prizmkit 1.1.159 → 1.1.160

package/bundled/templates/project-memory-template.md

@@ -4,30 +4,30 @@
 This project uses PrizmKit with the Prizm documentation system for AI-optimized progressive context loading.
 
 ### Progressive Loading Protocol
-- ON SESSION START: Always read `.prizmkit/prizm-docs/root.prizm` first (L0 — project map)
-- ON RESUME (feature/bugfix directory has session-summary.md): Read session-summary.md first for prior context, then load only L1/L2 for modules mentioned in it
-- ON TASK: Read L1 (`.prizmkit/prizm-docs/<module>.prizm`) for relevant modules referenced in MODULE_INDEX or MODULE_GROUPS. If entries have keyword tags (e.g., `[login, jwt, oauth]`), match user's task against tags to prioritize which modules to load.
-- ON FILE EDIT: Read L2 (`.prizmkit/prizm-docs/<module>/<submodule>.prizm`) before modifying files. Pay attention to TRAPS and DECISIONS.
-- NEVER load all .prizm docs at once. Load only what is needed for the current task.
-
-### Auto-Update Protocol
-- BEFORE EVERY COMMIT: Update affected `.prizmkit/prizm-docs/` files
-- Platform hooks (rules or UserPromptSubmit) will remind you automatically
-- Use `/prizmkit-committer` for the complete commit workflow
+- ON SESSION START: Read exact `.prizmkit/prizm-docs/root.prizm` first when it exists; it alone is L0.
+- ON TASK: Read only relevant direct-child L1 documents (`.prizmkit/prizm-docs/<module>.prizm`) selected through MODULE_INDEX or MODULE_GROUPS pointers.
+- ON FILE EDIT: Read the complete relevant nested L2 and complete parent/child documents needed to resolve its SUBDIRS or DETAILS pointer. Grep-only fragments are insufficient modification context.
+- IF L2 IS ABSENT: Inspect bounded target source and narrowly implicated contracts without creating a placeholder; documentation creation belongs to Retrospective or explicit repair.
+- NEVER load all `.prizm` docs at once, load unrelated modules, or create L3.
+
+### Framework Directory and Maintenance Protocol
+- `.prizmkit/**` is the PrizmKit framework directory; owning capabilities may read/write their exact managed artifacts.
+- The project alone controls whether framework paths are ignored, untracked, or tracked. Do not add, remove, force-add, stage, commit, or interpret `.gitignore` entries as documentation maintenance.
+- Run `/prizmkit-retrospective` after validated changes when structure, interfaces, dependencies, behavior, or durable knowledge changed; it never owns staging/commit.
+- Use `/prizmkit-committer` for an exact commit operation. A Git-visible `.prizmkit/**` intended path receives ordinary exact-manifest and Secret checks; ignored paths remain absent.
 
 ### Doc Format Rules
 - All `.prizm` files use KEY: value format, not prose
-- Size limits: L0 = 4KB, L1 = 4KB, L2 = 5KB
+- Path levels and raw UTF-8 limits: exact `root.prizm` = L0/4096B; other direct `.prizm` children = L1/4096B; nested `.prizm` documents = L2/5120B
 - Arrow notation (->) indicates load pointers to other .prizm docs
 - Memory files must not contain CHANGELOG sections/files, UPDATED/date metadata, feature/bug/refactor/task/session/run/pipeline/workflow IDs, branch names, absolute worktree paths, or `.prizmkit/specs` / `.prizmkit/dev-pipeline` artifact paths
-- Update durable sections in place; git history is the change log
-- No date/time fields — git is the authoritative source for temporal info
-
-### Creating New L2 Docs
-- When you first modify files in a sub-module that has no L2 doc:
-  1. Read the source files in that sub-module
-  2. Generate a new L2 `.prizm` file following Prizm specification
-  3. Add a pointer in the parent L1 doc's SUBDIRS section
+- Update durable sections in place; temporal and workflow history stays outside Prizm memory
+- No date/time fields and no Git-history requirement
+
+### Missing L2 Fallback
+- When relevant L2 is absent, inspect only bounded source needed for the current modification.
+- Do not create a placeholder merely because source was read or changed.
+- Retrospective or explicit documentation repair may later write a complete Value-Gate-qualified L2 and resolving parent pointer after identity, ownership, capacity, and format checks pass.
 
 ### Available Commands
 Run `/prizmkit` to see all available PrizmKit commands.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prizmkit",
-  "version": "1.1.159",
+  "version": "1.1.160",
   "description": "Create a new PrizmKit-powered project with clean initialization — no framework dev files, just what you need.",
   "type": "module",
   "bin": {

package/src/clean.js

@@ -5,13 +5,12 @@ import { loadMetadata, loadRulesMetadata } from './metadata.js';
 import { readManifest } from './manifest.js';
 import { privateProjectMemoryFile, projectMemoryFile } from './platforms.js';
 
+// Cleanup owns only deterministic private host-memory entries. Existing
+// `.prizmkit/**` ignore policy is project-owned and must remain untouched.
 const PRIZMKIT_GITIGNORE_HEADERS = new Set([
-  '# PrizmKit',
-  '# PrizmKit 运行时全部产物（state/、prizm-docs/、.env、logs 等）',
+  '# PrizmKit private host memory',
 ]);
 const PRIZMKIT_GITIGNORE_ENTRIES = new Set([
-  '.prizmkit/',
-  '.prizmkit/*',
   'CLAUDE.private.md',
   'AGENTS.private.md',
   'CODEBUDDY.private.md',
@@ -298,7 +297,7 @@ export async function runClean(directory, options = {}) {
     results.push(await cleanMarkedProjectMemory(projectRoot, privateMemoryFile, dryRun));
   }
 
-  // ── .gitignore cleanup ────────────────────────────────────────────────────
+  // ── Private host-memory .gitignore cleanup (never `.prizmkit/**`) ─────────
   const gitignoreResult = await cleanGitignore(projectRoot, dryRun);
 
   // ── Global team (optional) ────────────────────────────────────────────────
@@ -326,9 +325,9 @@ export async function runClean(directory, options = {}) {
 
   if (gitignoreResult.updated) {
     if (gitignoreResult.reason === 'dry_run') {
-      console.log(chalk.gray('    [dry-run] 将更新 .gitignore（移除 PrizmKit 段）'));
+      console.log(chalk.gray('    [dry-run] 将更新 .gitignore（仅移除私有主机记忆条目）'));
     } else {
-      console.log(chalk.green('    ✓ 已更新 .gitignore（移除 PrizmKit 段）'));
+      console.log(chalk.green('    ✓ 已更新 .gitignore（仅移除私有主机记忆条目）'));
     }
   }
 

package/src/gitignore-template.js

@@ -1,22 +1,18 @@
 /**
- * .gitignore 模板
- * 为新创建的 PrizmKit 项目生成合适的 .gitignore 内容。
+ * Generate only explicit private host-memory ignores.
+ *
+ * `.prizmkit/**` tracking policy is project-controlled: this module never adds,
+ * removes, or interprets framework-directory ignore entries.
  */
 
 /**
- * 生成 .gitignore 内容
- * @param {Object} options - { pipeline: boolean }
+ * @param {Object} options - { privateMemoryFiles?: string[] }
  * @returns {string}
  */
 export function generateGitignore(options = {}) {
   const privateMemoryFiles = Array.isArray(options.privateMemoryFiles)
-    ? options.privateMemoryFiles.filter(Boolean)
+    ? [...new Set(options.privateMemoryFiles.filter(Boolean))]
     : [];
-  const lines = [
-    '# PrizmKit',
-    '.prizmkit/*',
-    ...privateMemoryFiles,
-  ];
-
-  return [...new Set(lines)].join('\n');
+  if (privateMemoryFiles.length === 0) return '';
+  return ['# PrizmKit private host memory', ...privateMemoryFiles].join('\n');
 }

package/src/scaffold.js

@@ -4,7 +4,7 @@
  * 全部使用 Copy 模式（不使用 symlink），项目完全独立于框架仓库。
  * 通过 adapters 转换 core/ 资源为平台特定格式。
  * 不安装框架开发文件（docs、tests、scripts 等）。
- * 自动生成 .gitignore。
+ * 仅按显式平台需要合并私有记忆文件 ignore；`.prizmkit/**` Git 策略由项目控制。
  */
 
 import chalk from 'chalk';
@@ -381,6 +381,57 @@ export async function installSkills(platform, skills, projectRoot, dryRun, runti
  * Skill-owned references now provide inline reviewer/implementation subagent contracts.
  */
 
+const MANAGED_HOOK_MARKERS = [
+  '.prizmkit/scripts/commit-intent-status.py',
+  '.prizmkit/scripts/post-command-prizm-drift.py',
+  'PRIZMKIT_DOC_UPDATE_REQUIRED',
+  'PrizmKit: .prizmkit/prizm-docs found',
+];
+
+function isManagedHookEntry(entry) {
+  let serialized = '';
+  try {
+    serialized = JSON.stringify(entry);
+  } catch {
+    return false;
+  }
+  return MANAGED_HOOK_MARKERS.some(marker => serialized.includes(marker));
+}
+
+export function mergeManagedHooks(existingHooks = {}, managedHooks = {}) {
+  if (!existingHooks || typeof existingHooks !== 'object' || Array.isArray(existingHooks)) {
+    throw new Error('Cannot preserve malformed user hooks: hooks must be an object');
+  }
+  const merged = {};
+  for (const [event, entries] of Object.entries(existingHooks)) {
+    if (!Array.isArray(entries)) {
+      throw new Error(`Cannot preserve malformed user hooks: ${event} must be an array`);
+    }
+    merged[event] = entries.filter(entry => !isManagedHookEntry(entry));
+  }
+  for (const [event, entries] of Object.entries(managedHooks || {})) {
+    if (!Array.isArray(entries)) {
+      throw new Error(`Managed hook template is invalid: ${event} must be an array`);
+    }
+    const preserved = Array.isArray(merged[event]) ? merged[event] : [];
+    merged[event] = [...preserved, ...entries];
+  }
+  return merged;
+}
+
+async function readUserSettings(settingsPath) {
+  if (!await fs.pathExists(settingsPath)) return {};
+  try {
+    const value = await fs.readJSON(settingsPath);
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+      throw new Error('settings root must be an object');
+    }
+    return value;
+  } catch (error) {
+    throw new Error(`Cannot preserve malformed user settings at ${settingsPath}: ${error.message}`);
+  }
+}
+
 /**
  * 安装平台配置文件（settings/hooks/rules）
  */
@@ -412,11 +463,16 @@ export async function installSettings(platform, projectRoot, options, dryRun, ru
 
     await fs.ensureDir(path.dirname(settingsPath));
 
-    // Read hook definition from unified template.
+    // Replace only deterministic managed hook entries and preserve user settings/hooks.
     const templatesDir = getTemplatesDir();
     const hookTemplate = await fs.readJSON(path.join(templatesDir, 'hooks', 'commit-intent.json'));
+    const existingSettings = await readUserSettings(settingsPath);
+    const settings = {
+      ...existingSettings,
+      hooks: mergeManagedHooks(existingSettings.hooks, hookTemplate.hooks),
+    };
 
-    await fs.writeFile(settingsPath, JSON.stringify(hookTemplate, null, 2));
+    await fs.writeFile(settingsPath, JSON.stringify(settings, null, 2));
     console.log(chalk.green(`      ✓ .codebuddy/settings.json`));
 
     // Install rules for CodeBuddy
@@ -466,26 +522,37 @@ export async function installSettings(platform, projectRoot, options, dryRun, ru
       'Bash(jq *)',
     ];
 
+    const settingsPath = path.join(claudeDir, 'settings.json');
+    const existingSettings = await readUserSettings(settingsPath);
+    const existingPermissions = existingSettings.permissions && typeof existingSettings.permissions === 'object'
+      ? existingSettings.permissions
+      : {};
+    const mergedPermissions = [...new Set([
+      ...(Array.isArray(existingPermissions.allow) ? existingPermissions.allow : []),
+      ...permissions,
+    ])];
+    const managedHooks = {
+      ...hookTemplate.hooks,
+      SessionStart: [
+        {
+          matcher: 'startup',
+          hooks: [
+            {
+              type: 'command',
+              command: 'test -f .prizmkit/prizm-docs/root.prizm && echo "PrizmKit: .prizmkit/prizm-docs found. Read exact root.prizm for project context." || echo "PrizmKit: No .prizmkit/prizm-docs found. Run /prizmkit-init to bootstrap."',
+            },
+          ],
+        },
+      ],
+    };
     const settings = {
-      permissions: { allow: permissions },
-      hooks: {
-        ...hookTemplate.hooks,
-        SessionStart: [
-          {
-            matcher: 'startup',
-            hooks: [
-              {
-                type: 'command',
-                command: 'test -f .prizmkit/prizm-docs/root.prizm && echo "PrizmKit: .prizmkit/prizm-docs found. Read root.prizm for project context." || echo "PrizmKit: No .prizmkit/prizm-docs found. Run /prizmkit-init to bootstrap."',
-              },
-            ],
-          },
-        ],
-      },
+      ...existingSettings,
+      permissions: { ...existingPermissions, allow: mergedPermissions },
+      hooks: mergeManagedHooks(existingSettings.hooks, managedHooks),
     };
 
     await fs.writeFile(
-      path.join(claudeDir, 'settings.json'),
+      settingsPath,
       JSON.stringify(settings, null, 2)
     );
     console.log(chalk.green(`      ✓ .claude/settings.json`));
@@ -553,59 +620,33 @@ function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
-function ensureTrailingNewline(value) {
-  return value.endsWith('\n') ? value : `${value}\n`;
-}
-
-function buildStandalonePrizmHook(templateContent) {
-  const content = templateContent.trimEnd();
-  const firstNewline = content.indexOf('\n');
-
-  if (content.startsWith('#!') && firstNewline !== -1) {
-    return [
-      content.slice(0, firstNewline),
-      PRIZMKIT_HOOK_MARKER_START,
-      content.slice(firstNewline + 1),
-      PRIZMKIT_HOOK_MARKER_END,
-      '',
-    ].join('\n');
-  }
-
-  return [
-    PRIZMKIT_HOOK_MARKER_START,
-    content,
-    PRIZMKIT_HOOK_MARKER_END,
-    '',
-  ].join('\n');
-}
-
 function buildShellPythonLauncherHook() {
   return [
     PRIZMKIT_HOOK_MARKER_START,
-    '# PrizmKit Python validation launcher',
-    'PRIZMKIT_ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || PRIZMKIT_ROOT=""',
-    'if [ -n "$PRIZMKIT_ROOT" ] && [ -f "$PRIZMKIT_ROOT/.prizmkit/prizm-docs/root.prizm" ]; then',
-    '  PRIZMKIT_VALIDATE="$PRIZMKIT_ROOT/.prizmkit/scripts/validate-prizm-docs.py"',
-    '  [ -f "$PRIZMKIT_VALIDATE" ] || PRIZMKIT_VALIDATE="$PRIZMKIT_ROOT/.prizmkit/dev-pipeline/scripts/validate-prizm-docs.py"',
-    '  if [ -f "$PRIZMKIT_VALIDATE" ]; then',
-    '    if command -v python3 >/dev/null 2>&1; then',
-    '      python3 "$PRIZMKIT_VALIDATE" --staged || exit $?',
-    '    elif command -v python >/dev/null 2>&1; then',
-    '      python "$PRIZMKIT_VALIDATE" --staged || exit $?',
-    '    elif command -v py >/dev/null 2>&1; then',
-    '      py -3 "$PRIZMKIT_VALIDATE" --staged || exit $?',
-    '    else',
-    '      echo "PrizmKit: Python 3 is required for .prizm docs validation." >&2',
-    '      exit 1',
-    '    fi',
-    '  fi',
+    '# PrizmKit host-neutral staged documentation validation',
+    'PRIZMKIT_ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0',
+    'PRIZMKIT_RUNNER="$PRIZMKIT_ROOT/.prizmkit/scripts/run-python-hook.cjs"',
+    'PRIZMKIT_PRE_COMMIT="$PRIZMKIT_ROOT/.prizmkit/scripts/prizm-pre-commit.py"',
+    'if [ -f "$PRIZMKIT_RUNNER" ] && [ -f "$PRIZMKIT_PRE_COMMIT" ] && command -v node >/dev/null 2>&1; then',
+    '  node "$PRIZMKIT_RUNNER" "$PRIZMKIT_PRE_COMMIT" || exit $?',
+    'elif git diff --cached --quiet -- .prizmkit/prizm-docs; then',
+    '  :',
+    'else',
+    '  echo "PrizmKit: staged Prizm documents require the installed host-neutral validator launcher." >&2',
+    '  exit 1',
     'fi',
     PRIZMKIT_HOOK_MARKER_END,
     '',
   ].join('\n');
 }
 
+function buildStandalonePrizmHook(templateContent) {
+  void templateContent;
+  return `#!/bin/sh\n${buildShellPythonLauncherHook()}`;
+}
+
 function buildAppendedPrizmHook(templateContent, userHookContent) {
+  void templateContent;
   if (/^#!.*\bpython[0-9.]*\b/i.test(userHookContent)) {
     return [
       PRIZMKIT_HOOK_MARKER_START,
@@ -613,13 +654,15 @@ function buildAppendedPrizmHook(templateContent, userHookContent) {
       'prizmkit_root_result = subprocess.run(["git", "rev-parse", "--show-toplevel"], text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, check=False)',
       'if prizmkit_root_result.returncode == 0:',
       '    prizmkit_root = pathlib.Path(prizmkit_root_result.stdout.strip())',
-      '    prizmkit_validate = prizmkit_root / ".prizmkit/scripts/validate-prizm-docs.py"',
-      '    if not prizmkit_validate.is_file():',
-      '        prizmkit_validate = prizmkit_root / ".prizmkit/dev-pipeline/scripts/validate-prizm-docs.py"',
-      '    if prizmkit_validate.is_file():',
-      '        prizmkit_result = subprocess.run([sys.executable, str(prizmkit_validate), "--staged"], cwd=prizmkit_root, check=False)',
+      '    prizmkit_pre_commit = prizmkit_root / ".prizmkit/scripts/prizm-pre-commit.py"',
+      '    prizmkit_diff = subprocess.run(["git", "diff", "--cached", "--quiet", "--", ".prizmkit/prizm-docs"], cwd=prizmkit_root, check=False)',
+      '    if prizmkit_pre_commit.is_file():',
+      '        prizmkit_result = subprocess.run([sys.executable, str(prizmkit_pre_commit)], cwd=prizmkit_root, check=False)',
       '        if prizmkit_result.returncode != 0:',
       '            raise SystemExit(prizmkit_result.returncode)',
+      '    elif prizmkit_diff.returncode != 0:',
+      '        print("PrizmKit: staged Prizm documents require the installed validator.", file=sys.stderr)',
+      '        raise SystemExit(1)',
       PRIZMKIT_HOOK_MARKER_END,
       '',
     ].join('\n');
@@ -630,7 +673,10 @@ function buildAppendedPrizmHook(templateContent, userHookContent) {
 
 function insertPrizmHookIntoUserHook(userHookContent, prizmHookBlock) {
   const content = userHookContent.trimEnd();
-  const terminalSuccessExitPattern = /(^|\n)([ \t]*exit[ \t]+0[ \t]*(?:#.*)?)[ \t]*$/;
+  const isPython = /^#!.*\bpython[0-9.]*\b/i.test(content);
+  const terminalSuccessExitPattern = isPython
+    ? /(^|\n)([ \t]*(?:sys\.exit\(0\)|raise[ \t]+SystemExit\(0\)|exit\(0\))[ \t]*(?:#.*)?)[ \t]*$/
+    : /(^|\n)([ \t]*exit[ \t]+0[ \t]*(?:#.*)?)[ \t]*$/;
   const match = content.match(terminalSuccessExitPattern);
 
   if (!match) {
@@ -760,9 +806,11 @@ export async function installPrizmkitScripts(projectRoot, dryRun, runtime = 'pyt
 
   const scripts = [
     'validate-prizm-docs.py',
+    'prizm-pre-commit.py',
     'diff-prizm-docs.py',
     'commit-intent-status.py',
     'post-command-prizm-drift.py',
+    'run-python-hook.cjs',
   ];
   const legacyManagedScripts = [
     'validate-prizm-docs.sh',
@@ -1277,8 +1325,13 @@ export async function installGitignore(projectRoot, options = {}, dryRun) {
     privateMemoryFiles: options.privateMemoryFiles || [],
   });
 
+  if (!templateContent) {
+    if (dryRun) console.log(chalk.gray('      [dry-run] .gitignore (no managed private-memory entries)'));
+    return;
+  }
+
   if (dryRun) {
-    console.log(chalk.gray(`      [dry-run] .gitignore`));
+    console.log(chalk.gray(`      [dry-run] .gitignore (private host memory only)`));
     return;
   }
 
@@ -1291,14 +1344,15 @@ export async function installGitignore(projectRoot, options = {}, dryRun) {
 
     if (missing.length > 0) {
       const separator = existing.endsWith('\n') ? '' : '\n';
-      const header = existingLines.has('# PrizmKit') ? '' : '# PrizmKit\n';
+      const managedHeader = '# PrizmKit private host memory';
+      const header = existingLines.has(managedHeader) ? '' : `${managedHeader}\n`;
       await fs.appendFile(targetPath, separator + '\n' + header + missing.join('\n') + '\n');
       console.log(chalk.green(`      ✓ .gitignore (added ${missing.length} entries)`));
     } else {
       console.log(chalk.green('      ✓ .gitignore (up-to-date)'));
     }
   } else {
-    await fs.writeFile(targetPath, templateContent);
+    await fs.writeFile(targetPath, `${templateContent}\n`);
     console.log(chalk.green('      ✓ .gitignore'));
   }
 }

package/bundled/skills/prizmkit-deploy/assets/deploy-document-template.md

@@ -1,89 +0,0 @@
-# Deployment Document Template
-
-Render `.prizmkit/deploy/deploy.md` with the exact top-level headings below. Replace placeholders with established values, use `not configured` or `not applicable` when truthful, and never write raw secret values. Update sections in place; do not append duplicate headings or turn this document into deployment history. Immutable operation events belong in `deploy-history/`.
-
-```markdown
-# Deployment
-
-## Target
-
-- Project: <project name>
-- Project type: <detected project type>
-- Environment: <dev | test | production>
-- Target: <SSH host alias | cloud platform | Docker | unsupported target>
-- Adapter: <ssh | cloud-guided | docker-guided | documented-fallback>
-- Strategy: <push | pull | direct-upload | platform-native | container-native | manual>
-- Public URL: <URL | not configured>
-
-## Prerequisites
-
-- <required runtime/tool/account/connectivity prerequisite>
-
-## Required Environment Variables
-
-Record names, purpose, source, and presence only. Never record values.
-
-| Name | Required | Purpose | Secret Source | Present |
-|---|---|---|---|---|
-| `<VARIABLE_NAME>` | yes | <purpose> | <platform secret store or ignored local env file> | yes/no |
-
-## Build and Release
-
-- Install command: `<command | not required>`
-- Build command: `<command | not required>`
-- Start command: `<command>`
-- Release layout: <path/layout or platform-native>
-- Artifact source: <repository checkout | uploaded archive | container image | platform build>
-
-## Runtime
-
-- Process manager: <manager | platform-native>
-- Runtime user: <user | platform-managed>
-- Internal port: <port | platform-managed>
-- Public routing: <Nginx/proxy/platform route>
-- Persistent storage: <mounts/volumes | none>
-
-## Health Checks
-
-| Name | URL or Command | Expected | Last Verified Result |
-|---|---|---|---|
-| <check> | <path/command> | <status/output> | <pass/fail/not run> |
-
-## DNS and TLS
-
-- Domain: <domain | not configured>
-- DNS status: <configured/pending/not applicable>
-- TLS issuer: <issuer | platform-managed | not configured>
-- Renewal: <automatic/manual/not applicable>
-
-## Rollback
-
-- Strategy: <previous release/platform rollback/image rollback/manual>
-- Command or procedure: <safe rollback command/procedure>
-- Readiness: <verified/not verified/not applicable>
-
-## Operations
-
-- Status: `<command or platform action>`
-- Logs: `<command or platform action>`
-- Restart: `<command or platform action>`
-- Health: `<command or platform action>`
-- Rollback: `<command or platform action>`
-
-## Current Validation
-
-- Configuration: <pass/fail/not run>
-- Connectivity: <pass/fail/not run>
-- Build: <pass/fail/not run>
-- Staged health: <pass/fail/not run>
-- Live health: <pass/fail/not run>
-- Latest history record: `.prizmkit/deploy/deploy-history/<event-id>.json` or `none`
-
-## Manual Actions
-
-- <remaining user-owned action, or `None`>
-
-## Notes
-
-- <stable deployment constraint, adapter gap, or operational warning>
-```

package/bundled/skills/prizmkit-deploy/references/ci-cd-workflows.md

@@ -1,145 +0,0 @@
-# CI/CD Workflow Templates
-
-Read this file when `deployStrategy` is `ci-cd-push` or `ci-cd-pull`.
-
-## Shared Configuration
-
-**Secrets** (add to GitHub repository Settings → Secrets and variables → Actions):
-- `SSH_HOST` — server IP/hostname
-- `SSH_USER` — runtime user (e.g., `deploy`)
-- `SSH_KEY` — SSH private key
-- `SSH_PORT` — SSH port (default 22)
-
-**Shared trigger:**
-```yaml
-on:
-  push:
-    branches: [<branch>]
-    paths-ignore:
-      - '.prizmkit/**'
-      - 'docs/**'
-```
-
----
-
-## Push Mode Workflow (`ci-cd-push`)
-
-Build happens on GitHub Actions runner. Only built artifacts are transferred to the server.
-
-```yaml
-name: Deploy to Production (Push)
-
-on:
-  push:
-    branches: [<branch>]
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-
-      - name: Allocate Release Identity
-        run: echo "ARCHIVE_ID=$(date -u +%Y%m%dT%H%M%SZ)-$(git rev-parse --short=12 HEAD)" >> "$GITHUB_ENV"
-
-      - name: Install & Build
-        run: |
-          npm ci
-          npm run build
-
-      - name: Package & Transfer
-        run: |
-          tar czf deploy-$ARCHIVE_ID.tar.gz \
-            <build-output-dir>/ node_modules/ package.json package-lock.json
-          scp -P ${{ secrets.SSH_PORT }} deploy-$ARCHIVE_ID.tar.gz \
-            ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:/var/www/<project>/releases/
-
-      - name: Deploy on Server
-        uses: appleboy/ssh-action@v1
-        env:
-          ARCHIVE_ID: ${{ env.ARCHIVE_ID }}
-        with:
-          host: ${{ secrets.SSH_HOST }}
-          username: ${{ secrets.SSH_USER }}
-          key: ${{ secrets.SSH_KEY }}
-          port: ${{ secrets.SSH_PORT }}
-          envs: ARCHIVE_ID
-          script: |
-            set -eu
-            cd /var/www/<project>
-            RELEASE_ID="$ARCHIVE_ID"
-            SUFFIX=1
-            while [ -e "releases/$RELEASE_ID" ]; do
-              [ "$SUFFIX" -le 99 ] || { echo "release identity suffixes exhausted" >&2; exit 1; }
-              RELEASE_ID="$ARCHIVE_ID-$(printf '%02d' "$SUFFIX")"
-              SUFFIX=$((SUFFIX + 1))
-            done
-            mkdir "releases/$RELEASE_ID"
-            tar xzf "releases/deploy-$ARCHIVE_ID.tar.gz" -C "releases/$RELEASE_ID"
-            rm "releases/deploy-$ARCHIVE_ID.tar.gz"
-            # PM2 start, health check, Nginx switch, history, and metadata use RELEASE_ID
-```
-
-**Key difference from Pull:** the runner checks out code, installs, builds, and only transmits the result. The server doesn't need Git or build tools — just Node.js runtime and PM2.
-
----
-
-## Pull Mode Workflow (`ci-cd-pull`)
-
-GitHub Actions runner only triggers the server. The server does all the work.
-
-```yaml
-name: Deploy to Production (Pull)
-
-on:
-  push:
-    branches: [<branch>]
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Allocate Release Identity
-        run: |
-          echo "RELEASE_BASE=$(date -u +%Y%m%dT%H%M%SZ)-$(git rev-parse --short=12 HEAD)" >> "$GITHUB_ENV"
-          echo "DEPLOY_SHA=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
-
-      - name: Trigger Server Deploy
-        uses: appleboy/ssh-action@v1
-        env:
-          RELEASE_BASE: ${{ env.RELEASE_BASE }}
-          DEPLOY_SHA: ${{ env.DEPLOY_SHA }}
-        with:
-          host: ${{ secrets.SSH_HOST }}
-          username: ${{ secrets.SSH_USER }}
-          key: ${{ secrets.SSH_KEY }}
-          port: ${{ secrets.SSH_PORT }}
-          envs: RELEASE_BASE,DEPLOY_SHA
-          script: |
-            set -eu
-            cd /var/www/<project>
-            RELEASE_ID="$RELEASE_BASE"
-            SUFFIX=1
-            while [ -e "releases/$RELEASE_ID" ]; do
-              [ "$SUFFIX" -le 99 ] || { echo "release identity suffixes exhausted" >&2; exit 1; }
-              RELEASE_ID="$RELEASE_BASE-$(printf '%02d' "$SUFFIX")"
-              SUFFIX=$((SUFFIX + 1))
-            done
-            git clone --no-checkout --branch <branch> <repoUrl> "releases/$RELEASE_ID"
-            git -C "releases/$RELEASE_ID" checkout --detach "$DEPLOY_SHA"
-            cd "releases/$RELEASE_ID"
-            npm ci
-            cp ../../shared/.env.production .
-            npm run build
-            # PM2 start, health check, Nginx switch, history, and metadata use RELEASE_ID
-```
-
-**Key difference from Push:** the workflow is simpler (one step: SSH + run script), but the server needs Git, full build toolchain, and must be able to reach the repo.
-
-After generating the workflow, verify: the first `git push` to the configured branch will trigger the first deployment. Monitor the GitHub Actions run and report results.