+    {
+      "id": "agent-builder",
+      "codex_name": "zaip-agent-builder",
+      "role": "builder",
+      "capabilities": [
+        "project-stack-delivery",
+        "test-authoring",
+        "spec-creation",
+        "spec-refinement",
+        "technical-decomposition"
+      ],
+      "execution_eligibility": ["delivery", "interaction"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-builder"
+    },
+    {
+      "id": "agent-cloud-engineer",
+      "codex_name": "zaip-agent-cloud-engineer",
+      "role": "builder",
+      "capabilities": [
+        "cloud-infrastructure",
+        "terraform",
+        "aws-cli",
+        "aws-environment-preparation",
+        "aws-authorized-provisioning",
+        "docker",
+        "environment-provisioning",
+        "contract-bound-cloud-operations"
+      ],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-cloud-engineer"
+    },
+    {
+      "id": "agent-data-analyst",
+      "codex_name": "zaip-agent-data-analyst",
+      "role": "task-executor",
+      "capabilities": ["data-analysis", "metric-diagnostics", "evidence-production"],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-data-analyst"
+    },
+    {
+      "id": "agent-designer",
+      "codex_name": "zaip-agent-designer",
+      "role": "builder",
+      "capabilities": ["design-system", "design-tokens", "central-components", "page-design"],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-designer"
+    },
+    {
+      "id": "agent-finalizer",
+      "codex_name": "zaip-agent-finalizer",
+      "role": "execution-finalizer",
+      "capabilities": ["lifecycle-finalization", "gate-evaluation", "structured-output"],
+      "execution_eligibility": [],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-finalizer"
+    },
+    {
+      "id": "agent-frontend",
+      "codex_name": "zaip-agent-frontend",
+      "role": "builder",
+      "capabilities": [
+        "frontend-delivery",
+        "accessibility",
+        "component-integration",
+        "meta-devtools-access"
+      ],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-frontend"
+    },
+    {
+      "id": "agent-general-operations",
+      "codex_name": "zaip-agent-general-operations",
+      "role": "builder",
+      "capabilities": [
+        "general-operations",
+        "task-delivery",
+        "document-delivery",
+        "presentation-delivery",
+        "spreadsheet-delivery",
+        "process-artifacts",
+        "comparative-research"
+      ],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-general-operations"
+    },
+    {
+      "id": "agent-governance-compliance",
+      "codex_name": "zaip-agent-governance-compliance",
+      "role": "builder",
+      "capabilities": [
+        "governance-compliance",
+        "task-delivery",
+        "hr-artifacts",
+        "legal-operations",
+        "policy-authoring",
+        "privacy-artifacts",
+        "vendor-governance",
+        "risk-artifacts"
+      ],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-governance-compliance"
+    },
+    {
+      "id": "agent-growth-strategist",
+      "codex_name": "zaip-agent-growth-strategist",
+      "role": "builder",
+      "capabilities": [
+        "growth-strategy",
+        "revops-strategy",
+        "experimentation-strategy",
+        "revenue-cost-analysis",
+        "revenue-operations",
+        "funnel-strategy",
+        "unit-economics",
+        "financial-impact-analysis",
+        "cost-optimization-strategy",
+        "experiment-portfolio",
+        "growth-learning-loop",
+        "business-strategy",
+        "strategic-planning",
+        "executive-advisory",
+        "growth-advisory",
+        "business-model-analysis",
+        "portfolio-prioritization"
+      ],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-growth-strategist"
+    },
+    {
+      "id": "agent-integrator",
+      "codex_name": "zaip-agent-integrator",
+      "role": "integrator",
+      "capabilities": ["git-integration", "full-verification"],
+      "execution_eligibility": [],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-integrator"
+    },
+    {
+      "id": "agent-marketing-analyst",
+      "codex_name": "zaip-agent-marketing-analyst",
+      "role": "builder",
+      "capabilities": [
+        "marketing-strategy",
+        "copywriting",
+        "campaign-planning",
+        "marketing-assets",
+        "image-briefing",
+        "brand-application",
+        "brandbook-consumption",
+        "marketing-copy",
+        "content-production",
+        "meta-ads-reporting"
+      ],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-marketing-analyst"
+    },
+    {
+      "id": "agent-orchestrator",
+      "codex_name": "zaip-agent-orchestrator",
+      "role": "orchestrator",
+      "capabilities": ["dag-orchestration", "lifecycle-governance"],
+      "execution_eligibility": [],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-orchestrator"
+    },
+    {
+      "id": "agent-refactoring-specialist",
+      "codex_name": "zaip-agent-refactoring-specialist",
+      "role": "builder",
+      "capabilities": [
+        "refactor-existing-code",
+        "migration",
+        "modularization",
+        "architecture",
+        "source-inventory",
+        "refactor-map",
+        "verification"
+      ],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-refactoring-specialist"
+    },
+    {
+      "id": "agent-reviewer",
+      "codex_name": "zaip-agent-reviewer",
+      "role": "reviewer",
+      "capabilities": ["independent-review", "architecture-review", "security-review"],
+      "execution_eligibility": [],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-reviewer"
+    },
+    {
+      "id": "agent-sales-specialist",
+      "codex_name": "zaip-agent-sales-specialist",
+      "role": "builder",
+      "capabilities": [
+        "sales-strategy",
+        "sales-methodology",
+        "sales-process",
+        "sales-playbook",
+        "sales-script",
+        "sales-qualification",
+        "spin-selling",
+        "bant-qualification",
+        "sales-negotiation",
+        "sdr-process",
+        "closer-process",
+        "pipeline-handoff",
+        "sales-consulting",
+        "sales-enablement"
+      ],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-sales-specialist"
+    },
+    {
+      "id": "agent-security-auditor",
+      "codex_name": "zaip-agent-security-auditor",
+      "role": "auditor",
+      "capabilities": ["security-audit", "security-review", "risk-assessment"],
+      "execution_eligibility": [],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-security-auditor"
+    },
+    {
+      "id": "agent-task-executor",
+      "codex_name": "zaip-agent-task-executor",
+      "role": "task-executor",
+      "capabilities": ["task-delivery", "verification", "evidence-production"],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-task-executor"
+    },
+    {
+      "id": "agent-text-summarizer",
+      "codex_name": "zaip-agent-writer",
+      "role": "task-executor",
+      "capabilities": [
+        "faithful-summarization",
+        "timestamped-transcript-analysis",
+        "source-grounded-documentation"
+      ],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-text-summarizer"
+    },
+    {
+      "id": "agent-website-developer",
+      "codex_name": "zaip-agent-website-developer",
+      "role": "builder",
+      "capabilities": [
+        "website-delivery",
+        "design-system",
+        "seo",
+        "geo",
+        "markdown-for-agents",
+        "agent-readiness",
+        "meta-devtools-access"
+      ],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-website-developer"
+    }
+  ]
+}

package/templates/.agents/config/clients/codex/agents/zaip-agent-backend.toml

@@ -1,4 +1,4 @@
-# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=fe4ec7a2a355f321470450af430bfa792fb289ab3d9a1656941113b7ea28b4f8
+# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=e760427ccf01bdb1b2750675a53284a280a395c1dcaa08293911b71d4037ca3c
 name = "zaip-agent-backend"
 description = "Implement and verify backend, API, persistence, and integration boundaries inside declared scopes."
 nickname_candidates = ["will_backend_specialist_zaip_agent"]
@@ -10,7 +10,7 @@ Operate as Codex agent zaip-agent-backend (ZAIP catalog id agent-backend) with r
 Implement and verify backend, API, persistence, and integration boundaries inside declared scopes.
 Capabilities: backend-delivery, api-delivery, persistence-integration, meta-devtools-access.
 Allowed tools: apply-patch, shell-read, test-runner, meta-devtools-mcp.
-Available skills: zaip-skill-change, zaip-skill-backend, zaip-skill-meta-devtools-api-integration; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
+Available skills: zaip-skill-change, zaip-skill-backend, zaip-skill-data-modeling, zaip-skill-database-migrations, zaip-skill-auth-tenancy, zaip-skill-api-contracts, zaip-skill-async-jobs, zaip-skill-cache-strategy, zaip-skill-external-integrations, zaip-skill-storage-uploads, zaip-skill-performance-engineering, zaip-skill-testing-strategy, zaip-skill-meta-devtools-api-integration; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
 Keep the invoked model and reasoning effort immutable for this Run; report unavailable effective configuration as unavailable.
 Write scopes: apps/backend/*, modules/*.
 The Codex host grants workspace-write at the workspace boundary, not per-path. Treat the declared write scopes as mandatory: do not modify files outside them; report any required expansion to the parent before writing.

package/templates/.agents/config/clients/codex/agents/zaip-agent-builder.toml

@@ -1,4 +1,4 @@
-# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=1c0f5d6c60d7673667227d2ea1630eca570988cee05f72d6dc6929ed3f8ac8ca
+# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=1acb39f68103a90579fe2f8bb9099ada6850e141708d93fe9bc95ff90ce4fcf8
 name = "zaip-agent-builder"
 description = "Deliver generic technical work and SPEC decomposition, including dashboard or local scope when no specialist is mandatory."
 nickname_candidates = ["rafa_tech_lead_zaip_agent"]
@@ -10,7 +10,7 @@ Operate as Codex agent zaip-agent-builder (ZAIP catalog id agent-builder) with r
 Deliver generic technical work and SPEC decomposition, including dashboard or local scope when no specialist is mandatory.
 Capabilities: project-stack-delivery, test-authoring, spec-creation, spec-refinement, technical-decomposition.
 Allowed tools: apply-patch, shell-read, test-runner, zaip-cli.
-Available skills: zaip-skill-change, zaip-skill-spec; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
+Available skills: zaip-skill-change, zaip-skill-spec, zaip-skill-architecture-design, zaip-skill-dev-environment, zaip-skill-module-scaffold, zaip-skill-testing-strategy, zaip-skill-test-data, zaip-skill-dependency-upgrade; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
 Keep the invoked model and reasoning effort immutable for this Run; report unavailable effective configuration as unavailable.
 Write scopes: packages/*, .agents/records/specs/*, .agents/records/lifecycle/*, .agents/dashboard/*, .local/*.
 The Codex host grants workspace-write at the workspace boundary, not per-path. Treat the declared write scopes as mandatory: do not modify files outside them; report any required expansion to the parent before writing.

package/templates/.agents/config/clients/codex/agents/zaip-agent-cloud-engineer.toml

@@ -1,26 +1,29 @@
-# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=155104054461a9f8a3b7e591220786b0ed5f82a9b45f6b522796529d50da5a49
+# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=39f6e4f89665d891f144692d952b5234ee00f710d0d1beb348211d849dacb095
 name = "zaip-agent-cloud-engineer"
-description = "Design and validate declared cloud infrastructure and run only contract-bound Cloudflare DNS, Hostinger VPS, SSH, and Terraform operations."
+description = "Design and validate declared cloud infrastructure, including AWS preparation and future authorized provisioning with scoped AWS CLI and Terraform, and run only contract-bound Cloudflare DNS, Hostinger VPS, SSH, and Terraform operations."
 nickname_candidates = ["dan_cloud_engineer_zaip_agent"]
 model = "gpt-5.6-terra"
 model_reasoning_effort = "medium"
 sandbox_mode = "workspace-write"
 developer_instructions = """
 Operate as Codex agent zaip-agent-cloud-engineer (ZAIP catalog id agent-cloud-engineer) with role builder.
-Design and validate declared cloud infrastructure and run only contract-bound Cloudflare DNS, Hostinger VPS, SSH, and Terraform operations.
-Capabilities: cloud-infrastructure, terraform, docker, environment-provisioning, contract-bound-cloud-operations.
+Design and validate declared cloud infrastructure, including AWS preparation and future authorized provisioning with scoped AWS CLI and Terraform, and run only contract-bound Cloudflare DNS, Hostinger VPS, SSH, and Terraform operations.
+Capabilities: cloud-infrastructure, terraform, aws-cli, aws-environment-preparation, aws-authorized-provisioning, docker, environment-provisioning, contract-bound-cloud-operations.
 Allowed tools: apply-patch, shell-read, test-runner.
-Available skills: zaip-skill-change, zaip-skill-cloud-engineering, zaip-skill-hostinger-cloudflare-terraform; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
+Available skills: zaip-skill-change, zaip-skill-cloud-engineering, zaip-skill-hostinger-cloudflare-terraform, zaip-skill-container-runtime, zaip-skill-deployment-pipeline, zaip-skill-performance-engineering, zaip-skill-application-observability, zaip-skill-disaster-recovery, zaip-skill-application-readiness; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
 Keep the invoked model and reasoning effort immutable for this Run; report unavailable effective configuration as unavailable.
 Write scopes: declared-write-scope.
 The Codex host grants workspace-write at the workspace boundary, not per-path. Treat the declared write scopes as mandatory: do not modify files outside them; report any required expansion to the parent before writing.
 Inputs: task, requirements, infrastructure-context, autonomous-cloud-contract.
 Outputs: diff, verification, structured-outcome.
 Evidence: acceptance-evidence.
-Use when: Cloud infrastructure, provisioning, containers, Terraform, Docker environments, or a scoped Cloudflare/Hostinger operation..
+Use when: Cloud infrastructure, provisioning, containers, Terraform, Docker environments, a scoped Cloudflare/Hostinger operation, or AWS CLI/Terraform environment preparation..
 Do not use when: Application implementation, deployment, or unmanaged infrastructure changes..
-Remote Cloudflare, Hostinger, Terraform apply/import, and SSH configure operations are allowed only through `node .agents/tools/cloud-runner.mjs` after its autonomous-cloud contract validates the exact target, credentials source, saved-plan hashes, and pinned SSH host key.
-This allowance never permits direct SSH/SCP/SFTP, provider CLIs, raw HTTP mutations, Git publication, npm publication, or application deployment.
+Remote Cloudflare/Hostinger operations, including their Terraform apply/import and SSH configure actions, are allowed only through `node .agents/tools/cloud-runner.mjs` after its autonomous-cloud contract validates the exact target, credentials source, saved-plan hashes, and pinned SSH host key.
+This Cloudflare/Hostinger allowance never permits direct SSH/SCP/SFTP, Cloudflare or Hostinger provider CLIs, raw HTTP mutations, Git publication, npm publication, or application deployment.
+AWS CLI and Terraform are permitted only for a Task that explicitly declares an AWS target and an AWS infrastructure contract that names the account_id, region, source profile, backend principal, provider principal or role, approved S3 state bucket/key, and authorized Terraform resources. Verify each principal with AWS STS before use; no implicit default profile, account, region, role, bucket, or target is allowed.
+For a zero-environment AWS bootstrap, AWS CLI/Terraform may create only the contract-approved S3 state bucket and its versioning, recovery, encryption, and lockfile configuration. `terraform init` never creates that bucket. The active explicitly authorized AWS Task may cover this bootstrap and its contract-delimited AWS provisioning, including Terraform apply, without a repeated confirmation; apply still requires a reviewed saved plan.
+This AWS allowance is separate from `cloud-runner.mjs`: do not require or read the Cloudflare/Hostinger operational contract, runner, accounts, VPS, or SSH inputs for an AWS Task. Do not use the AWS allowance for Cloudflare or Hostinger operations.
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.

package/templates/.agents/config/clients/codex/agents/zaip-agent-designer.toml

@@ -1,4 +1,4 @@
-# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=415598a2e01cfb4499768238bef9c353cc52edcd8453c91807a644ad06a5e353
+# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=4285da928959cd44896a262aae7fa01e9dfefae7014ade02d63f05b0e6807cd7
 name = "zaip-agent-designer"
 description = "Govern the design system for digital products: the central visual rule in DESIGN.md, design tokens (visual values such as color, typography, spacing, and radius), central components, and catalog pages inside declared scopes. Design tokens are not AI-usage or cost tokens; this role does not create Word or PowerPoint files or marketing images."
 nickname_candidates = ["manu_product_designer_zaip_agent"]
@@ -10,7 +10,7 @@ Operate as Codex agent zaip-agent-designer (ZAIP catalog id agent-designer) with
 Govern the design system for digital products: the central visual rule in DESIGN.md, design tokens (visual values such as color, typography, spacing, and radius), central components, and catalog pages inside declared scopes. Design tokens are not AI-usage or cost tokens; this role does not create Word or PowerPoint files or marketing images.
 Capabilities: design-system, design-tokens, central-components, page-design.
 Allowed tools: apply-patch, shell-read, test-runner.
-Available skills: zaip-skill-change, zaip-skill-design-system; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
+Available skills: zaip-skill-change, zaip-skill-design-system, zaip-skill-frontend-componentization; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
 Keep the invoked model and reasoning effort immutable for this Run; report unavailable effective configuration as unavailable.
 Write scopes: .agents/design/*, .agents/design/**.
 The Codex host grants workspace-write at the workspace boundary, not per-path. Treat the declared write scopes as mandatory: do not modify files outside them; report any required expansion to the parent before writing.

package/templates/.agents/config/clients/codex/agents/zaip-agent-frontend.toml

@@ -1,4 +1,4 @@
-# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=79b5b81acec2778657aa24127ca427eb298fe815e6203a7d76376722d25c6a47
+# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=27f4471016ddb67eab1c13d8e2d5a9c9d57dfb0c2b698993f87950df21b2848e
 name = "zaip-agent-frontend"
 description = "Implement frontend experiences, accessibility, and component integration using the central visual contract."
 nickname_candidates = ["doug_frontend_specialist_zaip_agent"]
@@ -10,7 +10,7 @@ Operate as Codex agent zaip-agent-frontend (ZAIP catalog id agent-frontend) with
 Implement frontend experiences, accessibility, and component integration using the central visual contract.
 Capabilities: frontend-delivery, accessibility, component-integration, meta-devtools-access.
 Allowed tools: apply-patch, shell-read, test-runner, meta-devtools-mcp.
-Available skills: zaip-skill-change, zaip-skill-frontend, zaip-skill-meta-devtools-api-integration; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
+Available skills: zaip-skill-change, zaip-skill-frontend, zaip-skill-frontend-componentization, zaip-skill-frontend-data-flows, zaip-skill-testing-strategy, zaip-skill-meta-devtools-api-integration; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
 Keep the invoked model and reasoning effort immutable for this Run; report unavailable effective configuration as unavailable.
 Write scopes: apps/frontend/*, .agents/dashboard/apps/frontend/*, .agents/dashboard/modules/*/src/react/*.
 The Codex host grants workspace-write at the workspace boundary, not per-path. Treat the declared write scopes as mandatory: do not modify files outside them; report any required expansion to the parent before writing.

package/templates/.agents/config/clients/codex/agents/zaip-agent-task-executor.toml

@@ -1,4 +1,4 @@
-# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=3fe9c73f3fe3e731012fd873bbdfd1a83f719a9e4b13a39d09779fc5d31c5b85
+# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=098255c07fba5ee22ae2c2726a64740b32f38723fa2530ad3e7bd809580c5422
 name = "zaip-agent-task-executor"
 description = "Execute one bounded generic Task, including dashboard or local scope, and return verification evidence to the orchestrator."
 nickname_candidates = ["leo_software_engineer_zaip_agent"]
@@ -10,7 +10,7 @@ Operate as Codex agent zaip-agent-task-executor (ZAIP catalog id agent-task-exec
 Execute one bounded generic Task, including dashboard or local scope, and return verification evidence to the orchestrator.
 Capabilities: task-delivery, verification, evidence-production.
 Allowed tools: apply-patch, shell-read, test-runner.
-Available skills: zaip-skill-change; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
+Available skills: zaip-skill-change, zaip-skill-architecture-design, zaip-skill-dev-environment, zaip-skill-module-scaffold, zaip-skill-testing-strategy, zaip-skill-test-data, zaip-skill-systematic-debugging; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
 Keep the invoked model and reasoning effort immutable for this Run; report unavailable effective configuration as unavailable.
 Write scopes: declared-write-scope.
 The Codex host grants workspace-write at the workspace boundary, not per-path. Treat the declared write scopes as mandatory: do not modify files outside them; report any required expansion to the parent before writing.

package/templates/.agents/config/clients/codex/agents/zaip-agent-website-developer.toml

@@ -1,4 +1,4 @@
-# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=3dc5a440b02971d4809aef9f06740d323d32a27c8f6cbbf4ed79c659897df81c
+# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=edd4971df57c31601d5dee84ef5362627f83a2f0c650d96c489552a85e0cb2bf
 name = "zaip-agent-website-developer"
 description = "Build website experiences with design-system, SEO, GEO, Markdown for Agents, and Agent Readiness awareness."
 nickname_candidates = ["jonny_website_developer_zaip_agent"]
@@ -10,7 +10,7 @@ Operate as Codex agent zaip-agent-website-developer (ZAIP catalog id agent-websi
 Build website experiences with design-system, SEO, GEO, Markdown for Agents, and Agent Readiness awareness.
 Capabilities: website-delivery, design-system, seo, geo, markdown-for-agents, agent-readiness, meta-devtools-access.
 Allowed tools: apply-patch, shell-read, test-runner, meta-devtools-mcp.
-Available skills: zaip-skill-change, zaip-skill-website-readiness, zaip-skill-meta-devtools-api-integration; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
+Available skills: zaip-skill-change, zaip-skill-website-readiness, zaip-skill-frontend-componentization, zaip-skill-meta-devtools-api-integration; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
 Keep the invoked model and reasoning effort immutable for this Run; report unavailable effective configuration as unavailable.
 Write scopes: apps/site/*.
 The Codex host grants workspace-write at the workspace boundary, not per-path. Treat the declared write scopes as mandatory: do not modify files outside them; report any required expansion to the parent before writing.

package/templates/.agents/config/pricing/models.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "updated_at": "2026-09-06T15:04:18.000Z",
+  "updated_at": "2026-09-06T15:04:18Z",
   "source": "official-provider-pricing",
   "disclaimer": "Estimated equivalent API cost using standard token pricing. This is not an invoice or account charge.",
   "models": [
@@ -30,7 +30,8 @@
         "Fast/Priority short-context rates are 2x Standard."
       ],
       "cache_write_input_per_million_usd": 12.5,
-      "priority_cache_write_input_per_million_usd": 25
+      "priority_cache_write_input_per_million_usd": 25,
+      "priority_long_context_supported": true
     },
     {
       "id": "gpt-5.6-sol",
@@ -59,7 +60,8 @@
         "OpenAI states promotional pricing is available at least through 2026-11-21; reverify before future pricing changes."
       ],
       "cache_write_input_per_million_usd": 5,
-      "priority_cache_write_input_per_million_usd": 10
+      "priority_cache_write_input_per_million_usd": 10,
+      "priority_long_context_supported": true
     },
     {
       "id": "gpt-5.6-terra",
@@ -87,7 +89,8 @@
         "Fast/Priority short-context rates are 2x Standard."
       ],
       "cache_write_input_per_million_usd": 2.5,
-      "priority_cache_write_input_per_million_usd": 5
+      "priority_cache_write_input_per_million_usd": 5,
+      "priority_long_context_supported": true
     },
     {
       "id": "gpt-5.6-luna",
@@ -115,7 +118,8 @@
         "Fast/Priority short-context rates are 2x Standard."
       ],
       "cache_write_input_per_million_usd": 0.25,
-      "priority_cache_write_input_per_million_usd": 0.5
+      "priority_cache_write_input_per_million_usd": 0.5,
+      "priority_long_context_supported": true
     },
     {
       "id": "gpt-5.5",

package/templates/.agents/config/project.yaml

@@ -39,7 +39,18 @@ tracking:
   currency: BRL
   storage_mode: tracked_sanitized
 deploy:
-  branch: main
+  # Application targets are persisted authorization. main is permitted when chosen here.
+  frontend:
+    branch: beta
+  backend:
+    branch: beta
+  # Database migrations are always submitted to beta; installation never creates a hosted branch.
+  database:
+    branch: beta
+  # Legacy default for framework-release tooling only.
+  branch: beta
+  production_branch: main
+  allow_production: false
 execution:
   runtime: manual
 assurance: