fix: auto-download pre-built release for empty submodule sub-packages

When a Joomla package has a sub-package that is a git submodule with an empty or missing source directory (e.g. failed CI checkout), the packager now falls back to downloading the latest stable release ZIP from the submodule's Gitea remote. Also supports pre-staged ZIPs in the output directory, allowing manual or workflow-based pre-population of sub-package archives. Claude-Session: https://claude.ai/code/session_01MbEjBtsSjPuTWhqqrMS2wG
Merge pull request 'fix(security): prevent script injection in rc-revert workflow' (#324 ) from feature/harden-rc-revert-injection into dev
2026-06-28 14:33:53 -05:00 · 2026-06-27 02:32:26 +00:00 · 2026-06-27 02:30:54 +00:00 · 2026-06-27 02:30:43 +00:00 · 2026-06-23 17:59:22 +00:00 · 2026-06-23 17:58:56 +00:00
416 changed files with 24341 additions and 2735 deletions
@@ -38,7 +38,7 @@ composer check                           # Run all checks
 | `lib/Enterprise/Plugins/` | 11 platform plugins (Joomla, Dolibarr, Node.js, Python, etc.) |
 | `deploy/` | SFTP deployment scripts (Joomla, Dolibarr, health checks) |
 | `templates/` | Universal templates, configs, governance schema |
-| `.mokogitea/workflows/` | CI/CD workflows (MokoGitea Actions) |
+| `.mokogitea/workflows/` | CI/CD workflows (Gitea Actions) |
 | `bin/moko` | Unified CLI dispatcher — `php bin/moko <command>` |
 | `monitoring/sites.json` | Sites list for mcp_mokomonitor |

@@ -71,6 +71,6 @@ PHPStan runs with `--memory-limit=512M`. CI enforces PHPCS errors; PHPStan is `c
 - **Never commit** `.claude/`, `.mcp.json`, `TODO.md`, `*.min.css`/`*.min.js`
 - **Attribution**: `Authored-by: Moko Consulting`
 - **Workflow directory**: `.mokogitea/` (not `.gitea/` or `.github/`)
- **Wiki**: documentation lives in the MokoGitea wiki, not `docs/` files
+- **Wiki**: documentation lives in the Gitea wiki, not `docs/` files
 - **New CLI tools**: extend `CliFramework`, not `CLIApp` (legacy)
 - **Standards**: [MokoCli](https://git.mokoconsulting.tech/MokoConsulting/mokocli/wiki/Home)
@@ -124,8 +124,7 @@ jobs:
            "rule_name": "main",
            "enable_push": true,
            "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller", "moko-deploy"],
-            "push_whitelist_actions_user": true,
+            "push_whitelist_usernames": ["jmiller"],
            "enable_force_push": false,
            "enable_force_push_allowlist": false,
            "force_push_allowlist_usernames": [],
@@ -141,12 +140,10 @@ jobs:
            "rule_name": "dev",
            "enable_push": true,
            "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller", "moko-deploy"],
-            "push_whitelist_actions_user": true,
-            "enable_force_push": true,
-            "enable_force_push_allowlist": true,
-            "force_push_allowlist_usernames": ["jmiller", "moko-deploy"],
-            "force_push_allowlist_actions_user": true,
+            "push_whitelist_usernames": ["jmiller"],
+            "enable_force_push": false,
+            "enable_force_push_allowlist": false,
+            "force_push_allowlist_usernames": [],
            "enable_merge_whitelist": false,
            "required_approvals": 0,
            "block_on_rejected_reviews": false,
@@ -157,12 +154,10 @@ jobs:
            "rule_name": "rc",
            "enable_push": true,
            "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller", "moko-deploy"],
-            "push_whitelist_actions_user": true,
-            "enable_force_push": true,
-            "enable_force_push_allowlist": true,
-            "force_push_allowlist_usernames": ["jmiller", "moko-deploy"],
-            "force_push_allowlist_actions_user": true,
+            "push_whitelist_usernames": ["jmiller"],
+            "enable_force_push": false,
+            "enable_force_push_allowlist": false,
+            "force_push_allowlist_usernames": [],
            "enable_merge_whitelist": false,
            "required_approvals": 0,
            "block_on_rejected_reviews": false,
@@ -173,8 +168,7 @@ jobs:
            "rule_name": "beta",
            "enable_push": true,
            "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller", "moko-deploy"],
-            "push_whitelist_actions_user": true,
+            "push_whitelist_usernames": ["jmiller"],
            "enable_force_push": false,
            "enable_force_push_allowlist": false,
            "force_push_allowlist_usernames": [],
@@ -188,8 +182,7 @@ jobs:
            "rule_name": "alpha",
            "enable_push": true,
            "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller", "moko-deploy"],
-            "push_whitelist_actions_user": true,
+            "push_whitelist_usernames": ["jmiller"],
            "enable_force_push": false,
            "enable_force_push_allowlist": false,
            "force_push_allowlist_usernames": [],
@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
 # INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/auto-bump.yml
 # VERSION: 09.02.00
 # BRIEF: Auto patch-bump version on every push to dev (skips merge commits)
@@ -22,7 +22,7 @@ on:

 env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}

 permissions:
  contents: write
@@ -34,8 +34,7 @@ jobs:
    if: >-
      !contains(github.event.head_commit.message, '[skip ci]') &&
      !contains(github.event.head_commit.message, '[skip bump]') &&
-      !startsWith(github.event.head_commit.message, 'Merge pull request') &&
-      !startsWith(github.event.repository.name, 'Template-')
+      !startsWith(github.event.head_commit.message, 'Merge pull request')

    steps:
      - name: Checkout
@@ -53,7 +52,7 @@ jobs:
            echo "MOKO_CLI=/opt/mokocli/cli" >> "$GITHUB_ENV"
          else
            git clone --depth 1 --branch main --quiet \
-              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/MokoCLI.git" \
+              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/mokocli.git" \
              /tmp/mokocli
            cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
            echo "MOKO_CLI=/tmp/mokocli/cli" >> "$GITHUB_ENV"
@@ -3,11 +3,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
 # INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/auto-release.yml
-# VERSION: 05.01.00
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
+# PATH: /templates/workflows/universal/auto-release.yml.template
+# VERSION: 05.00.00
 # BRIEF: Universal build & release � detects platform from manifest.xml
 #
 # +=======================================================================+
@@ -27,18 +27,9 @@ name: "Universal: Build & Release"

 on:
  pull_request:
-    types: [opened, synchronize, closed]
+    types: [opened, closed]
    branches:
      - main
-    paths-ignore:
-      - '.mokogitea/workflows/**'
-      - '*.md'
-      - 'wiki/**'
-      - '.editorconfig'
-      - '.gitignore'
-      - '.gitattributes'
-      - '.gitmessage'
-      - 'LICENSE' 
  workflow_dispatch:
    inputs:
      action:
@@ -52,7 +43,7 @@ on:

 env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}

@@ -64,14 +55,9 @@ jobs:
  promote-rc:
    name: Promote to RC
    runs-on: release
-    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
    if: >-
-      !startsWith(github.event.repository.name, 'Template-') &&
-      (
-        (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
-        (github.event.action == 'synchronize' && github.event.pull_request.merged != true) ||
-        (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
-      )
+      (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
+      (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')

    steps:
      - name: Checkout repository
@@ -79,7 +65,6 @@ jobs:
        with:
          token: ${{ secrets.MOKOGITEA_TOKEN }}
          fetch-depth: 1
-          submodules: recursive

      - name: Setup mokocli tools
        env:
@@ -95,7 +80,7 @@ jobs:
              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
            fi
            rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
            cd /tmp/mokocli
            composer install --no-dev --no-interaction --quiet
@@ -104,46 +89,18 @@ jobs:

      - name: Rename branch to rc
        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          AUTH="Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}"
-          FROM="${{ github.event.pull_request.head.ref || 'dev' }}"
-          PR="${{ github.event.pull_request.number }}"
-
-          # Resolve the source branch HEAD commit.
-          SRC_JSON=$(curl -sf -H "$AUTH" "${API_BASE}/branches/${FROM}") \
-            || { echo "::error::Source branch ${FROM} not found"; exit 1; }
-          SRC_SHA=$(printf '%s' "$SRC_JSON" | python3 -c "import sys, json; print(json.load(sys.stdin)['commit']['id'])" 2>/dev/null || true)
-          [ -n "$SRC_SHA" ] || { echo "::error::Could not resolve HEAD of ${FROM}"; exit 1; }
-
-          # Point rc at the source commit. If rc already exists (a protected branch that
-          # cannot be deleted), force-update its ref in place instead of delete+recreate:
-          # deleting a protected branch fails, which then makes the recreate return HTTP 409.
-          if curl -sf -o /dev/null -H "$AUTH" "${API_BASE}/branches/rc"; then
-            echo "rc exists - force-updating to ${FROM} (${SRC_SHA})"
-            curl -sf -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
-              "${API_BASE}/git/refs/heads/rc" -d "{\"sha\":\"${SRC_SHA}\",\"force\":true}" \
-              || { echo "::error::Failed to force-update rc (CI token needs force-push on the protected rc branch)"; exit 1; }
-          else
-            echo "Creating rc from ${FROM}"
-            curl -sf -X POST -H "$AUTH" -H "Content-Type: application/json" \
-              "${API_BASE}/branches" -d "{\"new_branch_name\":\"rc\",\"old_branch_name\":\"${FROM}\"}" \
-              || { echo "::error::Failed to create rc from ${FROM}"; exit 1; }
-          fi
-
-          # Repoint the PR at rc, then delete the old source branch (non-fatal).
-          if [ -n "$PR" ]; then
-            curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
-              "${API_BASE}/pulls/${PR}" -d '{"head":"rc"}' >/dev/null || true
-          fi
-          curl -s -X DELETE -H "$AUTH" "${API_BASE}/branches/${FROM}" >/dev/null || true
-          echo "Renamed ${FROM} -> rc"
+          php ${MOKO_CLI}/branch_rename.php \
+            --from "${{ github.event.pull_request.head.ref || 'dev' }}" --to rc \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
+            --api-base "${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}" \
+            --pr "${{ github.event.pull_request.number }}"

      - name: Checkout rc and configure git
        run: |
          git fetch origin rc
          git checkout rc
-          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "mokogitea-actions[bot]"
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"

      - name: Publish RC release
@@ -154,7 +111,7 @@ jobs:

      - name: Update RC release notes from CHANGELOG.md
        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"

          # Extract [Unreleased] section from changelog
@@ -196,13 +153,9 @@ jobs:
  release:
    name: Build & Release Pipeline
    runs-on: release
-    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
    if: >-
-      !startsWith(github.event.repository.name, 'Template-') &&
-      (
-        github.event.pull_request.merged == true ||
-        (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
-      )
+      github.event.pull_request.merged == true ||
+      (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')

    steps:
      - name: Checkout repository
@@ -210,12 +163,11 @@ jobs:
        with:
          token: ${{ secrets.MOKOGITEA_TOKEN }}
          fetch-depth: 0
-          submodules: recursive

      - name: Configure git for bot pushes
        run: |
-          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "mokogitea-actions[bot]"
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"

      - name: Check for merge conflict markers
@@ -246,7 +198,7 @@ jobs:
              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
            fi
            rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
            cd /tmp/mokocli
            composer install --no-dev --no-interaction --quiet
@@ -307,7 +259,7 @@ jobs:
          !startsWith(steps.platform.outputs.platform, 'joomla')
        run: |
          VERSION="${{ steps.version.outputs.version }}"
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
          SEMVER_TAG="v${VERSION}"

@@ -332,7 +284,7 @@ jobs:

      - name: Update release notes and promote changelog
        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"

          # Get the stable release info (version and ID)
@@ -401,7 +353,7 @@ jobs:
          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
          RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          php ${MOKO_CLI}/release_mirror.php \
            --version "$VERSION" --tag "$RELEASE_TAG" \
            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
@@ -426,11 +378,11 @@ jobs:
            && echo "main branch pushed to GitHub mirror" \
            || echo "WARNING: GitHub mirror push failed"

-      - name: "Step 11: Delete rc branch (dev reset moved to cascade-dev.yml)"
+      - name: "Step 11: Delete rc branch and recreate dev from main"
        if: steps.version.outputs.skip != 'true'
        continue-on-error: true
        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"

          # Delete rc branch (ephemeral — created by promote-rc)
@@ -438,15 +390,23 @@ jobs:
            "${API_BASE}/branches/rc" 2>/dev/null \
            && echo "Deleted rc branch" || echo "rc branch not found"

-          # dev is reset from main by the dedicated "Cascade Main -> Dev" workflow
-          # (cascade-dev.yml), which runs after this release completes.
-          echo "rc cleaned; dev reset handled by cascade-dev.yml" >> $GITHUB_STEP_SUMMARY
+          # Delete dev branch
+          curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
+            "${API_BASE}/branches/dev" 2>/dev/null && echo "Deleted dev branch"
+
+          # Recreate dev from main (now includes version bump + changelog promotion)
+          curl -sf -X POST -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${API_BASE}/branches" \
+            -d '{"new_branch_name":"dev","old_branch_name":"main"}' 2>/dev/null && echo "Recreated dev from main"
+
+          echo "Pre-release branches cleaned, dev reset from main" >> $GITHUB_STEP_SUMMARY

      - name: "Step 12: Create version branch from main"
        if: steps.version.outputs.skip != 'true'
        continue-on-error: true
        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
          BRANCH_NAME="version/${VERSION}"
@@ -467,7 +427,7 @@ jobs:
        if: steps.version.outputs.skip != 'true'
        continue-on-error: true
        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          php ${MOKO_CLI}/version_reset_dev.php \
            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "${API_BASE}" \
            --branch dev --path . 2>&1 || true
@@ -493,5 +453,5 @@ jobs:
            echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
            echo "| Branch | \`${{ steps.version.outputs.branch }}\` |" >> $GITHUB_STEP_SUMMARY
            echo "| Tag | \`${{ steps.version.outputs.tag }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Release | [View](${MOKOGITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
+            echo "| Release | [View](${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
          fi
@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoCli.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/branch-cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Delete feature branches after PR merge
@@ -33,8 +33,7 @@ jobs:
        run: |
          BRANCH="${{ github.event.pull_request.head.ref }}"
          API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
-          # URL-encode the branch name's slashes (no PHP dependency on the runner)
-          ENCODED=$(printf '%s' "${BRANCH}" | sed 's|/|%2F|g')
+          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")

          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
            -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
@@ -1,54 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# Enforce branch protection rules across all org repos.
-# Runs weekly and on manual dispatch.
-
-name: "Org: Enforce Branch Protections"
-
-on:
-  schedule:
-    - cron: '0 6 * * 1'  # Every Monday at 6am UTC
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Dry run (show changes without applying)'
-        required: false
-        type: boolean
-        default: false
-
-jobs:
-  enforce:
-    name: Enforce Branch Protections
-    runs-on: release
-
-    steps:
-      - name: Checkout MokoCLI
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
-
-      - name: Setup PHP
-        run: |
-          if ! command -v php > /dev/null 2>&1; then
-            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-curl > /dev/null 2>&1
-          fi
-
-      - name: Run branch protection enforcement
-        run: |
-          DRY_RUN=""
-          if [ "${{ inputs.dry_run }}" = "true" ]; then
-            DRY_RUN="--dry-run"
-          fi
-          php cli/branch_protect_org.php \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
-            --org "MokoConsulting" \
-            $DRY_RUN
-
-      - name: Summary
-        if: always()
-        run: |
-          echo "## Branch Protection Enforcement" >> $GITHUB_STEP_SUMMARY
-          echo "All repos checked for main, dev, rc, beta, alpha protections" >> $GITHUB_STEP_SUMMARY
-          echo "Push whitelist: jmiller only" >> $GITHUB_STEP_SUMMARY
@@ -1,106 +1,10 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.Cascade
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/cascade-dev.yml
-# VERSION: 02.00.00
-# BRIEF: Cascade main -> dev via PR; auto-merge only if conflict-free, else notify
-
-name: "Cascade Main -> Dev"
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-env:
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  # ntfy destination is configured via repo or org variables (org vars are inherited).
-  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
-  NTFY_TOPIC: ${{ vars.CASCADE_NTFY_TOPIC || vars.NTFY_TOPIC || 'gitea-releases' }}
-
+# DISABLED — auto-release Step 11 recreates dev from main after every release.
+# Cascade-dev is redundant and causes version conflicts when both main and dev
+# have different version numbers in templateDetails.xml / manifest.xml.
+name: "Cascade Main → Dev (DISABLED)"
+on: workflow_dispatch
 jobs:
-  cascade:
-    name: Cascade main -> dev
+  noop:
    runs-on: ubuntu-latest
    steps:
-      - name: Open main -> dev PR (auto-merge if clean, else notify)
-        env:
-          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -uo pipefail
-          API="${MOKOGITEA_URL}/api/v1/repos/${REPO}"
-          AUTH="Authorization: token ${TOKEN}"
-          jqnum() { python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('$1',''))" 2>/dev/null; }
-
-          # 0. dev must exist
-          if ! curl -sf -H "$AUTH" "${API}/branches/dev" >/dev/null 2>&1; then
-            echo "No dev branch - nothing to cascade."; exit 0
-          fi
-
-          # 1. is main ahead of dev?
-          AHEAD=$(curl -sf -H "$AUTH" "${API}/compare/dev...main" \
-            | python3 -c "import sys,json; print(json.load(sys.stdin).get('total_commits',0))" 2>/dev/null || echo 0)
-          if [ "${AHEAD:-0}" -eq 0 ]; then
-            echo "dev already up to date with main."; exit 0
-          fi
-          echo "main is ${AHEAD} commit(s) ahead of dev."
-
-          # 2. reuse an open main->dev PR, else create one
-          PR=$(curl -sf -H "$AUTH" "${API}/pulls?state=open&base=dev" \
-            | python3 -c "import sys,json; d=json.load(sys.stdin); print(next((str(p['number']) for p in d if p.get('head',{}).get('ref')=='main'), ''))" 2>/dev/null || echo "")
-          if [ -z "$PR" ]; then
-            RESP=$(curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/pulls" \
-              -d '{"head":"main","base":"dev","title":"chore(sync): cascade main -> dev","body":"Automated cascade of main into dev. Auto-merges only if conflict-free; otherwise left open for manual resolution."}')
-            PR=$(printf '%s' "$RESP" | jqnum number)
-            if [ -z "$PR" ]; then
-              echo "::warning::Could not open cascade PR: $RESP"; exit 0
-            fi
-            echo "Opened cascade PR #${PR}"
-          else
-            echo "Reusing open cascade PR #${PR}"
-          fi
-
-          # 3. wait for MokoGitea to compute mergeability (conflict detection)
-          MERGEABLE=""
-          for _ in 1 2 3 4 5 6; do
-            MERGEABLE=$(curl -sf -H "$AUTH" "${API}/pulls/${PR}" | jqnum mergeable)
-            case "$MERGEABLE" in True|False) break ;; esac
-            sleep 3
-          done
-          echo "mergeable=${MERGEABLE}"
-
-          notify() {
-            curl -sS \
-              -H "Title: ${REPO}: dev cascade needs manual merge" \
-              -H "Tags: warning,twisted_rightwards_arrows" \
-              -H "Priority: high" \
-              -H "Click: ${MOKOGITEA_URL}/${REPO}/pulls/${PR}" \
-              -d "main -> dev cascade PR #${PR} $1 It was NOT auto-merged; resolve it manually." \
-              "${NTFY_URL}/${NTFY_TOPIC}" || true
-          }
-
-          # 4. auto-merge only if conflict-free; otherwise notify
-          if [ "$MERGEABLE" = "True" ]; then
-            CODE=$(curl -s -o /tmp/merge.json -w "%{http_code}" -H "$AUTH" -H "Content-Type: application/json" \
-              -X POST "${API}/pulls/${PR}/merge" -d '{"Do":"merge","merge_when_checks_succeed":true}')
-            if [ "$CODE" -ge 200 ] && [ "$CODE" -lt 300 ]; then
-              echo "Cascade PR #${PR} merged (or scheduled to merge when checks pass)."
-            else
-              echo "::warning::Auto-merge returned HTTP ${CODE}: $(cat /tmp/merge.json)"
-              notify "could not be auto-merged (HTTP ${CODE})."
-            fi
-          else
-            echo "::warning::Cascade PR #${PR} has conflicts (mergeable=${MERGEABLE}); sending notification."
-            notify "has conflicts and cannot be merged automatically."
-          fi
+      - run: echo "Cascade disabled — auto-release handles dev recreation"
@@ -3,22 +3,16 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.CI
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoCli.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/ci-generic.yml
+# PATH: /.gitea/workflows/ci-generic.yml
 # VERSION: 01.00.00
 # BRIEF: CI pipeline — lint, validate, and test for generic projects (PHP + Node.js)

 name: "Generic: Project CI"

 on:
-  pull_request:
-    branches:
-      - main
-      - dev
-      - dev/**
-      - rc/**
  workflow_dispatch:

 permissions:
@@ -32,8 +26,6 @@ jobs:
  lint:
    name: Lint & Validate
    runs-on: ubuntu-latest
-    # Skip on template repos (Template-*) — they hold placeholder scaffolding, not buildable source.
-    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}

    steps:
      - name: Checkout
@@ -132,9 +124,6 @@ jobs:
    name: Tests
    runs-on: ubuntu-latest
    needs: lint
-    # Run only when lint succeeded; always() forces evaluation so a skipped
-    # lint (e.g. template repos) skips this job cleanly instead of hanging.
-    if: ${{ always() && needs.lint.result == 'success' }}

    steps:
      - name: Checkout
@@ -1,68 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/ci-issue-reporter.yml
-# VERSION: 01.00.00
-# BRIEF: Reusable workflow — creates/updates a MokoGitea issue when a CI gate fails.
-#        Clones MokoCLI and runs cli/ci_issue_reporter.sh.
-
-name: "Universal: CI Issue Reporter"
-
-on:
-  workflow_call:
-    inputs:
-      gate:
-        description: "CI gate name (e.g. PR Validation, Repository Health)"
-        required: true
-        type: string
-      details:
-        description: "Human-readable failure description"
-        required: true
-        type: string
-      severity:
-        description: "error or warning"
-        required: false
-        type: string
-        default: "error"
-      workflow:
-        description: "Workflow name for the issue title"
-        required: false
-        type: string
-        default: ""
-    secrets:
-      MOKOGITEA_TOKEN:
-        required: true
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  report:
-    name: "Report: ${{ inputs.gate }}"
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Clone MokoCLI
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
-          git clone --depth 1 --filter=blob:none --sparse "${MOKOGITEA_URL}/MokoConsulting/MokoCLI.git" /tmp/mokocli
-          cd /tmp/mokocli && git sparse-checkout set cli/ci_issue_reporter.sh
-
-      - name: Report CI failure
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-        run: |
-          chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh
-          /tmp/mokocli/cli/ci_issue_reporter.sh \
-            --gate "${{ inputs.gate }}" \
-            --details "${{ inputs.details }}" \
-            --severity "${{ inputs.severity }}" \
-            --workflow "${{ inputs.workflow }}"
@@ -115,7 +115,7 @@ jobs:

      - name: "PHPCS (PSR-12)"
        run: |
-          vendor/bin/phpcs --standard=phpcs.xml --report=summary --warning-severity=0 lib/ validate/ 2>&1 || {
+          vendor/bin/phpcs --standard=phpcs.xml --report=summary --warning-severity=0 lib/ validate/ automation/ 2>&1 || {
            echo "::error::PHPCS found coding standard violations"
            echo "### PHPCS" >> $GITHUB_STEP_SUMMARY
            echo "Coding standard violations detected. Run \`composer phpcs\` locally." >> $GITHUB_STEP_SUMMARY
@@ -453,8 +453,8 @@ jobs:
           needs.governance.result == 'failure' ||
           needs.templates.result == 'failure')
        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
        run: |
          chmod +x automation/ci-issue-reporter.sh
          REPORTER="./automation/ci-issue-reporter.sh"
@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.Maintenance
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.mokogitea/workflows/cleanup.yml
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoCli.Maintenance
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoCli
+# PATH: /.gitea/workflows/cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Scheduled cleanup — delete merged branches and old workflow runs

@@ -21,7 +21,7 @@ permissions:
  contents: write

 env:
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}

 jobs:
  cleanup:
@@ -33,30 +33,30 @@ jobs:
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          token: ${{ secrets.GA_TOKEN }}

      - name: Delete merged branches
        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN }}
        run: |
          echo "=== Merged Branch Cleanup ==="
-          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"

          # List branches via API
-          BRANCHES=$(curl -sS -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+          BRANCHES=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
            "${API}/branches?limit=50" | jq -r '.[].name')

          DELETED=0
          for BRANCH in $BRANCHES; do
            # Skip protected branches
            case "$BRANCH" in
-              main|master|dev|develop|rc|beta|alpha|release|release/*|production|stable|staging|hotfix/*|version/*) continue ;;
+              main|master|develop|release/*|hotfix/*) continue ;;
            esac

            # Check if branch is merged into main
            if git merge-base --is-ancestor "origin/${BRANCH}" origin/main 2>/dev/null; then
              echo "  Deleting merged branch: ${BRANCH}"
-              curl -sS -X DELETE -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+              curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
                "${API}/branches/${BRANCH}" 2>/dev/null || true
              DELETED=$((DELETED + 1))
            fi
@@ -66,20 +66,20 @@ jobs:

      - name: Clean old workflow runs
        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN }}
        run: |
          echo "=== Workflow Run Cleanup ==="
-          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
          CUTOFF=$(date -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -v-30d +%Y-%m-%dT%H:%M:%SZ)

          # Get old completed runs
-          RUNS=$(curl -sS -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+          RUNS=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
            "${API}/actions/runs?status=completed&limit=50" | \
            jq -r ".workflow_runs[] | select(.created_at < \"${CUTOFF}\") | .id" 2>/dev/null)

          DELETED=0
          for RUN_ID in $RUNS; do
-            curl -sS -X DELETE -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+            curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
              "${API}/actions/runs/${RUN_ID}" 2>/dev/null || true
            DELETED=$((DELETED + 1))
          done
@@ -1,76 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-name: "Publish to Composer"
-
-on:
-  push:
-    tags:
-      - 'v*'
-      - '[0-9]*.[0-9]*.[0-9]*'
-  release:
-    types: [published]
-  workflow_dispatch:
-
-env:
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-
-jobs:
-  publish:
-    name: Publish Package
-    runs-on: ubuntu-latest
-    if: >-
-      !contains(github.event.head_commit.message, '[skip ci]') &&
-      !contains(github.event.head_commit.message, '[skip publish]')
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup PHP
-        run: |
-          if ! command -v php &> /dev/null; then
-            sudo apt-get update -qq
-            sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
-          fi
-
-      - name: Install dependencies
-        run: composer install --no-dev --no-interaction --prefer-dist --quiet
-
-      - name: Determine version
-        id: version
-        run: |
-          VERSION=$(php -r "echo json_decode(file_get_contents('composer.json'))->version;")
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "Package version: ${VERSION}"
-
-      # Gitea Composer Registry — auto-publishes from tags
-      # The tag push itself registers the package at:
-      # https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer
-      - name: Verify Gitea registry
-        run: |
-          echo "Gitea Composer registry auto-publishes from tags."
-          echo "Package available at: ${MOKOGITEA_URL}/api/packages/MokoConsulting/composer"
-          echo "Install: composer require mokoconsulting/mokocli"
-
-      # Packagist — notify of new version (points to GitHub mirror which Packagist can access)
-      - name: Notify Packagist
-        if: ${{ secrets.PACKAGIST_TOKEN != '' }}
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          echo "Notifying Packagist of version ${VERSION}..."
-          curl -sf -X POST \
-            -H "Content-Type: application/json" \
-            -d '{"repository":{"url":"https://github.com/mokoconsulting-tech/mokocli"}}' \
-            "https://packagist.org/api/update-package?username=mokoconsulting&apiToken=${{ secrets.PACKAGIST_TOKEN }}" \
-            && echo "Packagist notified" \
-            || echo "::warning::Packagist notification failed (package may not be registered yet)"
-
-      - name: Summary
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          echo "## Composer Package Published" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "| Registry | Status |" >> $GITHUB_STEP_SUMMARY
-          echo "|----------|--------|" >> $GITHUB_STEP_SUMMARY
-          echo "| Gitea | \`composer require mokoconsulting/mokocli:${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
-          echo "| Packagist | \`composer require mokoconsulting/mokocli\` |" >> $GITHUB_STEP_SUMMARY
@@ -0,0 +1,126 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoCli.Deploy
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /templates/workflows/joomla/deploy-manual.yml.template
+# VERSION: 04.07.00
+# BRIEF: Manual SFTP deploy to dev server for Joomla repos
+
+name: "Universal: Deploy to Dev (Manual)"
+
+on:
+  workflow_dispatch:
+    inputs:
+      clear_remote:
+        description: 'Delete all remote files before uploading'
+        required: false
+        default: 'false'
+        type: boolean
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    name: SFTP Deploy to Dev
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Setup PHP
+        run: |
+          php -v && composer --version
+
+      - name: Setup MokoCli tools
+        env:
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
+        run: |
+          git clone --depth 1 --branch main --quiet \
+            "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git" \
+            /tmp/mokostandards-api 2>/dev/null || true
+          if [ -d "/tmp/mokostandards-api" ] && [ -f "/tmp/mokostandards-api/composer.json" ]; then
+            cd /tmp/mokostandards-api && composer install --no-dev --no-interaction --quiet 2>/dev/null || true
+          fi
+
+      - name: Check FTP configuration
+        id: check
+        env:
+          HOST: ${{ vars.DEV_FTP_HOST }}
+          PATH_VAR: ${{ vars.DEV_FTP_PATH }}
+          PORT: ${{ vars.DEV_FTP_PORT }}
+        run: |
+          if [ -z "$HOST" ] || [ -z "$PATH_VAR" ]; then
+            echo "DEV_FTP_HOST or DEV_FTP_PATH not configured -- cannot deploy"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+          echo "host=$HOST" >> "$GITHUB_OUTPUT"
+
+          REMOTE="${PATH_VAR%/}"
+          echo "remote=$REMOTE" >> "$GITHUB_OUTPUT"
+
+          [ -z "$PORT" ] && PORT="22"
+          echo "port=$PORT" >> "$GITHUB_OUTPUT"
+
+      - name: Deploy via SFTP
+        if: steps.check.outputs.skip != 'true'
+        env:
+          SFTP_KEY: ${{ secrets.DEV_FTP_KEY }}
+          SFTP_PASS: ${{ secrets.DEV_FTP_PASSWORD }}
+          SFTP_USER: ${{ vars.DEV_FTP_USERNAME }}
+        run: |
+          SOURCE_DIR="src"
+          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
+          [ ! -d "$SOURCE_DIR" ] && { echo "No src/ or htdocs/ -- nothing to deploy"; exit 0; }
+
+          printf '{"host":"%s","port":%s,"username":"%s","remotePath":"%s"' \
+            "${{ steps.check.outputs.host }}" "${{ steps.check.outputs.port }}" "$SFTP_USER" "${{ steps.check.outputs.remote }}" \
+            > /tmp/sftp-config.json
+
+          if [ -n "$SFTP_KEY" ]; then
+            echo "$SFTP_KEY" > /tmp/deploy_key
+            chmod 600 /tmp/deploy_key
+            printf ',"privateKeyPath":"/tmp/deploy_key"}' >> /tmp/sftp-config.json
+          else
+            printf ',"password":"%s"}' "$SFTP_PASS" >> /tmp/sftp-config.json
+          fi
+
+          DEPLOY_ARGS=(--path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json)
+          [ "${{ inputs.clear_remote }}" = "true" ] && DEPLOY_ARGS+=(--clear-remote)
+
+          PLATFORM=$(php /tmp/mokostandards-api/cli/platform_detect.php --path . 2>/dev/null || true)
+          if [ "$PLATFORM" = "waas-component" ] && [ -f "/tmp/mokostandards-api/deploy/deploy-joomla.php" ]; then
+            php /tmp/mokostandards-api/deploy/deploy-joomla.php "${DEPLOY_ARGS[@]}"
+          else
+            php /tmp/mokostandards-api/deploy/deploy-sftp.php "${DEPLOY_ARGS[@]}"
+          fi
+
+          rm -f /tmp/deploy_key /tmp/sftp-config.json
+
+      - name: Summary
+        if: always()
+        run: |
+          if [ "${{ steps.check.outputs.skip }}" = "true" ]; then
+            echo "### Deploy Skipped -- FTP not configured" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "### Manual Dev Deploy Complete" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
+            echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
+            echo "| Host | \`${{ steps.check.outputs.host }}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Remote | \`${{ steps.check.outputs.remote }}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Clear | ${{ inputs.clear_remote }} |" >> $GITHUB_STEP_SUMMARY
+          fi
@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.Security
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards-API
-# PATH: /.mokogitea/workflows/gitleaks.yml
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoCli.Security
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
+# PATH: /templates/workflows/gitleaks.yml.template
 # VERSION: 01.00.00
 # BRIEF: Secret scanning — detect leaked credentials, API keys, and tokens
 #
@@ -5,7 +5,7 @@
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
 # INGROUP: mokocli.Automation
-# VERSION: 01.00.00
+# VERSION: 09.38.05
 # BRIEF: Auto-create feature branch when an issue is opened

 name: "Universal: Issue Branch"
@@ -19,7 +19,7 @@ permissions:
  issues: write

 env:
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}

 jobs:
  create-branch:
@@ -28,8 +28,8 @@ jobs:
    steps:
      - name: Create branch and comment
        run: |
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
+          TOKEN="${{ secrets.GA_TOKEN }}"
+          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
          ISSUE_NUM="${{ github.event.issue.number }}"
          ISSUE_TITLE="${{ github.event.issue.title }}"

@@ -58,7 +58,7 @@ jobs:
            echo "Created branch: ${BRANCH}"

            # Comment on issue with branch link
-            REPO_URL="${MOKOGITEA_URL}/${{ github.repository }}"
+            REPO_URL="${GITEA_URL}/${{ github.repository }}"
            BODY="Branch created: [\`${BRANCH}\`](${REPO_URL}/src/branch/${BRANCH})\n\n\`\`\`bash\ngit fetch origin\ngit checkout ${BRANCH}\n\`\`\`"

            curl -sf -X POST \
@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.Notifications
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.mokogitea/workflows/notify.yml
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoCli.Notifications
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoCli
+# PATH: /.gitea/workflows/notify.yml
 # VERSION: 01.00.00
 # BRIEF: Push notifications via ntfy on release success or workflow failure

@@ -15,9 +15,9 @@ name: "Universal: Notifications"
 on:
  workflow_run:
    workflows:
-      - "Universal: Build & Release"
-      - "Joomla: Extension CI"
-      - "Generic: Project CI"
+      - "Joomla Build & Release"
+      - "Joomla Extension CI"
+      - "Deploy"
    types:
      - completed

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
 # INGROUP: mokocli.CI
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/pr-check.yml
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
+# PATH: /templates/workflows/universal/pr-check.yml.template
 # VERSION: 09.23.00
 # BRIEF: PR gate — branch policy + code validation before merge

@@ -47,15 +47,15 @@ jobs:
              fi
              ;;
            fix/*|bugfix/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "main" ]; then
+              if [ "$BASE" != "dev" ]; then
                ALLOWED=false
-                REASON="Fix branches must target 'dev' or 'main', not '${BASE}'"
+                REASON="Fix branches must target 'dev', not '${BASE}'"
              fi
              ;;
            patch/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ] && [ "$BASE" != "main" ]; then
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
                ALLOWED=false
-                REASON="Patch branches must target 'dev', 'rc', or 'main', not '${BASE}'"
+                REASON="Patch branches must target 'dev' or 'rc', not '${BASE}'"
              fi
              ;;
            hotfix/*)
@@ -86,8 +86,7 @@ jobs:
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
            echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`fix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`patch/*\` → \`dev\`, \`rc\`, or \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
            echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
            echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
            echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
@@ -97,80 +96,6 @@ jobs:
          echo "Branch policy: OK (${HEAD} → ${BASE})"
          echo "## Branch Policy: Passed" >> $GITHUB_STEP_SUMMARY

-  # ── Docs Update Gate (main PRs) ─────────────────────────────────────────
-  require-docs:
-    name: Require Docs Update
-    runs-on: ubuntu-latest
-    # Enforce only on PRs merging into main: README.md + CHANGELOG.md must both be updated.
-    if: ${{ github.base_ref == 'main' }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Require README.md and CHANGELOG.md in the PR diff
-        run: |
-          BASE="${{ github.event.pull_request.base.sha }}"
-          HEAD="${{ github.event.pull_request.head.sha }}"
-          CHANGED="$(git diff --name-only "$BASE" "$HEAD" 2>/dev/null || true)"
-          if [ -z "$CHANGED" ]; then
-            git fetch -q origin "${{ github.base_ref }}" 2>/dev/null || true
-            CHANGED="$(git diff --name-only "origin/${{ github.base_ref }}...HEAD" 2>/dev/null || true)"
-          fi
-          echo "Changed files in PR:"
-          echo "$CHANGED"
-          MISSING=""
-          echo "$CHANGED" | grep -qxE 'README\.md' || MISSING="README.md"
-          echo "$CHANGED" | grep -qxE 'CHANGELOG\.md' || MISSING="${MISSING:+$MISSING, }CHANGELOG.md"
-          if [ -n "$MISSING" ]; then
-            echo "::error::PRs into main must update: ${MISSING}"
-            {
-              echo "## Docs Update Required"
-              echo ""
-              echo "PRs merging into \`main\` must update both **README.md** and **CHANGELOG.md**."
-              echo ""
-              echo "Not updated in this PR: **${MISSING}**"
-            } >> "$GITHUB_STEP_SUMMARY"
-            exit 1
-          fi
-          echo "Docs update present (README.md + CHANGELOG.md)"
-          echo "## Docs Update: Passed" >> "$GITHUB_STEP_SUMMARY"
-
-  # ── Wiki Update Reminder (main PRs, non-blocking) ───────────────────────
-  wiki-reminder:
-    name: Wiki Update Reminder
-    runs-on: ubuntu-latest
-    if: ${{ github.base_ref == 'main' }}
-    steps:
-      - name: Remind to update the wiki
-        env:
-          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          SERVER: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-          REPO: ${{ github.repository }}
-          PR: ${{ github.event.pull_request.number }}
-        run: |
-          set -uo pipefail
-          {
-            echo "## Wiki Update Reminder"
-            echo ""
-            echo "Docs are **wiki-first** at MokoConsulting. If this change affects behavior, usage, configuration, or standards, update the repo wiki:"
-            echo ""
-            echo "- ${SERVER}/${REPO}/wiki"
-            echo ""
-            echo "_Non-blocking reminder._"
-          } >> "$GITHUB_STEP_SUMMARY"
-          # Post a single PR comment (idempotent via hidden marker); best-effort, never fails.
-          API="${SERVER}/api/v1/repos/${REPO}/issues/${PR}/comments"
-          if [ -n "${TOKEN:-}" ] && [ -n "${PR:-}" ]; then
-            existing="$(curl -sf -H "Authorization: token ${TOKEN}" "$API" 2>/dev/null | grep -c 'wiki-reminder' || true)"
-            if [ "${existing:-0}" -eq 0 ]; then
-              curl -sf -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" -X POST "$API" \
-                -d '{"body":"<!-- wiki-reminder -->\n\n**Wiki reminder:** docs are wiki-first -- if this PR changes behavior, usage, config, or standards, please update the repo wiki before/after merge. _(non-blocking)_"}' >/dev/null 2>&1 || true
-            fi
-          fi
-          echo "Wiki reminder emitted (non-blocking)."
-
  # ── Secret Scanning ──────────────────────────────────────────────────
  gitleaks:
    name: Secret Scan
@@ -201,8 +126,6 @@ jobs:
  validate:
    name: Validate PR
    runs-on: ubuntu-latest
-    # Skip on template repos (Template-*) — no real manifest/source/changelog to validate.
-    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}

    steps:
      - name: Checkout
@@ -224,12 +147,11 @@ jobs:
      - name: Detect platform
        id: platform
        run: |
-          # Platform comes from the MokoGitea metadata API (public GET); manifest.xml is no longer used.
-          API="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${GITHUB_REPOSITORY}/metadata"
-          PLATFORM="$(curl -sf "$API" 2>/dev/null | python3 -c "import sys, json; print(json.load(sys.stdin).get('platform') or '')" 2>/dev/null || true)"
+          # Read platform from XML manifest (<platform> tag) or plain text fallback
+          PLATFORM=$(sed -n 's/.*<platform>\([^<]*\)<\/platform>.*/\1/p' .mokogitea/manifest.xml 2>/dev/null | head -1)
+          [ -z "$PLATFORM" ] && PLATFORM=$(cat .mokogitea/manifest.xml 2>/dev/null | tr -d '[:space:]')
          [ -z "$PLATFORM" ] && PLATFORM="generic"
          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
-          echo "Detected platform: $PLATFORM"

      - name: Setup PHP
        if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
@@ -350,7 +272,7 @@ jobs:
            joomla)
              MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
              if [ -z "$MANIFEST" ]; then
-                echo "::warning::No Joomla manifest found (MokoSuite site)"
+                echo "::warning::No Joomla manifest found (WaaS site)"
                exit 0
              fi
              echo "Manifest: ${MANIFEST}"
@@ -363,7 +285,7 @@ jobs:
              # Block legacy raw/branch update server URLs on MokoGitea
              RAW_URLS=$(grep -n 'raw/branch' "$MANIFEST" | grep -i 'mokoconsulting\|mokogitea\|git\.mokoconsulting\.tech' || true)
              if [ -n "$RAW_URLS" ]; then
-                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the MokoGitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
+                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the Gitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
                echo "$RAW_URLS"
                exit 1
              fi
@@ -570,33 +492,43 @@ jobs:
    name: Build RC Package
    runs-on: ubuntu-latest
    needs: [branch-policy, validate]
-    # Run only when both gates succeeded; always() forces evaluation so a skipped
-    # validate (e.g. template repos) skips this job cleanly instead of hanging.
-    if: ${{ always() && needs.branch-policy.result == 'success' && needs.validate.result == 'success' }}

    steps:
      - name: Trigger RC pre-release
        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
          REPO: ${{ github.repository }}
          BRANCH: ${{ github.head_ref }}
-          MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
        run: |
-          curl -s -X POST             "${MOKOGITEA_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${MOKOGITEA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
+          curl -s -X POST             "${GITEA_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${GITEA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
          echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY
          echo "Triggered RC build on branch \`${BRANCH}\`" >> $GITHUB_STEP_SUMMARY

  # ── Issue Reporter ──────────────────────────────────────────────────────
  report-issues:
    name: Report Issues
+    runs-on: ubuntu-latest
    needs: [branch-policy, validate]
    if: >-
      always() &&
      needs.validate.result == 'failure'
-    uses: ./.mokogitea/workflows/ci-issue-reporter.yml
-    with:
-      gate: "PR Validation"
-      workflow: "PR Check"
-      severity: error
-      details: "PR validation failed (syntax, manifest, changelog, or source checks). See the CI run for the specific check that failed."
-    secrets: inherit
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: automation/ci-issue-reporter.sh
+          sparse-checkout-cone-mode: false
+
+      - name: "File issue for PR validation failure"
+        env:
+          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+        run: |
+          chmod +x automation/ci-issue-reporter.sh
+          ./automation/ci-issue-reporter.sh \
+            --gate "PR Validation" \
+            --workflow "PR Check" \
+            --severity error \
+            --details "PR validation failed (syntax, manifest, changelog, or source checks). See the CI run for the specific check that failed."
@@ -3,11 +3,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
 # INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/pre-release.yml
-# VERSION: 05.02.00
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /templates/workflows/universal/pre-release.yml.template
+# VERSION: 05.01.00
 # BRIEF: Auto pre-release on push to dev/alpha/beta/rc branches

 name: "Universal: Pre-Release"
@@ -48,13 +48,9 @@ jobs:
  build:
    name: "Build Pre-Release (${{ inputs.stability || github.ref_name }})"
    runs-on: release
-    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
    if: >-
-      !startsWith(github.event.repository.name, 'Template-') &&
-      (
-        github.event_name == 'workflow_dispatch' ||
-        github.event_name == 'push'
-      )
+      github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'push'

    steps:
      - name: Checkout
@@ -63,11 +59,6 @@ jobs:
          fetch-depth: 0
          token: ${{ secrets.MOKOGITEA_TOKEN }}
          ref: ${{ github.ref_name }}
-          submodules: recursive
-
-      - name: Update submodules to main
-        run: |
-          git submodule foreach --quiet 'git checkout main && git pull --quiet origin main' 2>/dev/null || true

      - name: Setup mokocli tools
        env:
@@ -84,7 +75,7 @@ jobs:
              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
            fi
            rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
            cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
@@ -156,8 +147,8 @@ jobs:
          fi

          # Commit version bump
-          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "mokogitea-actions[bot]"
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
          git add -A
          git diff --cached --quiet || {
@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
 # INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/rc-revert.yml
 # VERSION: 09.23.00
 # BRIEF: Rename rc/ branch back to dev/ when PR is closed without merge
@@ -25,8 +25,7 @@ jobs:
    runs-on: ubuntu-latest
    if: >-
      github.event.pull_request.merged == false &&
-      startsWith(github.event.pull_request.head.ref, 'rc/') &&
-      !startsWith(github.event.repository.name, 'Template-')
+      startsWith(github.event.pull_request.head.ref, 'rc/')

    steps:
      - name: Rename branch
@@ -6,10 +6,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
 # INGROUP: mokocli.Validation
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/repo-health.yml
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
+# PATH: /templates/workflows/joomla/repo_health.yml.template
 # VERSION: 09.23.00
 # BRIEF: Enforces repository guardrails by validating scripts governance, tooling availability, and core repository health artifacts.
 # ============================================================================
@@ -77,7 +77,7 @@ jobs:
      - name: Check actor permission (admin only)
        id: perm
        env:
-          TOKEN: ${{ secrets.MOKOGITEA_TOKEN || github.token }}
+          TOKEN: ${{ secrets.MOKOGITEA_TOKEN || secrets.MOKOGITEA_TOKEN || github.token }}
          REPO: ${{ github.repository }}
          ACTOR: ${{ github.actor }}
        run: |
@@ -88,7 +88,7 @@ jobs:

          # Hardcoded authorized users — always allowed
          case "$ACTOR" in
-            jmiller|mokogitea-actions[bot])
+            jmiller|gitea-actions[bot])
              ALLOWED=true
              PERMISSION=admin
              METHOD="hardcoded allowlist"
@@ -671,30 +671,42 @@ jobs:
  # ═══════════════════════════════════════════════════════════════════════
  # Issue Reporter — file issues for failed gates
  # ═══════════════════════════════════════════════════════════════════════
-  report-scripts:
-    name: "Report: Scripts Governance"
-    needs: [access_check, scripts_governance]
+  report-issues:
+    name: "Report Issues"
+    runs-on: ubuntu-latest
+    needs: [access_check, scripts_governance, repo_health]
    if: >-
      always() &&
-      needs.scripts_governance.result == 'failure'
-    uses: ./.mokogitea/workflows/ci-issue-reporter.yml
-    with:
-      gate: "Scripts Governance"
-      workflow: "Repo Health"
-      severity: error
-      details: "Scripts directory policy violations detected. Review required and allowed directories."
-    secrets: inherit
+      (needs.scripts_governance.result == 'failure' ||
+       needs.repo_health.result == 'failure')

-  report-health:
-    name: "Report: Repository Health"
-    needs: [access_check, repo_health]
-    if: >-
-      always() &&
-      needs.repo_health.result == 'failure'
-    uses: ./.mokogitea/workflows/ci-issue-reporter.yml
-    with:
-      gate: "Repository Health"
-      workflow: "Repo Health"
-      severity: error
-      details: "Repository health checks failed — missing required artifacts, disallowed files, or content warnings. Check the CI run summary."
-    secrets: inherit
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: automation/ci-issue-reporter.sh
+          sparse-checkout-cone-mode: false
+
+      - name: "File issues for failed gates"
+        env:
+          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+        run: |
+          chmod +x automation/ci-issue-reporter.sh
+          REPORTER="./automation/ci-issue-reporter.sh"
+          WF="Repo Health"
+
+          report_gate() {
+            local gate="$1" result="$2" details="$3"
+            if [ "$result" = "failure" ]; then
+              "$REPORTER" --gate "$gate" --details "$details" --workflow "$WF" --severity error
+            fi
+          }
+
+          report_gate "Scripts Governance" \
+            "${{ needs.scripts_governance.result }}" \
+            "Scripts directory policy violations detected. Review required and allowed directories."
+
+          report_gate "Repository Health" \
+            "${{ needs.repo_health.result }}" \
+            "Repository health checks failed — missing required artifacts, disallowed files, or content warnings. Check the CI run summary."
@@ -0,0 +1,82 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoCli.Security
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoCli
+# PATH: /.gitea/workflows/security-audit.yml
+# VERSION: 01.00.00
+# BRIEF: Dependency vulnerability scanning for composer and npm packages
+
+name: "Universal: Security Audit"
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'  # Weekly on Monday at 06:00 UTC
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'composer.json'
+      - 'composer.lock'
+      - 'package.json'
+      - 'package-lock.json'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
+  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'gitea-security' }}
+
+jobs:
+  audit:
+    name: Dependency Audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Composer audit
+        if: hashFiles('composer.lock') != ''
+        run: |
+          echo "=== Composer Security Audit ==="
+          if ! command -v composer &> /dev/null; then
+            sudo apt-get update -qq
+            sudo apt-get install -y -qq php-cli composer >/dev/null 2>&1
+          fi
+          composer audit --format=plain 2>&1 | tee /tmp/composer-audit.txt
+          RESULT=$?
+          if [ $RESULT -ne 0 ]; then
+            echo "::warning::Composer vulnerabilities found"
+            echo "composer_vulnerable=true" >> "$GITHUB_ENV"
+          else
+            echo "No known vulnerabilities in composer dependencies"
+          fi
+
+      - name: NPM audit
+        if: hashFiles('package-lock.json') != ''
+        run: |
+          echo "=== NPM Security Audit ==="
+          npm audit --production 2>&1 | tee /tmp/npm-audit.txt || true
+          if npm audit --production 2>&1 | grep -q "found 0 vulnerabilities"; then
+            echo "No known vulnerabilities in npm dependencies"
+          else
+            echo "::warning::NPM vulnerabilities found"
+            echo "npm_vulnerable=true" >> "$GITHUB_ENV"
+          fi
+
+      - name: Notify on vulnerabilities
+        if: env.composer_vulnerable == 'true' || env.npm_vulnerable == 'true'
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          curl -sS \
+            -H "Title: ${REPO} has vulnerable dependencies" \
+            -H "Tags: lock,warning" \
+            -H "Priority: high" \
+            -d "Security audit found vulnerabilities. Review dependency updates." \
+            "${NTFY_URL}/${NTFY_TOPIC}" || true
@@ -22,7 +22,7 @@ permissions:
  contents: write

 env:
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}

 jobs:
  sync:
@@ -1,32 +0,0 @@
-name: Sync Workflows to Repos
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - '.mokogitea/workflows/**'
-
-jobs:
-  sync:
-    runs-on: ubuntu-latest
-    if: ${{ startsWith(github.event.repository.name, 'Template-') }}
-    steps:
-      - name: Checkout mokocli
-        uses: actions/checkout@v4
-        with:
-          repository: MokoConsulting/MokoCLI
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
-
-      - name: Setup PHP
-        uses: https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/raw/branch/main/actions/setup-php@v1
-        with:
-          php-version: '8.1'
-
-      - name: Install dependencies
-        run: composer install --no-dev --no-interaction
-
-      - name: Sync workflows to generic repos
-        run: php automation/bulk_sync.php --platform generic --org MokoConsulting --workflows-only --auto-merge --token "${{ secrets.MOKOGITEA_TOKEN }}"
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
@@ -1,131 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow.Template
-# INGROUP: MokoStandards.CI
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
-# PATH: /.mokogitea/workflows/version-set.yml
-# VERSION: 01.00.00
-# BRIEF: Set or reset the extension version across all version-bearing files
-
-name: "Joomla: Set Version"
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version number (e.g. 01.00.00)"
-        required: true
-        type: string
-      branch:
-        description: "Branch to update (default: current)"
-        required: false
-        type: string
-
-permissions:
-  contents: write
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  set-version:
-    name: Set Version to ${{ inputs.version }}
-    runs-on: ubuntu-latest
-    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
-
-    steps:
-      - name: Validate version format
-        run: |
-          VERSION="${{ inputs.version }}"
-          if ! echo "$VERSION" | grep -qP '^\d{2}\.\d{2}\.\d{2}$'; then
-            echo "::error::Invalid version format '${VERSION}' — expected XX.YY.ZZ (e.g. 01.00.00)"
-            exit 1
-          fi
-          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.MOKOGITEA_TOKEN || github.token }}
-          ref: ${{ inputs.branch || github.ref }}
-          fetch-depth: 1
-
-      - name: Update manifest version
-        run: |
-          MANIFEST=""
-          for XML_FILE in $(find . -maxdepth 3 -name "*.xml" -not -path "./.git/*" -not -path "./vendor/*"); do
-            if grep -q "<extension" "$XML_FILE" 2>/dev/null; then
-              MANIFEST="$XML_FILE"
-              break
-            fi
-          done
-
-          if [ -z "$MANIFEST" ]; then
-            echo "::warning::No Joomla extension manifest found — skipping manifest update"
-          else
-            OLD_VER=$(grep -oP '<version>\K[^<]+' "$MANIFEST" | head -1)
-            sed -i "s|<version>${OLD_VER}</version>|<version>${VERSION}</version>|" "$MANIFEST"
-            echo "Manifest: ${OLD_VER} → ${VERSION} (${MANIFEST})"
-          fi
-
-      - name: Update README.md version
-        run: |
-          if [ -f "README.md" ]; then
-            if grep -qP '^\s*VERSION:\s*\d' README.md; then
-              sed -i -E "s/(VERSION:\s*)[0-9]{2}\.[0-9]{2}\.[0-9]{2}/\1${VERSION}/" README.md
-              echo "README.md version updated to ${VERSION}"
-            else
-              echo "::warning::No VERSION line found in README.md — skipping"
-            fi
-          fi
-
-      - name: Update CHANGELOG.md
-        run: |
-          if [ -f "CHANGELOG.md" ]; then
-            DATE=$(date +%Y-%m-%d)
-            # Check if this version already has an entry
-            if grep -q "^\#\# \[${VERSION}\]" CHANGELOG.md; then
-              echo "CHANGELOG.md already has entry for ${VERSION} — skipping"
-            else
-              # Insert new version entry after [Unreleased] or at the top after header
-              if grep -q '^\#\# \[Unreleased\]' CHANGELOG.md; then
-                sed -i "/^\#\# \[Unreleased\]/a\\\\n## [${VERSION}] --- ${DATE}" CHANGELOG.md
-              else
-                sed -i "/^\# Changelog/a\\\\n## [Unreleased]\n\n## [${VERSION}] --- ${DATE}" CHANGELOG.md
-              fi
-              echo "CHANGELOG.md: added entry for ${VERSION}"
-            fi
-          else
-            echo "::warning::No CHANGELOG.md found — skipping"
-          fi
-
-      - name: Update FILE INFORMATION blocks
-        run: |
-          # Update VERSION in file header blocks (# VERSION: XX.YY.ZZ)
-          find . -maxdepth 1 -type f \( -name "*.yml" -o -name "*.yaml" -o -name "*.php" -o -name "*.md" \) \
-            -not -path "./.git/*" -not -path "./vendor/*" -print0 2>/dev/null | \
-          while IFS= read -r -d '' FILE; do
-            if head -20 "$FILE" | grep -qP '^\s*#?\s*VERSION:\s*\d{2}\.\d{2}\.\d{2}'; then
-              sed -i -E "s/(#?\s*VERSION:\s*)[0-9]{2}\.[0-9]{2}\.[0-9]{2}/\1${VERSION}/" "$FILE"
-              echo "Updated FILE INFORMATION VERSION in ${FILE}"
-            fi
-          done
-
-      - name: Commit and push
-        run: |
-          git config user.name "Moko Consulting [bot]"
-          git config user.email "hello@mokoconsulting.tech"
-          git add -A
-          if git diff --cached --quiet; then
-            echo "No version changes detected — nothing to commit"
-          else
-            git commit -m "chore: set version to ${VERSION} [skip bump]
-
-Authored-by: Moko Consulting"
-            git push
-            echo "### Version Set" >> $GITHUB_STEP_SUMMARY
-            echo "Version updated to \`${VERSION}\` on branch \`${GITHUB_REF_NAME}\`" >> $GITHUB_STEP_SUMMARY
-          fi
@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
 # INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/workflow-sync-trigger.yml
 # VERSION: 01.01.00
 # BRIEF: Trigger workflow sync to live repos when a PR is merged to main
@@ -13,7 +13,6 @@
 name: "Universal: Workflow Sync Trigger"

 on:
-  workflow_dispatch:
  pull_request:
    types: [closed]
    branches:
@@ -27,10 +26,8 @@ jobs:
    name: Sync workflows to live repos
    runs-on: ubuntu-latest
    if: >-
-      startsWith(github.event.repository.name, 'Template-') &&
-      (github.event_name == 'workflow_dispatch' ||
-      (github.event.pull_request.merged == true &&
-      !contains(github.event.pull_request.title, '[skip sync]')))
+      github.event.pull_request.merged == true &&
+      !contains(github.event.pull_request.title, '[skip sync]')

    steps:
      - name: Determine platform from repo name
@@ -52,14 +49,8 @@ jobs:
        env:
          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
        run: |
-          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
-          git clone --depth 1 "${MOKOGITEA_URL}/MokoConsulting/MokoCLI.git" /tmp/mokocli
-
-      - name: Install PHP
-        run: |
-          if ! command -v php &> /dev/null; then
-            apt-get update -qq && apt-get install -y -qq php-cli php-json php-curl > /dev/null 2>&1
-          fi
+          GITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          git clone --depth 1 "${GITEA_URL}/MokoConsulting/mokocli.git" /tmp/mokocli

      - name: Install dependencies
        run: |
@@ -4,7 +4,7 @@ SPDX-License-Identifier: GPL-3.0-or-later
 FILE INFORMATION
 DEFGROUP: MokoCli.Root
 INGROUP: MokoCli
-REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
 PATH: /CHANGELOG.md
 BRIEF: Release changelog
 -->
@@ -12,17 +12,14 @@ BRIEF: Release changelog
 # Changelog
 ## [Unreleased]

-## [09.43.00] --- 2026-07-05
+## [09.37.00] --- 2026-06-21

-## [09.43.00] --- 2026-07-05
+## [09.37.00] --- 2026-06-21

-## [09.42.00] --- 2026-07-04
+## [09.36.00] --- 2026-06-21

-## [09.42.00] --- 2026-07-04
+## [09.36.00] --- 2026-06-21

-### Fixed
- branch_rename.php: force-update the target branch ref in place instead of delete+recreate, so `moko repo:rename-branch` works when the target (e.g. `rc`) is a protected branch that cannot be deleted — previously the delete silently failed and the recreate returned HTTP 409
+## [09.35.00] --- 2026-06-21

-## [09.42.00] --- 2026-07-04
-
-## [09.42.00] --- 2026-07-04
+## [09.35.00] --- 2026-06-21
@@ -34,7 +34,7 @@ feature/* ──PR──> dev ──draft PR──> (renamed to rc) ──merge
 7. **Merging to main** triggers the stable release pipeline:
   - Minor version bump (e.g., `02.09.xx` → `02.10.00`)
   - Stability suffix stripped (clean version)
-   - MokoGitea release created with ZIP/tar.gz packages
+   - Gitea release created with ZIP/tar.gz packages
   - `updates.xml` updated (Joomla extensions)
   - `dev` branch recreated from `main`

@@ -2,8 +2,8 @@
 Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 SPDX-License-Identifier: GPL-3.0-or-later
 FILE INFORMATION
-DEFGROUP: MokoCLI.Root
-INGROUP: MokoCLI
+DEFGROUP: MokoPlatform.Root
+INGROUP: MokoPlatform
 REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 PATH: /PLUGIN_SCRIPTS.md
 BRIEF: Plugin system CLI documentation
@@ -2,11 +2,11 @@
 Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 SPDX-License-Identifier: GPL-3.0-or-later
 FILE INFORMATION
-DEFGROUP: MokoCLI.Root
-INGROUP: MokoCLI
+DEFGROUP: MokoPlatform.Root
+INGROUP: MokoPlatform
 REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 PATH: /README.md
-VERSION: 09.43.00
+VERSION: 09.38.05
 BRIEF: Project overview and documentation
 -->

@@ -16,7 +16,7 @@ BRIEF: Project overview and documentation

 PHP implementation of mokocli — enterprise standards, automation framework, workflow templates, and bulk sync tooling.

-> **Primary platform**: [MokoGitea — git.mokoconsulting.tech](https://git.mokoconsulting.tech/MokoConsulting/MokoCli-API)
+> **Primary platform**: [Gitea — git.mokoconsulting.tech](https://git.mokoconsulting.tech/MokoConsulting/MokoCli-API)
 > **Backup mirror**: [GitHub](https://github.com/MokoConsulting/MokoCli-API) *(read-only mirror)*

 ## What Lives Here
@@ -25,7 +25,7 @@ PHP implementation of mokocli — enterprise standards, automation framework, wo
 |-----------|---------|
 | `lib/Enterprise/` | 38 PHP enterprise library classes (platform adapters, sync, validation, plugins) |
 | `cli/` | CLI scripts (archive, create, release, sync rulesets, version management) |
-| `automation/` | Bulk sync, push files, repo cleanup, MokoGitea migration |
+| `automation/` | Bulk sync, push files, repo cleanup, Gitea migration |
 | `validate/` | 18 validation scripts (health, structure, secrets, syntax, drift) |
 | `templates/` | **Workflow templates** and config templates synced to governed repos |
 | `definitions/` | Repository structure definitions (`.tf` format) |
@@ -42,7 +42,7 @@ composer require mokoconsulting-tech/enterprise

 ### Composer Registry

-This package is served from MokoGitea package registry. Add this to your `composer.json`:
+This package is served from Gitea package registry. Add this to your `composer.json`:

 ```json
 {
@@ -73,10 +73,10 @@ vendor/bin/moko inventory -- --path .
 | Variable | Purpose |
 |----------|---------|
 | `GIT_PLATFORM` | `gitea` (default) or `github` |
-| `GA_TOKEN` | MokoGitea API / MokoGitea Actions token |
+| `GA_TOKEN` | Gitea API / Gitea Actions token |
 | `GH_TOKEN` | GitHub API token (for mirror sync) |
-| `GITEA_URL` | MokoGitea instance URL (default: `https://git.mokoconsulting.tech`) |
-| `GITEA_ORG` | MokoGitea organization (default: `MokoConsulting`) |
+| `GITEA_URL` | Gitea instance URL (default: `https://git.mokoconsulting.tech`) |
+| `GITEA_ORG` | Gitea organization (default: `MokoConsulting`) |

 ## License

@@ -2,8 +2,8 @@
 Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 SPDX-License-Identifier: GPL-3.0-or-later
 FILE INFORMATION
-DEFGROUP: MokoCLI.Index
-INGROUP: MokoCLI.Analysis
+DEFGROUP: MokoPlatform.Index
+INGROUP: MokoPlatform.Analysis
 REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 PATH: /analysis/index.md
 BRIEF: Analysis directory index
@@ -0,0 +1,937 @@
+#!/usr/bin/env php
+<?php
+
+/**
+ * Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * This file is part of a Moko Consulting project.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: MokoPlatform.Automation
+ * INGROUP: MokoPlatform.Scripts
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+ * PATH: /automation/bulk_joomla_template.php
+ * BRIEF: Bulk scaffold and sync Joomla template repositories
+ *
+ * USAGE
+ *   php automation/bulk_joomla_template.php --scaffold --name=MokoTheme
+ *   php automation/bulk_joomla_template.php --scaffold --name=MokoTheme --client=administrator
+ *   php automation/bulk_joomla_template.php --sync --repos=MokoTheme,MokoDarkTheme
+ *   php automation/bulk_joomla_template.php --sync --all
+ *   php automation/bulk_joomla_template.php --list
+ */
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/../vendor/autoload.php';
+require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
+
+use MokoCli\{
+    AuditLogger,
+    CliFramework,
+    Config,
+    GitPlatformAdapter,
+    MetricsCollector,
+    PlatformAdapterFactory
+};
+
+/**
+ * Bulk Joomla Template Manager
+ *
+ * Provides three operations for Joomla template projects:
+ *   --scaffold: Create a new template repository with the full directory structure
+ *   --sync:    Push mokocli files to existing template repositories
+ *   --list:    List all repositories tagged as joomla-template
+ *
+ * Works with both GitHub and Gitea via the PlatformAdapterFactory.
+ */
+class BulkJoomlaTemplate extends CliFramework
+{
+    public const DEFAULT_ORG = 'MokoConsulting';
+    public const VERSION     = '09.23.00';
+
+    private GitPlatformAdapter $adapter;
+    private Config $config;
+
+    protected function configure(): void
+    {
+        $this->setDescription('Bulk Joomla template management');
+        $this->addArgument('--org', 'Organization', self::DEFAULT_ORG);
+        $this->addArgument('--scaffold', 'Create new template repo', false);
+        $this->addArgument('--sync', 'Sync files to template repos', false);
+        $this->addArgument('--list', 'List template repos', false);
+        $this->addArgument('--name', 'Template name for scaffold', '');
+        $this->addArgument('--client', 'Joomla client: site or admin', 'site');
+        $this->addArgument('--repos', 'Target repos (comma-separated)', '');
+        $this->addArgument('--all', 'Sync all tagged repos', false);
+        $this->addArgument('--sync-updates', 'Sync updates.xml', false);
+        $this->addArgument('--private', 'Create as private repo', false);
+        $this->addArgument('--yes', 'Auto-confirm', false);
+    }
+
+    protected function run(): int
+    {
+        $this->log("🎨 Joomla Template Manager v" . self::VERSION, 'INFO');
+
+        $this->config = Config::load();
+
+        try {
+            $this->adapter = PlatformAdapterFactory::create($this->config);
+        } catch (\Exception $e) {
+            $this->log("❌ Failed to initialize: " . $e->getMessage(), 'ERROR');
+            return 1;
+        }
+
+        $org = $this->getArgument('--org', self::DEFAULT_ORG);
+        $platform = $this->adapter->getPlatformName();
+        $this->log("Platform: {$platform} | Organization: {$org}", 'INFO');
+
+        if ($this->getArgument('--list', false)) {
+            return $this->listTemplateRepos($org);
+        }
+
+        if ($this->getArgument('--scaffold', false)) {
+            return $this->scaffoldTemplate($org);
+        }
+
+        if ($this->getArgument('--sync', false)) {
+            return $this->syncTemplates($org);
+        }
+
+        if ($this->getArgument('--sync-updates', false)) {
+            return $this->syncUpdatesBetweenPlatforms($org);
+        }
+
+        $this->log("❌ Specify --scaffold, --sync, --sync-updates, or --list", 'ERROR');
+        return 1;
+    }
+
+    // ── List ─────────────────────────────────────────────────────────────
+
+    private function listTemplateRepos(string $org): int
+    {
+        $repos = $this->findTemplateRepos($org);
+
+        if (empty($repos)) {
+            $this->log("No joomla-template repositories found in {$org}", 'INFO');
+            return 0;
+        }
+
+        $this->log("\nJoomla template repositories in {$org}:", 'INFO');
+        foreach ($repos as $repo) {
+            $vis  = ($repo['private'] ?? false) ? 'private' : 'public';
+            $url  = $this->adapter->getRepoWebUrl($org, $repo['name']);
+            $this->log("  - {$repo['name']} ({$vis})  {$url}", 'INFO');
+        }
+        $this->log("\nTotal: " . count($repos), 'INFO');
+
+        return 0;
+    }
+
+    // ── Scaffold ─────────────────────────────────────────────────────────
+
+    private function scaffoldTemplate(string $org): int
+    {
+        $name   = $this->getArgument('--name', '');
+        $client = $this->getArgument('--client', 'site');
+        $dryRun = $this->dryRun;
+
+        if (empty($name)) {
+            $this->log("❌ --name is required for --scaffold", 'ERROR');
+            $this->log("   Example: --name=MokoTheme", 'ERROR');
+            return 1;
+        }
+
+        if (!in_array($client, ['site', 'administrator'], true)) {
+            $this->log("❌ --client must be 'site' or 'administrator'", 'ERROR');
+            return 1;
+        }
+
+        $shortName = $this->deriveShortName($name);
+        $this->log("\nScaffolding Joomla template:", 'INFO');
+        $this->log("  Name:       {$name}", 'INFO');
+        $this->log("  Short name: {$shortName}", 'INFO');
+        $this->log("  Client:     {$client}", 'INFO');
+        $this->log("  Element:    tpl_{$shortName}", 'INFO');
+
+        if ($dryRun) {
+            $this->log("\n[DRY RUN] Would create repository and scaffold files", 'INFO');
+            $this->printScaffoldPlan($shortName);
+            return 0;
+        }
+
+        // Check if repo already exists
+        try {
+            $this->adapter->getRepo($org, $name);
+            $this->log("❌ Repository {$org}/{$name} already exists", 'ERROR');
+            return 1;
+        } catch (\Exception $e) {
+            $this->adapter->getApiClient()->resetCircuitBreaker();
+        }
+
+        // Confirm
+        if (!$this->getArgument('--yes', false)) {
+            echo "\nCreate repository {$org}/{$name}? [y/N]: ";
+            $handle = fopen('php://stdin', 'r');
+            $line   = fgets($handle);
+            if ($handle) {
+                fclose($handle);
+            }
+            if (!is_string($line) || strtolower(trim($line)) !== 'y') {
+                $this->log("Cancelled.", 'INFO');
+                return 0;
+            }
+        }
+
+        // Create repository
+        $this->log("\nCreating repository...", 'INFO');
+        try {
+            $isPrivate = $this->getArgument('--private', false);
+            $this->adapter->createOrgRepo($org, $name, [
+                'description' => "Joomla {$client} template — {$name}",
+                'private'     => $isPrivate,
+                'auto_init'   => true,
+            ]);
+            $this->log("  ✓ Repository created: {$org}/{$name}", 'INFO');
+        } catch (\Exception $e) {
+            $this->log("❌ Failed to create repository: " . $e->getMessage(), 'ERROR');
+            return 1;
+        }
+
+        // Set topics
+        try {
+            $this->adapter->setRepoTopics($org, $name, [
+                'joomla', 'joomla-template', 'template', "joomla-{$client}",
+            ]);
+            $this->log("  ✓ Topics set", 'INFO');
+        } catch (\Exception $e) {
+            $this->log("  ⚠️  Could not set topics: " . $e->getMessage(), 'WARN');
+            $this->adapter->getApiClient()->resetCircuitBreaker();
+        }
+
+        // Scaffold files
+        $this->log("\nScaffolding template files...", 'INFO');
+        $files = $this->getScaffoldFiles($name, $shortName, $client, $org);
+
+        $created = 0;
+        foreach ($files as $path => $content) {
+            try {
+                $this->adapter->createOrUpdateFile(
+                    $org,
+                    $name,
+                    $path,
+                    $content,
+                    "chore: scaffold {$path}"
+                );
+                $this->log("  ✓ {$path}", 'INFO');
+                $created++;
+            } catch (\Exception $e) {
+                $this->log("  ✗ {$path}: " . $e->getMessage(), 'ERROR');
+                $this->adapter->getApiClient()->resetCircuitBreaker();
+            }
+        }
+
+        // Apply branch protection
+        try {
+            $this->adapter->setBranchProtection($org, $name, 'main', [
+                'required_reviews'  => 1,
+                'dismiss_stale'     => true,
+                'block_on_rejected' => true,
+            ]);
+            $this->log("  ✓ Branch protection applied", 'INFO');
+        } catch (\Exception $e) {
+            $this->log("  ⚠️  Branch protection: " . $e->getMessage(), 'WARN');
+            $this->adapter->getApiClient()->resetCircuitBreaker();
+        }
+
+        $url = $this->adapter->getRepoWebUrl($org, $name);
+        $this->log("\n✅ Template scaffolded: {$url}", 'INFO');
+        $this->log("   {$created} files created", 'INFO');
+
+        return 0;
+    }
+
+    // ── Sync ─────────────────────────────────────────────────────────────
+
+    private function syncTemplates(string $org): int
+    {
+        $repos = [];
+
+        if ($this->getArgument('--all', false)) {
+            $repos = $this->findTemplateRepos($org);
+        } else {
+            $reposArg = $this->getArgument('--repos', '');
+            if (empty($reposArg)) {
+                $this->log("❌ --repos or --all required for --sync", 'ERROR');
+                return 1;
+            }
+            $names = array_filter(array_map('trim', explode(',', $reposArg)));
+            foreach ($names as $name) {
+                $repos[] = ['name' => $name];
+            }
+        }
+
+        if (empty($repos)) {
+            $this->log("No template repositories to sync", 'INFO');
+            return 0;
+        }
+
+        $this->log("\nSyncing " . count($repos) . " template repo(s)...", 'INFO');
+
+        $dryRun  = $this->dryRun;
+        $success = 0;
+        $failed  = 0;
+
+        foreach ($repos as $repo) {
+            $name = $repo['name'];
+            $this->log("\n[{$name}]", 'INFO');
+
+            try {
+                $repoData   = $this->adapter->getRepo($org, $name);
+                $shortName  = $this->deriveShortName($name);
+                $branch     = $repoData['default_branch'] ?? 'main';
+
+                $syncFiles = $this->getSyncFiles($name, $shortName);
+
+                $updated = 0;
+                foreach ($syncFiles as $path => $content) {
+                    if ($dryRun) {
+                        $this->log("  (dry-run) {$path}", 'INFO');
+                        $updated++;
+                        continue;
+                    }
+
+                    // Check if file exists
+                    $existingSha = null;
+                    try {
+                        $existing    = $this->adapter->getFileContents($org, $name, $path, $branch);
+                        $existingSha = $existing['sha'] ?? null;
+                    } catch (\Exception $e) {
+                        $this->adapter->getApiClient()->resetCircuitBreaker();
+                    }
+
+                    try {
+                        $this->adapter->createOrUpdateFile(
+                            $org,
+                            $name,
+                            $path,
+                            $content,
+                            "chore: update {$path} from mokocli",
+                            $existingSha,
+                            $branch
+                        );
+                        $this->log("  ✓ {$path}", 'INFO');
+                        $updated++;
+                    } catch (\Exception $e) {
+                        $this->log("  ✗ {$path}: " . $e->getMessage(), 'ERROR');
+                        $this->adapter->getApiClient()->resetCircuitBreaker();
+                    }
+                }
+
+                $this->log("  {$updated} file(s) synced", 'INFO');
+                $success++;
+            } catch (\Exception $e) {
+                $this->log("  ✗ {$name}: " . $e->getMessage(), 'ERROR');
+                $failed++;
+                $this->adapter->getApiClient()->resetCircuitBreaker();
+            }
+        }
+
+        $this->log("\n" . str_repeat('=', 50), 'INFO');
+        $this->log("Sync complete: {$success} succeeded, {$failed} failed", 'INFO');
+
+        return $failed > 0 ? 1 : 0;
+    }
+
+    // ── Helpers ──────────────────────────────────────────────────────────
+
+    private function findTemplateRepos(string $org): array
+    {
+        $allRepos = $this->adapter->listOrgRepos($org, true);
+        $templates = [];
+
+        foreach ($allRepos as $repo) {
+            try {
+                $topics = $this->adapter->getRepoTopics($org, $repo['name']);
+                if (in_array('joomla-template', $topics, true)) {
+                    $templates[] = $repo;
+                }
+            } catch (\Exception $e) {
+                $this->adapter->getApiClient()->resetCircuitBreaker();
+            }
+        }
+
+        return $templates;
+    }
+
+    private function deriveShortName(string $name): string
+    {
+        // MokoTheme → mokotheme, Moko-Dark-Theme → mokodarktheme
+        return strtolower(preg_replace('/[^a-zA-Z0-9]/', '', $name));
+    }
+
+    private function printScaffoldPlan(string $shortName): void
+    {
+        $files = [
+            'templateDetails.xml',
+            'updates.xml',
+            'src/index.php',
+            'src/error.php',
+            'src/offline.php',
+            'src/component.php',
+            'src/html/index.html',
+            'src/css/.gitkeep',
+            'src/js/.gitkeep',
+            'src/images/.gitkeep',
+            "src/language/en-GB/tpl_{$shortName}.ini",
+            "src/language/en-GB/tpl_{$shortName}.sys.ini",
+            'media/css/.gitkeep',
+            'media/js/.gitkeep',
+            'media/images/.gitkeep',
+            'media/scss/.gitkeep',
+            '.editorconfig',
+        ];
+
+        $this->log("\nFiles that would be created:", 'INFO');
+        foreach ($files as $f) {
+            $this->log("  + {$f}", 'INFO');
+        }
+    }
+
+    /**
+     * Generate the full set of scaffold files for a new template.
+     *
+     * @return array<string, string> path => content
+     */
+    private function getScaffoldFiles(string $name, string $shortName, string $client, string $org): array
+    {
+        $element = "tpl_{$shortName}";
+        $now     = date('Y-m-d');
+
+        $files = [];
+
+        // templateDetails.xml
+        $files['templateDetails.xml'] = <<<XML
+		<?xml version="1.0" encoding="utf-8"?>
+		<extension type="template" client="{$client}" method="upgrade">
+			<name>{$name}</name>
+			<creationDate>{$now}</creationDate>
+			<author>Moko Consulting</author>
+			<authorEmail>hello@mokoconsulting.tech</authorEmail>
+			<authorUrl>https://mokoconsulting.tech</authorUrl>
+			<copyright>Copyright (C) 2026 Moko Consulting. All rights reserved.</copyright>
+			<license>GPL-3.0-or-later</license>
+			<version>1.0.0</version>
+			<description>{$name} — Joomla {$client} template by Moko Consulting</description>
+
+			<files>
+				<filename>index.php</filename>
+				<filename>component.php</filename>
+				<filename>error.php</filename>
+				<filename>offline.php</filename>
+				<filename>templateDetails.xml</filename>
+				<folder>html</folder>
+				<folder>css</folder>
+				<folder>js</folder>
+				<folder>images</folder>
+				<folder>language</folder>
+			</files>
+
+			<media destination="templates/{$client}/{$shortName}" folder="media">
+				<folder>css</folder>
+				<folder>js</folder>
+				<folder>images</folder>
+				<folder>scss</folder>
+			</media>
+
+			<positions>
+				<position>topbar</position>
+				<position>navbar</position>
+				<position>hero</position>
+				<position>breadcrumbs</position>
+				<position>sidebar-left</position>
+				<position>sidebar-right</position>
+				<position>main-top</position>
+				<position>main-bottom</position>
+				<position>footer</position>
+				<position>debug</position>
+			</positions>
+
+			<updateservers>
+				<server type="extension" priority="1" name="{$name} Update Server">
+					https://git.mokoconsulting.tech/{$org}/{$name}/raw/branch/main/updates.xml
+				</server>
+				<server type="extension" priority="2" name="{$name} Update Server">
+					https://raw.githubusercontent.com/{$org}/{$name}/main/updates.xml
+				</server>
+			</updateservers>
+
+			<config>
+				<fields name="params">
+					<fieldset name="basic">
+						<field name="logoFile" type="media" label="Logo" />
+						<field name="siteTitle" type="text" label="Site Title" default="" />
+						<field name="siteDescription" type="text" label="Site Description" default="" />
+						<field name="colorScheme" type="list" label="Color Scheme" default="light">
+							<option value="light">Light</option>
+							<option value="dark">Dark</option>
+							<option value="auto">Auto (system preference)</option>
+						</field>
+					</fieldset>
+				</fields>
+			</config>
+		</extension>
+		XML;
+        $files['templateDetails.xml'] = preg_replace('/^\t\t/m', '', $files['templateDetails.xml']);
+
+        // updates.xml — dual-platform download URLs (Gitea primary, GitHub secondary)
+        $files['updates.xml'] = <<<XML
+		<updates>
+			<update>
+				<name>{$name}</name>
+				<description>{$name} — Moko Consulting Joomla template</description>
+				<element>tpl_{$shortName}</element>
+				<type>template</type>
+				<version>1.0.0</version>
+				<downloads>
+					<downloadurl type="full" format="zip">
+						https://git.mokoconsulting.tech/{$org}/{$name}/releases/download/v1.0.0/{$shortName}.zip
+					</downloadurl>
+					<downloadurl type="full" format="zip">
+						https://github.com/{$org}/{$name}/releases/download/v1.0.0/{$shortName}.zip
+					</downloadurl>
+				</downloads>
+				<targetplatform name="joomla" version="[56].*"/>
+				<php_minimum>8.1</php_minimum>
+			</update>
+		</updates>
+		XML;
+        $files['updates.xml'] = preg_replace('/^\t\t/m', '', $files['updates.xml']);
+
+        // src/index.php
+        $files['src/index.php'] = <<<'PHP'
+		<?php
+		/**
+		 * @package     Joomla.Site
+		 * @subpackage  Templates.TEMPLATE_SHORT_NAME
+		 * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+		 * @license     GPL-3.0-or-later
+		 */
+
+		defined('_JEXEC') or die;
+
+		use Joomla\CMS\Factory;
+
+		$app = Factory::getApplication();
+		$wa  = $this->getWebAssetManager();
+
+		?>
+		<!DOCTYPE html>
+		<html lang="<?php echo $this->language; ?>" dir="<?php echo $this->direction; ?>">
+		<head>
+			<jdoc:include type="metas" />
+			<jdoc:include type="styles" />
+			<jdoc:include type="scripts" />
+		</head>
+		<body class="site <?php echo $this->direction === 'rtl' ? 'rtl' : 'ltr'; ?>">
+			<header>
+				<jdoc:include type="modules" name="topbar" style="none" />
+				<jdoc:include type="modules" name="navbar" style="none" />
+			</header>
+
+			<jdoc:include type="modules" name="hero" style="none" />
+			<jdoc:include type="modules" name="breadcrumbs" style="none" />
+
+			<main>
+				<jdoc:include type="modules" name="main-top" style="html5" />
+				<jdoc:include type="message" />
+				<jdoc:include type="component" />
+				<jdoc:include type="modules" name="main-bottom" style="html5" />
+			</main>
+
+			<footer>
+				<jdoc:include type="modules" name="footer" style="none" />
+			</footer>
+
+			<jdoc:include type="modules" name="debug" style="none" />
+		</body>
+		</html>
+		PHP;
+        $files['src/index.php'] = str_replace('TEMPLATE_SHORT_NAME', $shortName, $files['src/index.php']);
+        $files['src/index.php'] = preg_replace('/^\t\t/m', '', $files['src/index.php']);
+
+        // src/error.php
+        $files['src/error.php'] = <<<'PHP'
+		<?php
+		/**
+		 * @package     Joomla.Site
+		 * @subpackage  Templates.error
+		 * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+		 * @license     GPL-3.0-or-later
+		 */
+
+		defined('_JEXEC') or die;
+
+		/** @var Joomla\CMS\Document\ErrorDocument $this */
+
+		$code    = $this->error->getCode();
+		$message = htmlspecialchars($this->error->getMessage(), ENT_QUOTES, 'UTF-8');
+
+		?>
+		<!DOCTYPE html>
+		<html lang="<?php echo $this->language; ?>">
+		<head>
+			<meta charset="utf-8">
+			<meta name="viewport" content="width=device-width, initial-scale=1">
+			<title><?php echo $code; ?> — <?php echo $message; ?></title>
+		</head>
+		<body>
+			<div style="max-width:600px;margin:80px auto;text-align:center;font-family:sans-serif">
+				<h1><?php echo $code; ?></h1>
+				<p><?php echo $message; ?></p>
+				<p><a href="<?php echo $this->baseurl; ?>/">Return to homepage</a></p>
+			</div>
+		</body>
+		</html>
+		PHP;
+        $files['src/error.php'] = preg_replace('/^\t\t/m', '', $files['src/error.php']);
+
+        // src/offline.php
+        $files['src/offline.php'] = <<<'PHP'
+		<?php
+		/**
+		 * @package     Joomla.Site
+		 * @subpackage  Templates.offline
+		 * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+		 * @license     GPL-3.0-or-later
+		 */
+
+		defined('_JEXEC') or die;
+
+		use Joomla\CMS\Factory;
+
+		$app = Factory::getApplication();
+
+		?>
+		<!DOCTYPE html>
+		<html lang="<?php echo $this->language; ?>">
+		<head>
+			<meta charset="utf-8">
+			<meta name="viewport" content="width=device-width, initial-scale=1">
+			<title><?php echo htmlspecialchars($app->get('sitename')); ?> — Maintenance</title>
+		</head>
+		<body>
+			<div style="max-width:600px;margin:80px auto;text-align:center;font-family:sans-serif">
+				<h1><?php echo htmlspecialchars($app->get('sitename')); ?></h1>
+				<p><?php echo $app->get('offline_message', 'This site is currently undergoing maintenance. Please check back soon.'); ?></p>
+				<jdoc:include type="message" />
+				<form action="<?php echo $this->baseurl; ?>/index.php" method="post">
+					<input type="text" name="username" placeholder="Username" />
+					<input type="password" name="password" placeholder="Password" />
+					<button type="submit">Login</button>
+					<input type="hidden" name="option" value="com_users" />
+					<input type="hidden" name="task" value="user.login" />
+					<?php echo \Joomla\CMS\HTML\HTMLHelper::_('form.token'); ?>
+				</form>
+			</div>
+		</body>
+		</html>
+		PHP;
+        $files['src/offline.php'] = preg_replace('/^\t\t/m', '', $files['src/offline.php']);
+
+        // src/component.php
+        $files['src/component.php'] = <<<'PHP'
+		<?php
+		/**
+		 * @package     Joomla.Site
+		 * @subpackage  Templates.component
+		 * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+		 * @license     GPL-3.0-or-later
+		 */
+
+		defined('_JEXEC') or die;
+
+		?>
+		<!DOCTYPE html>
+		<html lang="<?php echo $this->language; ?>">
+		<head>
+			<jdoc:include type="head" />
+		</head>
+		<body class="contentpane">
+			<jdoc:include type="message" />
+			<jdoc:include type="component" />
+		</body>
+		</html>
+		PHP;
+        $files['src/component.php'] = preg_replace('/^\t\t/m', '', $files['src/component.php']);
+
+        // Directory keepfiles
+        $files['src/html/index.html']  = '<!DOCTYPE html><title></title>';
+        $files['src/css/.gitkeep']     = '';
+        $files['src/js/.gitkeep']      = '';
+        $files['src/images/.gitkeep']  = '';
+        $files['media/css/.gitkeep']   = '';
+        $files['media/js/.gitkeep']    = '';
+        $files['media/images/.gitkeep'] = '';
+        $files['media/scss/.gitkeep']  = '';
+
+        // Language files
+        $files["src/language/en-GB/{$element}.ini"]     = "; {$name} language strings\n";
+        $files["src/language/en-GB/{$element}.sys.ini"] =
+            "; {$name} system language strings\n"
+            . "{$element}=\"{$name}\"\n"
+            . "{$element}_XML_DESCRIPTION=\"{$name} Joomla template by Moko Consulting\"\n";
+
+        // .editorconfig
+        $repoRoot = dirname(__DIR__, 2);
+        $editorConfig = "{$repoRoot}/templates/configs/.editorconfig";
+        if (file_exists($editorConfig)) {
+            $files['.editorconfig'] = file_get_contents($editorConfig) ?: '';
+        }
+
+        return $files;
+    }
+
+    /**
+     * Get files to sync to existing template repos (standards-only, no template code).
+     *
+     * @return array<string, string> path => content
+     */
+    private function getSyncFiles(string $name, string $shortName): array
+    {
+        $repoRoot = dirname(__DIR__, 2);
+        $files    = [];
+
+        // Sync standards files from templates/
+        $standardsFiles = [
+            'SECURITY.md'        => 'templates/docs/required/template-SECURITY.md',
+            'CODE_OF_CONDUCT.md' => 'templates/docs/extra/template-CODE_OF_CONDUCT.md',
+            'CONTRIBUTING.md'    => 'templates/docs/required/template-CONTRIBUTING.md',
+            '.editorconfig'      => 'templates/configs/.editorconfig',
+        ];
+
+        foreach ($standardsFiles as $dest => $source) {
+            $fullPath = "{$repoRoot}/{$source}";
+            if (file_exists($fullPath)) {
+                $files[$dest] = file_get_contents($fullPath) ?: '';
+            }
+        }
+
+        return $files;
+    }
+
+    // ── Sync updates.xml between platforms ───────────────────────────────
+
+    /**
+     * Sync updates.xml (or updates.xml) between Gitea and GitHub for Joomla repos.
+     *
+     * Reads the file from both platforms, compares by latest <version> tag,
+     * and pushes the newer one to the stale platform.
+     *
+     * Designed to be called from a CI workflow via:
+     *   php automation/bulk_joomla_template.php --sync-updates --repos=MokoCassiopeia
+     */
+    private function syncUpdatesBetweenPlatforms(string $org): int
+    {
+        $repos = [];
+
+        if ($this->getArgument('--all', false)) {
+            $repos = $this->findTemplateRepos($org);
+            // Also include waas-component repos
+            $allRepos = $this->adapter->listOrgRepos($org, true);
+            foreach ($allRepos as $repo) {
+                try {
+                    $topics = $this->adapter->getRepoTopics($org, $repo['name']);
+                    if (in_array('joomla', $topics, true) || in_array('joomla-extension', $topics, true)) {
+                        $repos[] = $repo;
+                    }
+                } catch (\Exception $e) {
+                    $this->adapter->getApiClient()->resetCircuitBreaker();
+                }
+            }
+            // Deduplicate
+            $seen = [];
+            $repos = array_filter($repos, function ($r) use (&$seen) {
+                if (isset($seen[$r['name']])) {
+                    return false;
+                }
+                $seen[$r['name']] = true;
+                return true;
+            });
+        } else {
+            $reposArg = $this->getArgument('--repos', '');
+            if (empty($reposArg)) {
+                $this->log("❌ --repos or --all required for --sync-updates", 'ERROR');
+                return 1;
+            }
+            $names = array_filter(array_map('trim', explode(',', $reposArg)));
+            foreach ($names as $name) {
+                $repos[] = ['name' => $name];
+            }
+        }
+
+        if (empty($repos)) {
+            $this->log("No Joomla repositories to sync updates for", 'INFO');
+            return 0;
+        }
+
+        // Create both platform adapters
+        try {
+            $adapters = PlatformAdapterFactory::createBoth($this->config);
+        } catch (\Exception $e) {
+            $this->log("❌ Both platform tokens required for --sync-updates: " . $e->getMessage(), 'ERROR');
+            return 1;
+        }
+
+        $gitea  = $adapters['gitea'];
+        $github = $adapters['github'];
+        $dryRun = $this->dryRun;
+
+        $this->log("\nSyncing updates.xml across Gitea <-> GitHub for " . count($repos) . " repo(s)...", 'INFO');
+
+        $synced = 0;
+        $failed = 0;
+
+        foreach ($repos as $repo) {
+            $name = $repo['name'];
+            $this->log("\n[{$name}]", 'INFO');
+
+            // Try both updates.xml and updates.xml filenames
+            $updateFile = $this->resolveUpdateFile($gitea, $github, $org, $name);
+            if ($updateFile === null) {
+                $this->log("  ⊘ No update(s).xml found on either platform", 'INFO');
+                continue;
+            }
+
+            $fileName = $updateFile['name'];
+            $source   = $updateFile['source'];     // 'gitea' or 'github'
+            $content  = $updateFile['content'];
+            $target   = $source === 'gitea' ? 'github' : 'gitea';
+            $targetAdapter = $source === 'gitea' ? $github : $gitea;
+
+            $this->log("  Source: {$source} ({$fileName})", 'INFO');
+
+            if ($dryRun) {
+                $this->log("  (dry-run) Would push {$fileName} to {$target}", 'INFO');
+                $synced++;
+                continue;
+            }
+
+            // Push to the other platform
+            try {
+                $existingSha = null;
+                try {
+                    $existing    = $targetAdapter->getFileContents($org, $name, $fileName);
+                    $existingSha = $existing['sha'] ?? null;
+
+                    // Compare content — skip if identical
+                    $existingContent = base64_decode($existing['content'] ?? '');
+                    if (trim($existingContent) === trim($content)) {
+                        $this->log("  ✓ Already in sync", 'INFO');
+                        $synced++;
+                        continue;
+                    }
+                } catch (\Exception $e) {
+                    $targetAdapter->getApiClient()->resetCircuitBreaker();
+                }
+
+                $targetAdapter->createOrUpdateFile(
+                    $org,
+                    $name,
+                    $fileName,
+                    $content,
+                    "chore: sync {$fileName} from {$source}",
+                    $existingSha
+                );
+                $this->log("  ✓ Pushed to {$target}", 'INFO');
+                $synced++;
+            } catch (\Exception $e) {
+                $this->log("  ✗ Failed to push to {$target}: " . $e->getMessage(), 'ERROR');
+                $targetAdapter->getApiClient()->resetCircuitBreaker();
+                $failed++;
+            }
+        }
+
+        $this->log("\n" . str_repeat('=', 50), 'INFO');
+        $this->log("Updates sync complete: {$synced} synced, {$failed} failed", 'INFO');
+
+        return $failed > 0 ? 1 : 0;
+    }
+
+    /**
+     * Find the updates file on both platforms, return the one with the higher version.
+     *
+     * Checks both `updates.xml` and `updates.xml` filenames.
+     * Returns the content from the platform with the newer <version>.
+     * Gitea wins ties (primary platform).
+     *
+     * @return array{name: string, source: string, content: string}|null
+     */
+    private function resolveUpdateFile(
+        GitPlatformAdapter $gitea,
+        GitPlatformAdapter $github,
+        string $org,
+        string $name
+    ): ?array {
+        $candidates = ['updates.xml', 'updates.xml'];
+        $found      = []; // platform => [name, content, version]
+
+        foreach (['gitea' => $gitea, 'github' => $github] as $platform => $adapter) {
+            foreach ($candidates as $fileName) {
+                try {
+                    $file    = $adapter->getFileContents($org, $name, $fileName);
+                    $content = base64_decode($file['content'] ?? '');
+
+                    // Extract latest version from the XML
+                    $version = '0.0.0';
+                    if (preg_match('/<version>([^<]+)<\/version>/', $content, $m)) {
+                        $version = trim($m[1]);
+                    }
+
+                    $found[$platform] = [
+                        'name'    => $fileName,
+                        'content' => $content,
+                        'version' => $version,
+                    ];
+                    break; // Found one — stop checking other filenames for this platform
+                } catch (\Exception $e) {
+                    $adapter->getApiClient()->resetCircuitBreaker();
+                }
+            }
+        }
+
+        if (empty($found)) {
+            return null;
+        }
+
+        // If only one platform has it, that's the source
+        if (count($found) === 1) {
+            $platform = array_key_first($found);
+            return [
+                'name'    => $found[$platform]['name'],
+                'source'  => $platform,
+                'content' => $found[$platform]['content'],
+            ];
+        }
+
+        // Both have it — pick the one with the higher version (Gitea wins ties)
+        $giteaVer  = $found['gitea']['version'];
+        $githubVer = $found['github']['version'];
+
+        $source = version_compare($githubVer, $giteaVer, '>') ? 'github' : 'gitea';
+
+        return [
+            'name'    => $found[$source]['name'],
+            'source'  => $source,
+            'content' => $found[$source]['content'],
+        ];
+    }
+}
+
+// Execute if run directly
+if (php_sapi_name() === 'cli' && isset($argv[0]) && realpath($argv[0]) === __FILE__) {
+    $app = new BulkJoomlaTemplate();
+    exit($app->execute());
+}
@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# BRIEF: Trigger a workflow across all client-waas repos in a Gitea org
+
+set -euo pipefail
+
+# ---------------------------------------------------------------------------
+# Usage
+# ---------------------------------------------------------------------------
+usage() {
+  cat <<EOF
+Usage: $(basename "$0") GITEA_URL TOKEN ORG WORKFLOW [REF] [INPUTS]
+
+Arguments:
+  GITEA_URL   Base URL of the Gitea instance (e.g. https://git.mokoconsulting.tech)
+  TOKEN       Gitea API token with repo/action permissions
+  ORG         Organisation or user that owns the repos
+  WORKFLOW    Workflow filename to trigger (e.g. dependency-audit.yml)
+  REF         Branch ref to run against (default: main)
+  INPUTS      Optional JSON object of workflow inputs (e.g. '{"dry_run":"true"}')
+
+Example:
+  $(basename "$0") https://git.mokoconsulting.tech abc123 MokoConsulting dependency-audit.yml main '{"notify":"true"}'
+EOF
+  exit 1
+}
+
+# ---------------------------------------------------------------------------
+# Argument parsing
+# ---------------------------------------------------------------------------
+if [ $# -lt 4 ]; then
+  usage
+fi
+
+GITEA_URL="${1%/}"
+TOKEN="$2"
+ORG="$3"
+WORKFLOW="$4"
+REF="${5:-main}"
+INPUTS="${6:-{\}}"
+
+# ---------------------------------------------------------------------------
+# Fetch all repos in the org, paginated
+# ---------------------------------------------------------------------------
+echo "Fetching repos for org '${ORG}' on ${GITEA_URL} ..."
+
+PAGE=1
+LIMIT=50
+ALL_REPOS=""
+
+while true; do
+  RESPONSE=$(curl -s \
+    -H "Authorization: token ${TOKEN}" \
+    -H "Accept: application/json" \
+    "${GITEA_URL}/api/v1/orgs/${ORG}/repos?page=${PAGE}&limit=${LIMIT}")
+
+  # Break if empty array
+  COUNT=$(echo "$RESPONSE" | jq -r 'length')
+  if [ "$COUNT" -eq 0 ]; then
+    break
+  fi
+
+  NAMES=$(echo "$RESPONSE" | jq -r '.[].name')
+  ALL_REPOS="${ALL_REPOS}${NAMES}"$'\n'
+
+  if [ "$COUNT" -lt "$LIMIT" ]; then
+    break
+  fi
+
+  PAGE=$((PAGE + 1))
+done
+
+# ---------------------------------------------------------------------------
+# Filter for client-waas repos
+# ---------------------------------------------------------------------------
+CLIENT_REPOS=$(echo "$ALL_REPOS" | grep 'client-waas' | sort || true)
+
+if [ -z "$CLIENT_REPOS" ]; then
+  echo "No client-waas repos found in org '${ORG}'."
+  exit 0
+fi
+
+TOTAL=$(echo "$CLIENT_REPOS" | wc -l | tr -d ' ')
+echo "Found ${TOTAL} client-waas repo(s). Triggering workflow '${WORKFLOW}' (ref: ${REF}) ..."
+echo ""
+
+# ---------------------------------------------------------------------------
+# Trigger workflow for each repo
+# ---------------------------------------------------------------------------
+SUCCESS=0
+FAIL=0
+
+while IFS= read -r REPO; do
+  [ -z "$REPO" ] && continue
+
+  PAYLOAD=$(jq -n --arg ref "$REF" --argjson inputs "$INPUTS" '{ref: $ref, inputs: $inputs}')
+
+  HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' \
+    -X POST \
+    -H "Authorization: token ${TOKEN}" \
+    -H "Content-Type: application/json" \
+    -d "$PAYLOAD" \
+    "${GITEA_URL}/api/v1/repos/${ORG}/${REPO}/actions/workflows/${WORKFLOW}/dispatches")
+
+  if [ "$HTTP_CODE" -eq 204 ] || [ "$HTTP_CODE" -eq 201 ]; then
+    echo "  [OK]   ${ORG}/${REPO} (HTTP ${HTTP_CODE})"
+    SUCCESS=$((SUCCESS + 1))
+  else
+    echo "  [FAIL] ${ORG}/${REPO} (HTTP ${HTTP_CODE})"
+    FAIL=$((FAIL + 1))
+  fi
+done <<< "$CLIENT_REPOS"
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+echo ""
+echo "Done. Success: ${SUCCESS} | Failed: ${FAIL} | Total: ${TOTAL}"
+
+if [ "$FAIL" -gt 0 ]; then
+  exit 1
+fi
@@ -6,10 +6,10 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Automation.CI
-# INGROUP: mokocli.CLI
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoCLI
-# PATH: /cli/ci_issue_reporter.sh
-# VERSION: 10.00.00
+# INGROUP: mokocli.Automation
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /automation/ci-issue-reporter.sh
+# VERSION: 09.23.00
 # BRIEF: Creates or updates a Gitea issue when a CI gate fails.
 #        Deduplicates by searching open issues with the "ci-auto" label
 #        whose title matches the gate. If a matching issue exists, a comment
@@ -19,10 +19,10 @@
 set -euo pipefail

 # ── Defaults ────────────────────────────────────────────────────────────────
-MOKOGITEA_URL="${MOKOGITEA_URL:-https://git.mokoconsulting.tech}"
-MOKOGITEA_TOKEN="${MOKOGITEA_TOKEN:-}"
+GITEA_URL="${GITEA_URL:-https://git.mokoconsulting.tech}"
+GITEA_TOKEN="${GITEA_TOKEN:-}"
 REPO="${GITHUB_REPOSITORY:-}"
-RUN_URL="${GITHUB_SERVER_URL:-${MOKOGITEA_URL}}/${REPO}/actions/runs/${GITHUB_RUN_ID:-0}"
+RUN_URL="${GITHUB_SERVER_URL:-${GITEA_URL}}/${REPO}/actions/runs/${GITHUB_RUN_ID:-0}"
 LABEL_NAME="ci-auto"
 LABEL_COLOR="#e11d48"

@@ -34,7 +34,7 @@ WORKFLOW=""
 # ── Parse arguments ─────────────────────────────────────────────────────────
 usage() {
  cat <<EOF
-Usage: ci_issue_reporter.sh --gate NAME --details TEXT [OPTIONS]
+Usage: ci-issue-reporter.sh --gate NAME --details TEXT [OPTIONS]

 Required:
  --gate      CI gate name (e.g. "Code Quality", "Self-Health")
@@ -45,8 +45,8 @@ Optional:
  --workflow  Workflow name for the issue title
  --repo      owner/repo (default: \$GITHUB_REPOSITORY)
  --run-url   URL to the CI run (auto-detected from env)
-  --token     Gitea API token (default: \$MOKOGITEA_TOKEN)
-  --url       Gitea base URL (default: \$MOKOGITEA_URL)
+  --token     Gitea API token (default: \$GITEA_TOKEN)
+  --url       Gitea base URL (default: \$GITEA_URL)
 EOF
  exit 1
 }
@@ -59,19 +59,19 @@ while [[ $# -gt 0 ]]; do
    --workflow) WORKFLOW="$2";   shift 2 ;;
    --repo)     REPO="$2";      shift 2 ;;
    --run-url)  RUN_URL="$2";   shift 2 ;;
-    --token)    MOKOGITEA_TOKEN="$2"; shift 2 ;;
-    --url)      MOKOGITEA_URL="$2"; shift 2 ;;
+    --token)    GITEA_TOKEN="$2"; shift 2 ;;
+    --url)      GITEA_URL="$2"; shift 2 ;;
    -h|--help)  usage ;;
    *)          echo "Unknown option: $1"; usage ;;
  esac
 done

-[[ -z "$GATE" ]]             && { echo "ERROR: --gate is required"; usage; }
-[[ -z "$DETAILS" ]]          && { echo "ERROR: --details is required"; usage; }
-[[ -z "$MOKOGITEA_TOKEN" ]]  && { echo "ERROR: MOKOGITEA_TOKEN not set"; exit 1; }
-[[ -z "$REPO" ]]             && { echo "ERROR: GITHUB_REPOSITORY not set"; exit 1; }
+[[ -z "$GATE" ]]         && { echo "ERROR: --gate is required"; usage; }
+[[ -z "$DETAILS" ]]      && { echo "ERROR: --details is required"; usage; }
+[[ -z "$GITEA_TOKEN" ]]  && { echo "ERROR: GITEA_TOKEN not set"; exit 1; }
+[[ -z "$REPO" ]]         && { echo "ERROR: GITHUB_REPOSITORY not set"; exit 1; }

-API="${MOKOGITEA_URL}/api/v1/repos/${REPO}"
+API="${GITEA_URL}/api/v1/repos/${REPO}"

 # ── Build title ─────────────────────────────────────────────────────────────
 if [[ -n "$WORKFLOW" ]]; then
@@ -84,19 +84,20 @@ fi
 ensure_label() {
  local exists
  exists=$(curl -sf -o /dev/null -w '%{http_code}' \
-    -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+    -H "Authorization: token ${GITEA_TOKEN}" \
    "${API}/labels" 2>/dev/null || echo "000")

  if [[ "$exists" == "200" ]]; then
+    # Check if label already exists
    local found
    found=$(curl -sf \
-      -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+      -H "Authorization: token ${GITEA_TOKEN}" \
      "${API}/labels" 2>/dev/null \
      | grep -o "\"name\":\"${LABEL_NAME}\"" || true)

    if [[ -z "$found" ]]; then
      curl -sf -X POST \
-        -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+        -H "Authorization: token ${GITEA_TOKEN}" \
        -H "Content-Type: application/json" \
        "${API}/labels" \
        -d "{\"name\":\"${LABEL_NAME}\",\"color\":\"${LABEL_COLOR}\",\"description\":\"Auto-created by CI issue reporter\"}" \
@@ -107,15 +108,17 @@ ensure_label() {

 # ── Search for existing open issue ──────────────────────────────────────────
 find_existing_issue() {
+  # URL-encode the gate name for the query
  local query
  query=$(printf '%s' "[CI] ${GATE}" | sed 's/ /%20/g; s/\[/%5B/g; s/\]/%5D/g')

  local response
  response=$(curl -sf \
-    -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+    -H "Authorization: token ${GITEA_TOKEN}" \
    "${API}/issues?type=issues&state=open&labels=${LABEL_NAME}&q=${query}&limit=5" \
    2>/dev/null || echo "[]")

+  # Extract the first matching issue number
  echo "$response" \
    | grep -oP '"number":\s*\K[0-9]+' \
    | head -1
@@ -148,7 +151,7 @@ ${DETAILS}
 Fix the issue described above and push a new commit. This issue will be closed automatically when the gate passes, or can be closed manually.

 ---
-*Auto-created by [ci-issue-reporter](${MOKOGITEA_URL}/MokoConsulting/MokoCLI/src/branch/main/cli/ci_issue_reporter.sh)*
+*Auto-created by [ci-issue-reporter](${GITEA_URL}/${REPO}/src/branch/main/automation/ci-issue-reporter.sh)*
 BODY
 }

@@ -171,13 +174,14 @@ ensure_label
 EXISTING=$(find_existing_issue)

 if [[ -n "$EXISTING" ]]; then
+  # Append comment to existing issue
  COMMENT_BODY=$(build_comment)
  COMMENT_JSON=$(printf '%s' "$COMMENT_BODY" | python3 -c "
 import sys, json
 print(json.dumps({'body': sys.stdin.read()}))" 2>/dev/null)

  HTTP=$(curl -sf -o /dev/null -w '%{http_code}' -X POST \
-    -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+    -H "Authorization: token ${GITEA_TOKEN}" \
    -H "Content-Type: application/json" \
    "${API}/issues/${EXISTING}/comments" \
    -d "${COMMENT_JSON}" 2>/dev/null || echo "000")
@@ -188,6 +192,7 @@ print(json.dumps({'body': sys.stdin.read()}))" 2>/dev/null)
    echo "WARNING: Failed to comment on issue #${EXISTING} (HTTP ${HTTP})"
  fi
 else
+  # Create new issue
  ISSUE_BODY=$(build_body)
  ISSUE_JSON=$(python3 -c "
 import sys, json
@@ -198,8 +203,9 @@ print(json.dumps({
    'labels': []
 }))" "$TITLE" <<< "$ISSUE_BODY" 2>/dev/null)

+  # Create the issue
  RESPONSE=$(curl -sf -X POST \
-    -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+    -H "Authorization: token ${GITEA_TOKEN}" \
    -H "Content-Type: application/json" \
    "${API}/issues" \
    -d "${ISSUE_JSON}" 2>/dev/null || echo "{}")
@@ -207,15 +213,16 @@ print(json.dumps({
  ISSUE_NUM=$(echo "$RESPONSE" | grep -oP '"number":\s*\K[0-9]+' | head -1)

  if [[ -n "$ISSUE_NUM" ]]; then
+    # Apply label (separate call — more reliable across Gitea versions)
    LABEL_ID=$(curl -sf \
-      -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+      -H "Authorization: token ${GITEA_TOKEN}" \
      "${API}/labels" 2>/dev/null \
      | grep -oP "\"id\":\s*\K[0-9]+(?=[^}]*\"name\":\s*\"${LABEL_NAME}\")" \
      | head -1 || true)

    if [[ -n "$LABEL_ID" ]]; then
      curl -sf -X POST \
-        -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+        -H "Authorization: token ${GITEA_TOKEN}" \
        -H "Content-Type: application/json" \
        "${API}/issues/${ISSUE_NUM}/labels" \
        -d "{\"labels\":[${LABEL_ID}]}" \
@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+# =============================================================================
+# enforce_tags.sh — Ensure all repos have the 5 standard release channel tags
+#
+# Standard tags: development, alpha, beta, release-candidate, stable
+# Also removes non-standard tags (keeps vXX production tags)
+#
+# Usage:
+#   GA_TOKEN=xxx ./enforce_tags.sh [--dry-run] [--repos repo1,repo2]
+#
+# Called by: bulk-repo-sync.yml, infrastructure-tests/mirror-check.yml
+# =============================================================================
+set -euo pipefail
+
+GITEA_URL="${GITEA_URL:-https://git.mokoconsulting.tech}"
+ORG="${GITEA_ORG:-MokoConsulting}"
+TOKEN="${GA_TOKEN:?GA_TOKEN required}"
+DRY_RUN=false
+FILTER_REPOS=""
+
+STANDARD_TAGS=("development" "alpha" "beta" "release-candidate" "stable")
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run) DRY_RUN=true; shift ;;
+    --repos) FILTER_REPOS="$2"; shift 2 ;;
+    *) shift ;;
+  esac
+done
+
+api() {
+  local method="$1" path="$2" data="${3:-}"
+  local args=(-sf -H "Authorization: token $TOKEN" -H "Content-Type: application/json" -X "$method")
+  [[ -n "$data" ]] && args+=(-d "$data")
+  curl "${args[@]}" "$GITEA_URL/api/v1$path" 2>/dev/null
+}
+
+# Get repos
+REPOS=""
+for page in 1 2 3; do
+  BATCH=$(api GET "/orgs/$ORG/repos?limit=50&page=$page" | python3 -c "
+import sys,json
+for r in json.load(sys.stdin):
+    if not r.get(empty) and not r.get(archived):
+        print(r[name])
+" 2>/dev/null)
+  [[ -z "$BATCH" ]] && break
+  REPOS="$REPOS $BATCH"
+done
+
+# Filter if specified
+if [[ -n "$FILTER_REPOS" ]]; then
+  FILTERED=""
+  IFS=, read -ra FILTER_ARR <<< "$FILTER_REPOS"
+  for repo in $REPOS; do
+    for f in "${FILTER_ARR[@]}"; do
+      [[ "$repo" == "$f" ]] && FILTERED="$FILTERED $repo"
+    done
+  done
+  REPOS="$FILTERED"
+fi
+
+TOTAL=$(echo $REPOS | wc -w)
+ADDED=0
+DELETED=0
+ERRORS=0
+
+echo "Enforcing tags on $TOTAL repos (dry_run=$DRY_RUN)"
+
+for repo in $REPOS; do
+  TAGS=$(api GET "/repos/$ORG/$repo/tags?limit=50" | python3 -c "import sys,json; print( .join(t[name] for t in json.load(sys.stdin)))" 2>/dev/null)
+  MAIN_SHA=$(api GET "/repos/$ORG/$repo/branches/main" | python3 -c "import sys,json; print(json.load(sys.stdin)[commit][id])" 2>/dev/null)
+  [[ -z "$MAIN_SHA" ]] && continue
+
+  # Add missing standard tags
+  for st in "${STANDARD_TAGS[@]}"; do
+    if ! echo " $TAGS " | grep -q " $st "; then
+      if [[ "$DRY_RUN" == "true" ]]; then
+        echo "  [DRY] ADD $repo: $st"
+      else
+        STATUS=$(api POST "/repos/$ORG/$repo/tags" "{\"tag_name\":\"$st\",\"target\":\"$MAIN_SHA\"}" | python3 -c "import sys,json; print(ok)" 2>/dev/null || echo "err")
+        [[ "$STATUS" == "ok" ]] && ADDED=$((ADDED + 1)) || ERRORS=$((ERRORS + 1))
+      fi
+    fi
+  done
+
+  # Remove non-standard tags
+  for t in $TAGS; do
+    IS_STD=false
+    for st in "${STANDARD_TAGS[@]}"; do [[ "$t" == "$st" ]] && IS_STD=true; done
+    # Keep vXX production tags
+    if [[ "$t" =~ ^v[0-9]{1,3}$ ]]; then IS_STD=true; fi
+    
+    if [[ "$IS_STD" == "false" ]]; then
+      if [[ "$DRY_RUN" == "true" ]]; then
+        echo "  [DRY] DEL $repo: $t"
+      else
+        # Delete release first if exists
+        api DELETE "/repos/$ORG/$repo/releases/tags/$t" > /dev/null 2>&1 || true
+        api DELETE "/repos/$ORG/$repo/tags/$t" > /dev/null 2>&1
+        DELETED=$((DELETED + 1))
+        echo "  DEL $repo: $t"
+      fi
+    fi
+  done
+done
+
+echo "Done: $ADDED added, $DELETED deleted, $ERRORS errors (dry_run=$DRY_RUN)"
@@ -0,0 +1,481 @@
+#!/usr/bin/env php
+<?php
+
+/**
+ * Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: MokoPlatform.Automation
+ * INGROUP: MokoPlatform
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+ * PATH: /automation/enrich_manifest_xml.php
+ * BRIEF: Enrich XML manifests with repo-specific build and deploy details
+ *
+ * Note: This script uses proc_open for shell commands. All arguments are escaped
+ * via escapeshellarg(). No user-supplied input reaches the shell unescaped.
+ */
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/../vendor/autoload.php';
+require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
+
+use MokoCli\CliFramework;
+use MokoCli\ManifestParser;
+
+class EnrichManifestXmlCli extends CliFramework
+{
+    protected function configure(): void
+    {
+        $this->setDescription('Enrich XML manifests with repo-specific build and deploy details');
+        $this->addArgument('--repo', 'Filter to a single repo name', '');
+        $this->addArgument('--skip', 'Comma-separated list of repos to skip', '');
+    }
+
+    protected function run(): int
+    {
+        $giteaUrl  = rtrim(getenv('GITEA_URL') ?: 'https://git.mokoconsulting.tech', '/');
+        $giteaOrg  = getenv('GITEA_ORG') ?: 'MokoConsulting';
+        $token     = getenv('GA_TOKEN') ?: getenv('GH_TOKEN') ?: '';
+
+        $repoFilter = $this->getArgument('--repo') ?: null;
+        $skipStr    = $this->getArgument('--skip');
+        $skipRepos  = $skipStr !== '' ? array_map('trim', explode(',', $skipStr)) : [];
+
+        $parser = new ManifestParser();
+        $tmpBase = sys_get_temp_dir() . '/moko-enrich-' . getmypid();
+
+        echo "=== mokocli XML Manifest Enrichment ===\n";
+        echo "Mode: " . ($this->dryRun ? "DRY RUN" : "LIVE") . "\n";
+        if (!empty($skipRepos)) {
+            echo "Skipping: " . implode(', ', $skipRepos) . "\n";
+        }
+        echo "\n";
+
+        if (empty($token)) {
+            $this->log('ERROR', 'GA_TOKEN required');
+            return 1;
+        }
+
+        $repos = $this->fetchRepos($giteaUrl, $giteaOrg, $token);
+        echo "Found " . count($repos) . " repositories\n\n";
+
+        $stats = ['enriched' => 0, 'skipped' => 0, 'failed' => 0];
+
+        foreach ($repos as $repo) {
+            $name = $repo['name'];
+            if ($repoFilter && $name !== $repoFilter) {
+                continue;
+            }
+            if (in_array($name, $skipRepos, true)) {
+                echo "  {$name} ... SKIP (excluded)\n";
+                $stats['skipped']++;
+                continue;
+            }
+            if ($repo['archived'] ?? false) {
+                $stats['skipped']++;
+                continue;
+            }
+
+            $defaultBranch = $repo['default_branch'] ?? 'main';
+            $httpsUrl = $repo['clone_url'] ?? "{$giteaUrl}/{$giteaOrg}/{$name}.git";
+            $authedUrl = preg_replace('#^https://#', "https://gitea-actions:{$token}@", $httpsUrl);
+
+            echo "  {$name} ... ";
+
+            $workDir = "{$tmpBase}/{$name}";
+            @mkdir($workDir, 0755, true);
+            [$ret] = $this->safeExec(
+                'git clone --depth 1 --branch ' . escapeshellarg($defaultBranch)
+                . ' ' . escapeshellarg($authedUrl) . ' ' . escapeshellarg($workDir)
+            );
+            if ($ret !== 0) {
+                echo "FAIL (clone)\n";
+                $stats['failed']++;
+                continue;
+            }
+
+            $manifestPath = "{$workDir}/.mokogitea/manifest.xml";
+            if (!file_exists($manifestPath) || !str_contains(file_get_contents($manifestPath), '<mokocli')) {
+                echo "SKIP (no XML manifest)\n";
+                $stats['skipped']++;
+                $this->rmTree($workDir);
+                continue;
+            }
+
+            $existingXml = file_get_contents($manifestPath);
+            $platform = $parser->extractPlatform($existingXml) ?? 'default-repository';
+            $enrichment = $this->inspectRepo($workDir, $platform);
+
+            if (!isset($enrichment['build'])) {
+                $enrichment['build'] = [];
+            }
+            $enrichment['build']['language'] = $enrichment['build']['language']
+                ?? $repo['language']
+                ?? ManifestParser::platformLanguage($platform);
+            $enrichment['build']['package_type'] = $enrichment['build']['package_type'] ?? ManifestParser::platformPackageType($platform);
+
+            $enrichedXml = $this->enrichManifestXml($existingXml, $enrichment);
+            $dc = count($enrichment['deploy'] ?? []);
+            $sc = count($enrichment['scripts'] ?? []);
+            $details = "deploy={$dc} scripts={$sc}";
+
+            if ($this->dryRun) {
+                echo "WOULD ENRICH [{$details}]\n";
+                $stats['enriched']++;
+                $this->rmTree($workDir);
+                continue;
+            }
+
+            file_put_contents($manifestPath, $enrichedXml);
+            $this->gitCmd($workDir, 'config', 'user.name', 'gitea-actions[bot]');
+            $this->gitCmd($workDir, 'config', 'user.email', 'gitea-actions[bot]@git.mokoconsulting.tech');
+            $this->gitCmd($workDir, 'add', '.mokogitea/manifest.xml');
+
+            [$cr, $co] = $this->gitCmd($workDir, 'commit', '-m', "chore: enrich manifest.xml with build/deploy/scripts\n\nAuto-detected: {$details}");
+            if ($cr !== 0) {
+                echo "SKIP (no diff)\n";
+                $stats['skipped']++;
+                $this->rmTree($workDir);
+                continue;
+            }
+
+            [$pr] = $this->gitCmd($workDir, 'push', 'origin', $defaultBranch);
+            if ($pr !== 0) {
+                echo "FAIL (push)\n";
+                $stats['failed']++;
+            } else {
+                echo "ENRICHED [{$details}]\n";
+                $stats['enriched']++;
+            }
+
+            $this->rmTree($workDir);
+        }
+
+        @rmdir($tmpBase);
+        echo "\n=== Summary ===\nEnriched: {$stats['enriched']}\nSkipped:  {$stats['skipped']}\nFailed:   {$stats['failed']}\n";
+
+        return 0;
+    }
+
+    private function inspectRepo(string $workDir, string $platform): array
+    {
+        $enrichment = [];
+        $build = [];
+
+        // Detect entry point
+        if (is_dir("{$workDir}/src")) {
+            foreach (glob("{$workDir}/src/*.xml") ?: [] as $xf) {
+                $c = file_get_contents($xf);
+                if (str_contains($c, '<extension') || str_contains($c, '<install')) {
+                    $build['entry_point'] = 'src/' . basename($xf);
+                    break;
+                }
+            }
+            foreach (glob("{$workDir}/src/core/modules/mod*.class.php") ?: [] as $mf) {
+                $build['entry_point'] = str_replace("{$workDir}/", '', $mf);
+                break;
+            }
+        }
+
+        // composer.json
+        if (file_exists("{$workDir}/composer.json")) {
+            $composer = json_decode(file_get_contents("{$workDir}/composer.json"), true) ?: [];
+            $phpReq = $composer['require']['php'] ?? null;
+            if ($phpReq) {
+                $build['runtime'] = "php:{$phpReq}";
+            }
+
+            $deps = [];
+            foreach (['joomla/cms', 'joomla/framework', 'dolibarr/dolibarr'] as $pd) {
+                if (isset($composer['require'][$pd])) {
+                    $deps[] = ['name' => $pd, 'version' => $composer['require'][$pd], 'type' => 'platform'];
+                }
+            }
+            if (isset($composer['require']['mokoconsulting-tech/enterprise'])) {
+                $deps[] = [
+                    'name' => 'mokoconsulting-tech/enterprise',
+                    'version' => $composer['require']['mokoconsulting-tech/enterprise'],
+                    'type' => 'composer',
+                ];
+            }
+            if (!empty($deps)) {
+                $build['dependencies'] = $deps;
+            }
+        }
+
+        // Artifact from Makefile
+        if (file_exists("{$workDir}/Makefile")) {
+            $mk = file_get_contents("{$workDir}/Makefile");
+            if (preg_match('/\bdist\/(\S+\.zip)\b/', $mk, $m)) {
+                $build['artifact'] = ['format' => 'zip', 'path' => 'dist/', 'filename' => $m[1]];
+            }
+        }
+
+        if (!empty($build)) {
+            $enrichment['build'] = $build;
+        }
+
+        // Deploy targets from workflows
+        $targets = [];
+        $wfDir = is_dir("{$workDir}/.gitea/workflows") ? "{$workDir}/.gitea/workflows" : "{$workDir}/.github/workflows";
+        if (is_dir($wfDir)) {
+            foreach (['deploy-dev', 'deploy-demo', 'deploy-rs'] as $dn) {
+                $wf = "{$wfDir}/{$dn}.yml";
+                if (!file_exists($wf)) {
+                    continue;
+                }
+                $wc = file_get_contents($wf);
+                $t = ['name' => str_replace('deploy-', '', $dn)];
+                if (str_contains($wc, 'sftp') || str_contains($wc, 'SFTP')) {
+                    $t['method'] = 'sftp';
+                } elseif (str_contains($wc, 'rsync')) {
+                    $t['method'] = 'rsync';
+                }
+                if (str_contains($wc, 'src/')) {
+                    $t['src_dir'] = 'src/';
+                }
+                if (preg_match('/branches:\s*\n\s*-\s*["\']?([^"\'}\s]+)/', $wc, $m)) {
+                    $t['branch'] = $m[1];
+                }
+                $targets[] = $t;
+            }
+        }
+        if (!empty($targets)) {
+            $enrichment['deploy'] = $targets;
+        }
+
+        // Scripts from Makefile + composer
+        $scripts = [];
+        if (file_exists("{$workDir}/Makefile")) {
+            $mk = file_get_contents("{$workDir}/Makefile");
+            $known = [
+                'build' => 'build', 'test' => 'test', 'lint' => 'lint',
+                'clean' => 'build', 'package' => 'build',
+                'validate' => 'validate', 'release' => 'release',
+            ];
+            if (preg_match_all('/^([a-zA-Z_-]+)\s*:/m', $mk, $matches)) {
+                foreach ($matches[1] as $tgt) {
+                    $tl = strtolower($tgt);
+                    if (isset($known[$tl])) {
+                        $scripts[] = [
+                            'name' => $tl, 'phase' => $known[$tl],
+                            'command' => "make {$tgt}",
+                            'desc' => ucfirst($tl) . ' via make',
+                            'runner' => 'make',
+                        ];
+                    }
+                }
+            }
+        }
+        if (file_exists("{$workDir}/composer.json")) {
+            $composer = json_decode(file_get_contents("{$workDir}/composer.json"), true) ?: [];
+            $km = ['test' => 'test','lint' => 'lint','cs' => 'lint','phpcs' => 'lint','phpstan' => 'lint','validate' => 'validate'];
+            foreach ($composer['scripts'] ?? [] as $sn => $cmd) {
+                $sl = strtolower($sn);
+                foreach ($km as $match => $phase) {
+                    if (str_contains($sl, $match)) {
+                        $exists = false;
+                        foreach ($scripts as $s) {
+                            if ($s['name'] === $sl) {
+                                $exists = true;
+                                break;
+                            }
+                        }
+                        if (!$exists) {
+                            $scripts[] = [
+                                'name' => $sn, 'phase' => $phase,
+                                'command' => "composer run {$sn}",
+                                'desc' => is_string($cmd) ? $cmd : "Run {$sn}",
+                                'runner' => 'composer',
+                            ];
+                        }
+                        break;
+                    }
+                }
+            }
+        }
+        if (!empty($scripts)) {
+            $enrichment['scripts'] = $scripts;
+        }
+
+        return $enrichment;
+    }
+
+    private function enrichManifestXml(string $xml, array $enrichment): string
+    {
+        $dom = new \DOMDocument('1.0', 'UTF-8');
+        $dom->preserveWhiteSpace = false;
+        $dom->formatOutput = true;
+        if (!$dom->loadXML($xml)) {
+            return $xml;
+        }
+
+        $ns = ManifestParser::NAMESPACE_URI;
+        $root = $dom->documentElement;
+
+        foreach (['build', 'deploy', 'scripts'] as $tag) {
+            $toRemove = [];
+            $existing = $root->getElementsByTagNameNS($ns, $tag);
+            for ($i = 0; $i < $existing->length; $i++) {
+                $toRemove[] = $existing->item($i);
+            }
+            foreach ($toRemove as $node) {
+                $root->removeChild($node);
+            }
+        }
+
+        if (!empty($enrichment['build'])) {
+            $buildEl = $dom->createElementNS($ns, 'build');
+            $b = $enrichment['build'];
+            foreach (['language', 'runtime'] as $f) {
+                if (isset($b[$f])) {
+                    $buildEl->appendChild($dom->createElementNS($ns, $f, htmlspecialchars($b[$f], ENT_XML1)));
+                }
+            }
+            if (isset($b['package_type'])) {
+                $buildEl->appendChild($dom->createElementNS($ns, 'package-type', htmlspecialchars($b['package_type'], ENT_XML1)));
+            }
+            if (isset($b['entry_point'])) {
+                $buildEl->appendChild($dom->createElementNS($ns, 'entry-point', htmlspecialchars($b['entry_point'], ENT_XML1)));
+            }
+            if (isset($b['artifact'])) {
+                $art = $dom->createElementNS($ns, 'artifact');
+                foreach (['format','path','filename'] as $af) {
+                    if (isset($b['artifact'][$af])) {
+                        $art->appendChild($dom->createElementNS($ns, $af, htmlspecialchars($b['artifact'][$af], ENT_XML1)));
+                    }
+                }
+                $buildEl->appendChild($art);
+            }
+            if (isset($b['dependencies'])) {
+                $deps = $dom->createElementNS($ns, 'dependencies');
+                foreach ($b['dependencies'] as $d) {
+                    $req = $dom->createElementNS($ns, 'requires', '');
+                    $req->setAttribute('name', $d['name']);
+                    if (isset($d['version'])) {
+                        $req->setAttribute('version', $d['version']);
+                    }
+                    if (isset($d['type'])) {
+                        $req->setAttribute('type', $d['type']);
+                    }
+                    $deps->appendChild($req);
+                }
+                $buildEl->appendChild($deps);
+            }
+            $root->appendChild($buildEl);
+        }
+
+        if (!empty($enrichment['deploy'])) {
+            $deploy = $dom->createElementNS($ns, 'deploy');
+            foreach ($enrichment['deploy'] as $t) {
+                $target = $dom->createElementNS($ns, 'target');
+                $target->setAttribute('name', $t['name']);
+                $target->appendChild($dom->createElementNS($ns, 'host', '${{ secrets.' . strtoupper($t['name']) . '_HOST }}'));
+                $target->appendChild($dom->createElementNS($ns, 'path', '${{ secrets.' . strtoupper($t['name']) . '_PATH }}'));
+                if (isset($t['method'])) {
+                    $target->appendChild($dom->createElementNS($ns, 'method', $t['method']));
+                }
+                if (isset($t['branch'])) {
+                    $target->appendChild($dom->createElementNS($ns, 'branch', htmlspecialchars($t['branch'], ENT_XML1)));
+                }
+                if (isset($t['src_dir'])) {
+                    $target->appendChild($dom->createElementNS($ns, 'src-dir', htmlspecialchars($t['src_dir'], ENT_XML1)));
+                }
+                $deploy->appendChild($target);
+            }
+            $root->appendChild($deploy);
+        }
+
+        if (!empty($enrichment['scripts'])) {
+            $scriptsEl = $dom->createElementNS($ns, 'scripts');
+            foreach ($enrichment['scripts'] as $s) {
+                $script = $dom->createElementNS($ns, 'script');
+                $script->setAttribute('name', $s['name']);
+                if (isset($s['phase'])) {
+                    $script->setAttribute('phase', $s['phase']);
+                }
+                $script->appendChild($dom->createElementNS($ns, 'command', htmlspecialchars($s['command'], ENT_XML1)));
+                if (isset($s['desc'])) {
+                    $script->appendChild($dom->createElementNS($ns, 'description', htmlspecialchars($s['desc'], ENT_XML1)));
+                }
+                if (isset($s['runner'])) {
+                    $script->appendChild($dom->createElementNS($ns, 'runner', htmlspecialchars($s['runner'], ENT_XML1)));
+                }
+                $scriptsEl->appendChild($script);
+            }
+            $root->appendChild($scriptsEl);
+        }
+
+        return $dom->saveXML();
+    }
+
+    /** @return array{int, string} */
+    private function safeExec(string $command, string $cwd = '.'): array
+    {
+        $proc = proc_open($command, [1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes, $cwd);
+        if (!is_resource($proc)) {
+            return [1, "proc_open failed"];
+        }
+        $stdout = stream_get_contents($pipes[1]);
+        $stderr = stream_get_contents($pipes[2]);
+        fclose($pipes[1]);
+        fclose($pipes[2]);
+        return [proc_close($proc), trim($stdout . "\n" . $stderr)];
+    }
+
+    private function rmTree(string $dir): void
+    {
+        if (!is_dir($dir)) {
+            return;
+        }
+        $it = new \RecursiveDirectoryIterator($dir, \FilesystemIterator::SKIP_DOTS);
+        $files = new \RecursiveIteratorIterator($it, \RecursiveIteratorIterator::CHILD_FIRST);
+        foreach ($files as $file) {
+            if ($file->isDir()) {
+                @rmdir($file->getPathname());
+            } else {
+                @chmod($file->getPathname(), 0777);
+                @unlink($file->getPathname());
+            }
+        }
+        @rmdir($dir);
+    }
+
+    /** @return array{int, string} */
+    private function gitCmd(string $workDir, string ...$args): array
+    {
+        $cmd = 'git';
+        foreach ($args as $a) {
+            $cmd .= ' ' . escapeshellarg($a);
+        }
+        return $this->safeExec($cmd, $workDir);
+    }
+
+    private function fetchRepos(string $url, string $org, string $token): array
+    {
+        $repos = [];
+        $page = 1;
+        do {
+            $ch = curl_init("{$url}/api/v1/orgs/{$org}/repos?page={$page}&limit=50");
+            curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => ["Authorization: token {$token}"], CURLOPT_TIMEOUT => 30]);
+            $body = curl_exec($ch);
+            $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+            curl_close($ch);
+            if ($code !== 200) {
+                break;
+            }
+            $batch = json_decode($body, true);
+            if (empty($batch)) {
+                break;
+            }
+            $repos = array_merge($repos, $batch);
+            $page++;
+        } while (count($batch) >= 50);
+        return $repos;
+    }
+}
+
+$app = new EnrichManifestXmlCli();
+exit($app->execute());
@@ -0,0 +1,484 @@
+#!/usr/bin/env php
+<?php
+
+/**
+ * Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: MokoPlatform.Automation
+ * INGROUP: MokoPlatform
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+ * PATH: /automation/enrich_mokostandards_xml.php
+ * BRIEF: Enrich XML manifests with repo-specific build and deploy details
+ *
+ * Note: This script uses proc_open for shell commands. All arguments are escaped
+ * via escapeshellarg(). No user-supplied input reaches the shell unescaped.
+ */
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/../vendor/autoload.php';
+require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
+
+use MokoCli\CliFramework;
+use MokoCli\ManifestParser;
+
+class EnrichMokostandardsXmlCli extends CliFramework
+{
+    protected function configure(): void
+    {
+        $this->setDescription('Enrich XML manifests with repo-specific build and deploy details');
+        $this->addArgument('--repo', 'Filter to a single repo name', '');
+        $this->addArgument('--skip', 'Comma-separated list of repos to skip', '');
+    }
+
+    protected function run(): int
+    {
+        $giteaUrl  = rtrim(getenv('GITEA_URL') ?: 'https://git.mokoconsulting.tech', '/');
+        $giteaOrg  = getenv('GITEA_ORG') ?: 'MokoConsulting';
+        $token     = getenv('GA_TOKEN') ?: getenv('GH_TOKEN') ?: '';
+
+        $repoFilter = $this->getArgument('--repo') ?: null;
+        $skipStr    = $this->getArgument('--skip');
+        $skipRepos  = $skipStr !== '' ? array_map('trim', explode(',', $skipStr)) : [];
+
+        $parser = new ManifestParser();
+        $tmpBase = sys_get_temp_dir() . '/moko-enrich-' . getmypid();
+
+        echo "=== mokocli XML Manifest Enrichment ===\n";
+        echo "Mode: " . ($this->dryRun ? "DRY RUN" : "LIVE") . "\n";
+        if (!empty($skipRepos)) {
+            echo "Skipping: " . implode(', ', $skipRepos) . "\n";
+        }
+        echo "\n";
+
+        if (empty($token)) {
+            $this->log('ERROR', 'GA_TOKEN required');
+            return 1;
+        }
+
+        $repos = $this->fetchRepos($giteaUrl, $giteaOrg, $token);
+        echo "Found " . count($repos) . " repositories\n\n";
+
+        $stats = ['enriched' => 0, 'skipped' => 0, 'failed' => 0];
+
+        foreach ($repos as $repo) {
+            $name = $repo['name'];
+            if ($repoFilter && $name !== $repoFilter) {
+                continue;
+            }
+            if (in_array($name, $skipRepos, true)) {
+                echo "  {$name} ... SKIP (excluded)\n";
+                $stats['skipped']++;
+                continue;
+            }
+            if ($repo['archived'] ?? false) {
+                $stats['skipped']++;
+                continue;
+            }
+
+            $defaultBranch = $repo['default_branch'] ?? 'main';
+            $httpsUrl = $repo['clone_url'] ?? "{$giteaUrl}/{$giteaOrg}/{$name}.git";
+            $authedUrl = preg_replace('#^https://#', "https://gitea-actions:{$token}@", $httpsUrl);
+
+            echo "  {$name} ... ";
+
+            $workDir = "{$tmpBase}/{$name}";
+            @mkdir($workDir, 0755, true);
+            [$ret] = $this->safeExec(
+                'git clone --depth 1 --branch ' . escapeshellarg($defaultBranch)
+                . ' ' . escapeshellarg($authedUrl) . ' ' . escapeshellarg($workDir)
+            );
+            if ($ret !== 0) {
+                echo "FAIL (clone)\n";
+                $stats['failed']++;
+                continue;
+            }
+
+            $manifestPath = "{$workDir}/.mokogitea/manifest.xml";
+            if (!file_exists($manifestPath) || !str_contains(file_get_contents($manifestPath), '<mokocli')) {
+                echo "SKIP (no XML manifest)\n";
+                $stats['skipped']++;
+                $this->rmTree($workDir);
+                continue;
+            }
+
+            $existingXml = file_get_contents($manifestPath);
+            $platform = $parser->extractPlatform($existingXml) ?? 'default-repository';
+            $enrichment = $this->inspectRepo($workDir, $platform);
+
+            if (!isset($enrichment['build'])) {
+                $enrichment['build'] = [];
+            }
+            $enrichment['build']['language'] = $enrichment['build']['language']
+                ?? $repo['language']
+                ?? ManifestParser::platformLanguage($platform);
+            $enrichment['build']['package_type'] = $enrichment['build']['package_type'] ?? ManifestParser::platformPackageType($platform);
+
+            $enrichedXml = $this->enrichManifestXml($existingXml, $enrichment);
+            $dc = count($enrichment['deploy'] ?? []);
+            $sc = count($enrichment['scripts'] ?? []);
+            $details = "deploy={$dc} scripts={$sc}";
+
+            if ($this->dryRun) {
+                echo "WOULD ENRICH [{$details}]\n";
+                $stats['enriched']++;
+                $this->rmTree($workDir);
+                continue;
+            }
+
+            file_put_contents($manifestPath, $enrichedXml);
+            $this->gitCmd($workDir, 'config', 'user.name', 'gitea-actions[bot]');
+            $this->gitCmd($workDir, 'config', 'user.email', 'gitea-actions[bot]@git.mokoconsulting.tech');
+            $this->gitCmd($workDir, 'add', '.mokogitea/manifest.xml');
+
+            $commitMsg = "chore: enrich .mokostandards"
+                . " with build/deploy/scripts\n\n"
+                . "Auto-detected: {$details}";
+            [$cr, $co] = $this->gitCmd(
+                $workDir,
+                'commit',
+                '-m',
+                $commitMsg
+            );
+            if ($cr !== 0) {
+                echo "SKIP (no diff)\n";
+                $stats['skipped']++;
+                $this->rmTree($workDir);
+                continue;
+            }
+
+            [$pr] = $this->gitCmd($workDir, 'push', 'origin', $defaultBranch);
+            if ($pr !== 0) {
+                echo "FAIL (push)\n";
+                $stats['failed']++;
+            } else {
+                echo "ENRICHED [{$details}]\n";
+                $stats['enriched']++;
+            }
+
+            $this->rmTree($workDir);
+        }
+
+        @rmdir($tmpBase);
+        echo "\n=== Summary ===\nEnriched: {$stats['enriched']}\nSkipped:  {$stats['skipped']}\nFailed:   {$stats['failed']}\n";
+
+        return 0;
+    }
+
+    private function inspectRepo(string $workDir, string $platform): array
+    {
+        $enrichment = [];
+        $build = [];
+
+        if (is_dir("{$workDir}/src")) {
+            foreach (glob("{$workDir}/src/*.xml") ?: [] as $xf) {
+                $c = file_get_contents($xf);
+                if (str_contains($c, '<extension') || str_contains($c, '<install')) {
+                    $build['entry_point'] = 'src/' . basename($xf);
+                    break;
+                }
+            }
+            foreach (glob("{$workDir}/src/core/modules/mod*.class.php") ?: [] as $mf) {
+                $build['entry_point'] = str_replace("{$workDir}/", '', $mf);
+                break;
+            }
+        }
+
+        if (file_exists("{$workDir}/composer.json")) {
+            $composer = json_decode(file_get_contents("{$workDir}/composer.json"), true) ?: [];
+            $phpReq = $composer['require']['php'] ?? null;
+            if ($phpReq) {
+                $build['runtime'] = "php:{$phpReq}";
+            }
+
+            $deps = [];
+            foreach (['joomla/cms', 'joomla/framework', 'dolibarr/dolibarr'] as $pd) {
+                if (isset($composer['require'][$pd])) {
+                    $deps[] = ['name' => $pd, 'version' => $composer['require'][$pd], 'type' => 'platform'];
+                }
+            }
+            if (isset($composer['require']['mokoconsulting-tech/enterprise'])) {
+                $deps[] = [
+                    'name' => 'mokoconsulting-tech/enterprise',
+                    'version' => $composer['require']['mokoconsulting-tech/enterprise'],
+                    'type' => 'composer',
+                ];
+            }
+            if (!empty($deps)) {
+                $build['dependencies'] = $deps;
+            }
+        }
+
+        if (file_exists("{$workDir}/Makefile")) {
+            $mk = file_get_contents("{$workDir}/Makefile");
+            if (preg_match('/\bdist\/(\S+\.zip)\b/', $mk, $m)) {
+                $build['artifact'] = ['format' => 'zip', 'path' => 'dist/', 'filename' => $m[1]];
+            }
+        }
+
+        if (!empty($build)) {
+            $enrichment['build'] = $build;
+        }
+
+        $targets = [];
+        $wfDir = is_dir("{$workDir}/.gitea/workflows") ? "{$workDir}/.gitea/workflows" : "{$workDir}/.github/workflows";
+        if (is_dir($wfDir)) {
+            foreach (['deploy-dev', 'deploy-demo', 'deploy-rs'] as $dn) {
+                $wf = "{$wfDir}/{$dn}.yml";
+                if (!file_exists($wf)) {
+                    continue;
+                }
+                $wc = file_get_contents($wf);
+                $t = ['name' => str_replace('deploy-', '', $dn)];
+                if (str_contains($wc, 'sftp') || str_contains($wc, 'SFTP')) {
+                    $t['method'] = 'sftp';
+                } elseif (str_contains($wc, 'rsync')) {
+                    $t['method'] = 'rsync';
+                }
+                if (str_contains($wc, 'src/')) {
+                    $t['src_dir'] = 'src/';
+                }
+                if (preg_match('/branches:\s*\n\s*-\s*["\']?([^"\'}\s]+)/', $wc, $m)) {
+                    $t['branch'] = $m[1];
+                }
+                $targets[] = $t;
+            }
+        }
+        if (!empty($targets)) {
+            $enrichment['deploy'] = $targets;
+        }
+
+        $scripts = [];
+        if (file_exists("{$workDir}/Makefile")) {
+            $mk = file_get_contents("{$workDir}/Makefile");
+            $known = [
+                'build' => 'build', 'test' => 'test', 'lint' => 'lint',
+                'clean' => 'build', 'package' => 'build',
+                'validate' => 'validate', 'release' => 'release',
+            ];
+            if (preg_match_all('/^([a-zA-Z_-]+)\s*:/m', $mk, $matches)) {
+                foreach ($matches[1] as $tgt) {
+                    $tl = strtolower($tgt);
+                    if (isset($known[$tl])) {
+                        $scripts[] = [
+                            'name' => $tl, 'phase' => $known[$tl],
+                            'command' => "make {$tgt}",
+                            'desc' => ucfirst($tl) . ' via make',
+                            'runner' => 'make',
+                        ];
+                    }
+                }
+            }
+        }
+        if (file_exists("{$workDir}/composer.json")) {
+            $composer = json_decode(file_get_contents("{$workDir}/composer.json"), true) ?: [];
+            $km = ['test' => 'test','lint' => 'lint','cs' => 'lint','phpcs' => 'lint','phpstan' => 'lint','validate' => 'validate'];
+            foreach ($composer['scripts'] ?? [] as $sn => $cmd) {
+                $sl = strtolower($sn);
+                foreach ($km as $match => $phase) {
+                    if (str_contains($sl, $match)) {
+                        $exists = false;
+                        foreach ($scripts as $s) {
+                            if ($s['name'] === $sl) {
+                                $exists = true;
+                                break;
+                            }
+                        }
+                        if (!$exists) {
+                            $scripts[] = [
+                                'name' => $sn, 'phase' => $phase,
+                                'command' => "composer run {$sn}",
+                                'desc' => is_string($cmd) ? $cmd : "Run {$sn}",
+                                'runner' => 'composer',
+                            ];
+                        }
+                        break;
+                    }
+                }
+            }
+        }
+        if (!empty($scripts)) {
+            $enrichment['scripts'] = $scripts;
+        }
+
+        return $enrichment;
+    }
+
+    private function enrichManifestXml(string $xml, array $enrichment): string
+    {
+        $dom = new \DOMDocument('1.0', 'UTF-8');
+        $dom->preserveWhiteSpace = false;
+        $dom->formatOutput = true;
+        if (!$dom->loadXML($xml)) {
+            return $xml;
+        }
+
+        $ns = ManifestParser::NAMESPACE_URI;
+        $root = $dom->documentElement;
+
+        foreach (['build', 'deploy', 'scripts'] as $tag) {
+            $toRemove = [];
+            $existing = $root->getElementsByTagNameNS($ns, $tag);
+            for ($i = 0; $i < $existing->length; $i++) {
+                $toRemove[] = $existing->item($i);
+            }
+            foreach ($toRemove as $node) {
+                $root->removeChild($node);
+            }
+        }
+
+        if (!empty($enrichment['build'])) {
+            $buildEl = $dom->createElementNS($ns, 'build');
+            $b = $enrichment['build'];
+            foreach (['language', 'runtime'] as $f) {
+                if (isset($b[$f])) {
+                    $buildEl->appendChild($dom->createElementNS($ns, $f, htmlspecialchars($b[$f], ENT_XML1)));
+                }
+            }
+            if (isset($b['package_type'])) {
+                $buildEl->appendChild($dom->createElementNS($ns, 'package-type', htmlspecialchars($b['package_type'], ENT_XML1)));
+            }
+            if (isset($b['entry_point'])) {
+                $buildEl->appendChild($dom->createElementNS($ns, 'entry-point', htmlspecialchars($b['entry_point'], ENT_XML1)));
+            }
+            if (isset($b['artifact'])) {
+                $art = $dom->createElementNS($ns, 'artifact');
+                foreach (['format','path','filename'] as $af) {
+                    if (isset($b['artifact'][$af])) {
+                        $art->appendChild($dom->createElementNS($ns, $af, htmlspecialchars($b['artifact'][$af], ENT_XML1)));
+                    }
+                }
+                $buildEl->appendChild($art);
+            }
+            if (isset($b['dependencies'])) {
+                $deps = $dom->createElementNS($ns, 'dependencies');
+                foreach ($b['dependencies'] as $d) {
+                    $req = $dom->createElementNS($ns, 'requires', '');
+                    $req->setAttribute('name', $d['name']);
+                    if (isset($d['version'])) {
+                        $req->setAttribute('version', $d['version']);
+                    }
+                    if (isset($d['type'])) {
+                        $req->setAttribute('type', $d['type']);
+                    }
+                    $deps->appendChild($req);
+                }
+                $buildEl->appendChild($deps);
+            }
+            $root->appendChild($buildEl);
+        }
+
+        if (!empty($enrichment['deploy'])) {
+            $deploy = $dom->createElementNS($ns, 'deploy');
+            foreach ($enrichment['deploy'] as $t) {
+                $target = $dom->createElementNS($ns, 'target');
+                $target->setAttribute('name', $t['name']);
+                $target->appendChild($dom->createElementNS($ns, 'host', '${{ secrets.' . strtoupper($t['name']) . '_HOST }}'));
+                $target->appendChild($dom->createElementNS($ns, 'path', '${{ secrets.' . strtoupper($t['name']) . '_PATH }}'));
+                if (isset($t['method'])) {
+                    $target->appendChild($dom->createElementNS($ns, 'method', $t['method']));
+                }
+                if (isset($t['branch'])) {
+                    $target->appendChild($dom->createElementNS($ns, 'branch', htmlspecialchars($t['branch'], ENT_XML1)));
+                }
+                if (isset($t['src_dir'])) {
+                    $target->appendChild($dom->createElementNS($ns, 'src-dir', htmlspecialchars($t['src_dir'], ENT_XML1)));
+                }
+                $deploy->appendChild($target);
+            }
+            $root->appendChild($deploy);
+        }
+
+        if (!empty($enrichment['scripts'])) {
+            $scriptsEl = $dom->createElementNS($ns, 'scripts');
+            foreach ($enrichment['scripts'] as $s) {
+                $script = $dom->createElementNS($ns, 'script');
+                $script->setAttribute('name', $s['name']);
+                if (isset($s['phase'])) {
+                    $script->setAttribute('phase', $s['phase']);
+                }
+                $script->appendChild($dom->createElementNS($ns, 'command', htmlspecialchars($s['command'], ENT_XML1)));
+                if (isset($s['desc'])) {
+                    $script->appendChild($dom->createElementNS($ns, 'description', htmlspecialchars($s['desc'], ENT_XML1)));
+                }
+                if (isset($s['runner'])) {
+                    $script->appendChild($dom->createElementNS($ns, 'runner', htmlspecialchars($s['runner'], ENT_XML1)));
+                }
+                $scriptsEl->appendChild($script);
+            }
+            $root->appendChild($scriptsEl);
+        }
+
+        return $dom->saveXML();
+    }
+
+    /** @return array{int, string} */
+    private function safeExec(string $command, string $cwd = '.'): array
+    {
+        $proc = proc_open($command, [1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes, $cwd);
+        if (!is_resource($proc)) {
+            return [1, "proc_open failed"];
+        }
+        $stdout = stream_get_contents($pipes[1]);
+        $stderr = stream_get_contents($pipes[2]);
+        fclose($pipes[1]);
+        fclose($pipes[2]);
+        return [proc_close($proc), trim($stdout . "\n" . $stderr)];
+    }
+
+    private function rmTree(string $dir): void
+    {
+        if (!is_dir($dir)) {
+            return;
+        }
+        $it = new \RecursiveDirectoryIterator($dir, \FilesystemIterator::SKIP_DOTS);
+        $files = new \RecursiveIteratorIterator($it, \RecursiveIteratorIterator::CHILD_FIRST);
+        foreach ($files as $file) {
+            if ($file->isDir()) {
+                @rmdir($file->getPathname());
+            } else {
+                @chmod($file->getPathname(), 0777);
+                @unlink($file->getPathname());
+            }
+        }
+        @rmdir($dir);
+    }
+
+    /** @return array{int, string} */
+    private function gitCmd(string $workDir, string ...$args): array
+    {
+        $cmd = 'git';
+        foreach ($args as $a) {
+            $cmd .= ' ' . escapeshellarg($a);
+        }
+        return $this->safeExec($cmd, $workDir);
+    }
+
+    private function fetchRepos(string $url, string $org, string $token): array
+    {
+        $repos = [];
+        $page = 1;
+        do {
+            $ch = curl_init("{$url}/api/v1/orgs/{$org}/repos?page={$page}&limit=50");
+            curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => ["Authorization: token {$token}"], CURLOPT_TIMEOUT => 30]);
+            $body = curl_exec($ch);
+            $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+            curl_close($ch);
+            if ($code !== 200) {
+                break;
+            }
+            $batch = json_decode($body, true);
+            if (empty($batch)) {
+                break;
+            }
+            $repos = array_merge($repos, $batch);
+            $page++;
+        } while (count($batch) >= 50);
+        return $repos;
+    }
+}
+
+$app = new EnrichMokostandardsXmlCli();
+exit($app->execute());
@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "description": "Example configuration file for file-distributor.ps1 v02.00.00",
+  "SourceFile": "C:\\path\\to\\your\\source\\file.txt",
+  "RootDirectory": "C:\\path\\to\\root\\directory",
+  "Depth": 1,
+  "DryRun": true,
+  "Overwrite": false,
+  "ConfirmEach": false,
+  "IncludeHidden": true,
+  "LogDirectory": "C:\\path\\to\\logs"
+}
@@ -0,0 +1,32 @@
+<!--
+Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+SPDX-License-Identifier: GPL-3.0-or-later
+FILE INFORMATION
+DEFGROUP: MokoPlatform.Index
+INGROUP: MokoPlatform.Automation
+REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+PATH: /automation/index.md
+BRIEF: Automation directory index
+-->
+
+# Docs Index: /api/automation
+
+## Purpose
+
+This index provides navigation to documentation within this folder.
+
+## Documents
+
+- [README-file-distributor](./README-file-distributor.md)
+- [README](./README.md)
+
+## Metadata
+
+- **Document Type:** index
+- **Auto-generated:** This file is automatically generated by rebuild_indexes.py
+
+## Revision History
+
+| Date       | Author             | Change            | Notes                                      |
+| ---------- | ------------------ | ----------------- | ------------------------------------------ |
+| Auto       | rebuild_indexes.py | Automated update  | Generated by documentation index automation |
@@ -0,0 +1,300 @@
+#!/usr/bin/env php
+<?php
+
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * This file is part of a Moko Consulting project.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: MokoPlatform.Automation
+ * INGROUP: MokoPlatform
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+ * PATH: /automation/migrate_to_gitea.php
+ * BRIEF: Migrate repositories from GitHub to self-hosted Gitea instance
+ *
+ * USAGE
+ *   php automation/migrate_to_gitea.php --dry-run
+ *   php automation/migrate_to_gitea.php --repos MokoCRM MokoDoliMods
+ *   php automation/migrate_to_gitea.php --exclude mokocli --skip-archived
+ *   php automation/migrate_to_gitea.php --resume
+ */
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/../vendor/autoload.php';
+
+use MokoCli\CheckpointManager;
+use MokoCli\CliFramework;
+use MokoCli\Config;
+use MokoCli\PlatformAdapterFactory;
+use MokoCli\GitHubAdapter;
+use MokoCli\MokoGiteaAdapter;
+
+/**
+ * Gitea Migration Script
+ *
+ * Migrates repositories from GitHub to a self-hosted Gitea instance.
+ * Uses Gitea's built-in migration endpoint for git history, tags, releases,
+ * issues, and labels. Post-migration applies branch protection, topics,
+ * and workflow conversion.
+ */
+class MigrateToGitea extends CliFramework
+{
+    private ?GitHubAdapter $github = null;
+    private ?MokoGiteaAdapter $gitea  = null;
+    private ?CheckpointManager $checkpoints = null;
+
+    protected function configure(): void
+    {
+        $this->setDescription('Migrate repositories from GitHub to Gitea');
+        $this->addArgument('--dry-run', 'Show what would be migrated without making changes', false);
+        $this->addArgument('--repos', 'Specific repositories to migrate (space-separated)', '');
+        $this->addArgument('--exclude', 'Repositories to exclude (space-separated)', '');
+        $this->addArgument('--skip-archived', 'Skip archived repositories', false);
+        $this->addArgument('--resume', 'Resume from last checkpoint', false);
+        $this->addArgument('--github-token', 'GitHub token override', '');
+        $this->addArgument('--gitea-token', 'Gitea token override', '');
+    }
+
+    protected function run(): int
+    {
+        $dryRun       = (bool) $this->getArgument('--dry-run');
+        $specificRepos = array_filter(explode(' ', (string) $this->getArgument('--repos')));
+        $excludeRepos  = array_filter(explode(' ', (string) $this->getArgument('--exclude')));
+        $skipArchived  = (bool) $this->getArgument('--skip-archived');
+        $resume        = (bool) $this->getArgument('--resume');
+
+        $config = Config::load();
+
+        // Override tokens if provided
+        $ghToken = (string) $this->getArgument('--github-token');
+        $giteaToken = (string) $this->getArgument('--gitea-token');
+        if ($ghToken !== '') {
+            $config->set('github.token', $ghToken);
+        }
+        if ($giteaToken !== '') {
+            $config->set('gitea.token', $giteaToken);
+        }
+
+        // Create both adapters
+        try {
+            $adapters = PlatformAdapterFactory::createBoth($config);
+            $this->github = $adapters['github'];
+            $this->gitea  = $adapters['gitea'];
+        } catch (\RuntimeException $e) {
+            $this->log('ERROR', $e->getMessage());
+            return 1;
+        }
+
+        $this->checkpoints = new CheckpointManager('.checkpoints/migration');
+        $org = $config->getString('github.organization', 'MokoConsulting');
+        $giteaOrg = $config->getString('gitea.organization', 'MokoConsulting');
+
+        echo "=== Gitea Migration Tool ===\n";
+        echo "Source:      GitHub ({$org})\n";
+        echo "Destination: Gitea ({$giteaOrg}) at " . $config->getString('gitea.url') . "\n";
+        echo "Mode:        " . ($dryRun ? 'DRY RUN' : 'LIVE') . "\n\n";
+
+        // ── Phase 1: Discovery ──────────────────────────────────────────
+        $this->section('Phase 1: Discovery');
+
+        $ghRepos = $this->github->listOrgRepos($org, $skipArchived);
+        echo "Found " . count($ghRepos) . " repositories on GitHub\n";
+
+        // Filter repos
+        if (!empty($specificRepos)) {
+            $ghRepos = array_filter($ghRepos, fn($r) => in_array($r['name'], $specificRepos, true));
+        }
+        if (!empty($excludeRepos)) {
+            $ghRepos = array_filter($ghRepos, fn($r) => !in_array($r['name'], $excludeRepos, true));
+        }
+
+        // Check which already exist on Gitea
+        $giteaRepos = [];
+        try {
+            $existing = $this->gitea->listOrgRepos($giteaOrg);
+            foreach ($existing as $r) {
+                $giteaRepos[$r['name']] = true;
+            }
+        } catch (\Exception $e) {
+            echo "Note: Could not list Gitea repos (org may not exist yet): {$e->getMessage()}\n";
+        }
+
+        $toMigrate = [];
+        $toSkip    = [];
+        foreach ($ghRepos as $repo) {
+            $name = $repo['name'];
+            if (isset($giteaRepos[$name])) {
+                $toSkip[] = $name;
+            } else {
+                $toMigrate[] = $repo;
+            }
+        }
+
+        echo "\nMigration plan:\n";
+        echo "  Migrate: " . count($toMigrate) . " repositories\n";
+        echo "  Skip:    " . count($toSkip) . " (already on Gitea)\n";
+        if (!empty($toSkip)) {
+            echo "  Skipped: " . implode(', ', $toSkip) . "\n";
+        }
+        echo "\n";
+
+        if (empty($toMigrate)) {
+            echo "Nothing to migrate.\n";
+            return 0;
+        }
+
+        if ($dryRun) {
+            echo "Repositories to migrate:\n";
+            foreach ($toMigrate as $repo) {
+                $vis = $repo['private'] ? 'private' : 'public';
+                echo "  - {$repo['name']} ({$vis})\n";
+            }
+            echo "\nDry run complete. Use without --dry-run to execute.\n";
+            return 0;
+        }
+
+        // ── Phase 2: Migrate ────────────────────────────────────────────
+        $this->section('Phase 2: Migration');
+
+        $ghToken = $config->getString('github.token');
+        $results = ['migrated' => [], 'failed' => [], 'skipped' => $toSkip];
+
+        // Resume support
+        $checkpoint = $resume ? $this->checkpoints->loadCheckpoint('gitea_migration') : null;
+        $startFrom = $checkpoint['last_completed'] ?? '';
+        $skipUntil = !empty($startFrom);
+
+        foreach ($toMigrate as $index => $repo) {
+            $name = $repo['name'];
+
+            if ($skipUntil) {
+                if ($name === $startFrom) {
+                    $skipUntil = false;
+                }
+                echo "  Skipping {$name} (already migrated)\n";
+                continue;
+            }
+
+            echo "\n  [{$index}/{" . count($toMigrate) . "}] Migrating {$name}...\n";
+
+            try {
+                // Shallow migration — copy current branch state only, no past
+                // commit history. This gives every repo a clean start on Gitea.
+                $this->gitea->migrateRepository([
+                    'clone_addr'  => "https://github.com/{$org}/{$name}.git",
+                    'repo_name'   => $name,
+                    'repo_owner'  => $giteaOrg,
+                    'service'     => 'github',
+                    'auth_token'  => $ghToken,
+                    'mirror'      => false,
+                    'private'     => $repo['private'],
+                    'issues'      => false,
+                    'labels'      => true,
+                    'milestones'  => false,
+                    'releases'    => false,
+                    'pull_requests' => false,
+                    'wiki'        => false,
+                ]);
+
+                echo "    Migrated successfully\n";
+                $results['migrated'][] = $name;
+
+                // Save checkpoint after each successful migration
+                $this->checkpoints->saveCheckpoint('gitea_migration', [
+                    'last_completed' => $name,
+                    'migrated'       => $results['migrated'],
+                    'failed'         => $results['failed'],
+                ]);
+            } catch (\Exception $e) {
+                echo "    FAILED: " . $e->getMessage() . "\n";
+                $results['failed'][] = ['name' => $name, 'error' => $e->getMessage()];
+                $this->gitea->getApiClient()->resetCircuitBreaker();
+            }
+        }
+
+        // ── Phase 3: Post-migration ─────────────────────────────────────
+        $this->section('Phase 3: Post-migration');
+
+        foreach ($results['migrated'] as $name) {
+            echo "  Post-processing {$name}...\n";
+
+            try {
+                // Apply topics from GitHub
+                $ghTopics = $this->github->getRepoTopics($org, $name);
+                if (!empty($ghTopics)) {
+                    $this->gitea->setRepoTopics($giteaOrg, $name, $ghTopics);
+                    echo "    Topics applied\n";
+                }
+
+                // Apply branch protection
+                $this->gitea->setBranchProtection($giteaOrg, $name, 'main', [
+                    'required_reviews' => 1,
+                    'dismiss_stale'    => true,
+                    'block_on_rejected' => true,
+                ]);
+                echo "    Branch protection applied\n";
+            } catch (\Exception $e) {
+                echo "    Warning: post-processing issue: " . $e->getMessage() . "\n";
+                $this->gitea->getApiClient()->resetCircuitBreaker();
+            }
+        }
+
+        // ── Phase 4: Verification ───────────────────────────────────────
+        $this->section('Phase 4: Verification');
+
+        $report = "## Migration Report\n\n";
+        $report .= "**Date:** " . gmdate('Y-m-d H:i:s') . " UTC\n";
+        $report .= "**Source:** GitHub ({$org})\n";
+        $report .= "**Destination:** Gitea ({$giteaOrg})\n\n";
+
+        $report .= "### Results\n\n";
+        $report .= "| Status | Count |\n|--------|-------|\n";
+        $report .= "| Migrated | " . count($results['migrated']) . " |\n";
+        $report .= "| Failed | " . count($results['failed']) . " |\n";
+        $report .= "| Skipped (existing) | " . count($results['skipped']) . " |\n\n";
+
+        if (!empty($results['migrated'])) {
+            $report .= "### Migrated Repositories\n\n";
+            foreach ($results['migrated'] as $name) {
+                $report .= "- {$name}\n";
+            }
+            $report .= "\n";
+        }
+
+        if (!empty($results['failed'])) {
+            $report .= "### Failed Repositories\n\n";
+            foreach ($results['failed'] as $fail) {
+                $report .= "- **{$fail['name']}**: {$fail['error']}\n";
+            }
+            $report .= "\n";
+        }
+
+        echo $report;
+
+        // Create summary issue on Gitea
+        try {
+            $this->gitea->createIssue(
+                $giteaOrg,
+                'mokocli',
+                'chore: GitHub → Gitea migration report — ' . count($results['migrated']) . ' repos migrated',
+                $report,
+                ['labels' => ['automation', 'type: chore']]
+            );
+            echo "Migration report issue created on Gitea.\n";
+        } catch (\Exception $e) {
+            echo "Could not create report issue: " . $e->getMessage() . "\n";
+        }
+
+        echo "\nMigration complete: " . count($results['migrated']) . " migrated, "
+            . count($results['failed']) . " failed, "
+            . count($results['skipped']) . " skipped\n";
+
+        return count($results['failed']) > 0 ? 1 : 0;
+    }
+}
+
+$script = new MigrateToGitea('migrate_to_gitea', 'Migrate repositories from GitHub to Gitea');
+exit($script->execute());
@@ -0,0 +1,683 @@
+#!/usr/bin/env php
+<?php
+
+/**
+ * Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * This file is part of a Moko Consulting project.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: MokoPlatform.Automation
+ * INGROUP: MokoPlatform.Scripts
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+ * PATH: /automation/push_files.php
+ * BRIEF: Push one or more specific files to one or more remote repositories
+ */
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/../vendor/autoload.php';
+require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
+
+use MokoCli\{
+    ApiClient,
+    AuditLogger,
+    CliFramework,
+    Config,
+    GitPlatformAdapter,
+    MetricsCollector,
+    PlatformAdapterFactory,
+    ProjectTypeDetector
+};
+
+/**
+ * Targeted File Push Tool
+ *
+ * Pushes one or more specific files from mokocli templates to one or
+ * more remote repositories — without running a full sync.
+ *
+ * Files are specified by their destination path as they appear in the target
+ * repository (e.g., ".github/ISSUE_TEMPLATE/config.yml").  The tool looks up
+ * the matching source template from the appropriate platform definition.
+ *
+ * Files may also be given as "source:destination" pairs to bypass definition
+ * lookup and push any arbitrary local file.
+ *
+ * Usage:
+ *   php push_files.php --files=.github/ISSUE_TEMPLATE/config.yml --repos=MokoCRM
+ *   php push_files.php --files=".github/workflows/ci.yml,.github/workflows/codeql-analysis.yml" --repos=MokoCRM,WaasComponent
+ *   php push_files.php --files=templates/foo.txt:docs/foo.txt --repos=MyRepo --direct
+ */
+class PushFiles extends CliFramework
+{
+    public const DEFAULT_ORG = 'MokoConsulting';
+    public const VERSION = '09.23.00';
+
+    private ApiClient $api;
+    private GitPlatformAdapter $adapter;
+    private AuditLogger $logger;
+    private ProjectTypeDetector $typeDetector;
+
+    /**
+     * Setup command-line arguments
+     */
+    protected function configure(): void
+    {
+        $this->setDescription('Push files to remote repositories');
+        $this->addArgument('--org', 'GitHub organization', self::DEFAULT_ORG);
+        $this->addArgument('--repos', 'Target repos (comma-separated)', '');
+        $this->addArgument('--files', 'Files to push (comma-separated)', '');
+        $this->addArgument('--message', 'Custom commit message', '');
+        $this->addArgument('--branch', 'Target branch for direct pushes', '');
+        $this->addArgument('--direct', 'Push directly instead of PR', false);
+        $this->addArgument('--yes', 'Auto-confirm without prompting', false);
+        $this->addArgument('--no-issue', 'Skip creating tracking issue', false);
+    }
+
+    /**
+     * Main execution
+     */
+    protected function run(): int
+    {
+        $this->log('📦 mokocli File Push v' . self::VERSION, 'INFO');
+
+        if (!$this->initializeComponents()) {
+            return 1;
+        }
+
+        $org       = $this->getArgument('--org', self::DEFAULT_ORG);
+        $reposArg  = $this->getArgument('--repos', '');
+        $filesArg  = $this->getArgument('--files', '');
+        $direct    = $this->getArgument('--direct', false);
+        $autoYes   = $this->getArgument('--yes', false);
+
+        // Validate required arguments
+        if (empty($reposArg)) {
+            $this->log('❌ --repos is required. Specify one or more repository names.', 'ERROR');
+            $this->log('   Example: --repos=MokoCRM,WaasComponent', 'ERROR');
+            return 1;
+        }
+
+        if (empty($filesArg)) {
+            $this->log('❌ --files is required. Specify destination paths or source:destination pairs.', 'ERROR');
+            $this->log('   Example: --files=.github/ISSUE_TEMPLATE/config.yml', 'ERROR');
+            return 1;
+        }
+
+        $repos = $this->parseList($reposArg);
+        $files = $this->parseList($filesArg);
+
+        $this->log("Organisation: {$org}", 'INFO');
+        $this->log('Repositories: ' . implode(', ', $repos), 'INFO');
+        $this->log('Files:        ' . implode(', ', $files), 'INFO');
+        $this->log('Mode:         ' . ($direct ? 'direct commit' : 'pull request'), 'INFO');
+
+        // Resolve file mappings for each repo
+        $this->log("\n🔍 Resolving file mappings...", 'INFO');
+        $repoFileMaps = $this->buildRepoFileMaps($org, $repos, $files);
+
+        if (empty($repoFileMaps)) {
+            $this->log('❌ No files could be resolved. Check file paths and platform definitions.', 'ERROR');
+            return 1;
+        }
+
+        // Confirm before proceeding
+        if (!$autoYes && !$this->confirmPush($repoFileMaps, $direct)) {
+            $this->log('❌ Cancelled.', 'INFO');
+            return 0;
+        }
+
+        // Execute pushes
+        $results = $this->executePushes($org, $repoFileMaps, $direct);
+
+        $this->displayResults($results);
+
+        if ($results['failed'] > 0 && !isset($this->options['no-issue']) && !$this->dryRun) {
+            $this->createFailureIssue($org, $results);
+        }
+
+        return $results['failed'] > 0 ? 1 : 0;
+    }
+
+    /**
+     * Initialize enterprise components
+     */
+    private function initializeComponents(): bool
+    {
+        $config = Config::load();
+
+        try {
+            $this->adapter      = PlatformAdapterFactory::create($config);
+            $this->api          = $this->adapter->getApiClient();
+            $this->logger       = new AuditLogger('push_files');
+            $this->typeDetector = new ProjectTypeDetector($this->logger);
+
+            $platform = $this->adapter->getPlatformName();
+            $this->log("✓ Components initialized for platform: {$platform}", 'INFO');
+            return true;
+        } catch (\Exception $e) {
+            $this->log('❌ Failed to initialize: ' . $e->getMessage(), 'ERROR');
+            return false;
+        }
+    }
+
+    /**
+     * Parse a comma- or space-separated list into a clean array
+     */
+    private function parseList(string $input): array
+    {
+        return array_values(array_filter(
+            array_map('trim', preg_split('/[\s,]+/', $input)),
+            fn($v) => $v !== ''
+        ));
+    }
+
+    /**
+     * Build per-repo file maps: repo → [ [source, destination], … ]
+     *
+     * Each entry in $files is either:
+     *   - "destination/path"            → looked up in the platform definition
+     *   - "source/path:destination/path" → used as-is (raw mode)
+     *
+     * @param  string[] $repos
+     * @param  string[] $files
+     * @return array<string, list<array{source: string, destination: string}>>
+     */
+    private function buildRepoFileMaps(string $org, array $repos, array $files): array
+    {
+        $repoRoot = dirname(__DIR__, 2);
+        $maps     = [];
+
+        foreach ($repos as $repo) {
+            // Detect the repo's platform so we load the right definition
+            $platform = $this->detectRepoPlatform($org, $repo);
+            $this->log("  {$repo}: platform = {$platform}", 'INFO');
+
+            $resolved = [];
+            foreach ($files as $fileSpec) {
+                if (str_contains($fileSpec, ':')) {
+                    // Raw source:destination pair
+                    [$src, $dest] = explode(':', $fileSpec, 2);
+                } else {
+                    // Same path as source and destination
+                    $src  = $fileSpec;
+                    $dest = $fileSpec;
+                }
+                $dest = ltrim($dest, '/');
+                $srcAbs = rtrim($repoRoot, '/') . '/' . ltrim($src, '/');
+                if (!file_exists($srcAbs)) {
+                    $this->log("  ⚠️  Source not found for {$repo}: {$src}", 'WARN');
+                    continue;
+                }
+                $resolved[] = ['source' => $srcAbs, 'destination' => $dest];
+                $this->log("    ✓ {$dest}", 'INFO');
+            }
+
+            if (!empty($resolved)) {
+                $maps[$repo] = $resolved;
+            }
+        }
+
+        return $maps;
+    }
+
+    /**
+     * Detect platform for a repo via manifest or live detection.
+     */
+    private function detectRepoPlatform(string $org, string $repo): string
+    {
+        // Read platform from repo's .mokogitea/manifest.xml via API
+        try {
+            $fileInfo = $this->adapter->getFileContents($org, $repo, '.mokogitea/manifest.xml', 'main');
+            $manifestData = isset($fileInfo['content']) ? base64_decode($fileInfo['content']) : '';
+            if (!empty($manifestData)) {
+                $xml = @simplexml_load_string($manifestData);
+                if ($xml !== false) {
+                    $platform = (string)($xml->governance->platform ?? '');
+                    if (!empty($platform)) {
+                        return $platform;
+                    }
+                }
+            }
+        } catch (\Exception $e) {
+            // Fall through to local detection
+        }
+
+        // Fall back to live detection
+        try {
+            $result = $this->typeDetector->detect('.');
+            return $result['type'] ?? 'default';
+        } catch (\Exception $e) {
+            $this->log("  ⚠️  Could not detect platform for {$repo}, using 'default'", 'WARN');
+            return 'default';
+        }
+    }
+
+    /**
+     * Prompt for confirmation before pushing
+     *
+     * @param array<string, list<array{source: string, destination: string}>> $repoFileMaps
+     */
+    private function confirmPush(array $repoFileMaps, bool $direct): bool
+    {
+        if ($this->quiet) {
+            return true;
+        }
+
+        $totalFiles = array_sum(array_map('count', $repoFileMaps));
+        $totalRepos = count($repoFileMaps);
+        $mode       = $direct ? 'direct commit' : 'PR';
+
+        echo "\n";
+        foreach ($repoFileMaps as $repo => $entries) {
+            echo "  {$repo}:\n";
+            foreach ($entries as $entry) {
+                echo "    → {$entry['destination']}\n";
+            }
+        }
+        echo "\n";
+        echo "⚠️  About to push {$totalFiles} file(s) to {$totalRepos} repo(s) via {$mode}.\n";
+        echo "Continue? [y/N]: ";
+
+        $handle = fopen('php://stdin', 'r');
+        $line   = fgets($handle);
+        if ($handle) {
+            fclose($handle);
+        }
+
+        return is_string($line) && strtolower(trim($line)) === 'y';
+    }
+
+    /**
+     * Execute all file pushes
+     *
+     * @param  array<string, list<array{source: string, destination: string}>> $repoFileMaps
+     * @return array{total: int, success: int, failed: int, repos: array<string, string>}
+     */
+    private function executePushes(string $org, array $repoFileMaps, bool $direct): array
+    {
+        $results = [
+            'total'   => count($repoFileMaps),
+            'success' => 0,
+            'failed'  => 0,
+            'repos'   => [],
+        ];
+
+        $customMessage = $this->getArgument('--message', '');
+        $targetBranch  = $this->getArgument('--branch', '');
+
+        foreach ($repoFileMaps as $repo => $entries) {
+            $this->log("\n[{$repo}] Pushing " . count($entries) . ' file(s)...', 'INFO');
+
+            try {
+                // Resolve the default branch
+                $repoData      = $this->adapter->getRepo($org, $repo);
+                $defaultBranch = $repoData['default_branch'] ?? 'main';
+                $branch        = $direct
+                    ? ($targetBranch ?: $defaultBranch)
+                    : $this->createSyncBranch($org, $repo, $defaultBranch);
+
+                $pushed = 0;
+                foreach ($entries as $entry) {
+                    if ($this->pushSingleFile($org, $repo, $entry['source'], $entry['destination'], $branch, $customMessage)) {
+                        $pushed++;
+                        $this->log("  ✓ {$entry['destination']}", 'INFO');
+                    } else {
+                        $this->log("  ✗ {$entry['destination']}", 'ERROR');
+                    }
+                }
+
+                if ($pushed === 0) {
+                    $results['failed']++;
+                    $results['repos'][$repo] = 'failed';
+                    continue;
+                }
+
+                $prNumber = null;
+                if (!$direct) {
+                    $prTitle  = "chore: push " . count($entries) . " file(s) from mokocli";
+                    $prBody   = $this->buildPRBody($entries);
+                    $pr       = $this->adapter->createPullRequest(
+                        $org,
+                        $repo,
+                        $prTitle,
+                        $branch,
+                        $defaultBranch,
+                        $prBody,
+                        ['assignees' => ['jmiller']]
+                    );
+                    $prNumber = $pr['number'] ?? null;
+                    $this->log("  📋 PR #{$prNumber} created", 'INFO');
+                    $results['repos'][$repo] = "pr#{$prNumber}";
+                } else {
+                    $results['repos'][$repo] = 'pushed';
+                }
+
+                if (!isset($this->options['no-issue']) && !$this->dryRun) {
+                    $this->createTargetRepoIssue($org, $repo, $entries, $prNumber, $direct ? $branch : null);
+                }
+
+                $results['success']++;
+            } catch (\Exception $e) {
+                $this->log("  ✗ {$repo}: " . $e->getMessage(), 'ERROR');
+                $results['failed']++;
+                $results['repos'][$repo] = 'failed';
+            }
+        }
+
+        return $results;
+    }
+
+    /**
+     * Create a uniquely-named sync branch off the default branch
+     */
+    private function createSyncBranch(string $org, string $repo, string $base): string
+    {
+        $branchName = 'moko/push-files-' . date('Ymd-His');
+
+        // Resolve the base branch to a commit SHA using the adapter
+        $sha = $this->adapter->resolveRef($org, $repo, $base);
+
+        if (empty($sha)) {
+            throw new \RuntimeException("Cannot resolve SHA for branch {$base} in {$repo}");
+        }
+
+        $this->api->post("/repos/{$org}/{$repo}/git/refs", [
+            'ref' => "refs/heads/{$branchName}",
+            'sha' => $sha,
+        ]);
+
+        $this->log("  🌿 Branch created: {$branchName}", 'INFO');
+        return $branchName;
+    }
+
+    /**
+     * Push a single file to a repository branch via the Contents API
+     *
+     * @return bool True on success
+     */
+    private function pushSingleFile(
+        string $org,
+        string $repo,
+        string $sourcePath,
+        string $destPath,
+        string $branch,
+        string $customMessage
+    ): bool {
+        $content = file_get_contents($sourcePath);
+        if ($content === false) {
+            $this->log("  ⚠️  Cannot read source: {$sourcePath}", 'WARN');
+            return false;
+        }
+
+        $message = !empty($customMessage)
+            ? $customMessage
+            : "chore: update {$destPath} from mokocli";
+
+        // Fetch existing file SHA (needed for updates)
+        $existingSha = null;
+        try {
+            $existing    = $this->adapter->getFileContents($org, $repo, $destPath, $branch);
+            $existingSha = $existing['sha'] ?? null;
+        } catch (\Exception $e) {
+            // File does not exist — create it (no sha needed)
+            $this->adapter->getApiClient()->resetCircuitBreaker();
+        }
+
+        try {
+            $this->adapter->createOrUpdateFile(
+                $org,
+                $repo,
+                $destPath,
+                $content,
+                $message,
+                $existingSha,
+                $branch
+            );
+            return true;
+        } catch (\Exception $e) {
+            $this->log("  ✗ API error pushing {$destPath}: " . $e->getMessage(), 'ERROR');
+            return false;
+        }
+    }
+
+    /**
+     * Create a tracking issue in the target repository after a successful push.
+     *
+     * @param list<array{source: string, destination: string}> $entries
+     */
+    private function createTargetRepoIssue(
+        string $org,
+        string $repo,
+        array $entries,
+        ?int $prNumber,
+        ?string $directBranch
+    ): void {
+        $now     = gmdate('Y-m-d H:i:s') . ' UTC';
+        $version = self::VERSION;
+        $source  = $this->adapter->getRepoWebUrl($org, 'mokocli');
+
+        $title = "chore: mokocli file push tracking";
+
+        $deliveryLine = $prNumber !== null
+            ? "| **Pull request** | [#{$prNumber}](" . $this->adapter->getPullRequestWebUrl($org, $repo, $prNumber) . ") |"
+            : "| **Delivery** | Direct commit to `{$directBranch}` |";
+
+        $fileRows = implode("\n", array_map(
+            fn($e) => "- `{$e['destination']}`",
+            $entries
+        ));
+
+        $body = <<<MD
+        ## mokocli File Push
+
+        One or more files were pushed to this repository from mokocli.
+
+        | Field | Value |
+        |-------|-------|
+        | **Pushed** | {$now} |
+        | **Standards version** | `{$version}` |
+        {$deliveryLine}
+        | **Source** | [{$source}]({$source}) |
+
+        ### Files pushed
+
+        {$fileRows}
+
+        ---
+        *Generated automatically by [mokocli]({$source}) `push_files.php`*
+        MD;
+
+        $body = preg_replace('/^        /m', '', $body);
+
+        $labels = ['standards-update', 'mokocli', 'type: chore', 'automation'];
+
+        try {
+            $existing = $this->api->get("/repos/{$org}/{$repo}/issues", [
+                'labels'    => 'standards-update',
+                'state'     => 'all',
+                'per_page'  => 1,
+                'sort'      => 'created',
+                'direction' => 'desc',
+            ]);
+
+            $existing = array_values($existing);
+            if (!empty($existing) && isset($existing[0]['number'])) {
+                $num   = $existing[0]['number'];
+                $patch = ['title' => $title, 'body' => $body, 'assignees' => ['jmiller']];
+                if (($existing[0]['state'] ?? 'open') === 'closed') {
+                    $patch['state'] = 'open';
+                }
+                $this->api->patch("/repos/{$org}/{$repo}/issues/{$num}", $patch);
+                try {
+                    $this->api->post("/repos/{$org}/{$repo}/issues/{$num}/labels", ['labels' => $labels]);
+                } catch (\Exception $le) {
+/* non-fatal */
+                }
+                $this->log("  📋 Tracking issue #{$num} updated in {$repo}", 'INFO');
+            } else {
+                $issue = $this->api->post("/repos/{$org}/{$repo}/issues", [
+                    'title'     => $title,
+                    'body'      => $body,
+                    'labels'    => $labels,
+                    'assignees' => ['jmiller'],
+                ]);
+                $num = $issue['number'] ?? null;
+                $this->log("  📋 Tracking issue #{$num} created in {$repo}", 'INFO');
+            }
+
+            // Cross-link: patch the sync PR body to reference the tracking issue
+            // so GitHub shows it in the PR's Development sidebar.
+            if ($prNumber !== null && is_int($num)) {
+                try {
+                    $pr          = $this->api->get("/repos/{$org}/{$repo}/pulls/{$prNumber}");
+                    $currentBody = $pr['body'] ?? '';
+                    $ref         = "Linked to #{$num}";
+                    if (!str_contains($currentBody, $ref)) {
+                        $this->api->patch("/repos/{$org}/{$repo}/pulls/{$prNumber}", [
+                            'body' => $ref . "\n\n" . $currentBody,
+                        ]);
+                    }
+                } catch (\Exception $le) {
+/* non-fatal */
+                }
+            }
+        } catch (\Exception $e) {
+            $this->log("  ⚠️  Could not create/update tracking issue in {$repo}: " . $e->getMessage(), 'WARN');
+        }
+    }
+
+    /**
+     * Create or update a failure issue in mokocli when repos fail to receive files.
+     * Uses the 'push-failure' label. Reopens a closed issue rather than creating a duplicate.
+     */
+    private function createFailureIssue(string $org, array $results): void
+    {
+        $now     = gmdate('Y-m-d H:i:s') . ' UTC';
+        $failed  = $results['failed'];
+        $version = self::VERSION;
+
+        $failedRepos = array_keys(array_filter(
+            $results['repos'] ?? [],
+            fn($s) => $s === 'failed'
+        ));
+
+        $repoList = implode("\n", array_map(fn($r) => "- `{$r}`", $failedRepos));
+        $fileArgs = $this->getArgument('--files', '');
+
+        $title = "fix: push_files failed for {$failed} repo(s) — action required";
+
+        $body = <<<MD
+        ## File Push Failure
+
+        `push_files.php` v{$version} encountered failures pushing files on {$now}.
+
+        ### Failed repositories
+
+        {$repoList}
+
+        ### Files that were being pushed
+
+        ```
+        {$fileArgs}
+        ```
+
+        ### Next steps
+
+        1. Check the output above for the specific error per repo.
+        2. Fix the underlying issue (API token, branch permissions, file path, etc.).
+        3. Re-run: `php automation/push_files.php --org={$org} --repos=<repo> --files=<files> --yes`
+        4. Close this issue once resolved.
+
+        ---
+        *Auto-created by `push_files.php` — close once resolved.*
+        MD;
+
+        $body = preg_replace('/^        /m', '', $body);
+
+        try {
+            $existing = $this->api->get("/repos/{$org}/mokocli/issues", [
+                'labels'    => 'push-failure',
+                'state'     => 'all',
+                'per_page'  => 1,
+                'sort'      => 'created',
+                'direction' => 'desc',
+            ]);
+
+            $existing = array_values($existing);
+            if (!empty($existing) && isset($existing[0]['number'])) {
+                $num   = $existing[0]['number'];
+                $patch = ['title' => $title, 'body' => $body, 'assignees' => ['jmiller']];
+                if (($existing[0]['state'] ?? 'open') === 'closed') {
+                    $patch['state'] = 'open';
+                }
+                $this->api->patch("/repos/{$org}/mokocli/issues/{$num}", $patch);
+                $this->log("🚨 Failure issue #{$num} updated: {$org}/mokocli#{$num}", 'WARN');
+            } else {
+                $issue = $this->api->post("/repos/{$org}/mokocli/issues", [
+                    'title'     => $title,
+                    'body'      => $body,
+                    'labels'    => ['push-failure'],
+                    'assignees' => ['jmiller'],
+                ]);
+                $num = $issue['number'] ?? '?';
+                $this->log("🚨 Failure issue created: {$org}/mokocli#{$num}", 'WARN');
+            }
+        } catch (\Exception $e) {
+            $this->log("⚠️  Could not create/update failure issue: " . $e->getMessage(), 'WARN');
+        }
+    }
+
+    /**
+     * Build a markdown PR body listing every pushed file
+     *
+     * @param list<array{source: string, destination: string}> $entries
+     */
+    private function buildPRBody(array $entries): string
+    {
+        $now   = gmdate('Y-m-d H:i:s') . ' UTC';
+        $lines = ["## mokocli File Push\n", "**Pushed:** {$now}\n", '### Files\n'];
+
+        foreach ($entries as $entry) {
+            $lines[] = "- `{$entry['destination']}`";
+        }
+
+        $sourceUrl = $this->adapter->getRepoWebUrl(self::DEFAULT_ORG, 'mokocli');
+        $lines[] = "\n---\n*Generated by [mokocli]({$sourceUrl}) `push_files.php`*";
+
+        return implode("\n", $lines);
+    }
+
+    /**
+     * Display final results
+     *
+     * @param array{total: int, success: int, failed: int, repos: array<string, string>} $results
+     */
+    private function displayResults(array $results): void
+    {
+        $this->log("\n" . str_repeat('=', 60), 'INFO');
+        $this->log('📊 Push Complete', 'INFO');
+        $this->log(str_repeat('=', 60), 'INFO');
+        $this->log(sprintf('Total:   %d repos', $results['total']), 'INFO');
+        $this->log(sprintf('Success: %d', $results['success']), 'INFO');
+        $this->log(sprintf('Failed:  %d', $results['failed']), 'INFO');
+
+        if ($this->verbose) {
+            $this->log("\n📋 Details:", 'INFO');
+            foreach ($results['repos'] as $repo => $outcome) {
+                $icon = str_starts_with($outcome, 'pr#') || $outcome === 'pushed' ? '✓' : '✗';
+                $this->log("  {$icon} {$repo}: {$outcome}", 'INFO');
+            }
+        }
+
+        $this->log(str_repeat('=', 60), 'INFO');
+    }
+}
+
+// Execute if run directly
+if (php_sapi_name() === 'cli' && isset($argv[0]) && realpath($argv[0]) === __FILE__) {
+    $app = new PushFiles();
+    exit($app->execute());
+}
@@ -0,0 +1,345 @@
+#!/usr/bin/env php
+<?php
+
+/**
+ * Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: MokoPlatform.Automation
+ * INGROUP: MokoPlatform
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+ * PATH: /automation/push_manifest_xml.php
+ * BRIEF: Push XML manifests to all governed repositories
+ */
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/../vendor/autoload.php';
+require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
+
+use MokoCli\CliFramework;
+use MokoCli\ManifestParser;
+
+class PushManifestXmlCli extends CliFramework
+{
+    private const CRM_PLATFORM_REPOS = ['MokoDolibarr', 'MokoDoliMods'];
+
+    protected function configure(): void
+    {
+        $this->setDescription('Push XML manifest.xml to all governed repositories');
+        $this->addArgument('--repo', 'Filter to a single repo name', '');
+        $this->addArgument('--skip', 'Comma-separated list of repos to skip', '');
+        $this->addArgument('--force', 'Force overwrite even if already XML', false);
+    }
+
+    protected function run(): int
+    {
+        $giteaUrl  = rtrim(getenv('GITEA_URL') ?: 'https://git.mokoconsulting.tech', '/');
+        $giteaOrg  = getenv('GITEA_ORG') ?: 'MokoConsulting';
+        $token     = getenv('GA_TOKEN') ?: getenv('GH_TOKEN') ?: '';
+
+        $force      = $this->getArgument('--force');
+        $repoFilter = $this->getArgument('--repo') ?: null;
+        $skipStr    = $this->getArgument('--skip');
+        $skipRepos  = $skipStr !== '' ? array_map('trim', explode(',', $skipStr)) : [];
+
+        $parser = new ManifestParser();
+        $tmpBase = sys_get_temp_dir() . '/moko-manifest-push-' . getmypid();
+
+        echo "=== mokocli XML Manifest Push ===\n";
+        echo "Org: {$giteaOrg}\n";
+        echo "Mode: " . ($this->dryRun ? "DRY RUN" : "LIVE") . "\n";
+        if ($repoFilter) {
+            echo "Filter: {$repoFilter}\n";
+        }
+        echo "\n";
+
+        if (empty($token)) {
+            $this->log('ERROR', 'GA_TOKEN or GH_TOKEN environment variable required');
+            return 1;
+        }
+
+        $repos = $this->fetchRepos($giteaUrl, $giteaOrg, $token);
+        echo "Found " . count($repos) . " repositories\n\n";
+
+        $stats = ['created' => 0, 'updated' => 0, 'skipped' => 0, 'failed' => 0];
+
+        foreach ($repos as $repo) {
+            $name = $repo['name'];
+            if ($repoFilter && $name !== $repoFilter) {
+                continue;
+            }
+            if (in_array($name, $skipRepos, true)) {
+                echo "  SKIP {$name} (excluded)\n";
+                $stats['skipped']++;
+                continue;
+            }
+            if ($repo['archived'] ?? false) {
+                echo "  SKIP {$name} (archived)\n";
+                $stats['skipped']++;
+                continue;
+            }
+
+            $platform      = $this->detectPlatform($repo);
+            $defaultBranch = $repo['default_branch'] ?? 'main';
+            $httpsUrl = $repo['clone_url'] ?? "{$giteaUrl}/{$giteaOrg}/{$name}.git";
+            $authedUrl = preg_replace('#^https://#', "https://gitea-actions:{$token}@", $httpsUrl);
+
+            echo "  {$name} [{$platform}] ... ";
+
+            // Generate XML manifest
+            $xmlContent = $parser->generate([
+                'name'              => $name,
+                'org'               => $giteaOrg,
+                'platform'          => $platform,
+                'standards_version' => '04.07.00',
+                'description'       => $repo['description'] ?? '',
+                'license'           => 'GPL-3.0-or-later',
+                'topics'            => $repo['topics'] ?? [],
+                'language'          => $repo['language'] ?? ManifestParser::platformLanguage($platform),
+                'package_type'      => ManifestParser::platformPackageType($platform),
+                'last_synced'       => date('c'),
+            ]);
+
+            if ($this->dryRun) {
+                echo "WOULD WRITE ({$platform})\n";
+                $stats['created']++;
+                continue;
+            }
+
+            // Clone shallow via HTTPS (token-authed)
+            $workDir = "{$tmpBase}/{$name}";
+            @mkdir($workDir, 0755, true);
+
+            [$ret, $out] = $this->safeExec(
+                'git clone --depth 1 --branch ' . escapeshellarg($defaultBranch) . ' '
+                . escapeshellarg($authedUrl) . ' ' . escapeshellarg($workDir)
+            );
+            if ($ret !== 0) {
+                echo "FAIL (clone)\n";
+                fprintf(STDERR, "    %s\n", $out);
+                $stats['failed']++;
+                continue;
+            }
+
+            // Check if already XML and up-to-date
+            $manifestPath = "{$workDir}/.mokogitea/manifest.xml";
+            $existingIsXml = file_exists($manifestPath) && str_contains(file_get_contents($manifestPath), '<mokocli');
+            if ($existingIsXml && !$force) {
+                $existingPlatform = $parser->extractPlatform(file_get_contents($manifestPath));
+                if ($existingPlatform === $platform) {
+                    echo "SKIP (already XML)\n";
+                    $stats['skipped']++;
+                    $this->rmTree($workDir);
+                    continue;
+                }
+            }
+
+            // Write manifest
+            @mkdir("{$workDir}/.gitea", 0755, true);
+            file_put_contents($manifestPath, $xmlContent);
+
+            // Delete legacy files if present
+            $legacyDeleted = [];
+            foreach (['.mokostandards', '.github/.mokostandards', '.gitea/.mokostandards', '.mokogitea/.mokostandards'] as $legacy) {
+                $legacyPath = "{$workDir}/{$legacy}";
+                if (file_exists($legacyPath)) {
+                    unlink($legacyPath);
+                    $legacyDeleted[] = $legacy;
+                }
+            }
+
+            // Commit
+            $isNew = !$existingIsXml;
+            $commitMsg = $isNew
+                ? 'chore: add XML manifest.xml'
+                : 'chore: update manifest.xml';
+            if (!empty($legacyDeleted)) {
+                $commitMsg .= "\n\nRemoved legacy: " . implode(', ', $legacyDeleted);
+            }
+
+            $this->gitCmd($workDir, 'config', 'user.name', 'gitea-actions[bot]');
+            $this->gitCmd($workDir, 'config', 'user.email', 'gitea-actions[bot]@git.mokoconsulting.tech');
+            $this->gitCmd($workDir, 'add', '.mokogitea/manifest.xml');
+            foreach ($legacyDeleted as $lf) {
+                $this->gitCmd($workDir, 'add', $lf);
+            }
+
+            [$commitRet, $commitOut] = $this->gitCmd($workDir, 'commit', '-m', $commitMsg);
+            if ($commitRet !== 0 && str_contains($commitOut, 'nothing to commit')) {
+                echo "SKIP (no changes)\n";
+                $stats['skipped']++;
+                $this->rmTree($workDir);
+                continue;
+            }
+            if ($commitRet !== 0) {
+                echo "FAIL (commit)\n";
+                fprintf(STDERR, "    %s\n", $commitOut);
+                $stats['failed']++;
+                $this->rmTree($workDir);
+                continue;
+            }
+
+            [$pushRet, $pushOut] = $this->gitCmd($workDir, 'push', 'origin', $defaultBranch);
+            if ($pushRet !== 0) {
+                echo "FAIL (push)\n";
+                fprintf(STDERR, "    %s\n", $pushOut);
+                $stats['failed']++;
+            } else {
+                $action = $isNew ? 'CREATED' : 'UPDATED';
+                echo "{$action}\n";
+                $stats[$isNew ? 'created' : 'updated']++;
+            }
+
+            // Cleanup
+            $this->rmTree($workDir);
+        }
+
+        // Cleanup tmp base
+        @rmdir($tmpBase);
+
+        echo "\n=== Summary ===\n";
+        echo "Created: {$stats['created']}\n";
+        echo "Updated: {$stats['updated']}\n";
+        echo "Skipped: {$stats['skipped']}\n";
+        echo "Failed:  {$stats['failed']}\n";
+
+        return 0;
+    }
+
+    private function detectPlatform(array $repo): string
+    {
+        $name = $repo['name'] ?? '';
+        $nameLower = strtolower($name);
+        $description = strtolower($repo['description'] ?? '');
+        $topics = $repo['topics'] ?? [];
+
+        if (in_array($name, self::CRM_PLATFORM_REPOS, true)) {
+            return 'crm-platform';
+        }
+        if (in_array('dolibarr-platform', $topics)) {
+            return 'crm-platform';
+        }
+        if (in_array('joomla-template', $topics)) {
+            return 'joomla-template';
+        }
+        if (in_array('joomla', $topics) || in_array('joomla-extension', $topics)) {
+            return 'waas-component';
+        }
+        if (in_array('dolibarr', $topics) || in_array('dolibarr-module', $topics)) {
+            return 'crm-module';
+        }
+
+        if (str_contains($nameLower, 'template') && (str_contains($nameLower, 'joomla') || str_contains($nameLower, 'tpl'))) {
+            return 'joomla-template';
+        }
+        if (str_contains($nameLower, 'joomla') || str_contains($nameLower, 'waas')) {
+            return 'waas-component';
+        }
+        if (str_contains($nameLower, 'doli') || str_contains($nameLower, 'crm')) {
+            return 'crm-module';
+        }
+
+        if (str_contains($description, 'joomla template')) {
+            return 'joomla-template';
+        }
+        if (str_contains($description, 'joomla') || str_contains($description, 'component')) {
+            return 'waas-component';
+        }
+        if (str_contains($description, 'dolibarr') || str_contains($description, 'module')) {
+            return 'crm-module';
+        }
+
+        if (str_contains($nameLower, 'standard')) {
+            return 'standards-repository';
+        }
+        return 'default-repository';
+    }
+
+    /**
+     * @return array{int, string}
+     */
+    private function safeExec(string $command, string $cwd = '.'): array
+    {
+        $proc = proc_open(
+            $command,
+            [1 => ['pipe', 'w'], 2 => ['pipe', 'w']],
+            $pipes,
+            $cwd
+        );
+        if (!is_resource($proc)) {
+            return [1, "proc_open failed for: {$command}"];
+        }
+        $stdout = stream_get_contents($pipes[1]);
+        $stderr = stream_get_contents($pipes[2]);
+        fclose($pipes[1]);
+        fclose($pipes[2]);
+        $code = proc_close($proc);
+        return [$code, trim($stdout . "\n" . $stderr)];
+    }
+
+    private function rmTree(string $dir): void
+    {
+        if (!is_dir($dir)) {
+            return;
+        }
+        $it = new \RecursiveDirectoryIterator($dir, \FilesystemIterator::SKIP_DOTS);
+        $files = new \RecursiveIteratorIterator($it, \RecursiveIteratorIterator::CHILD_FIRST);
+        foreach ($files as $file) {
+            if ($file->isDir()) {
+                @rmdir($file->getPathname());
+            } else {
+                @chmod($file->getPathname(), 0777);
+                @unlink($file->getPathname());
+            }
+        }
+        @rmdir($dir);
+    }
+
+    /**
+     * @return array{int, string}
+     */
+    private function gitCmd(string $workDir, string ...$args): array
+    {
+        $cmd = 'git';
+        foreach ($args as $a) {
+            $cmd .= ' ' . escapeshellarg($a);
+        }
+        return $this->safeExec($cmd, $workDir);
+    }
+
+    private function fetchRepos(string $url, string $org, string $token): array
+    {
+        $repos = [];
+        $page = 1;
+        do {
+            $ch = curl_init("{$url}/api/v1/orgs/{$org}/repos?page={$page}&limit=50");
+            curl_setopt_array($ch, [
+                CURLOPT_RETURNTRANSFER => true,
+                CURLOPT_HTTPHEADER => ["Authorization: token {$token}"],
+                CURLOPT_TIMEOUT => 30,
+            ]);
+            $body = curl_exec($ch);
+            $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+            curl_close($ch);
+
+            if ($code !== 200) {
+                $this->log('ERROR', "API error (HTTP {$code}) fetching repos page {$page}");
+                break;
+            }
+
+            $batch = json_decode($body, true);
+            if (empty($batch)) {
+                break;
+            }
+            $repos = array_merge($repos, $batch);
+            $page++;
+        } while (count($batch) >= 50);
+
+        return $repos;
+    }
+}
+
+$app = new PushManifestXmlCli();
+exit($app->execute());
@@ -0,0 +1,345 @@
+#!/usr/bin/env php
+<?php
+
+/**
+ * Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: MokoPlatform.Automation
+ * INGROUP: MokoPlatform
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+ * PATH: /automation/push_mokostandards_xml.php
+ * BRIEF: Push XML manifests to all governed repositories
+ */
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/../vendor/autoload.php';
+require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
+
+use MokoCli\CliFramework;
+use MokoCli\ManifestParser;
+
+class PushMokostandardsXmlCli extends CliFramework
+{
+    private const CRM_PLATFORM_REPOS = ['MokoDolibarr', 'MokoDoliMods'];
+
+    protected function configure(): void
+    {
+        $this->setDescription('Push XML manifests to all governed repositories');
+        $this->addArgument('--repo', 'Filter to a single repo name', '');
+        $this->addArgument('--skip', 'Comma-separated list of repos to skip', '');
+        $this->addArgument('--force', 'Force overwrite even if already XML', false);
+    }
+
+    protected function run(): int
+    {
+        $giteaUrl  = rtrim(getenv('GITEA_URL') ?: 'https://git.mokoconsulting.tech', '/');
+        $giteaOrg  = getenv('GITEA_ORG') ?: 'MokoConsulting';
+        $token     = getenv('GA_TOKEN') ?: getenv('GH_TOKEN') ?: '';
+
+        $force      = $this->getArgument('--force');
+        $repoFilter = $this->getArgument('--repo') ?: null;
+        $skipStr    = $this->getArgument('--skip');
+        $skipRepos  = $skipStr !== '' ? array_map('trim', explode(',', $skipStr)) : [];
+
+        $parser = new ManifestParser();
+        $tmpBase = sys_get_temp_dir() . '/moko-manifest-push-' . getmypid();
+
+        echo "=== mokocli XML Manifest Push ===\n";
+        echo "Org: {$giteaOrg}\n";
+        echo "Mode: " . ($this->dryRun ? "DRY RUN" : "LIVE") . "\n";
+        if ($repoFilter) {
+            echo "Filter: {$repoFilter}\n";
+        }
+        echo "\n";
+
+        if (empty($token)) {
+            $this->log('ERROR', 'GA_TOKEN or GH_TOKEN environment variable required');
+            return 1;
+        }
+
+        $repos = $this->fetchRepos($giteaUrl, $giteaOrg, $token);
+        echo "Found " . count($repos) . " repositories\n\n";
+
+        $stats = ['created' => 0, 'updated' => 0, 'skipped' => 0, 'failed' => 0];
+
+        foreach ($repos as $repo) {
+            $name = $repo['name'];
+            if ($repoFilter && $name !== $repoFilter) {
+                continue;
+            }
+            if (in_array($name, $skipRepos, true)) {
+                echo "  SKIP {$name} (excluded)\n";
+                $stats['skipped']++;
+                continue;
+            }
+            if ($repo['archived'] ?? false) {
+                echo "  SKIP {$name} (archived)\n";
+                $stats['skipped']++;
+                continue;
+            }
+
+            $platform      = $this->detectPlatform($repo);
+            $defaultBranch = $repo['default_branch'] ?? 'main';
+            $httpsUrl = $repo['clone_url'] ?? "{$giteaUrl}/{$giteaOrg}/{$name}.git";
+            $authedUrl = preg_replace('#^https://#', "https://gitea-actions:{$token}@", $httpsUrl);
+
+            echo "  {$name} [{$platform}] ... ";
+
+            // Generate XML manifest
+            $xmlContent = $parser->generate([
+                'name'              => $name,
+                'org'               => $giteaOrg,
+                'platform'          => $platform,
+                'standards_version' => '04.07.00',
+                'description'       => $repo['description'] ?? '',
+                'license'           => 'GPL-3.0-or-later',
+                'topics'            => $repo['topics'] ?? [],
+                'language'          => $repo['language'] ?? ManifestParser::platformLanguage($platform),
+                'package_type'      => ManifestParser::platformPackageType($platform),
+                'last_synced'       => date('c'),
+            ]);
+
+            if ($this->dryRun) {
+                echo "WOULD WRITE ({$platform})\n";
+                $stats['created']++;
+                continue;
+            }
+
+            // Clone shallow via HTTPS (token-authed)
+            $workDir = "{$tmpBase}/{$name}";
+            @mkdir($workDir, 0755, true);
+
+            [$ret, $out] = $this->safeExec(
+                'git clone --depth 1 --branch ' . escapeshellarg($defaultBranch) . ' '
+                . escapeshellarg($authedUrl) . ' ' . escapeshellarg($workDir)
+            );
+            if ($ret !== 0) {
+                echo "FAIL (clone)\n";
+                fprintf(STDERR, "    %s\n", $out);
+                $stats['failed']++;
+                continue;
+            }
+
+            // Check if already XML and up-to-date
+            $manifestPath = "{$workDir}/.mokogitea/manifest.xml";
+            $existingIsXml = file_exists($manifestPath) && str_contains(file_get_contents($manifestPath), '<mokocli');
+            if ($existingIsXml && !$force) {
+                $existingPlatform = $parser->extractPlatform(file_get_contents($manifestPath));
+                if ($existingPlatform === $platform) {
+                    echo "SKIP (already XML)\n";
+                    $stats['skipped']++;
+                    $this->rmTree($workDir);
+                    continue;
+                }
+            }
+
+            // Write manifest
+            @mkdir("{$workDir}/.gitea", 0755, true);
+            file_put_contents($manifestPath, $xmlContent);
+
+            // Delete legacy files if present
+            $legacyDeleted = [];
+            foreach (['.mokostandards', '.github/.mokostandards'] as $legacy) {
+                $legacyPath = "{$workDir}/{$legacy}";
+                if (file_exists($legacyPath)) {
+                    unlink($legacyPath);
+                    $legacyDeleted[] = $legacy;
+                }
+            }
+
+            // Commit
+            $isNew = !$existingIsXml;
+            $commitMsg = $isNew
+                ? 'chore: add XML manifest.xml'
+                : 'chore: update .mokostandards to XML format';
+            if (!empty($legacyDeleted)) {
+                $commitMsg .= "\n\nRemoved legacy: " . implode(', ', $legacyDeleted);
+            }
+
+            $this->gitCmd($workDir, 'config', 'user.name', 'gitea-actions[bot]');
+            $this->gitCmd($workDir, 'config', 'user.email', 'gitea-actions[bot]@git.mokoconsulting.tech');
+            $this->gitCmd($workDir, 'add', '.mokogitea/manifest.xml');
+            foreach ($legacyDeleted as $lf) {
+                $this->gitCmd($workDir, 'add', $lf);
+            }
+
+            [$commitRet, $commitOut] = $this->gitCmd($workDir, 'commit', '-m', $commitMsg);
+            if ($commitRet !== 0 && str_contains($commitOut, 'nothing to commit')) {
+                echo "SKIP (no changes)\n";
+                $stats['skipped']++;
+                $this->rmTree($workDir);
+                continue;
+            }
+            if ($commitRet !== 0) {
+                echo "FAIL (commit)\n";
+                fprintf(STDERR, "    %s\n", $commitOut);
+                $stats['failed']++;
+                $this->rmTree($workDir);
+                continue;
+            }
+
+            [$pushRet, $pushOut] = $this->gitCmd($workDir, 'push', 'origin', $defaultBranch);
+            if ($pushRet !== 0) {
+                echo "FAIL (push)\n";
+                fprintf(STDERR, "    %s\n", $pushOut);
+                $stats['failed']++;
+            } else {
+                $action = $isNew ? 'CREATED' : 'UPDATED';
+                echo "{$action}\n";
+                $stats[$isNew ? 'created' : 'updated']++;
+            }
+
+            // Cleanup
+            $this->rmTree($workDir);
+        }
+
+        // Cleanup tmp base
+        @rmdir($tmpBase);
+
+        echo "\n=== Summary ===\n";
+        echo "Created: {$stats['created']}\n";
+        echo "Updated: {$stats['updated']}\n";
+        echo "Skipped: {$stats['skipped']}\n";
+        echo "Failed:  {$stats['failed']}\n";
+
+        return 0;
+    }
+
+    private function detectPlatform(array $repo): string
+    {
+        $name = $repo['name'] ?? '';
+        $nameLower = strtolower($name);
+        $description = strtolower($repo['description'] ?? '');
+        $topics = $repo['topics'] ?? [];
+
+        if (in_array($name, self::CRM_PLATFORM_REPOS, true)) {
+            return 'crm-platform';
+        }
+        if (in_array('dolibarr-platform', $topics)) {
+            return 'crm-platform';
+        }
+        if (in_array('joomla-template', $topics)) {
+            return 'joomla-template';
+        }
+        if (in_array('joomla', $topics) || in_array('joomla-extension', $topics)) {
+            return 'waas-component';
+        }
+        if (in_array('dolibarr', $topics) || in_array('dolibarr-module', $topics)) {
+            return 'crm-module';
+        }
+
+        if (str_contains($nameLower, 'template') && (str_contains($nameLower, 'joomla') || str_contains($nameLower, 'tpl'))) {
+            return 'joomla-template';
+        }
+        if (str_contains($nameLower, 'joomla') || str_contains($nameLower, 'waas')) {
+            return 'waas-component';
+        }
+        if (str_contains($nameLower, 'doli') || str_contains($nameLower, 'crm')) {
+            return 'crm-module';
+        }
+
+        if (str_contains($description, 'joomla template')) {
+            return 'joomla-template';
+        }
+        if (str_contains($description, 'joomla') || str_contains($description, 'component')) {
+            return 'waas-component';
+        }
+        if (str_contains($description, 'dolibarr') || str_contains($description, 'module')) {
+            return 'crm-module';
+        }
+
+        if (str_contains($nameLower, 'standard')) {
+            return 'standards-repository';
+        }
+        return 'default-repository';
+    }
+
+    /**
+     * @return array{int, string}
+     */
+    private function safeExec(string $command, string $cwd = '.'): array
+    {
+        $proc = proc_open(
+            $command,
+            [1 => ['pipe', 'w'], 2 => ['pipe', 'w']],
+            $pipes,
+            $cwd
+        );
+        if (!is_resource($proc)) {
+            return [1, "proc_open failed for: {$command}"];
+        }
+        $stdout = stream_get_contents($pipes[1]);
+        $stderr = stream_get_contents($pipes[2]);
+        fclose($pipes[1]);
+        fclose($pipes[2]);
+        $code = proc_close($proc);
+        return [$code, trim($stdout . "\n" . $stderr)];
+    }
+
+    private function rmTree(string $dir): void
+    {
+        if (!is_dir($dir)) {
+            return;
+        }
+        $it = new \RecursiveDirectoryIterator($dir, \FilesystemIterator::SKIP_DOTS);
+        $files = new \RecursiveIteratorIterator($it, \RecursiveIteratorIterator::CHILD_FIRST);
+        foreach ($files as $file) {
+            if ($file->isDir()) {
+                @rmdir($file->getPathname());
+            } else {
+                @chmod($file->getPathname(), 0777);
+                @unlink($file->getPathname());
+            }
+        }
+        @rmdir($dir);
+    }
+
+    /**
+     * @return array{int, string}
+     */
+    private function gitCmd(string $workDir, string ...$args): array
+    {
+        $cmd = 'git';
+        foreach ($args as $a) {
+            $cmd .= ' ' . escapeshellarg($a);
+        }
+        return $this->safeExec($cmd, $workDir);
+    }
+
+    private function fetchRepos(string $url, string $org, string $token): array
+    {
+        $repos = [];
+        $page = 1;
+        do {
+            $ch = curl_init("{$url}/api/v1/orgs/{$org}/repos?page={$page}&limit=50");
+            curl_setopt_array($ch, [
+                CURLOPT_RETURNTRANSFER => true,
+                CURLOPT_HTTPHEADER => ["Authorization: token {$token}"],
+                CURLOPT_TIMEOUT => 30,
+            ]);
+            $body = curl_exec($ch);
+            $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+            curl_close($ch);
+
+            if ($code !== 200) {
+                $this->log('ERROR', "API error (HTTP {$code}) fetching repos page {$page}");
+                break;
+            }
+
+            $batch = json_decode($body, true);
+            if (empty($batch)) {
+                break;
+            }
+            $repos = array_merge($repos, $batch);
+            $page++;
+        } while (count($batch) >= 50);
+
+        return $repos;
+    }
+}
+
+$app = new PushMokostandardsXmlCli();
+exit($app->execute());
@@ -0,0 +1,517 @@
+#!/usr/bin/env php
+<?php
+
+/**
+ * Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * This file is part of a Moko Consulting project.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: MokoPlatform.Automation
+ * INGROUP: MokoPlatform.Scripts
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+ * PATH: /automation/repo_cleanup.php
+ * BRIEF: Enterprise repository cleanup — branches, PRs, issues, workflows, labels, logs
+ */
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/../vendor/autoload.php';
+require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
+
+use MokoCli\{ApiClient, AuditLogger, CliFramework, Config, GitPlatformAdapter, MetricsCollector, PlatformAdapterFactory};
+
+/**
+ * Enterprise Repository Cleanup
+ *
+ * Comprehensive maintenance tool for governed repositories:
+ *   1. Delete stale sync branches (keeps current versioned branch)
+ *   2. Close superseded PRs on deleted branches
+ *   3. Close/lock resolved tracking issues where linked PR is merged
+ *   4. Delete retired workflow files from repos
+ *   5. Clean cancelled/stale workflow runs
+ *   6. Delete workflow run logs older than N days
+ *   7. Verify and provision standard labels
+ *   8. Version drift detection
+ */
+class RepoCleanup extends CliFramework
+{
+    private const VERSION        = '09.23.00';
+    private const SYNC_PREFIX    = 'chore/sync-mokocli-';
+    private const CURRENT_BRANCH = 'chore/sync-mokocli-v04.02.00';
+
+    /** Workflow files that have been retired and should be deleted from governed repos. */
+    private const RETIRED_WORKFLOWS = [
+        'build.yml', 'code-quality.yml', 'release-cycle.yml', 'release-pipeline.yml',
+        'branch-cleanup.yml', 'auto-update-changelog.yml', 'enterprise-issue-manager.yml',
+        'flush-actions-cache.yml', 'mokocli-script-runner.yml', 'unified-ci.yml',
+        'unified-platform-testing.yml', 'reusable-build.yml', 'reusable-ci-validation.yml',
+        'reusable-deploy.yml', 'reusable-php-quality.yml', 'reusable-platform-testing.yml',
+        'reusable-project-detector.yml', 'reusable-release.yml', 'reusable-script-executor.yml',
+        'rebuild-docs-indexes.yml', 'setup-project-v2.yml', 'sync-docs-to-project.yml',
+        'release.yml', 'sync-changelogs.yml', 'version_branch.yml',
+        'publish-to-mokodolibarr.yml', 'ci.yml',
+        'deploy-rs.yml',
+    ];
+
+    private ApiClient $api;
+    private GitPlatformAdapter $adapter;
+    protected bool $dryRun = false;
+    private float $startTime;
+
+    protected function configure(): void
+    {
+        $this->setDescription('Enterprise repository cleanup');
+        $this->addArgument('--org', 'GitHub organization', 'MokoConsulting');
+        $this->addArgument('--repos', 'Specific repos (space-separated)', '');
+        $this->addArgument('--skip-archived', 'Skip archived repos', false);
+        $this->addArgument('--close-issues', 'Close resolved tracking issues', false);
+        $this->addArgument('--lock-old-issues', 'Lock issues closed >30 days', false);
+        $this->addArgument('--clean-workflows', 'Delete stale workflow runs', false);
+        $this->addArgument('--clean-logs', 'Delete old workflow logs', false);
+        $this->addArgument('--log-days', 'Days to keep logs', '30');
+        $this->addArgument('--delete-retired', 'Delete retired workflows', false);
+        $this->addArgument('--check-labels', 'Verify labels exist', false);
+        $this->addArgument('--check-drift', 'Check version drift', false);
+        $this->addArgument('--all', 'Run all operations', false);
+        $this->addArgument('--yes', 'Auto-confirm', false);
+        $this->addArgument('--json', 'Output as JSON', false);
+    }
+
+    protected function run(): int
+    {
+        $this->startTime = microtime(true);
+        $org = $this->getArgument('--org', 'MokoConsulting');
+        $this->dryRun = (bool) $this->getArgument('--dry-run', false);
+        $runAll = (bool) $this->getArgument('--all', false);
+
+        $config = Config::load();
+
+        try {
+            $this->adapter = PlatformAdapterFactory::create($config);
+            $this->api     = $this->adapter->getApiClient();
+        } catch (\Exception $e) {
+            $this->errorMsg('Failed to initialize platform adapter: ' . $e->getMessage());
+            return 1;
+        }
+
+
+        $this->logMsg("🧹 mokocli Repository Cleanup v" . self::VERSION);
+        $this->logMsg("Organization: {$org}");
+        $this->logMsg("Current sync branch: " . self::CURRENT_BRANCH);
+        if ($this->dryRun) {
+            $this->logMsg("⚠️  DRY RUN — no changes will be made");
+        }
+        $this->logMsg('');
+
+        $repos = $this->fetchRepositories($org);
+        $this->logMsg("Found " . count($repos) . " repositories");
+        $this->logMsg('');
+
+        $results = [
+            'repos_processed'    => 0,
+            'repos_cleaned'      => 0,
+            'branches_deleted'   => 0,
+            'prs_closed'         => 0,
+            'issues_closed'      => 0,
+            'issues_locked'      => 0,
+            'workflows_deleted'  => 0,
+            'runs_deleted'       => 0,
+            'logs_deleted'       => 0,
+            'labels_missing'     => 0,
+            'version_drift'      => 0,
+            'retired_files'      => 0,
+            'errors'             => 0,
+        ];
+
+        foreach ($repos as $i => $repo) {
+            $name = $repo['name'];
+            $num  = $i + 1;
+            $total = count($repos);
+            $this->logMsg("[{$num}/{$total}] {$name}");
+            $results['repos_processed']++;
+
+            try {
+                $this->api->resetCircuitBreaker();
+                $cleaned = false;
+
+                // Always: delete old sync branches + close their PRs
+                $cleaned = $this->cleanBranches($org, $name, $results) || $cleaned;
+
+                // Optional: close resolved issues
+                if ($runAll || $this->getArgument('--close-issues', false)) {
+                    $cleaned = $this->closeResolvedIssues($org, $name, $results) || $cleaned;
+                }
+
+                // Optional: lock old closed issues
+                if ($runAll || $this->getArgument('--lock-old-issues', false)) {
+                    $cleaned = $this->lockOldIssues($org, $name, $results) || $cleaned;
+                }
+
+                // Optional: delete retired workflow files
+                if ($runAll || $this->getArgument('--delete-retired', false)) {
+                    $cleaned = $this->deleteRetiredWorkflows($org, $name, $results) || $cleaned;
+                }
+
+                // Optional: clean workflow runs
+                if ($runAll || $this->getArgument('--clean-workflows', false)) {
+                    $cleaned = $this->cleanWorkflowRuns($org, $name, $results) || $cleaned;
+                }
+
+                // Optional: clean old logs
+                if ($runAll || $this->getArgument('--clean-logs', false)) {
+                    $cleaned = $this->cleanOldLogs($org, $name, $results) || $cleaned;
+                }
+
+                // Optional: check labels
+                if ($runAll || $this->getArgument('--check-labels', false)) {
+                    $this->checkLabels($org, $name, $results);
+                }
+
+                // Optional: check version drift
+                if ($runAll || $this->getArgument('--check-drift', false)) {
+                    $this->checkVersionDrift($org, $name, $results);
+                }
+
+                if ($cleaned) {
+                    $results['repos_cleaned']++;
+                }
+            } catch (\Exception $e) {
+                $this->errorMsg("  ✗ {$name}: " . $e->getMessage());
+                $results['errors']++;
+            }
+        }
+
+        $duration = round(microtime(true) - $this->startTime, 1);
+
+        $this->logMsg('');
+        $this->logMsg('============================================================');
+        $this->logMsg("🧹 Cleanup Complete ({$duration}s)");
+        $this->logMsg('============================================================');
+        $this->logMsg("Repos processed:     {$results['repos_processed']}");
+        $this->logMsg("Repos with changes:  {$results['repos_cleaned']}");
+        $this->logMsg("Branches deleted:    {$results['branches_deleted']}");
+        $this->logMsg("PRs closed:          {$results['prs_closed']}");
+        $this->logMsg("Issues closed:       {$results['issues_closed']}");
+        $this->logMsg("Issues locked:       {$results['issues_locked']}");
+        $this->logMsg("Retired files:       {$results['retired_files']}");
+        $this->logMsg("Workflow runs:       {$results['runs_deleted']}");
+        $this->logMsg("Logs cleaned:        {$results['logs_deleted']}");
+        $this->logMsg("Labels missing:      {$results['labels_missing']}");
+        $this->logMsg("Version drift:       {$results['version_drift']}");
+        $this->logMsg("Errors:              {$results['errors']}");
+        $this->logMsg('============================================================');
+
+        if ($this->getArgument('--json', false)) {
+            $results['duration_seconds'] = $duration;
+            echo json_encode($results, JSON_PRETTY_PRINT) . "\n";
+        }
+
+        return $results['errors'] > 0 ? 1 : 0;
+    }
+
+    // ─── Repository fetching ─────────────────────────────────────────────
+
+    private function fetchRepositories(string $org): array
+    {
+        $specificRepos = trim((string) $this->getArgument('--repos', ''));
+        $skipArchived  = (bool) $this->getArgument('--skip-archived', false);
+
+        if (!empty($specificRepos)) {
+            $names = preg_split('/[\s,]+/', $specificRepos);
+            return array_map(fn($n) => ['name' => trim($n), 'archived' => false], $names);
+        }
+
+        $allRepos = $this->adapter->listOrgRepos($org, $skipArchived);
+        return array_filter($allRepos, fn($r) => !in_array($r['name'], ['mokocli', '.github-private'], true));
+    }
+
+    // ─── Cleanup operations ──────────────────────────────────────────────
+
+    private function cleanBranches(string $org, string $repo, array &$results): bool
+    {
+        $changed = false;
+        try {
+            $branches = $this->api->get("/repos/{$org}/{$repo}/branches", ['per_page' => 100]);
+        } catch (\Exception $e) {
+            return false;
+        }
+
+        foreach ($branches as $branch) {
+            $name = $branch['name'] ?? '';
+            if (!str_starts_with($name, self::SYNC_PREFIX) || $name === self::CURRENT_BRANCH) {
+                continue;
+            }
+
+            // Close open PRs on this branch
+            try {
+                $prs = $this->api->get("/repos/{$org}/{$repo}/pulls", [
+                    'state' => 'open', 'head' => "{$org}:{$name}", 'per_page' => 10,
+                ]);
+                foreach ($prs as $pr) {
+                    if (($pr['number'] ?? 0) > 0 && !$this->dryRun) {
+                        $this->api->patch("/repos/{$org}/{$repo}/pulls/{$pr['number']}", ['state' => 'closed']);
+                    }
+                    $this->logMsg("  🔒 Closed PR #{$pr['number']} ({$name})");
+                    $results['prs_closed']++;
+                    $changed = true;
+                }
+            } catch (\Exception $e) {
+/* non-fatal */
+            }
+
+            if (!$this->dryRun) {
+                try {
+                    $this->api->delete("/repos/{$org}/{$repo}/git/refs/heads/{$name}");
+                } catch (\Exception $e) {
+                    continue;
+                }
+            }
+            $this->logMsg("  🗑️  Deleted branch: {$name}");
+            $results['branches_deleted']++;
+            $changed = true;
+        }
+
+        return $changed;
+    }
+
+    private function closeResolvedIssues(string $org, string $repo, array &$results): bool
+    {
+        $changed = false;
+        foreach (['standards-update', 'standards-drift'] as $label) {
+            try {
+                $issues = $this->api->get("/repos/{$org}/{$repo}/issues", [
+                    'labels' => $label, 'state' => 'open', 'per_page' => 10,
+                ]);
+            } catch (\Exception $e) {
+                continue;
+            }
+
+            foreach ($issues as $issue) {
+                $num  = $issue['number'] ?? 0;
+                $body = $issue['body'] ?? '';
+                if (preg_match('/\[#(\d+)\]/', $body, $m)) {
+                    $prNum = (int) $m[1];
+                    try {
+                        $pr = $this->api->get("/repos/{$org}/{$repo}/pulls/{$prNum}");
+                        if (!empty($pr['merged_at'])) {
+                            if (!$this->dryRun) {
+                                $this->api->patch("/repos/{$org}/{$repo}/issues/{$num}", [
+                                    'state' => 'closed', 'state_reason' => 'completed',
+                                ]);
+                            }
+                            $this->logMsg("  ✅ Closed issue #{$num} (PR #{$prNum} merged)");
+                            $results['issues_closed']++;
+                            $changed = true;
+                        }
+                    } catch (\Exception $e) {
+/* non-fatal */
+                    }
+                }
+            }
+        }
+        return $changed;
+    }
+
+    private function lockOldIssues(string $org, string $repo, array &$results): bool
+    {
+        $changed = false;
+        $cutoff = date('Y-m-d\TH:i:s\Z', strtotime('-30 days'));
+
+        try {
+            $issues = $this->api->get("/repos/{$org}/{$repo}/issues", [
+                'state' => 'closed', 'per_page' => 50, 'sort' => 'updated', 'direction' => 'asc',
+            ]);
+        } catch (\Exception $e) {
+            return false;
+        }
+
+        foreach ($issues as $issue) {
+            $closedAt = $issue['closed_at'] ?? '';
+            $locked   = $issue['locked'] ?? false;
+            $num      = $issue['number'] ?? 0;
+
+            if ($locked || $closedAt > $cutoff || $num === 0) {
+                continue;
+            }
+
+            if (!$this->dryRun) {
+                try {
+                    $this->api->put("/repos/{$org}/{$repo}/issues/{$num}/lock", [
+                        'lock_reason' => 'resolved',
+                    ]);
+                } catch (\Exception $e) {
+                    continue;
+                }
+            }
+            $results['issues_locked']++;
+            $changed = true;
+        }
+
+        if ($results['issues_locked'] > 0) {
+            $this->logMsg("  🔒 Locked {$results['issues_locked']} old closed issue(s)");
+        }
+        return $changed;
+    }
+
+    private function deleteRetiredWorkflows(string $org, string $repo, array &$results): bool
+    {
+        $changed = false;
+        $defaultBranch = 'main';
+        try {
+            $repoInfo = $this->api->get("/repos/{$org}/{$repo}");
+            $defaultBranch = $repoInfo['default_branch'] ?? 'main';
+        } catch (\Exception $e) {
+/* fallback to main */
+        }
+
+        // Check both workflow directories for retired workflows (supports dual-platform repos)
+        $wfDirs = array_unique(['.github/workflows', '.mokogitea/workflows', $this->adapter->getWorkflowDir()]);
+        foreach (self::RETIRED_WORKFLOWS as $wf) {
+            foreach ($wfDirs as $wfDir) {
+                $path = "{$wfDir}/{$wf}";
+                try {
+                    $file = $this->api->get("/repos/{$org}/{$repo}/contents/{$path}");
+                    $sha  = $file['sha'] ?? '';
+                    if (empty($sha)) {
+                        continue;
+                    }
+
+                    if (!$this->dryRun) {
+                        $this->api->delete("/repos/{$org}/{$repo}/contents/{$path}", [
+                            'message' => "chore: delete retired workflow {$wf}",
+                            'sha'     => $sha,
+                            'branch'  => $defaultBranch,
+                        ]);
+                    }
+                    $this->logMsg("  Deleted retired: {$wf} (from {$wfDir})");
+                    $results['retired_files']++;
+                    $changed = true;
+                } catch (\Exception $e) {
+                    // File doesn't exist in this dir — skip
+                    $this->api->resetCircuitBreaker();
+                }
+            }
+        }
+        return $changed;
+    }
+
+    private function cleanWorkflowRuns(string $org, string $repo, array &$results): bool
+    {
+        $changed = false;
+        foreach (['cancelled', 'stale'] as $status) {
+            try {
+                $runs = $this->api->get("/repos/{$org}/{$repo}/actions/runs", [
+                    'status' => $status, 'per_page' => 100,
+                ]);
+                foreach (($runs['workflow_runs'] ?? []) as $run) {
+                    $id = $run['id'] ?? 0;
+                    if ($id > 0 && !$this->dryRun) {
+                        try {
+                            $this->api->delete("/repos/{$org}/{$repo}/actions/runs/{$id}");
+                            $results['runs_deleted']++;
+                            $changed = true;
+                        } catch (\Exception $e) {
+                            $this->api->resetCircuitBreaker();
+                        }
+                    }
+                }
+            } catch (\Exception $e) {
+/* non-fatal */
+            }
+        }
+        if ($results['runs_deleted'] > 0) {
+            $this->logMsg("  🔄 Cleaned {$results['runs_deleted']} workflow run(s)");
+        }
+        return $changed;
+    }
+
+    private function cleanOldLogs(string $org, string $repo, array &$results): bool
+    {
+        $changed = false;
+        $days = (int) $this->getArgument('--log-days', '30');
+        $cutoff = date('Y-m-d\TH:i:s\Z', strtotime("-{$days} days"));
+
+        try {
+            $runs = $this->api->get("/repos/{$org}/{$repo}/actions/runs", [
+                'created' => "<{$cutoff}", 'per_page' => 100,
+            ]);
+            foreach (($runs['workflow_runs'] ?? []) as $run) {
+                $id = $run['id'] ?? 0;
+                if ($id > 0 && !$this->dryRun) {
+                    try {
+                        $this->api->delete("/repos/{$org}/{$repo}/actions/runs/{$id}/logs");
+                        $results['logs_deleted']++;
+                        $changed = true;
+                    } catch (\Exception $e) {
+                        $this->api->resetCircuitBreaker();
+                    }
+                }
+            }
+        } catch (\Exception $e) {
+/* non-fatal */
+        }
+
+        if ($results['logs_deleted'] > 0) {
+            $this->logMsg("  📋 Cleaned {$results['logs_deleted']} old log(s)");
+        }
+        return $changed;
+    }
+
+    private function checkLabels(string $org, string $repo, array &$results): void
+    {
+        try {
+            $this->api->get("/repos/{$org}/{$repo}/labels/mokocli");
+        } catch (\Exception $e) {
+            $this->logMsg("  ⚠️  Missing 'mokocli' label");
+            $results['labels_missing']++;
+            $this->api->resetCircuitBreaker();
+        }
+    }
+
+    private function checkVersionDrift(string $org, string $repo, array &$results): void
+    {
+        try {
+            $file = $this->api->get("/repos/{$org}/{$repo}/contents/README.md");
+            $content = base64_decode($file['content'] ?? '');
+            if (preg_match('/^\s*VERSION:\s*(\d{2}\.\d{2}\.\d{2})/m', $content, $m)) {
+                $version = $m[1];
+
+                // Check manifest.xml for the tracked mokocli version
+                try {
+                    $mokoFile = $this->api->get("/repos/{$org}/{$repo}/contents/.mokogitea/manifest.xml");
+                    $mokoContent = base64_decode($mokoFile['content'] ?? '');
+                    if (preg_match('/standards_version:\s*(\d{2}\.\d{2}\.\d{2})/m', $mokoContent, $vm)) {
+                        if ($vm[1] !== self::VERSION) {
+                            $this->logMsg("  ⚠️  Standards drift: {$vm[1]} (expected " . self::VERSION . ")");
+                            $results['version_drift']++;
+                        }
+                    }
+                } catch (\Exception $e) {
+                    $this->api->resetCircuitBreaker();
+                }
+            }
+        } catch (\Exception $e) {
+            $this->api->resetCircuitBreaker();
+        }
+    }
+
+    // ─── Helpers ─────────────────────────────────────────────────────────
+
+    private function logMsg(string $message): void
+    {
+        if (!$this->quiet) {
+            echo $message . "\n";
+        }
+    }
+
+    private function errorMsg(string $message): void
+    {
+        fwrite(STDERR, $message . "\n");
+    }
+}
+
+$app = new RepoCleanup();
+exit($app->execute());
@@ -0,0 +1,678 @@
+#!/usr/bin/env bash
+# server-autoheal.sh - Auto-heal on restart + split backup management
+#
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# DEFGROUP: MokoPlatform.Automation.ServerAutoheal
+# INGROUP:  MokoPlatform.Automation
+# REPO:     https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH:     /automation/server-autoheal.sh
+# BRIEF:    Server auto-heal on unclean restart + split system/content backups
+#
+# Usage:
+#   server-autoheal.sh <command> [options]
+#
+# Commands:
+#   boot-check       Run at boot — auto-heals if no safe point exists
+#   set-safepoint    Mark current state as safe (call before planned shutdown)
+#   backup-system    Run a system backup (configs, packages, services)
+#   backup-content   Run a content backup (site files, databases, uploads)
+#   cleanup          Prune expired backups per retention policy
+#   status           Show safe point and backup status
+#
+# Scheduling (cron):
+#   @reboot          server-autoheal.sh boot-check
+#   0 3 * * *        server-autoheal.sh backup-system    (daily at 3am)
+#   0 */2 * * *      server-autoheal.sh backup-content   (every 2 hours)
+#   30 */2 * * *     server-autoheal.sh cleanup           (30 min after content backup)
+
+set -euo pipefail
+
+# ──────────────────────────────────────────────
+# Configuration — override via /etc/moko/autoheal.conf
+# ──────────────────────────────────────────────
+CONF_FILE="/etc/moko/autoheal.conf"
+[[ -f "$CONF_FILE" ]] && source "$CONF_FILE"
+
+BACKUP_ROOT="${BACKUP_ROOT:-/var/backups/moko}"
+SAFEPOINT_FILE="${SAFEPOINT_FILE:-/var/run/moko/safepoint}"
+LOG_FILE="${LOG_FILE:-/var/log/moko/autoheal.log}"
+LOCK_DIR="${LOCK_DIR:-/var/run/moko}"
+
+# System backup: configs, package lists, service state, cron
+SYSTEM_BACKUP_DIR="${BACKUP_ROOT}/system"
+SYSTEM_BACKUP_RETAIN="${SYSTEM_BACKUP_RETAIN:-7}"  # keep 7 daily system backups
+
+# Content backup: web roots, databases, uploads
+CONTENT_BACKUP_DIR="${BACKUP_ROOT}/content"
+CONTENT_BACKUP_RETAIN_HOURS="${CONTENT_BACKUP_RETAIN_HOURS:-24}"  # 1 day of content backups
+
+# Paths to back up — override these in /etc/moko/autoheal.conf
+SYSTEM_PATHS="${SYSTEM_PATHS:-/etc/nginx /etc/php /etc/mysql /etc/cron.d /etc/systemd/system}"
+CONTENT_PATHS="${CONTENT_PATHS:-/var/www}"
+DB_NAMES="${DB_NAMES:-}"  # space-separated list, empty = auto-detect all
+
+# ──────────────────────────────────────────────
+# Helpers
+# ──────────────────────────────────────────────
+log() {
+    local level="$1"; shift
+    local ts
+    ts=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
+    local msg="[$ts] [$level] $*"
+    echo "$msg" | tee -a "$LOG_FILE" >&2
+}
+
+ensure_dirs() {
+    mkdir -p "$SYSTEM_BACKUP_DIR" "$CONTENT_BACKUP_DIR" \
+             "$LOCK_DIR" "$(dirname "$LOG_FILE")"
+}
+
+acquire_lock() {
+    local lockfile="${LOCK_DIR}/autoheal-${1}.lock"
+    if [[ -f "$lockfile" ]]; then
+        local pid
+        pid=$(<"$lockfile")
+        if kill -0 "$pid" 2>/dev/null; then
+            log WARN "Another $1 operation is running (PID $pid), skipping"
+            exit 0
+        fi
+        rm -f "$lockfile"
+    fi
+    echo $$ > "$lockfile"
+    trap "rm -f '$lockfile'" EXIT
+}
+
+timestamp() {
+    date -u '+%Y%m%d_%H%M%S'
+}
+
+# ──────────────────────────────────────────────
+# Safe-point management
+# ──────────────────────────────────────────────
+cmd_set_safepoint() {
+    ensure_dirs
+    local ts
+    ts=$(timestamp)
+    cat > "$SAFEPOINT_FILE" <<EOF
+timestamp=$ts
+hostname=$(hostname)
+kernel=$(uname -r)
+uptime=$(uptime -s 2>/dev/null || echo "unknown")
+set_by=${SUDO_USER:-$(whoami)}
+EOF
+    log INFO "Safe point set at $ts by ${SUDO_USER:-$(whoami)}"
+}
+
+cmd_clear_safepoint() {
+    rm -f "$SAFEPOINT_FILE"
+    log INFO "Safe point cleared"
+}
+
+has_safepoint() {
+    [[ -f "$SAFEPOINT_FILE" ]]
+}
+
+# ──────────────────────────────────────────────
+# System backup (daily)
+# ──────────────────────────────────────────────
+cmd_backup_system() {
+    ensure_dirs
+    acquire_lock "system-backup"
+
+    local ts
+    ts=$(timestamp)
+    local archive="${SYSTEM_BACKUP_DIR}/system_${ts}.tar.gz"
+    local manifest="${SYSTEM_BACKUP_DIR}/system_${ts}.manifest"
+
+    log INFO "Starting system backup → $archive"
+
+    # Collect existing paths only
+    local existing_paths=()
+    for p in $SYSTEM_PATHS; do
+        [[ -e "$p" ]] && existing_paths+=("$p")
+    done
+
+    if [[ ${#existing_paths[@]} -eq 0 ]]; then
+        log WARN "No system paths found to back up"
+        return 1
+    fi
+
+    # Archive configs and system files
+    tar -czf "$archive" "${existing_paths[@]}" 2>/dev/null || true
+
+    # Capture package list and service state as manifest
+    {
+        echo "=== PACKAGES ==="
+        if command -v dpkg &>/dev/null; then
+            dpkg --get-selections
+        elif command -v rpm &>/dev/null; then
+            rpm -qa --qf '%{NAME}\t%{VERSION}\n'
+        fi
+        echo ""
+        echo "=== ENABLED SERVICES ==="
+        if command -v systemctl &>/dev/null; then
+            systemctl list-unit-files --state=enabled --no-pager 2>/dev/null || true
+        fi
+        echo ""
+        echo "=== CRONTABS ==="
+        for user_home in /var/spool/cron/crontabs/*; do
+            [[ -f "$user_home" ]] && echo "--- $(basename "$user_home") ---" && cat "$user_home"
+        done 2>/dev/null || true
+    } > "$manifest"
+
+    local size
+    size=$(du -sh "$archive" 2>/dev/null | cut -f1)
+    log INFO "System backup complete: $archive ($size)"
+
+    # Prune old system backups (keep $SYSTEM_BACKUP_RETAIN)
+    local count
+    count=$(find "$SYSTEM_BACKUP_DIR" -name 'system_*.tar.gz' | wc -l)
+    if [[ "$count" -gt "$SYSTEM_BACKUP_RETAIN" ]]; then
+        local to_remove=$((count - SYSTEM_BACKUP_RETAIN))
+        find "$SYSTEM_BACKUP_DIR" -name 'system_*.tar.gz' -printf '%T+ %p\n' \
+            | sort | head -n "$to_remove" | awk '{print $2}' \
+            | while read -r f; do
+                rm -f "$f" "${f%.tar.gz}.manifest"
+                log INFO "Pruned old system backup: $f"
+            done
+    fi
+}
+
+# ──────────────────────────────────────────────
+# Content backup (every 2 hours)
+# ──────────────────────────────────────────────
+cmd_backup_content() {
+    ensure_dirs
+    acquire_lock "content-backup"
+
+    local ts
+    ts=$(timestamp)
+    local archive="${CONTENT_BACKUP_DIR}/content_${ts}.tar.gz"
+    local db_dump="${CONTENT_BACKUP_DIR}/content_${ts}.sql.gz"
+
+    log INFO "Starting content backup → $archive"
+
+    # Back up web content / uploads
+    local existing_paths=()
+    for p in $CONTENT_PATHS; do
+        [[ -e "$p" ]] && existing_paths+=("$p")
+    done
+
+    if [[ ${#existing_paths[@]} -gt 0 ]]; then
+        tar -czf "$archive" "${existing_paths[@]}" 2>/dev/null || true
+        local size
+        size=$(du -sh "$archive" 2>/dev/null | cut -f1)
+        log INFO "Content files archived: $archive ($size)"
+    else
+        log WARN "No content paths found to back up"
+    fi
+
+    # Database dump
+    if command -v mysqldump &>/dev/null || command -v mariadb-dump &>/dev/null; then
+        local dump_cmd="mysqldump"
+        command -v mariadb-dump &>/dev/null && dump_cmd="mariadb-dump"
+
+        local databases=()
+        if [[ -n "$DB_NAMES" ]]; then
+            read -ra databases <<< "$DB_NAMES"
+        else
+            # Auto-detect: dump all databases except system ones
+            databases=($(${dump_cmd%dump} -N -e \
+                "SELECT schema_name FROM information_schema.schemata
+                 WHERE schema_name NOT IN ('information_schema','performance_schema','mysql','sys')" \
+                2>/dev/null | tr '\n' ' ')) || true
+        fi
+
+        if [[ ${#databases[@]} -gt 0 ]]; then
+            $dump_cmd --single-transaction --routines --triggers \
+                --databases "${databases[@]}" 2>/dev/null \
+                | gzip > "$db_dump"
+            local db_size
+            db_size=$(du -sh "$db_dump" 2>/dev/null | cut -f1)
+            log INFO "Database dump complete: $db_dump ($db_size)"
+        else
+            log WARN "No databases found to dump"
+        fi
+    fi
+}
+
+# ──────────────────────────────────────────────
+# Cleanup — prune content backups older than retention
+# ──────────────────────────────────────────────
+cmd_cleanup() {
+    ensure_dirs
+    local before_count after_count
+
+    # Content: keep only last 24 hours (1 day)
+    before_count=$(find "$CONTENT_BACKUP_DIR" -name 'content_*' -type f | wc -l)
+    find "$CONTENT_BACKUP_DIR" -name 'content_*' -type f \
+        -mmin +$((CONTENT_BACKUP_RETAIN_HOURS * 60)) -delete 2>/dev/null || true
+    after_count=$(find "$CONTENT_BACKUP_DIR" -name 'content_*' -type f | wc -l)
+    local removed=$((before_count - after_count))
+    [[ "$removed" -gt 0 ]] && log INFO "Pruned $removed content backup(s) older than ${CONTENT_BACKUP_RETAIN_HOURS}h"
+
+    # System: keep N most recent (handled in backup-system, but double-check here)
+    before_count=$(find "$SYSTEM_BACKUP_DIR" -name 'system_*' -type f | wc -l)
+    local max_system_files=$((SYSTEM_BACKUP_RETAIN * 2))  # .tar.gz + .manifest
+    if [[ "$before_count" -gt "$max_system_files" ]]; then
+        local excess=$((before_count - max_system_files))
+        find "$SYSTEM_BACKUP_DIR" -name 'system_*' -type f -printf '%T+ %p\n' \
+            | sort | head -n "$excess" | awk '{print $2}' \
+            | xargs -r rm -f
+        log INFO "Pruned excess system backups"
+    fi
+
+    log INFO "Cleanup complete"
+}
+
+# ──────────────────────────────────────────────
+# Boot check — the auto-heal entry point
+# ──────────────────────────────────────────────
+cmd_boot_check() {
+    ensure_dirs
+    acquire_lock "boot-check"
+
+    log INFO "=== Boot check started ==="
+    log INFO "Hostname: $(hostname), Kernel: $(uname -r)"
+
+    if has_safepoint; then
+        log INFO "Safe point found — server was shut down cleanly"
+        log INFO "Clearing safe point for next cycle"
+        cmd_clear_safepoint
+        log INFO "=== Boot check passed (clean restart) ==="
+        return 0
+    fi
+
+    log WARN "NO safe point found — server restarted without clean shutdown"
+    log WARN "Initiating auto-heal sequence..."
+
+    auto_heal
+    local rc=$?
+
+    # Set safe point after successful heal
+    if [[ $rc -eq 0 ]]; then
+        cmd_set_safepoint
+        log INFO "=== Boot check complete (healed successfully) ==="
+    else
+        log ERROR "=== Boot check FAILED — manual intervention required ==="
+    fi
+
+    return $rc
+}
+
+# ──────────────────────────────────────────────
+# Auto-heal strategy
+#
+# TODO: This is the core decision point. Implement the recovery
+# steps that match your server's architecture. See guidance below.
+#
+# Trade-offs to consider:
+#   - Restore-from-backup: safest, but content may be up to 2h stale
+#   - Service-restart-only: faster, keeps current data, but won't fix
+#     corrupted configs or broken filesystem state
+#   - Hybrid: restart services first, verify health, only restore if
+#     health checks fail — best of both worlds but more complex
+#
+# The function receives no arguments. Use the latest system + content
+# backups to restore if needed. Return 0 on success, 1 on failure.
+# ──────────────────────────────────────────────
+auto_heal() {
+    log INFO "Phase 1: Verify and repair filesystem"
+    # Check for common post-crash issues
+    repair_filesystem
+
+    log INFO "Phase 2: Restore system configuration if corrupted"
+    restore_system_if_needed
+
+    log INFO "Phase 3: Restart core services"
+    restart_services
+
+    log INFO "Phase 4: Verify health"
+    if ! verify_health; then
+        log WARN "Health check failed after service restart — restoring from backup"
+        restore_from_backup
+        restart_services
+
+        if ! verify_health; then
+            log ERROR "Health check still failing after restore — giving up"
+            return 1
+        fi
+    fi
+
+    log INFO "Auto-heal completed successfully"
+    return 0
+}
+
+# ──────────────────────────────────────────────
+# Heal sub-steps
+# ──────────────────────────────────────────────
+repair_filesystem() {
+    # Fix common post-crash filesystem issues
+    # Clear stale PID/lock/socket files that prevent services from starting
+    local stale_files=(
+        /var/run/nginx.pid
+        /var/run/mysqld/mysqld.pid
+        /var/run/php-fpm.pid
+        /var/lib/mysql/*.pid
+    )
+    for f in "${stale_files[@]}"; do
+        for expanded in $f; do
+            if [[ -f "$expanded" ]]; then
+                local pid
+                pid=$(<"$expanded") 2>/dev/null || true
+                if [[ -n "$pid" ]] && ! kill -0 "$pid" 2>/dev/null; then
+                    rm -f "$expanded"
+                    log INFO "Removed stale PID file: $expanded"
+                fi
+            fi
+        done
+    done
+
+    # Fix permissions on critical dirs that may get mangled
+    [[ -d /var/run/mysqld ]] && chown mysql:mysql /var/run/mysqld 2>/dev/null || true
+    [[ -d /var/lib/php/sessions ]] && chmod 1733 /var/lib/php/sessions 2>/dev/null || true
+
+    # Repair tmp/cache dirs
+    for d in /tmp /var/tmp; do
+        [[ -d "$d" ]] && chmod 1777 "$d" 2>/dev/null || true
+    done
+}
+
+restore_system_if_needed() {
+    # Find latest system backup
+    local latest_system
+    latest_system=$(find "$SYSTEM_BACKUP_DIR" -name 'system_*.tar.gz' -printf '%T+ %p\n' \
+        2>/dev/null | sort -r | head -1 | awk '{print $2}')
+
+    if [[ -z "$latest_system" ]]; then
+        log WARN "No system backup available to verify against"
+        return 0
+    fi
+
+    # Check if critical configs exist and are non-empty
+    local needs_restore=false
+    local critical_configs=("/etc/nginx/nginx.conf" "/etc/php" "/etc/mysql")
+
+    for cfg in "${critical_configs[@]}"; do
+        if [[ -e "$cfg" ]]; then
+            # Config exists — check if it's a file and non-empty, or a directory
+            if [[ -f "$cfg" && ! -s "$cfg" ]]; then
+                log WARN "Critical config is empty: $cfg"
+                needs_restore=true
+                break
+            fi
+        fi
+    done
+
+    if $needs_restore; then
+        log WARN "Restoring system config from $latest_system"
+        tar -xzf "$latest_system" -C / 2>/dev/null || {
+            log ERROR "System restore failed from $latest_system"
+            return 1
+        }
+        log INFO "System config restored"
+    else
+        log INFO "System configs look intact — skipping restore"
+    fi
+}
+
+restart_services() {
+    if ! command -v systemctl &>/dev/null; then
+        log WARN "systemctl not available — skipping service restart"
+        return 0
+    fi
+
+    local services=("mysql" "mariadb" "nginx" "apache2" "php-fpm" "php8.1-fpm" "php8.2-fpm" "php8.3-fpm")
+
+    for svc in "${services[@]}"; do
+        if systemctl is-enabled "$svc" &>/dev/null; then
+            log INFO "Restarting $svc..."
+            systemctl restart "$svc" 2>/dev/null && \
+                log INFO "$svc restarted OK" || \
+                log WARN "$svc restart failed"
+        fi
+    done
+}
+
+verify_health() {
+    local failures=0
+
+    # Check critical services are running
+    local services=("mysql" "mariadb" "nginx" "apache2")
+    for svc in "${services[@]}"; do
+        if systemctl is-enabled "$svc" &>/dev/null; then
+            if ! systemctl is-active "$svc" &>/dev/null; then
+                log WARN "Service not running: $svc"
+                ((failures++))
+            fi
+        fi
+    done
+
+    # Check if web server responds
+    if command -v curl &>/dev/null; then
+        if ! curl -sf -o /dev/null --max-time 10 "http://localhost/" 2>/dev/null; then
+            log WARN "Local web server not responding"
+            ((failures++))
+        fi
+    fi
+
+    # Check if database accepts connections
+    if command -v mysqladmin &>/dev/null; then
+        if ! mysqladmin ping --silent 2>/dev/null; then
+            log WARN "Database not responding to ping"
+            ((failures++))
+        fi
+    fi
+
+    [[ $failures -eq 0 ]]
+}
+
+restore_from_backup() {
+    log WARN "=== Full restore from backup ==="
+
+    # Restore system config
+    local latest_system
+    latest_system=$(find "$SYSTEM_BACKUP_DIR" -name 'system_*.tar.gz' -printf '%T+ %p\n' \
+        2>/dev/null | sort -r | head -1 | awk '{print $2}')
+
+    if [[ -n "$latest_system" ]]; then
+        log INFO "Restoring system from $latest_system"
+        tar -xzf "$latest_system" -C / 2>/dev/null || \
+            log ERROR "System restore failed"
+    fi
+
+    # Restore content
+    local latest_content
+    latest_content=$(find "$CONTENT_BACKUP_DIR" -name 'content_*.tar.gz' -printf '%T+ %p\n' \
+        2>/dev/null | sort -r | head -1 | awk '{print $2}')
+
+    if [[ -n "$latest_content" ]]; then
+        log INFO "Restoring content from $latest_content"
+        tar -xzf "$latest_content" -C / 2>/dev/null || \
+            log ERROR "Content restore failed"
+    fi
+
+    # Restore database
+    local latest_db
+    latest_db=$(find "$CONTENT_BACKUP_DIR" -name 'content_*.sql.gz' -printf '%T+ %p\n' \
+        2>/dev/null | sort -r | head -1 | awk '{print $2}')
+
+    if [[ -n "$latest_db" ]]; then
+        log INFO "Restoring database from $latest_db"
+        local mysql_cmd="mysql"
+        command -v mariadb &>/dev/null && mysql_cmd="mariadb"
+        zcat "$latest_db" | $mysql_cmd 2>/dev/null || \
+            log ERROR "Database restore failed"
+    fi
+}
+
+# ──────────────────────────────────────────────
+# Status
+# ──────────────────────────────────────────────
+cmd_status() {
+    echo "=== Moko Server Auto-Heal Status ==="
+    echo ""
+
+    # Safe point
+    if has_safepoint; then
+        echo "Safe point:  SET"
+        cat "$SAFEPOINT_FILE" | sed 's/^/  /'
+    else
+        echo "Safe point:  NOT SET (will auto-heal on next boot)"
+    fi
+    echo ""
+
+    # System backups
+    echo "System backups (${SYSTEM_BACKUP_DIR}):"
+    local sys_count
+    sys_count=$(find "$SYSTEM_BACKUP_DIR" -name 'system_*.tar.gz' 2>/dev/null | wc -l)
+    echo "  Count:     $sys_count (retain $SYSTEM_BACKUP_RETAIN)"
+    local latest_sys
+    latest_sys=$(find "$SYSTEM_BACKUP_DIR" -name 'system_*.tar.gz' -printf '%T+ %p\n' \
+        2>/dev/null | sort -r | head -1)
+    if [[ -n "$latest_sys" ]]; then
+        echo "  Latest:    $(echo "$latest_sys" | awk '{print $2}')"
+        echo "  Timestamp: $(echo "$latest_sys" | awk '{print $1}')"
+    else
+        echo "  Latest:    (none)"
+    fi
+    echo ""
+
+    # Content backups
+    echo "Content backups (${CONTENT_BACKUP_DIR}):"
+    local cnt_count
+    cnt_count=$(find "$CONTENT_BACKUP_DIR" -name 'content_*.tar.gz' 2>/dev/null | wc -l)
+    echo "  Count:     $cnt_count (retain ${CONTENT_BACKUP_RETAIN_HOURS}h)"
+    local latest_cnt
+    latest_cnt=$(find "$CONTENT_BACKUP_DIR" -name 'content_*.tar.gz' -printf '%T+ %p\n' \
+        2>/dev/null | sort -r | head -1)
+    if [[ -n "$latest_cnt" ]]; then
+        echo "  Latest:    $(echo "$latest_cnt" | awk '{print $2}')"
+        echo "  Timestamp: $(echo "$latest_cnt" | awk '{print $1}')"
+    else
+        echo "  Latest:    (none)"
+    fi
+    echo ""
+
+    # Disk usage
+    echo "Backup disk usage:"
+    du -sh "$SYSTEM_BACKUP_DIR" "$CONTENT_BACKUP_DIR" 2>/dev/null | sed 's/^/  /'
+}
+
+# ──────────────────────────────────────────────
+# Install helper — sets up cron + systemd
+# ──────────────────────────────────────────────
+cmd_install() {
+    local script_path
+    script_path=$(readlink -f "$0")
+
+    echo "Installing Moko Auto-Heal..."
+
+    # Create config directory
+    mkdir -p /etc/moko "$(dirname "$LOG_FILE")" "$LOCK_DIR"
+
+    # Write example config if none exists
+    if [[ ! -f "$CONF_FILE" ]]; then
+        cat > "$CONF_FILE" <<'CONF'
+# /etc/moko/autoheal.conf — Server auto-heal configuration
+# Uncomment and modify as needed
+
+# BACKUP_ROOT="/var/backups/moko"
+# SAFEPOINT_FILE="/var/run/moko/safepoint"
+# LOG_FILE="/var/log/moko/autoheal.log"
+
+# System backup paths (space-separated)
+# SYSTEM_PATHS="/etc/nginx /etc/php /etc/mysql /etc/cron.d /etc/systemd/system"
+
+# Content backup paths (space-separated)
+# CONTENT_PATHS="/var/www"
+
+# Database names (space-separated, empty = auto-detect all)
+# DB_NAMES=""
+
+# Retention
+# SYSTEM_BACKUP_RETAIN=7        # daily backups to keep
+# CONTENT_BACKUP_RETAIN_HOURS=24  # hours of content backups to keep
+CONF
+        echo "  Created config: $CONF_FILE"
+    fi
+
+    # Install cron jobs
+    local cron_file="/etc/cron.d/moko-autoheal"
+    cat > "$cron_file" <<CRON
+# Moko Server Auto-Heal — managed by server-autoheal.sh install
+SHELL=/bin/bash
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+# Boot check — auto-heal if no safe point
+@reboot root ${script_path} boot-check
+
+# System backup — daily at 3:00 AM
+0 3 * * * root ${script_path} backup-system
+
+# Content backup — every 2 hours
+0 */2 * * * root ${script_path} backup-content
+
+# Cleanup expired backups — 30 min after each content backup
+30 */2 * * * root ${script_path} cleanup
+CRON
+    echo "  Installed cron: $cron_file"
+
+    # Install shutdown hook to set safe point on clean shutdown
+    local shutdown_hook="/etc/systemd/system/moko-safepoint.service"
+    cat > "$shutdown_hook" <<UNIT
+[Unit]
+Description=Moko Safe Point — mark clean shutdown
+DefaultDependencies=no
+Before=shutdown.target reboot.target halt.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/bin/true
+ExecStop=${script_path} set-safepoint
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+    systemctl daemon-reload
+    systemctl enable moko-safepoint.service
+    echo "  Installed systemd hook: $shutdown_hook"
+
+    echo ""
+    echo "Done! Edit $CONF_FILE to configure paths for your server."
+    echo "Run '${script_path} status' to verify."
+}
+
+# ──────────────────────────────────────────────
+# Main dispatcher
+# ──────────────────────────────────────────────
+main() {
+    local cmd="${1:-help}"
+
+    case "$cmd" in
+        boot-check)       cmd_boot_check ;;
+        set-safepoint)    cmd_set_safepoint ;;
+        clear-safepoint)  cmd_clear_safepoint ;;
+        backup-system)    cmd_backup_system ;;
+        backup-content)   cmd_backup_content ;;
+        cleanup)          cmd_cleanup ;;
+        status)           cmd_status ;;
+        install)          cmd_install ;;
+        help|--help|-h)
+            sed -n '2,/^$/s/^# //p' "$0"
+            echo ""
+            echo "Commands: boot-check, set-safepoint, clear-safepoint,"
+            echo "          backup-system, backup-content, cleanup, status, install"
+            ;;
+        *)
+            echo "Unknown command: $cmd" >&2
+            echo "Run '$0 help' for usage" >&2
+            exit 1
+            ;;
+    esac
+}
+
+main "$@"
@@ -0,0 +1,633 @@
+#!/usr/bin/env php
+<?php
+
+/**
+ * Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * This file is part of a Moko Consulting project.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: MokoPlatform.Automation
+ * INGROUP: MokoPlatform.Scripts
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+ * PATH: /automation/update_dependencies.php
+ * VERSION: 09.38.05
+ * BRIEF: Cross-repo dependency update automation — scan, update, PR, auto-merge
+ */
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/../vendor/autoload.php';
+
+use MokoCli\{
+    ApiClient,
+    AuditLogger,
+    CheckpointManager,
+    CircuitBreakerOpen,
+    CliFramework,
+    Config,
+    GitPlatformAdapter,
+    PlatformAdapterFactory,
+    RateLimitExceeded
+};
+
+/**
+ * Cross-Repo Dependency Update Automation
+ *
+ * Scans org repos for outdated Composer/npm dependencies, creates PRs with
+ * changelogs, and optionally auto-merges safe patch updates.
+ *
+ * @see https://git.mokoconsulting.tech/MokoConsulting/mokocli/issues/149
+ */
+class UpdateDependencies extends CliFramework
+{
+    public const VERSION = '01.00.00';
+
+    private const BRANCH_PREFIX = 'chore/deps-update';
+
+    private ApiClient $api;
+    private GitPlatformAdapter $adapter;
+    private AuditLogger $logger;
+    private CheckpointManager $checkpoints;
+
+    /** Summary counters. */
+    private int $reposScanned  = 0;
+    private int $reposUpdated  = 0;
+    private int $prsCreated    = 0;
+    private int $autoMerged    = 0;
+    private int $reposFailed   = 0;
+
+    protected function configure(): void
+    {
+        $this->setDescription('Cross-repo dependency update automation');
+        $this->addArgument('--org',           'Organization to scan',                         'MokoConsulting');
+        $this->addArgument('--repos',         'Comma-separated list of specific repos',       '');
+        $this->addArgument('--exclude',       'Comma-separated list of repos to exclude',     '');
+        $this->addArgument('--skip-archived', 'Skip archived repositories',                   true);
+        $this->addArgument('--type',          'Dependency type: composer, npm, or all',       'all');
+        $this->addArgument('--patch-only',    'Only update patch versions (safe updates)',     false);
+        $this->addArgument('--auto-merge',    'Auto-merge PRs with only patch updates',       false);
+        $this->addArgument('--resume',        'Resume from checkpoint',                       false);
+    }
+
+    protected function run(): int
+    {
+        $this->log("Dependency Update Automation v" . self::VERSION, 'INFO');
+
+        if (!$this->initComponents()) {
+            return self::EXIT_FAILURE;
+        }
+
+        $org       = $this->getArgument('--org', 'MokoConsulting');
+        $depType   = strtolower($this->getArgument('--type', 'all'));
+        $patchOnly = $this->getArgument('--patch-only', false);
+        $autoMerge = $this->getArgument('--auto-merge', false);
+
+        // ── Gather repos ─────────────────────────────────────────────────
+        $repos = $this->gatherRepos($org);
+        if ($repos === null) {
+            return self::EXIT_FAILURE;
+        }
+
+        $total = count($repos);
+        $this->log("Found {$total} repositories to scan", 'INFO');
+
+        // ── Resume support ───────────────────────────────────────────────
+        $completed = [];
+        if ($this->getArgument('--resume', false)) {
+            $checkpoint = $this->checkpoints->load('deps_update');
+            if ($checkpoint) {
+                $completed = $checkpoint['completed'] ?? [];
+                $this->log("Resuming — skipping " . count($completed) . " already-processed repos", 'INFO');
+            }
+        }
+
+        // ── Process each repo ────────────────────────────────────────────
+        $this->section('Scanning repositories for outdated dependencies');
+
+        foreach ($repos as $i => $repo) {
+            $repoName = $repo['name'];
+            $this->progress($i + 1, $total, $repoName);
+
+            if (in_array($repoName, $completed, true)) {
+                continue;
+            }
+
+            try {
+                $this->processRepo($org, $repoName, $depType, $patchOnly, $autoMerge);
+                $completed[] = $repoName;
+
+                $this->checkpoints->save('deps_update', ['completed' => $completed]);
+            } catch (RateLimitExceeded $e) {
+                $this->log("Rate limit hit — checkpoint saved", 'WARNING');
+                break;
+            } catch (CircuitBreakerOpen $e) {
+                $this->log("Circuit breaker open — checkpoint saved", 'WARNING');
+                break;
+            } catch (\Exception $e) {
+                $this->log("Failed {$repoName}: {$e->getMessage()}", 'ERROR');
+                $this->reposFailed++;
+            }
+        }
+
+        $this->progress($total, $total, '', true);
+
+        // ── Summary ──────────────────────────────────────────────────────
+        $this->section('Summary');
+        $this->printSummary(
+            $this->reposScanned - $this->reposFailed,
+            $this->reposFailed,
+            $this->elapsed()
+        );
+
+        $this->log("Repos scanned: {$this->reposScanned}", 'INFO');
+        $this->log("Repos updated: {$this->reposUpdated}", 'INFO');
+        $this->log("PRs created:   {$this->prsCreated}", 'INFO');
+        if ($autoMerge) {
+            $this->log("Auto-merged:   {$this->autoMerged}", 'INFO');
+        }
+
+        if (count($completed) === $total) {
+            $this->checkpoints->clear('deps_update');
+        }
+
+        return $this->reposFailed > 0 ? self::EXIT_FAILURE : self::EXIT_SUCCESS;
+    }
+
+    // ── Component init ───────────────────────────────────────────────────
+
+    private function initComponents(): bool
+    {
+        try {
+            $config            = new Config();
+            $this->api         = new ApiClient($config);
+            $this->adapter     = PlatformAdapterFactory::create($this->api, $config);
+            $this->logger      = new AuditLogger();
+            $this->checkpoints = new CheckpointManager();
+            return true;
+        } catch (\Exception $e) {
+            $this->log("Failed to initialise: {$e->getMessage()}", 'ERROR');
+            return false;
+        }
+    }
+
+    // ── Repo gathering ───────────────────────────────────────────────────
+
+    private function gatherRepos(string $org): ?array
+    {
+        $specificRepos = array_filter(explode(',', $this->getArgument('--repos', '')));
+        $excludeRepos  = array_filter(explode(',', $this->getArgument('--exclude', '')));
+        $skipArchived  = $this->getArgument('--skip-archived', true);
+
+        // Default exclusions
+        $excludeRepos = array_merge($excludeRepos, [
+            'mokocli', '.mokogitea-private', 'org-profile',
+        ]);
+
+        try {
+            $repos = $this->adapter->listOrgRepos($org, $skipArchived);
+        } catch (\Exception $e) {
+            $this->log("Failed to list repos: {$e->getMessage()}", 'ERROR');
+            return null;
+        }
+
+        if (!empty($specificRepos)) {
+            $repos = array_filter($repos, fn($r) => in_array($r['name'], $specificRepos, true));
+        }
+        if (!empty($excludeRepos)) {
+            $repos = array_filter($repos, fn($r) => !in_array($r['name'], $excludeRepos, true));
+        }
+
+        return array_values($repos);
+    }
+
+    // ── Per-repo processing ──────────────────────────────────────────────
+
+    private function processRepo(
+        string $org,
+        string $repoName,
+        string $depType,
+        bool $patchOnly,
+        bool $autoMerge
+    ): void {
+        $this->reposScanned++;
+
+        $hasComposer = ($depType === 'all' || $depType === 'composer');
+        $hasNpm      = ($depType === 'all' || $depType === 'npm');
+
+        $outdated = [];
+
+        // ── Composer ─────────────────────────────────────────────────
+        if ($hasComposer) {
+            $composerOutdated = $this->scanComposer($org, $repoName, $patchOnly);
+            if ($composerOutdated !== null) {
+                $outdated['composer'] = $composerOutdated;
+            }
+        }
+
+        // ── npm ──────────────────────────────────────────────────────
+        if ($hasNpm) {
+            $npmOutdated = $this->scanNpm($org, $repoName, $patchOnly);
+            if ($npmOutdated !== null) {
+                $outdated['npm'] = $npmOutdated;
+            }
+        }
+
+        if (empty($outdated)) {
+            return;
+        }
+
+        // Check if there's already an open deps PR
+        if ($this->hasExistingDepsPR($org, $repoName)) {
+            $this->log("  {$repoName}: existing deps PR found — skipping", 'INFO');
+            return;
+        }
+
+        $this->reposUpdated++;
+
+        // ── Create PR ────────────────────────────────────────────────
+        $totalUpdates = 0;
+        $allPatchOnly = true;
+
+        foreach ($outdated as $type => $packages) {
+            $totalUpdates += count($packages);
+            foreach ($packages as $pkg) {
+                if (!$this->isPatchUpdate($pkg['current'] ?? '', $pkg['latest'] ?? '')) {
+                    $allPatchOnly = false;
+                }
+            }
+        }
+
+        $title = "chore(deps): update {$totalUpdates} " . ($totalUpdates === 1 ? 'dependency' : 'dependencies');
+        $body  = $this->buildPrBody($repoName, $outdated);
+        $branch = self::BRANCH_PREFIX . '-' . date('Y-m-d');
+
+        if ($this->dryRun) {
+            $this->log("[dry-run] Would create PR in {$repoName}: {$title}", 'INFO');
+            foreach ($outdated as $type => $packages) {
+                foreach ($packages as $pkg) {
+                    $this->log("  [{$type}] {$pkg['name']}: {$pkg['current']} → {$pkg['latest']}", 'INFO');
+                }
+            }
+            return;
+        }
+
+        try {
+            // Clone repo, run updates, push branch
+            $prNumber = $this->cloneUpdateAndPR($org, $repoName, $branch, $title, $body, $outdated);
+
+            if ($prNumber > 0) {
+                $this->prsCreated++;
+                $this->log("  {$repoName}: PR #{$prNumber} created", 'INFO');
+
+                // Auto-merge if all updates are patch-level
+                if ($autoMerge && $allPatchOnly && $prNumber > 0) {
+                    $this->tryAutoMerge($org, $repoName, $prNumber);
+                }
+            }
+        } catch (\Exception $e) {
+            $this->log("  {$repoName}: PR creation failed — {$e->getMessage()}", 'ERROR');
+        }
+    }
+
+    // ── Composer scanning ────────────────────────────────────────────────
+
+    private function scanComposer(string $org, string $repoName, bool $patchOnly): ?array
+    {
+        // Check if repo has composer.json
+        try {
+            $this->adapter->getFileContents($org, $repoName, 'composer.json');
+        } catch (\Exception $e) {
+            return null;
+        }
+
+        // Check if repo has composer.lock
+        try {
+            $this->adapter->getFileContents($org, $repoName, 'composer.lock');
+        } catch (\Exception $e) {
+            return null;
+        }
+
+        // Clone to temp dir and run composer outdated
+        $tmpDir = sys_get_temp_dir() . '/moko_deps_' . $repoName . '_' . getmypid();
+        @mkdir($tmpDir, 0700, true);
+
+        try {
+            $cloneUrl = $this->adapter->getCloneUrl($org, $repoName);
+            $cmd = sprintf(
+                'git clone --depth 1 --quiet %s %s 2>/dev/null',
+                escapeshellarg($cloneUrl),
+                escapeshellarg($tmpDir)
+            );
+            exec($cmd, $output, $exitCode);
+            if ($exitCode !== 0) {
+                return null;
+            }
+
+            // Run composer outdated
+            $flags = $patchOnly ? '--minor-only' : '';
+            $cmd = sprintf(
+                'composer outdated --format=json --no-interaction %s --working-dir=%s 2>/dev/null',
+                $flags,
+                escapeshellarg($tmpDir)
+            );
+            $json = shell_exec($cmd);
+            if ($json === null || $json === '') {
+                return null;
+            }
+
+            $data = json_decode($json, true);
+            $installed = $data['installed'] ?? [];
+
+            if (empty($installed)) {
+                return null;
+            }
+
+            $outdated = [];
+            foreach ($installed as $pkg) {
+                // Skip abandoned/dev packages
+                if (($pkg['abandoned'] ?? false) || str_starts_with($pkg['version'] ?? '', 'dev-')) {
+                    continue;
+                }
+
+                $outdated[] = [
+                    'name'    => $pkg['name'] ?? '',
+                    'current' => $pkg['version'] ?? '',
+                    'latest'  => $pkg['latest'] ?? '',
+                    'status'  => $pkg['latest-status'] ?? 'unknown',
+                ];
+            }
+
+            return empty($outdated) ? null : $outdated;
+        } finally {
+            // Cleanup
+            if (is_dir($tmpDir)) {
+                exec(sprintf('rm -rf %s', escapeshellarg($tmpDir)));
+            }
+        }
+    }
+
+    // ── npm scanning ─────────────────────────────────────────────────────
+
+    private function scanNpm(string $org, string $repoName, bool $patchOnly): ?array
+    {
+        // Check if repo has package.json
+        try {
+            $this->adapter->getFileContents($org, $repoName, 'package.json');
+        } catch (\Exception $e) {
+            return null;
+        }
+
+        // Check for lock file
+        $hasLock = false;
+        foreach (['package-lock.json', 'yarn.lock', 'pnpm-lock.yaml'] as $lockFile) {
+            try {
+                $this->adapter->getFileContents($org, $repoName, $lockFile);
+                $hasLock = true;
+                break;
+            } catch (\Exception $e) {
+                // continue
+            }
+        }
+
+        if (!$hasLock) {
+            return null;
+        }
+
+        $tmpDir = sys_get_temp_dir() . '/moko_deps_npm_' . $repoName . '_' . getmypid();
+        @mkdir($tmpDir, 0700, true);
+
+        try {
+            $cloneUrl = $this->adapter->getCloneUrl($org, $repoName);
+            exec(sprintf('git clone --depth 1 --quiet %s %s 2>/dev/null',
+                escapeshellarg($cloneUrl), escapeshellarg($tmpDir)));
+
+            if (!file_exists("{$tmpDir}/package.json")) {
+                return null;
+            }
+
+            // Install deps first (needed for npm outdated)
+            exec(sprintf('cd %s && npm install --silent 2>/dev/null', escapeshellarg($tmpDir)));
+
+            $json = shell_exec(sprintf('cd %s && npm outdated --json 2>/dev/null', escapeshellarg($tmpDir)));
+            if ($json === null || $json === '' || $json === '{}') {
+                return null;
+            }
+
+            $data = json_decode($json, true);
+            if (!is_array($data) || empty($data)) {
+                return null;
+            }
+
+            $outdated = [];
+            foreach ($data as $name => $info) {
+                $current = $info['current'] ?? '';
+                $wanted  = $info['wanted'] ?? '';
+                $latest  = $info['latest'] ?? '';
+                $target  = $patchOnly ? $wanted : $latest;
+
+                if ($current === $target || $target === '') {
+                    continue;
+                }
+
+                $outdated[] = [
+                    'name'    => $name,
+                    'current' => $current,
+                    'latest'  => $target,
+                    'status'  => ($current === $wanted) ? 'up-to-date' : 'outdated',
+                ];
+            }
+
+            return empty($outdated) ? null : $outdated;
+        } finally {
+            if (is_dir($tmpDir)) {
+                exec(sprintf('rm -rf %s', escapeshellarg($tmpDir)));
+            }
+        }
+    }
+
+    // ── PR creation ──────────────────────────────────────────────────────
+
+    private function cloneUpdateAndPR(
+        string $org,
+        string $repoName,
+        string $branch,
+        string $title,
+        string $body,
+        array $outdated
+    ): int {
+        $tmpDir = sys_get_temp_dir() . '/moko_deps_pr_' . $repoName . '_' . getmypid();
+        @mkdir($tmpDir, 0700, true);
+
+        try {
+            $cloneUrl = $this->adapter->getCloneUrl($org, $repoName);
+            exec(sprintf('git clone --quiet %s %s 2>/dev/null',
+                escapeshellarg($cloneUrl), escapeshellarg($tmpDir)));
+
+            // Create branch
+            exec(sprintf('git -C %s checkout -b %s 2>/dev/null',
+                escapeshellarg($tmpDir), escapeshellarg($branch)));
+
+            $updated = false;
+
+            // Run composer update if needed
+            if (isset($outdated['composer'])) {
+                $packages = array_column($outdated['composer'], 'name');
+                $cmd = sprintf(
+                    'cd %s && composer update %s --no-interaction --quiet 2>/dev/null',
+                    escapeshellarg($tmpDir),
+                    implode(' ', array_map('escapeshellarg', $packages))
+                );
+                exec($cmd, $output, $exitCode);
+                if ($exitCode === 0) {
+                    $updated = true;
+                }
+            }
+
+            // Run npm update if needed
+            if (isset($outdated['npm'])) {
+                $packages = array_column($outdated['npm'], 'name');
+                $cmd = sprintf(
+                    'cd %s && npm update %s --save 2>/dev/null',
+                    escapeshellarg($tmpDir),
+                    implode(' ', array_map('escapeshellarg', $packages))
+                );
+                exec($cmd, $output, $exitCode);
+                if ($exitCode === 0) {
+                    $updated = true;
+                }
+            }
+
+            if (!$updated) {
+                return 0;
+            }
+
+            // Commit and push
+            exec(sprintf('git -C %s config user.email "gitea-actions[bot]@mokoconsulting.tech"', escapeshellarg($tmpDir)));
+            exec(sprintf('git -C %s config user.name "gitea-actions[bot]"', escapeshellarg($tmpDir)));
+            exec(sprintf('git -C %s add -A', escapeshellarg($tmpDir)));
+
+            // Check if there are actual changes
+            exec(sprintf('git -C %s diff --cached --quiet', escapeshellarg($tmpDir)), $output, $diffExit);
+            if ($diffExit === 0) {
+                return 0; // No changes
+            }
+
+            exec(sprintf('git -C %s commit -m %s',
+                escapeshellarg($tmpDir),
+                escapeshellarg($title . " [skip ci]")));
+            exec(sprintf('git -C %s push origin %s 2>/dev/null',
+                escapeshellarg($tmpDir), escapeshellarg($branch)), $output, $pushExit);
+
+            if ($pushExit !== 0) {
+                $this->log("  {$repoName}: push failed", 'ERROR');
+                return 0;
+            }
+
+            // Create PR via API
+            $defaultBranch = $this->getDefaultBranch($org, $repoName);
+            $pr = $this->adapter->createPullRequest(
+                $org, $repoName, $title, $branch, $defaultBranch, $body, [
+                    'labels' => ['dependencies'],
+                ]
+            );
+
+            return (int) ($pr['number'] ?? 0);
+        } finally {
+            if (is_dir($tmpDir)) {
+                exec(sprintf('rm -rf %s', escapeshellarg($tmpDir)));
+            }
+        }
+    }
+
+    // ── Auto-merge ───────────────────────────────────────────────────────
+
+    private function tryAutoMerge(string $org, string $repoName, int $prNumber): void
+    {
+        try {
+            $this->api->put(
+                "/repos/{$org}/{$repoName}/pulls/{$prNumber}/merge",
+                ['Do' => 'squash', 'merge_message_field' => 'chore(deps): auto-merge patch updates']
+            );
+            $this->autoMerged++;
+            $this->log("  {$repoName}: PR #{$prNumber} auto-merged", 'INFO');
+        } catch (\Exception $e) {
+            $this->log("  {$repoName}: auto-merge failed — {$e->getMessage()}", 'WARNING');
+        }
+    }
+
+    // ── Helpers ───────────────────────────────────────────────────────────
+
+    private function hasExistingDepsPR(string $org, string $repoName): bool
+    {
+        try {
+            $prs = $this->adapter->listPullRequests($org, $repoName, ['state' => 'open']);
+            foreach ($prs as $pr) {
+                if (str_starts_with($pr['head']['ref'] ?? '', self::BRANCH_PREFIX)) {
+                    return true;
+                }
+            }
+        } catch (\Exception $e) {
+            // Ignore — proceed with creating PR
+        }
+        return false;
+    }
+
+    private function getDefaultBranch(string $org, string $repoName): string
+    {
+        try {
+            $repo = $this->api->get("/repos/{$org}/{$repoName}");
+            return $repo['default_branch'] ?? 'main';
+        } catch (\Exception $e) {
+            return 'main';
+        }
+    }
+
+    private function isPatchUpdate(string $current, string $latest): bool
+    {
+        $cur = explode('.', ltrim($current, 'v'));
+        $lat = explode('.', ltrim($latest, 'v'));
+
+        if (count($cur) < 3 || count($lat) < 3) {
+            return false;
+        }
+
+        // Same major and minor, only patch differs
+        return $cur[0] === $lat[0] && $cur[1] === $lat[1] && $cur[2] !== $lat[2];
+    }
+
+    private function buildPrBody(string $repoName, array $outdated): string
+    {
+        $lines = [
+            "## Dependency Updates",
+            "",
+            "**Repository**: `{$repoName}`",
+            "**Scanned**: " . date('Y-m-d H:i:s'),
+            "",
+        ];
+
+        foreach ($outdated as $type => $packages) {
+            $lines[] = "### " . ucfirst($type);
+            $lines[] = "";
+            $lines[] = "| Package | Current | Latest | Type |";
+            $lines[] = "|---------|---------|--------|------|";
+
+            foreach ($packages as $pkg) {
+                $updateType = $this->isPatchUpdate($pkg['current'], $pkg['latest']) ? 'patch' : 'minor/major';
+                $lines[] = "| `{$pkg['name']}` | {$pkg['current']} | {$pkg['latest']} | {$updateType} |";
+            }
+
+            $lines[] = "";
+        }
+
+        $lines[] = "---";
+        $lines[] = "*Auto-generated by `moko deps:update`*";
+
+        return implode("\n", $lines);
+    }
+}
+
+$script = new UpdateDependencies('update_dependencies', 'Cross-repo dependency update automation');
+exit($script->execute());
@@ -14,8 +14,8 @@
 * (at your option) any later version.
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Enterprise.CLI
- * INGROUP: MokoCLI.Enterprise
+ * DEFGROUP: MokoPlatform.Enterprise.CLI
+ * INGROUP: MokoPlatform.Enterprise
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/audit_query.php
 * BRIEF: Search, filter, and export audit logs
@@ -1,158 +0,0 @@
-<?php
-/**
- * @package     MokoCLI
- * @subpackage  cli
- * @author      Moko Consulting <hello@mokoconsulting.tech>
- * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
- * @license     GNU General Public License version 3 or later; see LICENSE
- * SPDX-License-Identifier: GPL-3.0-or-later
- *
- * Enforce branch protection rules across all repos in the org.
- *
- * Usage:
- *   php cli/branch_protect_org.php --token TOKEN [--org MokoConsulting] [--dry-run]
- *
- * Branch flow: feature/* -> dev -> rc -> main
- *   main, dev, rc: push whitelist only (no direct push)
- *   alpha, beta:   push whitelist only (pre-release)
- */
-
-declare(strict_types=1);
-
-$options = getopt('', ['token:', 'org:', 'api-base:', 'dry-run', 'help']);
-
-if (isset($options['help']) || empty($options['token'])) {
-    echo "Usage: php cli/branch_protect_org.php --token TOKEN [--org ORG] [--api-base URL] [--dry-run]\n";
-    echo "\n";
-    echo "Options:\n";
-    echo "  --token      Gitea API token (required)\n";
-    echo "  --org        Organization name (default: MokoConsulting)\n";
-    echo "  --api-base   API base URL (default: https://git.mokoconsulting.tech/api/v1)\n";
-    echo "  --dry-run    Show what would be changed without making changes\n";
-    exit(0);
-}
-
-$token   = $options['token'];
-$org     = $options['org'] ?? 'MokoConsulting';
-$apiBase = rtrim($options['api-base'] ?? 'https://git.mokoconsulting.tech/api/v1', '/');
-$dryRun  = isset($options['dry-run']);
-
-// Protected branches and their rules
-$branchRules = [
-    // Primary branches (flow: feature/* -> dev -> rc -> main)
-    'main'  => ['enable_push' => true, 'enable_push_whitelist' => true, 'push_whitelist_usernames' => ['jmiller']],
-    'dev'   => ['enable_push' => true, 'enable_push_whitelist' => true, 'push_whitelist_usernames' => ['jmiller']],
-    'rc'    => ['enable_push' => true, 'enable_push_whitelist' => true, 'push_whitelist_usernames' => ['jmiller']],
-    'beta'  => ['enable_push' => true, 'enable_push_whitelist' => true, 'push_whitelist_usernames' => ['jmiller']],
-    'alpha' => ['enable_push' => true, 'enable_push_whitelist' => true, 'push_whitelist_usernames' => ['jmiller']],
-
-    // Synonyms (prevent bypass via alternate names)
-    'master'     => ['enable_push' => true, 'enable_push_whitelist' => true, 'push_whitelist_usernames' => ['jmiller']],
-    'develop'    => ['enable_push' => true, 'enable_push_whitelist' => true, 'push_whitelist_usernames' => ['jmiller']],
-    'release'    => ['enable_push' => true, 'enable_push_whitelist' => true, 'push_whitelist_usernames' => ['jmiller']],
-    'production' => ['enable_push' => true, 'enable_push_whitelist' => true, 'push_whitelist_usernames' => ['jmiller']],
-    'stable'     => ['enable_push' => true, 'enable_push_whitelist' => true, 'push_whitelist_usernames' => ['jmiller']],
-    'staging'    => ['enable_push' => true, 'enable_push_whitelist' => true, 'push_whitelist_usernames' => ['jmiller']],
-];
-
-function apiRequest(string $method, string $url, string $token, ?array $body = null): array
-{
-    $ch = curl_init($url);
-    curl_setopt_array($ch, [
-        CURLOPT_CUSTOMREQUEST  => $method,
-        CURLOPT_RETURNTRANSFER => true,
-        CURLOPT_HTTPHEADER     => [
-            'Authorization: token ' . $token,
-            'Content-Type: application/json',
-            'Accept: application/json',
-        ],
-        CURLOPT_TIMEOUT => 30,
-    ]);
-
-    if ($body !== null) {
-        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body));
-    }
-
-    $response = curl_exec($ch);
-    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
-    curl_close($ch);
-
-    return [
-        'status' => $httpCode,
-        'data'   => json_decode($response, true) ?: [],
-    ];
-}
-
-// 1. List all org repos
-echo "Fetching repos for {$org}...\n";
-$page = 1;
-$repos = [];
-
-do {
-    $result = apiRequest('GET', "{$apiBase}/orgs/{$org}/repos?limit=50&page={$page}", $token);
-    $batch = $result['data'];
-    $repos = array_merge($repos, $batch);
-    $page++;
-} while (count($batch) === 50);
-
-echo sprintf("Found %d repos\n\n", count($repos));
-
-$summary = ['protected' => 0, 'added' => 0, 'skipped' => 0, 'errors' => 0];
-
-foreach ($repos as $repo) {
-    $repoName = $repo['name'];
-
-    if ($repo['archived'] ?? false) {
-        continue;
-    }
-
-    // Get existing protections
-    $existing = apiRequest('GET', "{$apiBase}/repos/{$org}/{$repoName}/branch_protections", $token);
-    $existingNames = array_map(fn($p) => $p['branch_name'] ?? '', $existing['data'] ?: []);
-
-    $added = [];
-    $skipped = [];
-
-    foreach ($branchRules as $branch => $rules) {
-        if (in_array($branch, $existingNames, true)) {
-            $skipped[] = $branch;
-            $summary['skipped']++;
-            continue;
-        }
-
-        if ($dryRun) {
-            $added[] = $branch;
-            $summary['added']++;
-            continue;
-        }
-
-        $body = array_merge($rules, ['branch_name' => $branch]);
-        $result = apiRequest('POST', "{$apiBase}/repos/{$org}/{$repoName}/branch_protections", $token, $body);
-
-        if ($result['status'] >= 200 && $result['status'] < 300) {
-            $added[] = $branch;
-            $summary['added']++;
-        } elseif ($result['status'] === 422) {
-            $skipped[] = $branch;
-            $summary['skipped']++;
-        } else {
-            $added[] = "{$branch}(ERR:{$result['status']})";
-            $summary['errors']++;
-        }
-    }
-
-    $summary['protected']++;
-
-    if (!empty($added)) {
-        $prefix = $dryRun ? '[DRY-RUN] ' : '';
-        echo sprintf("  %s%-35s added: %s\n", $prefix, $repoName, implode(', ', $added));
-    }
-}
-
-echo "\n";
-echo sprintf("Summary: %d repos, %d rules added, %d already existed, %d errors\n",
-    $summary['protected'], $summary['added'], $summary['skipped'], $summary['errors']);
-
-if ($dryRun) {
-    echo "\n(Dry run - no changes made)\n";
-}
@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/branch_rename.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Rename a git branch via Gitea API (create new, update PR, delete old)
 */

@@ -64,46 +64,26 @@ class BranchRenameCli extends CliFramework
            return 1;
        }

-        // Step 2: Point the target branch at the source commit.
-        // If the target already exists (e.g. a protected `rc` branch that cannot be
-        // deleted), force-update its ref in place instead of delete+recreate: deleting a
-        // protected branch fails, which then makes the recreate return HTTP 409.
-        $sourceSha = '';
-        if (isset($check['body']['commit']['id']) && is_string($check['body']['commit']['id'])) {
-            $sourceSha = $check['body']['commit']['id'];
-        }
+        // Step 2: Delete target branch if it already exists
        $targetCheck = $this->apiRequest('GET', "{$apiBase}/branches/{$to}", $headers);
        if ($targetCheck['code'] === 200) {
-            echo "Target branch '{$to}' already exists - force-updating to {$from}
-";
+            echo "Target branch '{$to}' already exists — deleting\n";
            if (!$this->dryRun) {
-                if ($sourceSha === '') {
-                    $this->log('ERROR', "Cannot resolve HEAD commit of source '{$from}'");
-                    return 1;
-                }
-                $ref = $this->apiRequest('PATCH', "{$apiBase}/git/refs/heads/{$to}", $headers, [
-                    'sha'   => $sourceSha,
-                    'force' => true,
-                ]);
-                if ($ref['code'] < 200 || $ref['code'] >= 300) {
-                    $this->log('ERROR', "Failed to force-update '{$to}': HTTP {$ref['code']} (needs force-push perm)");
-                    $this->log('ERROR', json_encode($ref['body']));
-                    return 1;
-                }
+                $this->apiRequest('DELETE', "{$apiBase}/branches/{$to}", $headers);
            }
-        } else {
-            echo "Creating branch: {$to} (from {$from})
-";
-            if (!$this->dryRun) {
-                $create = $this->apiRequest('POST', "{$apiBase}/branches", $headers, [
-                    'new_branch_name' => $to,
-                    'old_branch_name' => $from,
-                ]);
-                if ($create['code'] < 200 || $create['code'] >= 300) {
-                    $this->log('ERROR', "Failed to create branch '{$to}': HTTP {$create['code']}");
-                    $this->log('ERROR', json_encode($create['body']));
-                    return 1;
-                }
+        }
+
+        // Step 3: Create new branch from source
+        echo "Creating branch: {$to} (from {$from})\n";
+        if (!$this->dryRun) {
+            $create = $this->apiRequest('POST', "{$apiBase}/branches", $headers, [
+                'new_branch_name' => $to,
+                'old_branch_name' => $from,
+            ]);
+            if ($create['code'] < 200 || $create['code'] >= 300) {
+                $this->log('ERROR', "Failed to create branch '{$to}': HTTP {$create['code']}");
+                $this->log('ERROR', json_encode($create['body']));
+                return 1;
            }
        }

@@ -12,7 +12,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/bulk_workflow_push.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Push a workflow file to all governed repos via the Gitea Contents API
 */

@@ -12,7 +12,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/bulk_workflow_trigger.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Trigger a workflow across multiple repos at once
 */

@@ -12,7 +12,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/client_dashboard.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Generate unified client dashboard HTML
 */

@@ -127,7 +127,7 @@ class ClientDashboardCli extends CliFramework
                    $name = $repo['name'] ?? '';

                    if (
-                        !str_starts_with($name, 'client-waas-') && !str_starts_with($name, 'client-mokosuite-')
+                        !str_starts_with($name, 'client-waas-')
                        || !empty($repo['archived'])
                    ) {
                        continue;
@@ -135,7 +135,7 @@ class ClientDashboardCli extends CliFramework

                    $clients[] = [
                        'repo' => $repo['full_name'] ?? '',
-                        'name' => str_replace(['client-waas-', 'client-mokosuite-'], '', $name),
+                        'name' => str_replace('client-waas-', '', $name),
                        'description' => $repo['description'] ?? '',
                        'updated' => $repo['updated_at'] ?? '',
                        'url' => $repo['html_url'] ?? '',
@@ -12,7 +12,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/client_inventory.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Discover and list all client-waas repos with their server configuration status
 */

@@ -79,7 +79,7 @@ class ClientInventoryCli extends CliFramework
            foreach ($repos as $repo) {
                $repoName = $repo['name'] ?? '';

-                if (strpos($repoName, 'client-waas') === false && strpos($repoName, 'client-mokosuite') === false) {
+                if (strpos($repoName, 'client-waas') === false) {
                    continue;
                }

@@ -12,7 +12,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/client_provision.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Provision a new client environment end-to-end
 */

@@ -87,7 +87,7 @@ class ClientProvisionCli extends CliFramework
            return 1;
        }

-        $this->repoName = 'client-mokosuite-' . $clientName;
+        $this->repoName = 'client-waas-' . $clientName;

        $this->log('INFO', "=== Client Provisioning: {$clientName} ===");
        $this->log('INFO', "  Org:  {$this->org}");
@@ -104,7 +104,7 @@ class ClientProvisionCli extends CliFramework
            'variables' => 'setVariables',
            'secrets' => 'setSecrets',
            'monitoring' => 'setupMonitoring',
-            'summary' => 'printProvisioningSummary',
+            'summary' => 'printSummary',
        ];

        $exitCode = 0;
@@ -156,7 +156,7 @@ class ClientProvisionCli extends CliFramework
        $resp = $this->giteaApi(
            'POST',
            '/api/v1/repos/MokoConsulting/'
-            . 'Template-Client/generate',
+            . 'Template-Client-WaaS/generate',
            $payload
        );

@@ -383,7 +383,7 @@ class ClientProvisionCli extends CliFramework
        return 0;
    }

-    private function printProvisioningSummary(): int
+    private function printSummary(): int
    {
        $vars = $this->config['variables'] ?? [];
        $secrets = $this->config['secrets'] ?? [];
@@ -95,10 +95,6 @@ class CreateProjectCli extends CliFramework

        $repoRoot     = dirname(__DIR__, 2);
        $templatesDir = "{$repoRoot}/templates/projects";
-        if (!is_dir($templatesDir)) {
-            $this->log('ERROR', "Project templates directory not found: {$templatesDir}");
-            return 1;
-        }

        $repos = [];

@@ -8,8 +8,8 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.CLI
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.CLI
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/deploy_joomla.php
 * BRIEF: Smart Joomla deploy — routes files to correct server directories by extension type
@@ -12,7 +12,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/grafana_dashboard.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Manage Grafana dashboards via API
 */

@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/joomla_build.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Build a Joomla extension ZIP from manifest — all types supported
 * NOTE: Called by pre-release and auto-release workflows.
 */
@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/joomla_metadata_validate.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Validate MokoGitea repo metadata against Joomla extension manifest XML
 */

@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/manifest_detect.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Auto-detect manifest fields from source files and optionally push to API
 */

@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/manifest_integrity.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Cross-check manifest API fields against repo contents across the org
 */

@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/manifest_licensing.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Ensure licensing tags (updateservers, dlid) in Joomla extension manifests
 */

@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/manifest_read.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Read repo metadata from Gitea manifest API, auto-detect the rest
 */

@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/platform_detect.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Auto-detect repository platform type and optionally update manifest
 */

@@ -40,6 +40,7 @@ class ReleaseCli extends CliFramework
        $bulkSyncFile = file_exists("{$repoRoot}/.mokogitea/workflows/bulk-repo-sync.yml")
            ? "{$repoRoot}/.mokogitea/workflows/bulk-repo-sync.yml"
            : "{$repoRoot}/.github/workflows/bulk-repo-sync.yml";
+        $cleanupFile = "{$repoRoot}/templates/workflows/shared/repository-cleanup.yml.template";

        // -- Step 1: Read current version --
        $readme = "{$repoRoot}/README.md";
@@ -130,7 +131,19 @@ class ReleaseCli extends CliFramework
            file_put_contents($bulkSyncFile, $bulkContent);
        }

-        // -- Step 5: Commit changes --
+        // -- Step 5: Update repository-cleanup.yml current branch --
+        echo "Updating repository-cleanup.yml -> chore/sync-mokostandards-v{$minorVersion}\n";
+        if (!$this->dryRun) {
+            $cleanupContent = file_get_contents($cleanupFile);
+            $cleanupContent = preg_replace(
+                '/CURRENT="chore\/sync-mokostandards-v[^"]*"/',
+                "CURRENT=\"chore/sync-mokostandards-v{$minorVersion}\"",
+                $cleanupContent
+            );
+            file_put_contents($cleanupFile, $cleanupContent);
+        }
+
+        // -- Step 6: Commit changes --
        if (!$this->dryRun) {
            echo "Committing...\n";
            passthru("cd {$repoRoot} && git add -A && git commit -m \"chore(release): prepare {$currentVersion} release [skip ci]\"");
@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/release_cascade.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Cascade release zip to all lower stability channels
 */

@@ -250,6 +250,14 @@ class ReleasePackageCli extends CliFramework
                }
                $subZipPath = "{$outputDir}/{$subName}.zip";

+                // Use pre-built ZIP if staged in the output directory
+                if (file_exists($subZipPath) && filesize($subZipPath) > 0) {
+                    $zip->addFile($subZipPath, "packages/{$subName}.zip");
+                    $sizeKb = number_format(filesize($subZipPath) / 1024, 1);
+                    echo "  Sub-package: {$subName}.zip (pre-built, {$sizeKb} KB)\n";
+                    continue;
+                }
+
                // If sub-package is a full repo checkout (e.g. git submodule),
                // look for a source/ or src/ subdirectory containing a Joomla manifest XML
                // and zip that instead of the repo root.
@@ -270,90 +278,22 @@ class ReleasePackageCli extends CliFramework
                    }
                }

-                // Check if sub-source is itself a Joomla package (nested package)
-                $nestedPkgManifests = glob("{$subSourceDir}/pkg_*.xml") ?: [];
-                $isNestedPackage = !empty($nestedPkgManifests) && is_dir("{$subSourceDir}/packages");
+                // If source dir has no manifest, the submodule may be empty.
+                // Try to download the pre-built release from Gitea.
+                $hasManifest = !empty(glob("{$subSourceDir}/*.xml") ?: []);
+                if (!$hasManifest && $token !== '' && $this->downloadSubmoduleRelease($root, $subName, $subZipPath, $token)) {
+                    $zip->addFile($subZipPath, "packages/{$subName}.zip");
+                    $sizeKb = number_format(filesize($subZipPath) / 1024, 1);
+                    echo "  Sub-package: {$subName}.zip (downloaded release, {$sizeKb} KB)\n";
+                    continue;
+                }

                $subZip = new \ZipArchive();
                if ($subZip->open($subZipPath, \ZipArchive::CREATE | \ZipArchive::OVERWRITE) !== true) {
                    $this->log('ERROR', "Failed to create sub-package ZIP: {$subZipPath}");
                    continue;
                }
-
-                if ($isNestedPackage) {
-                    // Build nested package: zip each sub-extension, then assemble
-                    echo "  Building nested package: {$subName}\n";
-                    $nestedPkgDirs = glob("{$subSourceDir}/packages/*", GLOB_ONLYDIR) ?: [];
-
-                    $nestedManifested = [];
-                    foreach ($nestedPkgManifests as $npmf) {
-                        $npmXml = @simplexml_load_file($npmf);
-                        if ($npmXml && isset($npmXml->files)) {
-                            foreach ($npmXml->files->file as $fn) {
-                                $nzn = pathinfo((string) $fn, PATHINFO_FILENAME);
-                                if (!empty($nzn)) {
-                                    $nestedManifested[$nzn] = true;
-                                }
-                            }
-                        }
-                    }
-
-                    // Use a subdirectory to avoid filename collisions with outer ZIPs
-                    $nestedOutputDir = "{$outputDir}/nested_{$subName}";
-                    @mkdir($nestedOutputDir, 0755, true);
-
-                    foreach ($nestedPkgDirs as $npd) {
-                        $nestedSubName = basename($npd);
-                        if (!empty($nestedManifested) && !isset($nestedManifested[$nestedSubName])) {
-                            continue;
-                        }
-                        $nestedSubZipPath = "{$nestedOutputDir}/{$nestedSubName}.zip";
-                        $nsZip = new \ZipArchive();
-                        if ($nsZip->open($nestedSubZipPath, \ZipArchive::CREATE | \ZipArchive::OVERWRITE) !== true) {
-                            continue;
-                        }
-                        $this->addDirToZip($nsZip, $npd, '', $this->excludePatterns);
-                        $nsZip->close();
-                        $subZip->addFile($nestedSubZipPath, "packages/{$nestedSubName}.zip");
-                        echo "    Nested sub: {$nestedSubName}.zip\n";
-                    }
-
-                    // Patch nested manifest: ensure folder="packages" so Joomla finds sub-ZIPs
-                    foreach ($nestedPkgManifests as $npmf) {
-                        $npmContent = file_get_contents($npmf);
-                        if ($npmContent !== false
-                            && strpos($npmContent, '<files>') !== false
-                            && strpos($npmContent, 'folder="packages"') === false
-                        ) {
-                            $npmContent = str_replace('<files>', '<files folder="packages">', $npmContent);
-                            file_put_contents($npmf, $npmContent);
-                            echo "    Fixed: added folder=\"packages\" to " . basename($npmf) . "\n";
-                        }
-                    }
-
-                    // Add top-level files (manifest, script, etc.) with exclude filter
-                    $nestedTopFiles = array_merge(
-                        glob("{$subSourceDir}/*.xml") ?: [],
-                        glob("{$subSourceDir}/*.php") ?: []
-                    );
-                    foreach ($nestedTopFiles as $ntf) {
-                        if (!$this->isExcluded(basename($ntf), $this->excludePatterns)) {
-                            $subZip->addFile($ntf, basename($ntf));
-                        }
-                    }
-
-                    // Add all top-level directories except packages/
-                    $nestedTopDirs = glob("{$subSourceDir}/*", GLOB_ONLYDIR) ?: [];
-                    foreach ($nestedTopDirs as $ntd) {
-                        $ndName = basename($ntd);
-                        if ($ndName === 'packages') {
-                            continue;
-                        }
-                        $this->addDirToZip($subZip, $ntd, $ndName, $this->excludePatterns);
-                    }
-                } else {
-                    $this->addDirToZip($subZip, $subSourceDir, '', $this->excludePatterns);
-                }
+                $this->addDirToZip($subZip, $subSourceDir, '', $this->excludePatterns);
                $subZip->close();

                $zip->addFile($subZipPath, "packages/{$subName}.zip");
@@ -605,6 +545,103 @@ class ReleasePackageCli extends CliFramework
        return false;
    }

+    /**
+     * Download a pre-built release ZIP for a sub-package that is a git submodule
+     * with an empty or missing source directory.
+     *
+     * Reads .gitmodules to find the submodule's remote URL, derives the Gitea
+     * API path, and downloads the latest stable release asset.
+     */
+    private function downloadSubmoduleRelease(string $root, string $subName, string $destPath, string $token): bool
+    {
+        $gitmodulesPath = "{$root}/.gitmodules";
+        if (!file_exists($gitmodulesPath)) {
+            return false;
+        }
+
+        $gitmodules = file_get_contents($gitmodulesPath);
+        if ($gitmodules === false) {
+            return false;
+        }
+
+        // Find the submodule URL by matching the subName in the path
+        if (!preg_match('/\[submodule\s[^\]]*\]\s*\n\s*path\s*=\s*[^\n]*' . preg_quote($subName, '/') . '\s*\n\s*url\s*=\s*(\S+)/m', $gitmodules, $matches)) {
+            return false;
+        }
+
+        $remoteUrl = preg_replace('/\.git$/', '', $matches[1]);
+
+        // Extract org/repo from the URL
+        if (!preg_match('#[/:]([^/]+)/([^/]+)$#', $remoteUrl, $parts)) {
+            return false;
+        }
+
+        $org  = $parts[1];
+        $repo = $parts[2];
+
+        // Derive the Gitea API base from the remote URL
+        $parsed = parse_url($remoteUrl);
+        $scheme = $parsed['scheme'] ?? 'https';
+        $host   = $parsed['host'] ?? '';
+        if ($host === '') {
+            return false;
+        }
+        $apiBase = "{$scheme}://{$host}/api/v1/repos/{$org}/{$repo}";
+
+        echo "  Submodule {$subName}: source empty, downloading release from {$org}/{$repo}...\n";
+
+        // Get the stable release
+        $result = $this->giteaApiRequest("{$apiBase}/releases/tags/stable", $token);
+        if ($result['data'] === null || !isset($result['data']['assets'])) {
+            echo "  WARNING: No stable release found for {$org}/{$repo}\n";
+            return false;
+        }
+
+        // Find the ZIP asset (not .sha256)
+        $downloadUrl = '';
+        foreach ($result['data']['assets'] as $asset) {
+            if (!is_array($asset)) {
+                continue;
+            }
+            $name = $asset['name'] ?? '';
+            if (str_ends_with($name, '.zip') && !str_ends_with($name, '.sha256')) {
+                $downloadUrl = $asset['browser_download_url'] ?? '';
+                break;
+            }
+        }
+
+        if ($downloadUrl === '') {
+            echo "  WARNING: No ZIP asset in {$org}/{$repo} stable release\n";
+            return false;
+        }
+
+        // Download the ZIP
+        $ch = curl_init($downloadUrl);
+        if ($ch === false) {
+            return false;
+        }
+        curl_setopt_array($ch, [
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_FOLLOWLOCATION => true,
+            CURLOPT_HTTPHEADER => ["Authorization: token {$token}"],
+            CURLOPT_TIMEOUT => 120,
+        ]);
+        $content = curl_exec($ch);
+        $httpCode = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
+        curl_close($ch);
+
+        if ($httpCode < 200 || $httpCode >= 300 || !is_string($content) || $content === '') {
+            echo "  WARNING: Download failed (HTTP {$httpCode})\n";
+            return false;
+        }
+
+        if (file_put_contents($destPath, $content) === false) {
+            return false;
+        }
+
+        return true;
+    }
+
    /**
     * Recursively add files from a directory to a ZipArchive.
     */
@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/release_publish.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Publish a release and create copies for all lesser stability streams.
 */

@@ -254,6 +254,17 @@ class ReleasePublishCli extends CliFramework
        // -- Step 3: Build release package --
        echo "\n--- Step 3: Build and upload release ---\n";
        $releaseTag = $releaseTagMap[$stability];
+
+        // For non-Joomla platforms, use semver tags instead of stream tags
+        $platformOutput = [];
+        exec("{$php} {$cli}/manifest_read.php --path " . escapeshellarg($resolvedPath) . " --field platform 2>/dev/null", $platformOutput);
+        $platform = trim($platformOutput[0] ?? '');
+        if ($platform !== '' && !str_starts_with($platform, 'joomla')) {
+            $releaseTag = 'v' . $releaseVersion;
+            echo "  Platform: {$platform} — using semver tag: {$releaseTag}
+";
+        }
+
        $sha256 = '';

        if (!$this->dryRun) {
@@ -12,8 +12,8 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/scaffold_client.php
- * VERSION: 09.43.00
- * BRIEF: Scaffold a new client-waas repo from Template-Client with pre-configured settings
+ * VERSION: 09.38.05
+ * BRIEF: Scaffold a new client-waas repo from Template-Client-WaaS with pre-configured settings
 */

 declare(strict_types=1);
@@ -26,7 +26,7 @@ class ScaffoldClientCli extends CliFramework
 {
    protected function configure(): void
    {
-        $this->setDescription('Scaffold a new client-waas repo from Template-Client');
+        $this->setDescription('Scaffold a new client-waas repo from Template-Client-WaaS');
        $this->addArgument('--name', 'Client name', '');
        $this->addArgument('--org', 'Gitea organization', '');
        $this->addArgument('--gitea-url', 'Gitea URL', 'https://git.mokoconsulting.tech');
@@ -47,7 +47,7 @@ class ScaffoldClientCli extends CliFramework
        $this->log('INFO', "Scaffolding client repo: {$org}/{$repoName}");
        $this->log('INFO', "Gitea URL: {$giteaUrl}");
        if ($this->dryRun) {
-            $this->log('INFO', '[DRY RUN] Would create repo from template MokoConsulting/Template-Client');
+            $this->log('INFO', '[DRY RUN] Would create repo from template MokoConsulting/Template-Client-WaaS');
            $this->log('INFO', "[DRY RUN] Repo: {$org}/{$repoName}");
            $this->printPostSetupInstructions($repoName, $giteaUrl, $org);
            return 0;
@@ -64,7 +64,7 @@ class ScaffoldClientCli extends CliFramework
        ]);
        $response = $this->apiRequest(
            'POST',
-            "/api/v1/repos/MokoConsulting/Template-Client/generate",
+            "/api/v1/repos/MokoConsulting/Template-Client-WaaS/generate",
            $giteaUrl,
            $token,
            $createPayload
@@ -1,294 +0,0 @@
-#!/usr/bin/env php
-<?php
-
-/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
- *
- * SPDX-License-Identifier: GPL-3.0-or-later
- *
- * FILE INFORMATION
- * DEFGROUP: mokocli.CLI
- * INGROUP: mokocli
- * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
- * PATH: /cli/theme_vars_check.php
- * BRIEF: Validate a client MokoOnyx theme package — required CSS variables
- *        (derived dynamically from the MokoOnyx standard theme) are defined in
- *        the client's light/dark custom CSS, required files exist, the manifest
- *        is sane, and (optionally) the repo's Gitea metadata is set.
- *
- * Standalone (no CliFramework dependency) so it runs even when the shared
- * framework autoloader is unavailable.
- *
- * Usage:
- *   php theme_vars_check.php --path . --reference /tmp/mokoonyx [--github-output]
- *       [--api-base <url> --repo <owner/repo> --token <token>]
- */
-
-declare(strict_types=1);
-
-$opts = getopt('', ['path:', 'reference:', 'github-output', 'api-base:', 'repo:', 'token:']);
-$path = isset($opts['path']) && is_string($opts['path']) && $opts['path'] !== '' ? $opts['path'] : '.';
-$ref  = isset($opts['reference']) && is_string($opts['reference']) ? $opts['reference'] : '';
-$gh   = array_key_exists('github-output', $opts);
-
-$root = realpath($path);
-if ($root === false) { $root = $path; }
-
-$src = is_dir("$root/src") ? "$root/src" : (is_dir("$root/source") ? "$root/source" : null);
-if ($src === null) {
-    fwrite(STDERR, "ERROR: no src/ or source/ directory under $root\n");
-    exit(1);
-}
-
-$errors  = 0;
-$summary = [];
-$fail = function (string $msg) use (&$errors, &$summary): void {
-    echo "  [FAIL] $msg\n";
-    $summary[] = "FAIL: $msg";
-    $errors++;
-};
-$ok    = function (string $msg): void { echo "  [ok]   $msg\n"; };
-$note  = function (string $msg): void { echo "  [note] $msg\n"; };
-
-/** Extract the set of CSS custom-property names DEFINED in a CSS string. */
-$definedVars = static function (string $css): array {
-    // Matches "--name:" at a declaration position (not var(--name) uses).
-    preg_match_all('/(?:^|[\s;{])(--[a-z0-9_-]+)\s*:/i', $css, $m);
-    return array_values(array_unique(array_map('strtolower', $m[1] ?? [])));
-};
-
-/** Find the MokoOnyx standard theme file for a mode inside a reference checkout. */
-$findStandard = static function (string $ref, string $mode): ?string {
-    if ($ref === '') { return null; }
-    foreach ([
-        "$ref/source/media/css/theme/$mode.standard.css",
-        "$ref/media/templates/site/mokoonyx/css/theme/$mode.standard.css",
-        "$ref/$mode.standard.css",
-    ] as $cand) {
-        if (is_file($cand)) { return $cand; }
-    }
-    return null;
-};
-
-$cssDir   = "$src/media/templates/site/mokoonyx/css";
-$themeDir = "$cssDir/theme";
-$manifest = "$src/templateDetails.xml";
-$customs  = ['light' => "$themeDir/light.custom.css", 'dark' => "$themeDir/dark.custom.css"];
-
-echo "MokoOnyx theme validation: $src\n\n";
-
-// 1) Required files -------------------------------------------------------
-echo "=== Required files ===\n";
-$requiredFiles = [
-    'templateDetails.xml'    => $manifest,
-    'theme/light.custom.css' => $customs['light'],
-    'theme/dark.custom.css'  => $customs['dark'],
-    'user.css'               => "$cssDir/user.css",
-];
-foreach ($requiredFiles as $label => $file) {
-    is_file($file) ? $ok("$label present") : $fail("missing required file: $label");
-}
-
-// 1b) Forbidden committed files ------------------------------------------
-echo "\n=== Forbidden files ===\n";
-$scan = static function (string $dir, array $skip) use (&$scan): array {
-    $out = [];
-    foreach (scandir($dir) ?: [] as $e) {
-        if ($e === '.' || $e === '..') { continue; }
-        $p = "$dir/$e";
-        if (is_dir($p)) {
-            if (in_array($e, $skip, true)) { continue; }
-            $out = array_merge($out, $scan($p, $skip));
-        } else {
-            $out[] = $p;
-        }
-    }
-    return $out;
-};
-$forbidden = [];
-if (is_dir("$root/.claude")) { $forbidden[] = '.claude/'; }
-foreach ($scan($root, ['.git', 'vendor', 'node_modules']) as $f) {
-    $b   = basename($f);
-    $rel = ltrim(str_replace('\\', '/', substr($f, strlen($root))), '/');
-    if ($b === '.mcp.json' || $b === 'TODO.md'
-        || fnmatch('.mcp_*.json', $b) || fnmatch('sftp-config*.json', $b)
-        || fnmatch('*.min.css', $b) || fnmatch('*.min.js', $b)) {
-        $forbidden[] = $rel;
-    }
-}
-$forbidden = array_values(array_unique($forbidden));
-if ($forbidden) {
-    $shown = array_slice($forbidden, 0, 10);
-    $more  = count($forbidden) - count($shown);
-    $fail('forbidden file(s) committed: ' . implode(', ', $shown) . ($more > 0 ? " (+$more more)" : ''));
-} else {
-    $ok('no forbidden files committed');
-}
-
-// 2) CSS variables — required set derived from the MokoOnyx standard theme
-echo "\n=== CSS variables vs MokoOnyx standard theme ===\n";
-if ($ref === '') {
-    $note('no --reference given; skipping variable parity check');
-} else {
-    foreach ($customs as $mode => $customFile) {
-        $std = $findStandard($ref, $mode);
-        if ($std === null) {
-            $fail("$mode: standard theme not found under reference '$ref'");
-            continue;
-        }
-        if (!is_file($customFile)) {
-            continue; // already reported missing
-        }
-        $required = $definedVars((string) file_get_contents($std));
-        $defined  = $definedVars((string) file_get_contents($customFile));
-        $missing  = array_values(array_diff($required, $defined));
-        if ($missing) {
-            $shown = array_slice($missing, 0, 15);
-            $more  = count($missing) - count($shown);
-            $fail("$mode mode missing " . count($missing) . '/' . count($required)
-                . ' standard variable(s): ' . implode(', ', $shown) . ($more > 0 ? " (+$more more)" : ''));
-        } else {
-            $ok("$mode mode defines all " . count($required) . ' standard variables');
-        }
-    }
-}
-
-// 3) Manifest sanity ------------------------------------------------------
-echo "\n=== Manifest (templateDetails.xml) ===\n";
-if (is_file($manifest)) {
-    $xml = @simplexml_load_file($manifest);
-    if ($xml === false) {
-        $fail('templateDetails.xml is not well-formed XML');
-    } else {
-        $version = isset($xml->version) ? trim((string) $xml->version) : '';
-        $version !== '' ? $ok("version $version") : $fail('<version> is missing or empty');
-
-        $server = isset($xml->updateservers->server) ? trim((string) $xml->updateservers->server) : '';
-        if ($server === '') {
-            $fail('<updateservers><server> is missing');
-        } elseif (strpos($server, '/raw/branch/') !== false) {
-            $fail('update server uses a legacy raw/branch URL; use the dynamic MokoGitea feed');
-        } else {
-            $ok("update server: $server");
-        }
-
-        isset($xml->dlid) ? $ok('<dlid> license-key field present')
-            : $fail('<dlid prefix="dlid=" suffix=""/> is missing');
-
-        // Element naming convention (MokoOnyx client theme file package)
-        $type    = trim((string) ($xml['type'] ?? ''));
-        $element = isset($xml->element) ? trim((string) $xml->element) : '';
-        if ($type === 'file' && $element !== '') {
-            strpos($element, 'file_mokoonyx_') === 0
-                ? $ok("element naming ok ($element)")
-                : $fail("element '$element' should start with 'file_mokoonyx_' for a MokoOnyx client theme package");
-        }
-
-        // Required manifest fields
-        foreach (['name', 'element', 'author', 'creationDate'] as $field) {
-            (isset($xml->$field) && trim((string) $xml->$field) !== '')
-                ? $ok("<$field> present")
-                : $fail("<$field> is missing or empty");
-        }
-
-        // scriptfile (if declared) must exist
-        if (isset($xml->scriptfile)) {
-            $sf = trim((string) $xml->scriptfile);
-            is_file("$src/$sf") ? $ok("scriptfile '$sf' present")
-                : $fail("<scriptfile> references '$sf' which is not in src/");
-        }
-
-        // Fileset integrity — every referenced file/folder must exist in src/
-        if (isset($xml->fileset)) {
-            $missingFs = [];
-            foreach ($xml->fileset->files as $files) {
-                $folder  = trim((string) ($files['folder'] ?? ''));
-                $baseDir = $folder !== '' ? "$src/$folder" : $src;
-                foreach ($files->filename as $fn) {
-                    $rel = ($folder !== '' ? "$folder/" : '') . trim((string) $fn);
-                    if (!is_file("$baseDir/" . trim((string) $fn))) { $missingFs[] = $rel; }
-                }
-                foreach ($files->folder as $fd) {
-                    $rel = ($folder !== '' ? "$folder/" : '') . trim((string) $fd) . '/';
-                    if (!is_dir("$baseDir/" . trim((string) $fd))) { $missingFs[] = $rel; }
-                }
-            }
-            if ($missingFs) {
-                $shown = array_slice($missingFs, 0, 10);
-                $more  = count($missingFs) - count($shown);
-                $fail('fileset references ' . count($missingFs) . ' missing path(s): '
-                    . implode(', ', $shown) . ($more > 0 ? " (+$more more)" : ''));
-            } else {
-                $ok('all fileset paths exist in src/');
-            }
-        }
-    }
-}
-
-// 4) Repository metadata via Gitea API (optional) -------------------------
-$apiBase = isset($opts['api-base']) && is_string($opts['api-base']) ? rtrim($opts['api-base'], '/') : '';
-$repoSlug = isset($opts['repo']) && is_string($opts['repo']) ? trim($opts['repo']) : '';
-$token   = isset($opts['token']) && is_string($opts['token']) ? trim($opts['token']) : '';
-if ($apiBase !== '' && $repoSlug !== '' && $token !== '') {
-    echo "\n=== Repository metadata (Gitea API) ===\n";
-    $url  = "$apiBase/repos/$repoSlug";
-    $ctx  = stream_context_create(['http' => [
-        'method'        => 'GET',
-        'header'        => "Authorization: token $token\r\nAccept: application/json\r\n",
-        'ignore_errors' => true,
-        'timeout'       => 15,
-    ]]);
-    $resp = @file_get_contents($url, false, $ctx);
-    $data = $resp !== false ? json_decode($resp, true) : null;
-    if (!is_array($data) || !isset($data['name'])) {
-        $fail("could not read repo metadata from Gitea API ($url)");
-    } else {
-        trim((string) ($data['description'] ?? '')) !== '' ? $ok('description set')
-            : $fail('repo description is empty');
-        trim((string) ($data['website'] ?? '')) !== '' ? $ok('website set: ' . $data['website'])
-            : $fail('repo website is empty');
-        $topics = $data['topics'] ?? [];
-        (is_array($topics) && count($topics) > 0) ? $ok(count($topics) . ' topic(s) set')
-            : $fail('repo has no topics');
-
-        // Required topics
-        $requiredTopics = ['joomla', 'client-waas', 'mokoonyx'];
-        $haveTopics     = array_map('strtolower', is_array($topics) ? $topics : []);
-        $missingTopics  = array_values(array_diff($requiredTopics, $haveTopics));
-        $missingTopics
-            ? $fail('missing required topic(s): ' . implode(', ', $missingTopics))
-            : $ok('required topics present (' . implode(', ', $requiredTopics) . ')');
-
-        ((string) ($data['default_branch'] ?? '')) === 'main' ? $ok('default branch is main')
-            : $fail("default branch is '" . ($data['default_branch'] ?? '') . "' (expected main)");
-
-        // Branch protection on main
-        $bresp = @file_get_contents("$apiBase/repos/$repoSlug/branches/main", false, $ctx);
-        $bdata = $bresp !== false ? json_decode($bresp, true) : null;
-        if (is_array($bdata) && array_key_exists('protected', $bdata)) {
-            $bdata['protected'] ? $ok('main branch is protected')
-                : $fail('main branch is not protected');
-        } else {
-            $note('could not read branch protection state for main');
-        }
-    }
-} else {
-    echo "\n=== Repository metadata (Gitea API) ===\n";
-    $note('API args not provided; skipping repo metadata check');
-}
-
-// Output / exit -----------------------------------------------------------
-echo "\n";
-if ($gh && ($f = getenv('GITHUB_STEP_SUMMARY'))) {
-    $md = "## MokoOnyx Theme Validation\n\n";
-    $md .= $errors === 0
-        ? "All checks passed.\n"
-        : implode("\n", array_map(static fn ($l) => "- $l", $summary)) . "\n";
-    @file_put_contents($f, $md, FILE_APPEND);
-}
-
-if ($errors > 0) {
-    echo "FAILED: $errors issue(s) found.\n";
-    exit(1);
-}
-echo "All MokoOnyx theme validation checks passed.\n";
-exit(0);
@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/updates_xml_sync.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Sync updates.xml to target branches via Gitea API
 * NOTE: Called by pre-release and auto-release workflows after updates.xml
 *       is modified on the current branch. Pushes the file to other branches
@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/version_auto_bump.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Auto patch-bump, set stability suffix, and commit — single CLI replacing inline workflow bash
 */

@@ -124,19 +124,17 @@ class VersionBumpCli extends CliFramework
            $minVersion = preg_replace('/-(?:dev|alpha|beta|rc)$/', '', $minVersion);
            if (preg_match('/^\d{2}\.\d{2}\.\d{2}$/', $minVersion)) {
                if ($baseVersion === null || version_compare($minVersion, $baseVersion, '>')) {
-                    $this->log('INFO', "Using --min-version {$minVersion} (higher than manifest {$baseVersion})");
+                    $this->log('INFO', "Using --min-version {$minVersion} (higher than manifest " . ($baseVersion ?? '(none)') . ")");
                    $baseVersion = $minVersion;
                }
            }
        }

        // Auto-detect: scan git tags for higher versions from other channels
-        if ($baseVersion !== null) {
-            $gitTagVersion = $this->getHighestGitTagVersion($root);
-            if ($gitTagVersion !== null && version_compare($gitTagVersion, $baseVersion, '>')) {
-                $this->log('INFO', "Git tag version {$gitTagVersion} is higher than manifest {$baseVersion} — using as base");
-                $baseVersion = $gitTagVersion;
-            }
+        $gitTagVersion = $this->getHighestGitTagVersion($root);
+        if ($gitTagVersion !== null && ($baseVersion === null || version_compare($gitTagVersion, $baseVersion, '>'))) {
+            $this->log('INFO', "Git tag version {$gitTagVersion} is higher than manifest " . ($baseVersion ?? '(none)') . " — using as base");
+            $baseVersion = $gitTagVersion;
        }

        if ($baseVersion === null) {
@@ -214,8 +212,7 @@ class VersionBumpCli extends CliFramework
                    $newContent = preg_replace(
                        $xmlPattern,
                        '${1}' . $newBase . '</version>',
-                        $content,
-                        1
+                        $content
                    );
                } else {
                    $xmlPattern = '#<version>\d{2}\.\d{2}\.\d{2}'
@@ -223,13 +220,9 @@ class VersionBumpCli extends CliFramework
                    $newContent = preg_replace(
                        $xmlPattern,
                        "<version>{$newFull}</version>",
-                        $content,
-                        1
+                        $content
                    );
                }
-                if ($newContent !== null) {
-                    $newContent = preg_replace('#(\s*<version>[^<]*</version>)\s*<version>[^<]*</version>#', '$1', $newContent);
-                }
                if ($newContent !== null && $newContent !== $content) {
                    file_put_contents($xmlFile, $newContent);
                    $updatedFiles[] = substr($xmlFile, strlen($root) + 1);
@@ -239,20 +232,6 @@ class VersionBumpCli extends CliFramework
        if (!empty($updatedFiles)) {
            fwrite(STDERR, "Updated " . count($updatedFiles) . " Joomla manifest(s): " . implode(', ', $updatedFiles) . "\n");
        }
-        // Joomla schema version: create empty SQL update file if sql/updates/mysql/ exists
-        $sqlUpdateDirs = array_merge(
-            SourceResolver::globSource($root, 'packages/*/sql/updates/mysql'),
-            SourceResolver::globSource($root, 'sql/updates/mysql'),
-            glob("{$root}/sql/updates/mysql") ?: []
-        );
-        $sqlUpdateDirs = array_unique(array_filter($sqlUpdateDirs, 'is_dir'));
-        foreach ($sqlUpdateDirs as $sqlDir) {
-            $sqlFile = "{$sqlDir}/{$newBase}.sql";
-            if (!file_exists($sqlFile)) {
-                file_put_contents($sqlFile, "/* {$newBase} — no schema changes */\n");
-                fwrite(STDERR, "Created SQL update file: " . substr($sqlFile, strlen($root) + 1) . "\n");
-            }
-        }
        $packageJsonFile = "{$root}/package.json";
        if (file_exists($packageJsonFile)) {
            $pkgContent = file_get_contents($packageJsonFile);
@@ -389,7 +368,7 @@ class VersionBumpCli extends CliFramework
    /**
     * Scan git release tags for the highest version across all channels.
     *
-     * Checks release names like "MokoSuiteClient (VERSION: 09.43.00)" in
+     * Checks release names like "MokoSuiteClient (VERSION: 09.38.05)" in
     * git tags (stable, release-candidate, development, etc.) to find the
     * highest version that has been released on any channel.
     */
@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/version_check.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Validate version consistency across README, manifests, and sub-packages
 */

@@ -131,11 +131,9 @@ class VersionCheckCli extends CliFramework
                    $updated = preg_replace(
                        $vPat,
                        "<version>{$highestVersion}</version>",
-                        $content,
-                        1
+                        $content
                    );
                    if ($updated !== null) {
-                        $updated = preg_replace('#(\s*<version>[^<]*</version>)\s*<version>[^<]*</version>#', '$1', $updated);
                        file_put_contents($mokoManifest, $updated);
                    } echo "  Fixed: .mokogitea/manifest.xml -> {$highestVersion}\n";
                }
@@ -187,9 +185,8 @@ class VersionCheckCli extends CliFramework
                    if (!file_exists($file)) {
                        continue;
                    } $content = file_get_contents($file);
-                    $updated = preg_replace('#<version>[^<]*</version>#', "<version>{$highestVersion}</version>", $content, 1);
+                    $updated = preg_replace('#<version>[^<]*</version>#', "<version>{$highestVersion}</version>", $content);
                    if ($updated !== null) {
-                        $updated = preg_replace('#(\s*<version>[^<]*</version>)\s*<version>[^<]*</version>#', '$1', $updated);
                        file_put_contents($file, $updated);
                    } echo "  Fixed: {$source} -> {$highestVersion}\n";
                }
@@ -164,12 +164,8 @@ class VersionSetPlatformCli extends CliFramework
                $updated = preg_replace(
                    '|<version>[^<]*</version>|',
                    "<version>{$version}</version>",
-                    $content,
-                    1
+                    $content
                );
-                if ($updated !== null) {
-                    $updated = preg_replace('#(\s*<version>[^<]*</version>)\s*<version>[^<]*</version>#', '$1', $updated);
-                }
                if ($updated !== null && $updated !== $content) {
                    file_put_contents($file, $updated);
                    $relPath = str_replace($root . '/', '', $file);
@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/wiki_sync.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Sync select wiki pages from mokocli to all template repos
 */

@@ -10,7 +10,7 @@
 * INGROUP: mokocli
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /cli/workflow_sync.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Sync workflows from Generic → platform templates → live repos based on manifest.platform
 */

@@ -42,13 +42,9 @@ class WorkflowSyncCli extends CliFramework
        'joomla' => ['deploy-manual.yml'],
    ];

-    /** Prefix for custom workflows preserved during orphan cleanup. */
-    private const CUSTOM_PREFIX = 'custom-';
-
    private int $updated = 0;
    private int $created = 0;
    private int $skipped = 0;
-    private int $deleted = 0;
    private int $errors = 0;

    protected function configure(): void
@@ -60,7 +56,6 @@ class WorkflowSyncCli extends CliFramework
        $this->addArgument('--branch', 'Target branch (default: main)', 'main');
        $this->addArgument('--phase', 'Phase to run: all, templates, repos (default: all)', 'all');
        $this->addArgument('--platform-filter', 'Only sync repos matching this platform', '');
-        $this->addArgument('--delete-orphans', 'Delete workflows not in template (preserves custom-* and custom/)', false);
    }

    protected function run(): int
@@ -119,7 +114,7 @@ class WorkflowSyncCli extends CliFramework

        echo "\n";
        $this->log('INFO', "Done: {$this->created} created, {$this->updated} updated, "
-            . "{$this->deleted} deleted, {$this->skipped} skipped, {$this->errors} error(s).");
+            . "{$this->skipped} skipped, {$this->errors} error(s).");

        return $this->errors > 0 ? 1 : 0;
    }
@@ -280,15 +275,14 @@ class WorkflowSyncCli extends CliFramework

            foreach ($workflows as $workflow) {
                $filename = $workflow['name'];
-                $destPath = '.mokogitea/workflows/' . $filename;
-                $label = "{$repoFullName}/{$filename}";
-
                // Skip platform-excluded workflows
                if (in_array($filename, self::PLATFORM_EXCLUDES[$platform] ?? [], true)) {
                    fprintf(STDERR, "%-45s | %s\n", $label, 'EXCLUDED (platform)');
                    $this->skipped++;
                    continue;
                }
+                $destPath = '.mokogitea/workflows/' . $filename;
+                $label = "{$repoFullName}/{$filename}";

                // Get source content from template
                $sourceContent = $this->getFileContent(
@@ -309,14 +303,6 @@ class WorkflowSyncCli extends CliFramework
                    $destPath, $sourceContent, $branch, $commitMsg, $label
                );
            }
-
-            // Delete orphan workflows if enabled
-            if ($this->getArgument('--delete-orphans', false)) {
-                $templateNames = array_map(fn($w) => $w['name'], $workflows);
-                $this->deleteOrphanWorkflows(
-                    $giteaUrl, $token, $org, $repoName, $branch, $templateNames, $platform
-                );
-            }
        }

        echo "\n";
@@ -420,116 +406,6 @@ class WorkflowSyncCli extends CliFramework
        }
    }

-    /**
-     * Delete workflows in a repo that are NOT in the template and NOT custom.
-     *
-     * Protected from deletion:
-     *   - Files matching template workflow names
-     *   - Files with `custom-` prefix (convention for repo-specific workflows)
-     *   - Directories named `custom` (future: subfolder discovery)
-     *   - Platform-excluded workflows
-     */
-    private function deleteOrphanWorkflows(
-        string $giteaUrl,
-        string $token,
-        string $org,
-        string $repoName,
-        string $branch,
-        array $templateNames,
-        string $platform
-    ): void {
-        $repoWorkflows = $this->listWorkflows($giteaUrl, $token, $org, $repoName, $branch);
-        if ($repoWorkflows === null) {
-            return;
-        }
-
-        $platformExcludes = self::PLATFORM_EXCLUDES[$platform] ?? [];
-
-        foreach ($repoWorkflows as $workflow) {
-            $name = $workflow['name'];
-
-            // Keep if it's in the template
-            if (in_array($name, $templateNames, true)) {
-                continue;
-            }
-
-            // Keep if it has the custom- prefix
-            if (str_starts_with($name, self::CUSTOM_PREFIX)) {
-                $label = "{$org}/{$repoName}/{$name}";
-                fprintf(STDERR, "%-45s | %s\n", $label, 'KEPT (custom)');
-                continue;
-            }
-
-            // Keep if it's platform-excluded (legitimately skipped during sync)
-            if (in_array($name, $platformExcludes, true)) {
-                $label = "{$org}/{$repoName}/{$name}";
-                fprintf(STDERR, "%-45s | %s\n", $label, 'KEPT (platform-excluded)');
-                continue;
-            }
-
-            // Delete orphan
-            $filePath = '.mokogitea/workflows/' . $name;
-            $label = "{$org}/{$repoName}/{$name}";
-
-            if ($this->dryRun) {
-                fprintf(STDERR, "%-45s | %s\n", $label, 'WOULD DELETE');
-                $this->deleted++;
-                continue;
-            }
-
-            $deleted = $this->deleteFile($giteaUrl, $token, $org, $repoName, $filePath, $branch);
-            if ($deleted) {
-                fprintf(STDERR, "%-45s | %s\n", $label, 'DELETED');
-                $this->deleted++;
-            } else {
-                fprintf(STDERR, "%-45s | %s\n", $label, 'ERROR (delete)');
-                $this->errors++;
-            }
-        }
-    }
-
-    /**
-     * Delete a file from a repo via the Gitea Contents API.
-     */
-    private function deleteFile(
-        string $giteaUrl,
-        string $token,
-        string $org,
-        string $repoName,
-        string $filePath,
-        string $branch
-    ): bool {
-        // Get SHA first
-        $existing = $this->apiRequest(
-            $giteaUrl, $token, 'GET',
-            "/api/v1/repos/{$org}/{$repoName}/contents/{$filePath}?ref={$branch}"
-        );
-
-        if ($existing['code'] !== 200) {
-            return false;
-        }
-
-        $data = json_decode($existing['body'], true);
-        $sha = $data['sha'] ?? '';
-        if ($sha === '') {
-            return false;
-        }
-
-        $payload = json_encode([
-            'sha'     => $sha,
-            'message' => "chore: delete orphan workflow {$filePath} [skip ci]",
-            'branch'  => $branch,
-        ]);
-
-        $response = $this->apiRequest(
-            $giteaUrl, $token, 'DELETE',
-            "/api/v1/repos/{$org}/{$repoName}/contents/{$filePath}",
-            $payload
-        );
-
-        return $response['code'] === 200;
-    }
-
    /**
     * List workflow files in a repo's .mokogitea/workflows/ directory.
     */
@@ -71,8 +71,8 @@
    ],
    "scripts": {
        "test": "phpunit",
-        "phpcs": "phpcs --standard=phpcs.xml lib/ validate/",
-        "phpstan": "phpstan analyse -c phpstan.neon lib/ validate/",
+        "phpcs": "phpcs --standard=phpcs.xml lib/ validate/ automation/",
+        "phpstan": "phpstan analyse -c phpstan.neon lib/ validate/ automation/",
        "psalm": "psalm --config=psalm.xml",
        "check": [
            "@phpcs",
@@ -8,11 +8,11 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /deploy/backup-before-deploy.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Snapshot Joomla directories before deployment for rollback capability
 */

@@ -4,8 +4,8 @@
 /* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 * SPDX-License-Identifier: GPL-3.0-or-later
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /deploy/deploy-and-verify.php
 * BRIEF: Deploy with automatic health check and rollback on failure
@@ -8,11 +8,11 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /deploy/deploy-dolibarr.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Deploy Dolibarr module files to a remote server via SFTP/rsync
 */

@@ -8,8 +8,8 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /deploy/deploy-joomla.php
 * BRIEF: Smart Joomla deploy — routes files to correct Joomla directories based on XML manifest
@@ -8,8 +8,8 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /deploy/deploy-sftp.php
 * BRIEF: Deploy a repository src/ directory to a remote web server via SFTP
@@ -8,11 +8,11 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /deploy/health-check.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Post-deploy health check — verify a Joomla site is responding correctly
 */

@@ -8,11 +8,11 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /deploy/rollback-joomla.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Rollback a Joomla deployment by restoring from a pre-deploy snapshot
 */

@@ -8,11 +8,11 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /deploy/sync-joomla.php
- * VERSION: 09.43.00
+ * VERSION: 09.38.05
 * BRIEF: Sync Joomla site directories between two servers via rsync over SSH
 */

@@ -7,8 +7,8 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Scripts.Fix
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Scripts.Fix
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /fix/fix_line_endings.php
 * BRIEF: CLI script to normalise CRLF/CR to LF in tracked source files
@@ -7,8 +7,8 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Scripts.Fix
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Scripts.Fix
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /fix/fix_permissions.php
 * BRIEF: CLI script to normalise file permissions (dirs 755, files 644, scripts 755)
@@ -7,8 +7,8 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Scripts.Fix
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Scripts.Fix
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /fix/fix_tabs.php
 * BRIEF: CLI script to convert tabs to spaces in tracked source files
@@ -7,8 +7,8 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Scripts.Fix
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Scripts.Fix
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /fix/fix_trailing_spaces.php
 * BRIEF: CLI script to remove trailing whitespace from tracked source files
@@ -2,8 +2,8 @@
 Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 SPDX-License-Identifier: GPL-3.0-or-later
 FILE INFORMATION
-DEFGROUP: MokoCLI.Index
-INGROUP: MokoCLI.Fix
+DEFGROUP: MokoPlatform.Index
+INGROUP: MokoPlatform.Fix
 REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 PATH: /fix/index.md
 BRIEF: Fix directory index
@@ -2,8 +2,8 @@
 Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 SPDX-License-Identifier: GPL-3.0-or-later
 FILE INFORMATION
-DEFGROUP: MokoCLI.Root
-INGROUP: MokoCLI
+DEFGROUP: MokoPlatform.Root
+INGROUP: MokoPlatform
 REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 PATH: /index.md
 BRIEF: Scripts directory index
@@ -61,7 +61,7 @@ Shared library code
 - GitHub client

 ### [Wiki](https://git.mokoconsulting.tech/MokoConsulting/mokocli/wiki)
-All documentation lives in the MokoGitea wiki.
+All documentation lives in the Gitea wiki.

 ### [Tests](tests/)
 Test scripts
@@ -7,8 +7,8 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Lib
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Lib
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /lib/CliBase.php
 * BRIEF: Standalone base CLI class for scripts that do not use CliFramework
@@ -7,8 +7,8 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Lib
- * INGROUP: MokoCLI
+ * DEFGROUP: MokoPlatform.Lib
+ * INGROUP: MokoPlatform
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /lib/Common.php
 * BRIEF: Common utility functions for scripts
@@ -9,8 +9,8 @@ declare(strict_types=1);
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Enterprise.Plugins
- * INGROUP: MokoCLI.Enterprise
+ * DEFGROUP: MokoPlatform.Enterprise.Plugins
+ * INGROUP: MokoPlatform.Enterprise
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /lib/Enterprise/AbstractProjectPlugin.php
 * BRIEF: Abstract base class for project plugins
@@ -23,7 +23,7 @@ namespace MokoCli;
 *
 * Provides common functionality for all project type plugins
 *
- * @package MokoCLI\Enterprise
+ * @package MokoPlatform\Enterprise
 * @version 1.0.0
 */
 abstract class AbstractProjectPlugin implements ProjectPluginInterface
@@ -9,8 +9,8 @@ declare(strict_types=1);
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Enterprise.API
- * INGROUP: MokoCLI.Enterprise
+ * DEFGROUP: MokoPlatform.Enterprise.API
+ * INGROUP: MokoPlatform.Enterprise
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /lib/Enterprise/ApiClient.php
 * BRIEF: HTTP API client library
@@ -31,7 +31,7 @@ declare(strict_types=1);
 *
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
- * @package MokoCLI\Enterprise
+ * @package MokoPlatform\Enterprise
 * @version 04.00.04
 * @author mokocli Team
 * @license GPL-3.0-or-later
@@ -22,13 +22,13 @@ declare(strict_types=1);
 * (at your option) any later version.
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Enterprise.Audit
- * INGROUP: MokoCLI.Enterprise
+ * DEFGROUP: MokoPlatform.Enterprise.Audit
+ * INGROUP: MokoPlatform.Enterprise
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /lib/Enterprise/AuditLogger.php
 * BRIEF: Enterprise audit logging
 *
- * @package MokoCLI\Enterprise
+ * @package MokoPlatform\Enterprise
 * @version 04.00.04
 * @author mokocli Team
 * @license GPL-3.0-or-later
@@ -10,13 +10,13 @@ declare(strict_types=1);
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Enterprise.Checkpoint
- * INGROUP: MokoCLI.Enterprise
+ * DEFGROUP: MokoPlatform.Enterprise.Checkpoint
+ * INGROUP: MokoPlatform.Enterprise
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /lib/Enterprise/CheckpointManager.php
 * BRIEF: Checkpoint manager for resumable operations
 *
- * @package MokoCLI\Enterprise
+ * @package MokoPlatform\Enterprise
 * @version 04.00.04
 * @author mokocli Team
 * @license GPL-3.0-or-later
@@ -7,8 +7,8 @@
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Enterprise.CLI
- * INGROUP: MokoCLI.Enterprise
+ * DEFGROUP: MokoPlatform.Enterprise.CLI
+ * INGROUP: MokoPlatform.Enterprise
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /lib/Enterprise/CliFramework.php
 * BRIEF: CliFramework — unified base class for all mokocli CLI scripts
@@ -9,8 +9,8 @@ declare(strict_types=1);
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * FILE INFORMATION
- * DEFGROUP: MokoCLI.Enterprise.Config
- * INGROUP: MokoCLI.Enterprise
+ * DEFGROUP: MokoPlatform.Enterprise.Config
+ * INGROUP: MokoPlatform.Enterprise
 * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 * PATH: /lib/Enterprise/Config.php
 * BRIEF: Configuration manager
@@ -32,7 +32,7 @@ declare(strict_types=1);
 *
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
- * @package MokoCLI\Enterprise
+ * @package MokoPlatform\Enterprise
 * @version 04.00.04
 * @author mokocli Team
 * @license GPL-3.0-or-later
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
jmiller	84259c6636	fix: auto-download pre-built release for empty submodule sub-packages Universal: Pre-Release / Build Pre-Release (${{ inputs.stability \|\| github.ref_name }}) (push) Successful in 16s Details Universal: PR Check / Branch Policy (pull_request) Successful in 1s Details Universal: PR Check / Validate PR (pull_request) Failing after 6s Details Universal: PR Check / Secret Scan (pull_request) Successful in 8s Details Platform: mokocli CI / Gate 1: Code Quality (pull_request) Failing after 48s Details Platform: mokocli CI / Gate 2: Unit Tests (8.1) (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.2) (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.3) (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 3: Self-Health Check (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 4: Governance (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 5: Template Integrity (pull_request) Has been cancelled Details Platform: mokocli CI / CI Summary (pull_request) Has been cancelled Details Universal: PR Check / Build RC Package (pull_request) Has been cancelled Details Universal: PR Check / Report Issues (pull_request) Has been cancelled Details When a Joomla package has a sub-package that is a git submodule with an empty or missing source directory (e.g. failed CI checkout), the packager now falls back to downloading the latest stable release ZIP from the submodule's Gitea remote. Also supports pre-staged ZIPs in the output directory, allowing manual or workflow-based pre-population of sub-package archives. Claude-Session: https://claude.ai/code/session_01MbEjBtsSjPuTWhqqrMS2wG	2026-06-28 14:33:53 -05:00
jmiller	282a56258c	Merge pull request 'fix(security): prevent script injection in rc-revert workflow' (#324 ) from feature/harden-rc-revert-injection into dev Universal: Auto Version Bump / Version Bump (push) Has been skipped Details Universal: Pre-Release / Build Pre-Release (${{ inputs.stability \|\| github.ref_name }}) (push) Successful in 13s Details Platform: mokocli CI / Gate 1: Code Quality (push) Failing after 55s Details Platform: mokocli CI / Gate 2: Unit Tests (8.1) (push) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.2) (push) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.3) (push) Has been cancelled Details Platform: mokocli CI / Gate 3: Self-Health Check (push) Has been cancelled Details Platform: mokocli CI / Gate 4: Governance (push) Has been cancelled Details Platform: mokocli CI / Gate 5: Template Integrity (push) Has been cancelled Details Platform: mokocli CI / CI Summary (push) Has been cancelled Details	2026-06-27 02:32:26 +00:00
gitea-actions[bot]	3972b91169	chore(version): auto-bump patch 09.38.05-dev [skip ci] RC Revert / Rename rc/ back to dev/ (pull_request) Has been skipped Details Branch Cleanup / Delete merged branch (pull_request) Successful in 2s Details	2026-06-27 02:30:54 +00:00
jmiller	5885797728	fix(security): prevent shell/PHP script injection in rc-revert workflow Universal: Auto Version Bump / Version Bump (push) Successful in 8s Details The PR head branch ref is attacker-controlled and was substituted via ${{ }} directly into the shell run block (and interpolated into php -r), allowing command injection with secrets.MOKOGITEA_TOKEN in scope. - Pass untrusted values through env (BRANCH/REPO/GITEA_URL/TOKEN), not ${{ }} template substitution into shell source - Strict allowlist ^rc/[A-Za-z0-9._/-]+$ before any use - PHP reads BRANCH via getenv() instead of string interpolation	2026-06-27 02:30:43 +00:00
gitea-actions[bot]	27c19ccbaa	chore(version): auto-bump patch 09.38.04-dev [skip ci]	2026-06-23 17:59:22 +00:00
jmiller	8dcd3a6af3	chore: remove composer-publish.yml -- no longer needed Universal: Sync Feature Branch Versions / Sync feature branches with dev (push) Has been skipped Details Universal: Auto Version Bump / Version Bump (push) Successful in 19s Details Universal: Pre-Release / Build Pre-Release (${{ inputs.stability \|\| github.ref_name }}) (push) Successful in 18s Details Platform: mokocli CI / Gate 1: Code Quality (push) Failing after 1m48s Details Platform: mokocli CI / Gate 2: Unit Tests (8.1) (push) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.2) (push) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.3) (push) Has been cancelled Details Platform: mokocli CI / Gate 3: Self-Health Check (push) Has been cancelled Details Platform: mokocli CI / Gate 4: Governance (push) Has been cancelled Details Platform: mokocli CI / Gate 5: Template Integrity (push) Has been cancelled Details Platform: mokocli CI / CI Summary (push) Has been cancelled Details	2026-06-23 17:58:56 +00:00
jmiller	12779900b4	Merge pull request 'feat: release_publish.php uses semver tags for non-Joomla platforms (#304 )' (#311 ) from feature/304-release-publish into dev Universal: Auto Version Bump / Version Bump (push) Has been skipped Details Universal: Pre-Release / Build Pre-Release (${{ inputs.stability \|\| github.ref_name }}) (push) Successful in 18s Details Universal: Sync Feature Branch Versions / Sync feature branches with dev (push) Has been skipped Details Platform: mokocli CI / Gate 1: Code Quality (push) Failing after 2m24s Details Platform: mokocli CI / Gate 2: Unit Tests (8.1) (push) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.2) (push) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.3) (push) Has been cancelled Details Platform: mokocli CI / Gate 3: Self-Health Check (push) Has been cancelled Details Platform: mokocli CI / Gate 4: Governance (push) Has been cancelled Details Platform: mokocli CI / Gate 5: Template Integrity (push) Has been cancelled Details Platform: mokocli CI / CI Summary (push) Has been cancelled Details	2026-06-21 23:34:29 +00:00
jmiller	31d2e4939a	feat: release_publish.php uses semver tags for non-Joomla platforms (#304 ) Universal: Auto Version Bump / Version Bump (push) Successful in 13s Details Universal: PR Check / Branch Policy (pull_request) Successful in 5s Details Universal: PR Check / Secret Scan (pull_request) Successful in 16s Details Universal: PR Check / Validate PR (pull_request) Failing after 17s Details Platform: mokocli CI / Gate 1: Code Quality (pull_request) Failing after 1m32s Details RC Revert / Rename rc/ back to dev/ (pull_request) Failing after 10m25s Details Branch Cleanup / Delete merged branch (pull_request) Failing after 10m33s Details Platform: mokocli CI / Gate 2: Unit Tests (8.1) (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.2) (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.3) (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 3: Self-Health Check (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 4: Governance (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 5: Template Integrity (pull_request) Has been cancelled Details Platform: mokocli CI / CI Summary (pull_request) Has been cancelled Details Universal: PR Check / Build RC Package (pull_request) Has been cancelled Details Universal: PR Check / Report Issues (pull_request) Has been cancelled Details	2026-06-21 23:33:57 +00:00
jmiller	ad9b82cbe9	Merge pull request 'feat: create semver tags for non-Joomla repos on merge to main (#304 )' (#308 ) from feature/304-semver-auto-release into dev Universal: Sync Feature Branch Versions / Sync feature branches with dev (push) Has been skipped Details Universal: Pre-Release / Build Pre-Release (${{ inputs.stability \|\| github.ref_name }}) (push) Successful in 11s Details Platform: mokocli CI / Gate 1: Code Quality (push) Failing after 56s Details Universal: Auto Version Bump / Version Bump (push) Has been skipped Details Platform: mokocli CI / Gate 2: Unit Tests (8.1) (push) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.2) (push) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.3) (push) Has been cancelled Details Platform: mokocli CI / Gate 3: Self-Health Check (push) Has been cancelled Details Platform: mokocli CI / Gate 4: Governance (push) Has been cancelled Details Platform: mokocli CI / Gate 5: Template Integrity (push) Has been cancelled Details Platform: mokocli CI / CI Summary (push) Has been cancelled Details	2026-06-21 15:16:04 +00:00
gitea-actions[bot]	a8769c1cdc	chore(version): auto-bump patch 09.38.03-dev [skip ci] RC Revert / Rename rc/ back to dev/ (pull_request) Has been skipped Details Branch Cleanup / Delete merged branch (pull_request) Successful in 2s Details	2026-06-21 15:04:41 +00:00
jmiller	ccd1b23bff	feat: create semver tags for non-Joomla repos on merge to main (#304 ) Universal: PR Check / Branch Policy (pull_request) Successful in 2s Details Universal: Auto Version Bump / Version Bump (push) Successful in 11s Details Universal: PR Check / Secret Scan (pull_request) Successful in 6s Details Universal: PR Check / Validate PR (pull_request) Failing after 4s Details Platform: mokocli CI / Gate 1: Code Quality (pull_request) Failing after 40s Details Platform: mokocli CI / Gate 2: Unit Tests (8.1) (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.2) (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.3) (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 3: Self-Health Check (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 4: Governance (pull_request) Has been cancelled Details Platform: mokocli CI / Gate 5: Template Integrity (pull_request) Has been cancelled Details Platform: mokocli CI / CI Summary (pull_request) Has been cancelled Details Universal: PR Check / Build RC Package (pull_request) Has been cancelled Details Universal: PR Check / Report Issues (pull_request) Has been cancelled Details	2026-06-21 15:04:05 +00:00
jmiller	8a6f476957	Merge pull request 'feat: skip pre-release auto-bump for non-Joomla repos (#304 )' (#307 ) from feature/304-semver-tags into dev Universal: Sync Feature Branch Versions / Sync feature branches with dev (push) Has been skipped Details Universal: Pre-Release / Build Pre-Release (${{ inputs.stability \|\| github.ref_name }}) (push) Successful in 10s Details Platform: mokocli CI / Gate 1: Code Quality (push) Failing after 41s Details Universal: Auto Version Bump / Version Bump (push) Has been skipped Details Platform: mokocli CI / Gate 2: Unit Tests (8.1) (push) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.2) (push) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.3) (push) Has been cancelled Details Platform: mokocli CI / Gate 3: Self-Health Check (push) Has been cancelled Details Platform: mokocli CI / Gate 4: Governance (push) Has been cancelled Details Platform: mokocli CI / Gate 5: Template Integrity (push) Has been cancelled Details Platform: mokocli CI / CI Summary (push) Has been cancelled Details	2026-06-21 14:51:40 +00:00
gitea-actions[bot]	7083ad9f9b	chore(version): auto-bump patch 09.38.02-dev [skip ci] Branch Cleanup / Delete merged branch (pull_request) Successful in 1s Details RC Revert / Rename rc/ back to dev/ (pull_request) Has been skipped Details	2026-06-21 14:48:21 +00:00
jmiller	660f6caaa2	feat: skip pre-release auto-bump for non-Joomla repos (#304 ) Universal: Auto Version Bump / Version Bump (push) Successful in 9s Details	2026-06-21 14:48:09 +00:00
gitea-actions[bot]	8fef6a3ce7	chore(version): pre-release bump to 09.38.01-dev [skip ci] Publish to Composer / Publish Package (release) Successful in 26s Details	2026-06-21 06:21:25 +00:00
gitea-actions[bot]	e678f31817	chore(version): auto-bump patch 09.37.08-dev [skip ci]	2026-06-21 06:21:15 +00:00
Jonathan Miller	3ef651e34d	fix(version-bump): always run git tag scan, fix null log interpolation Universal: Sync Feature Branch Versions / Sync feature branches with dev (push) Has been skipped Details Universal: Auto Version Bump / Version Bump (push) Successful in 9s Details Universal: Pre-Release / Build Pre-Release (${{ inputs.stability \|\| github.ref_name }}) (push) Successful in 12s Details Platform: mokocli CI / Gate 1: Code Quality (push) Failing after 38s Details Platform: mokocli CI / Gate 2: Unit Tests (8.1) (push) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.2) (push) Has been cancelled Details Platform: mokocli CI / Gate 2: Unit Tests (8.3) (push) Has been cancelled Details Platform: mokocli CI / Gate 3: Self-Health Check (push) Has been cancelled Details Platform: mokocli CI / Gate 4: Governance (push) Has been cancelled Details Platform: mokocli CI / Gate 5: Template Integrity (push) Has been cancelled Details Platform: mokocli CI / CI Summary (push) Has been cancelled Details	2026-06-21 01:20:58 -05:00