chore(docs): normalize refs — MokoStandards->org wiki, moko-platform->mokocli, residual MokoGitea/MokoSuite

Non-workflow docs/config only (CLAUDE.md, README, branch-protection, ISSUE_TEMPLATE/config.yml,
ci-issue-reporter). Workflow files, manifest schema, and Makefile install paths left for the
forge-rebrand gate. Authored-by: Moko Consulting

.mokogitea/CLAUDE.md

@@ -38,7 +38,7 @@ composer check                           # Run all checks
 | `lib/Enterprise/Plugins/` | 11 platform plugins (Joomla, Dolibarr, Node.js, Python, etc.) |
 | `deploy/` | SFTP deployment scripts (Joomla, Dolibarr, health checks) |
 | `templates/` | Universal templates, configs, governance schema |
-| `.mokogitea/workflows/` | CI/CD workflows (Gitea Actions) |
+| `.mokogitea/workflows/` | CI/CD workflows (MokoGitea Actions) |
 | `bin/moko` | Unified CLI dispatcher — `php bin/moko <command>` |
 | `monitoring/sites.json` | Sites list for mcp_mokomonitor |
 
@@ -71,6 +71,6 @@ PHPStan runs with `--memory-limit=512M`. CI enforces PHPCS errors; PHPStan is `c
 - **Never commit** `.claude/`, `.mcp.json`, `TODO.md`, `*.min.css`/`*.min.js`
 - **Attribution**: `Authored-by: Moko Consulting`
 - **Workflow directory**: `.mokogitea/` (not `.gitea/` or `.github/`)
-- **Wiki**: documentation lives in the Gitea wiki, not `docs/` files
+- **Wiki**: documentation lives in the MokoGitea wiki, not `docs/` files
 - **New CLI tools**: extend `CliFramework`, not `CLIApp` (legacy)
 - **Standards**: [MokoCli](https://git.mokoconsulting.tech/MokoConsulting/mokocli/wiki/Home)

.mokogitea/branch-protection.yml

@@ -124,7 +124,8 @@ jobs:
             "rule_name": "main",
             "enable_push": true,
             "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller"],
+            "push_whitelist_usernames": ["jmiller", "moko-deploy"],
+            "push_whitelist_actions_user": true,
             "enable_force_push": false,
             "enable_force_push_allowlist": false,
             "force_push_allowlist_usernames": [],
@@ -140,10 +141,12 @@ jobs:
             "rule_name": "dev",
             "enable_push": true,
             "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller"],
+            "push_whitelist_usernames": ["jmiller", "moko-deploy"],
-            "enable_force_push": false,
+            "push_whitelist_actions_user": true,
-            "enable_force_push_allowlist": false,
+            "enable_force_push": true,
-            "force_push_allowlist_usernames": [],
+            "enable_force_push_allowlist": true,
+            "force_push_allowlist_usernames": ["jmiller", "moko-deploy"],
+            "force_push_allowlist_actions_user": true,
             "enable_merge_whitelist": false,
             "required_approvals": 0,
             "block_on_rejected_reviews": false,
@@ -154,10 +157,12 @@ jobs:
             "rule_name": "rc",
             "enable_push": true,
             "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller"],
+            "push_whitelist_usernames": ["jmiller", "moko-deploy"],
-            "enable_force_push": false,
+            "push_whitelist_actions_user": true,
-            "enable_force_push_allowlist": false,
+            "enable_force_push": true,
-            "force_push_allowlist_usernames": [],
+            "enable_force_push_allowlist": true,
+            "force_push_allowlist_usernames": ["jmiller", "moko-deploy"],
+            "force_push_allowlist_actions_user": true,
             "enable_merge_whitelist": false,
             "required_approvals": 0,
             "block_on_rejected_reviews": false,
@@ -168,7 +173,8 @@ jobs:
             "rule_name": "beta",
             "enable_push": true,
             "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller"],
+            "push_whitelist_usernames": ["jmiller", "moko-deploy"],
+            "push_whitelist_actions_user": true,
             "enable_force_push": false,
             "enable_force_push_allowlist": false,
             "force_push_allowlist_usernames": [],
@@ -182,7 +188,8 @@ jobs:
             "rule_name": "alpha",
             "enable_push": true,
             "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller"],
+            "push_whitelist_usernames": ["jmiller", "moko-deploy"],
+            "push_whitelist_actions_user": true,
             "enable_force_push": false,
             "enable_force_push_allowlist": false,
             "force_push_allowlist_usernames": [],

.mokogitea/workflows/auto-bump.yml

@@ -1,66 +1,67 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
+#
-# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-License-Identifier: GPL-3.0-or-later
-#
+#
-# FILE INFORMATION
+# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Release
+# INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/auto-bump.yml
+# PATH: /.mokogitea/workflows/auto-bump.yml
-# VERSION: 09.02.00
+# VERSION: 09.02.00
-# BRIEF: Auto patch-bump version on every push to dev (skips merge commits)
+# BRIEF: Auto patch-bump version on every push to dev (skips merge commits)
-
+
-name: "Universal: Auto Version Bump"
+name: "Universal: Auto Version Bump"
-
+
-on:
+on:
-  push:
+  push:
-    branches:
+    branches:
-      - dev
+      - dev
-      - rc
+      - rc
-      - 'feature/**'
+      - 'feature/**'
-      - 'patch/**'
+      - 'patch/**'
-
+
-env:
+env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-
+
-permissions:
+permissions:
-  contents: write
+  contents: write
-
+
-jobs:
+jobs:
-  bump:
+  bump:
-    name: Version Bump
+    name: Version Bump
-    runs-on: release
+    runs-on: release
-    if: >-
+    if: >-
-      !contains(github.event.head_commit.message, '[skip ci]') &&
+      !contains(github.event.head_commit.message, '[skip ci]') &&
-      !contains(github.event.head_commit.message, '[skip bump]') &&
+      !contains(github.event.head_commit.message, '[skip bump]') &&
-      !startsWith(github.event.head_commit.message, 'Merge pull request')
+      !startsWith(github.event.head_commit.message, 'Merge pull request') &&
-
+      !startsWith(github.event.repository.name, 'Template-')
-    steps:
+
-      - name: Checkout
+    steps:
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Checkout
-        with:
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+        with:
-          fetch-depth: 1
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
-
+          fetch-depth: 1
-      - name: Setup mokocli tools
+
-        run: |
+      - name: Setup mokocli tools
-          if ! command -v composer &> /dev/null; then
+        run: |
-            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
+          if ! command -v composer &> /dev/null; then
-          fi
+            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
-          if [ -d "/opt/mokocli/cli" ]; then
+          fi
-            echo "MOKO_CLI=/opt/mokocli/cli" >> "$GITHUB_ENV"
+          if [ -d "/opt/mokocli/cli" ]; then
-          else
+            echo "MOKO_CLI=/opt/mokocli/cli" >> "$GITHUB_ENV"
-            git clone --depth 1 --branch main --quiet \
+          else
-              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/mokocli.git" \
+            git clone --depth 1 --branch main --quiet \
-              /tmp/mokocli
+              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/MokoCLI.git" \
-            cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
+              /tmp/mokocli
-            echo "MOKO_CLI=/tmp/mokocli/cli" >> "$GITHUB_ENV"
+            cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
-          fi
+            echo "MOKO_CLI=/tmp/mokocli/cli" >> "$GITHUB_ENV"
-
+          fi
-      - name: Bump version
+
-        run: |
+      - name: Bump version
-          php ${MOKO_CLI}/version_auto_bump.php \
+        run: |
-            --path . --branch "${GITHUB_REF_NAME}" \
+          php ${MOKO_CLI}/version_auto_bump.php \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
+            --path . --branch "${GITHUB_REF_NAME}" \
-            --repo-url "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
+            --repo-url "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"

.mokogitea/workflows/auto-release.yml

@@ -1,467 +1,497 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
+#
-# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-License-Identifier: GPL-3.0-or-later
-#
+#
-# FILE INFORMATION
+# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Release
+# INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /templates/workflows/universal/auto-release.yml.template
+# PATH: /.mokogitea/workflows/auto-release.yml
-# VERSION: 05.00.00
+# VERSION: 05.01.00
-# BRIEF: Universal build & release � detects platform from manifest.xml
+# BRIEF: Universal build & release � detects platform from manifest.xml
-#
+#
-# +=======================================================================+
+# +=======================================================================+
-# |              UNIVERSAL BUILD & RELEASE PIPELINE                        |
+# |              UNIVERSAL BUILD & RELEASE PIPELINE                        |
-# +=======================================================================+
+# +=======================================================================+
-# |                                                                        |
+# |                                                                        |
-# |  Reads manifest.xml (joomla|dolibarr|generic) to branch logic.       |
+# |  Reads manifest.xml (joomla|dolibarr|generic) to branch logic.       |
-# |                                                                        |
+# |                                                                        |
-# |  Platform-specific:                                                    |
+# |  Platform-specific:                                                    |
-# |    joomla:   XML manifest, type-prefixed packages                      |
+# |    joomla:   XML manifest, type-prefixed packages                      |
-# |    dolibarr: mod*.class.php, update.txt, dev version reset             |
+# |    dolibarr: mod*.class.php, update.txt, dev version reset             |
-# |    generic:  README-only, no update stream                             |
+# |    generic:  README-only, no update stream                             |
-# |                                                                        |
+# |                                                                        |
-# +=======================================================================+
+# +=======================================================================+
-
+
-name: "Universal: Build & Release"
+name: "Universal: Build & Release"
-
+
-on:
+on:
-  pull_request:
+  pull_request:
-    types: [opened, synchronize, closed]
+    types: [opened, synchronize, closed]
-    branches:
+    branches:
-      - main
+      - main
-    paths-ignore:
+    paths-ignore:
-      - '.mokogitea/workflows/**'
+      - '.mokogitea/workflows/**'
-      - '*.md'
+      - '*.md'
-      - 'wiki/**'
+      - 'wiki/**'
-      - '.editorconfig'
+      - '.editorconfig'
-      - '.gitignore'
+      - '.gitignore'
-      - '.gitattributes'
+      - '.gitattributes'
-      - '.gitmessage'
+      - '.gitmessage'
-      - 'LICENSE' 
+      - 'LICENSE' 
-  workflow_dispatch:
+  workflow_dispatch:
-    inputs:
+    inputs:
-      action:
+      action:
-        description: 'Action to perform'
+        description: 'Action to perform'
-        required: false
+        required: false
-        type: choice
+        type: choice
-        default: release
+        default: release
-        options:
+        options:
-          - release
+          - release
-          - promote-rc
+          - promote-rc
-
+
-env:
+env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
-
+
-permissions:
+permissions:
-  contents: write
+  contents: write
-
+
-jobs:
+jobs:
-  # ── PR Opened → Rename branch to RC and build RC release ─────────────────────────
+  # ── PR Opened → Rename branch to RC and build RC release ─────────────────────────
-  promote-rc:
+  promote-rc:
-    name: Promote to RC
+    name: Promote to RC
-    runs-on: release
+    runs-on: release
-    if: >-
+    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
-      (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
+    if: >-
-      (github.event.action == 'synchronize' && github.event.pull_request.merged != true) ||
+      !startsWith(github.event.repository.name, 'Template-') &&
-      (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
+      (
-
+        (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
-    steps:
+        (github.event.action == 'synchronize' && github.event.pull_request.merged != true) ||
-      - name: Checkout repository
+        (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      )
-        with:
+
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+    steps:
-          fetch-depth: 1
+      - name: Checkout repository
-
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - name: Setup mokocli tools
+        with:
-        env:
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          fetch-depth: 1
-          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+          submodules: recursive
-        run: |
+
-          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
+      - name: Setup mokocli tools
-            echo Using pre-installed /opt/mokocli
+        env:
-            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          else
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
-            echo Falling back to fresh clone
+        run: |
-            if ! command -v composer > /dev/null 2>&1; then
+          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
-              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+            echo Using pre-installed /opt/mokocli
-            fi
+            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
-            rm -rf /tmp/mokocli
+          else
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            echo Falling back to fresh clone
-            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+            if ! command -v composer > /dev/null 2>&1; then
-            cd /tmp/mokocli
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
-            composer install --no-dev --no-interaction --quiet
+            fi
-            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
+            rm -rf /tmp/mokocli
-          fi
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
-
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
-      - name: Rename branch to rc
+            cd /tmp/mokocli
-        run: |
+            composer install --no-dev --no-interaction --quiet
-          php ${MOKO_CLI}/branch_rename.php \
+            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
-            --from "${{ github.event.pull_request.head.ref || 'dev' }}" --to rc \
+          fi
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
+
-            --api-base "${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}" \
+      - name: Rename branch to rc
-            --pr "${{ github.event.pull_request.number }}"
+        run: |
-
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-      - name: Checkout rc and configure git
+          AUTH="Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}"
-        run: |
+          FROM="${{ github.event.pull_request.head.ref || 'dev' }}"
-          git fetch origin rc
+          PR="${{ github.event.pull_request.number }}"
-          git checkout rc
+
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          # Resolve the source branch HEAD commit.
-          git config --local user.name "gitea-actions[bot]"
+          SRC_JSON=$(curl -sf -H "$AUTH" "${API_BASE}/branches/${FROM}") \
-          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+            || { echo "::error::Source branch ${FROM} not found"; exit 1; }
-
+          SRC_SHA=$(printf '%s' "$SRC_JSON" | python3 -c "import sys, json; print(json.load(sys.stdin)['commit']['id'])" 2>/dev/null || true)
-      - name: Publish RC release
+          [ -n "$SRC_SHA" ] || { echo "::error::Could not resolve HEAD of ${FROM}"; exit 1; }
-        run: |
+
-          php ${MOKO_CLI}/release_publish.php \
+          # Point rc at the source commit. If rc already exists (a protected branch that
-            --path . --stability rc --bump minor --branch rc \
+          # cannot be deleted), force-update its ref in place instead of delete+recreate:
-            --token "${{ secrets.MOKOGITEA_TOKEN }}"
+          # deleting a protected branch fails, which then makes the recreate return HTTP 409.
-
+          if curl -sf -o /dev/null -H "$AUTH" "${API_BASE}/branches/rc"; then
-      - name: Update RC release notes from CHANGELOG.md
+            echo "rc exists - force-updating to ${FROM} (${SRC_SHA})"
-        run: |
+            curl -sf -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+              "${API_BASE}/git/refs/heads/rc" -d "{\"sha\":\"${SRC_SHA}\",\"force\":true}" \
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+              || { echo "::error::Failed to force-update rc (CI token needs force-push on the protected rc branch)"; exit 1; }
-
+          else
-          # Extract [Unreleased] section from changelog
+            echo "Creating rc from ${FROM}"
-          NOTES=""
+            curl -sf -X POST -H "$AUTH" -H "Content-Type: application/json" \
-          if [ -f "CHANGELOG.md" ]; then
+              "${API_BASE}/branches" -d "{\"new_branch_name\":\"rc\",\"old_branch_name\":\"${FROM}\"}" \
-            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
+              || { echo "::error::Failed to create rc from ${FROM}"; exit 1; }
-          fi
+          fi
-          [ -z "$NOTES" ] && NOTES="Release candidate"
+
-
+          # Repoint the PR at rc, then delete the old source branch (non-fatal).
-          # Find the RC release and update its body
+          if [ -n "$PR" ]; then
-          RELEASE_ID=$(curl -sf -H "Authorization: token ${TOKEN}" \
+            curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
-            "${API_BASE}/releases/tags/release-candidate" \
+              "${API_BASE}/pulls/${PR}" -d '{"head":"rc"}' >/dev/null || true
-            | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+          fi
-
+          curl -s -X DELETE -H "$AUTH" "${API_BASE}/branches/${FROM}" >/dev/null || true
-          if [ -n "$RELEASE_ID" ]; then
+          echo "Renamed ${FROM} -> rc"
-            python3 -c "
+
-          import json, urllib.request
+      - name: Checkout rc and configure git
-          body = open('/dev/stdin').read()
+        run: |
-          payload = json.dumps({'body': body}).encode()
+          git fetch origin rc
-          req = urllib.request.Request(
+          git checkout rc
-              '${API_BASE}/releases/${RELEASE_ID}',
+          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
-              data=payload, method='PATCH',
+          git config --local user.name "mokogitea-actions[bot]"
-              headers={
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
-                  'Authorization': 'token ${TOKEN}',
+
-                  'Content-Type': 'application/json'
+      - name: Publish RC release
-              })
+        run: |
-          urllib.request.urlopen(req)
+          php ${MOKO_CLI}/release_publish.php \
-          " <<< "$NOTES"
+            --path . --stability rc --bump minor --branch rc \
-            echo "RC release notes updated from CHANGELOG.md"
+            --token "${{ secrets.MOKOGITEA_TOKEN }}"
-          fi
+
-
+      - name: Update RC release notes from CHANGELOG.md
-      - name: Summary
+        run: |
-        if: always()
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-        run: |
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-          echo "## Promoted to Release Candidate" >> $GITHUB_STEP_SUMMARY
+
-          echo "Branch renamed to rc, minor bump, RC release built" >> $GITHUB_STEP_SUMMARY
+          # Extract [Unreleased] section from changelog
-
+          NOTES=""
-  # ── Merged PR → Build & Release (or promote RC to stable) ─────────────────────────
+          if [ -f "CHANGELOG.md" ]; then
-  release:
+            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
-    name: Build & Release Pipeline
+          fi
-    runs-on: release
+          [ -z "$NOTES" ] && NOTES="Release candidate"
-    if: >-
+
-      github.event.pull_request.merged == true ||
+          # Find the RC release and update its body
-      (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
+          RELEASE_ID=$(curl -sf -H "Authorization: token ${TOKEN}" \
-
+            "${API_BASE}/releases/tags/release-candidate" \
-    steps:
+            | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
-      - name: Checkout repository
+
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+          if [ -n "$RELEASE_ID" ]; then
-        with:
+            python3 -c "
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          import json, urllib.request
-          fetch-depth: 0
+          body = open('/dev/stdin').read()
-
+          payload = json.dumps({'body': body}).encode()
-      - name: Configure git for bot pushes
+          req = urllib.request.Request(
-        run: |
+              '${API_BASE}/releases/${RELEASE_ID}',
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+              data=payload, method='PATCH',
-          git config --local user.name "gitea-actions[bot]"
+              headers={
-          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+                  'Authorization': 'token ${TOKEN}',
-
+                  'Content-Type': 'application/json'
-      - name: Check for merge conflict markers
+              })
-        run: |
+          urllib.request.urlopen(req)
-          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
+          " <<< "$NOTES"
-          if [ -n "$CONFLICTS" ]; then
+            echo "RC release notes updated from CHANGELOG.md"
-            echo "::error::Merge conflict markers found — aborting release"
+          fi
-            echo "## Release Blocked: Conflict Markers" >> $GITHUB_STEP_SUMMARY
+
-            echo '```' >> $GITHUB_STEP_SUMMARY
+      - name: Summary
-            echo "$CONFLICTS" >> $GITHUB_STEP_SUMMARY
+        if: always()
-            echo '```' >> $GITHUB_STEP_SUMMARY
+        run: |
-            exit 1
+          echo "## Promoted to Release Candidate" >> $GITHUB_STEP_SUMMARY
-          fi
+          echo "Branch renamed to rc, minor bump, RC release built" >> $GITHUB_STEP_SUMMARY
-          echo "No conflict markers found"
+
-
+  # ── Merged PR → Build & Release (or promote RC to stable) ─────────────────────────
-      - name: Setup mokocli tools
+  release:
-        env:
+    name: Build & Release Pipeline
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+    runs-on: release
-          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_MIRROR_TOKEN }}"}}'
+    if: >-
-        run: |
+      !startsWith(github.event.repository.name, 'Template-') &&
-          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
+      (
-            echo Using pre-installed /opt/mokocli
+        github.event.pull_request.merged == true ||
-            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
+        (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
-          else
+      )
-            echo Falling back to fresh clone
+
-            if ! command -v composer > /dev/null 2>&1; then
+    steps:
-              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+      - name: Checkout repository
-            fi
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-            rm -rf /tmp/mokocli
+        with:
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
-            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+          fetch-depth: 0
-            cd /tmp/mokocli
+          submodules: recursive
-            composer install --no-dev --no-interaction --quiet
+
-            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
+      - name: Configure git for bot pushes
-          fi
+        run: |
-
+          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
-      - name: "Detect platform"
+          git config --local user.name "mokogitea-actions[bot]"
-        id: platform
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
-        run: |
+
-          php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
+      - name: Check for merge conflict markers
-          php ${MOKO_CLI}/manifest_read.php --path . --github-output 2>/dev/null || true
+        run: |
-
+          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
-      - name: "Determine version bump level"
+          if [ -n "$CONFLICTS" ]; then
-        id: bump
+            echo "::error::Merge conflict markers found — aborting release"
-        run: |
+            echo "## Release Blocked: Conflict Markers" >> $GITHUB_STEP_SUMMARY
-          # Fix/patch branches: version was already bumped by pre-release, just strip suffix
+            echo '```' >> $GITHUB_STEP_SUMMARY
-          # Feature/dev branches: bump minor for the new stable release
+            echo "$CONFLICTS" >> $GITHUB_STEP_SUMMARY
-          HEAD_REF="${{ github.event.pull_request.head.ref || 'dev' }}"
+            echo '```' >> $GITHUB_STEP_SUMMARY
-          case "$HEAD_REF" in
+            exit 1
-            fix/*|patch/*|hotfix/*|bugfix/*) BUMP="none" ;;
+          fi
-            *)                               BUMP="minor" ;;
+          echo "No conflict markers found"
-          esac
+
-          echo "level=${BUMP}" >> "$GITHUB_OUTPUT"
+      - name: Setup mokocli tools
-          echo "Bump level: ${BUMP} (from branch: ${HEAD_REF})"
+        env:
-
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-      - name: "Publish stable release"
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
-        run: |
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_MIRROR_TOKEN }}"}}'
-          BUMP_FLAG=""
+        run: |
-          if [ "${{ steps.bump.outputs.level }}" != "none" ]; then
+          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
-            BUMP_FLAG="--bump ${{ steps.bump.outputs.level }}"
+            echo Using pre-installed /opt/mokocli
-          fi
+            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
-          php ${MOKO_CLI}/release_publish.php \
+          else
-            --path . --stability stable ${BUMP_FLAG} --branch main \
+            echo Falling back to fresh clone
-            --token "${{ secrets.MOKOGITEA_TOKEN }}"
+            if ! command -v composer > /dev/null 2>&1; then
-
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
-      - name: "Read published version"
+            fi
-        id: version
+            rm -rf /tmp/mokocli
-        run: |
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
-          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null || echo "")
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
-          VERSION=$(echo "$VERSION" | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
+            cd /tmp/mokocli
-          [ -z "$VERSION" ] && VERSION="00.00.00" && echo "skip=true" >> "$GITHUB_OUTPUT"
+            composer install --no-dev --no-interaction --quiet
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
-          PLATFORM="${{ steps.platform.outputs.platform }}"
+          fi
-          if [[ "$PLATFORM" == joomla* ]]; then
+
-            echo "tag=stable" >> "$GITHUB_OUTPUT"
+      - name: "Detect platform"
-            echo "release_tag=stable" >> "$GITHUB_OUTPUT"
+        id: platform
-          else
+        run: |
-            echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT"
+          php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
-            echo "release_tag=v${VERSION}" >> "$GITHUB_OUTPUT"
+          php ${MOKO_CLI}/manifest_read.php --path . --github-output 2>/dev/null || true
-          fi
+
-          echo "branch=main" >> "$GITHUB_OUTPUT"
+      - name: "Determine version bump level"
-          echo "Published version: ${VERSION}"
+        id: bump
-
+        run: |
-      - name: "Create semver tag for non-Joomla repos"
+          # Fix/patch branches: version was already bumped by pre-release, just strip suffix
-        id: semver
+          # Feature/dev branches: bump minor for the new stable release
-        if: |
+          HEAD_REF="${{ github.event.pull_request.head.ref || 'dev' }}"
-          steps.version.outputs.skip != 'true' &&
+          case "$HEAD_REF" in
-          !startsWith(steps.platform.outputs.platform, 'joomla')
+            fix/*|patch/*|hotfix/*|bugfix/*) BUMP="none" ;;
-        run: |
+            *)                               BUMP="minor" ;;
-          VERSION="${{ steps.version.outputs.version }}"
+          esac
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          echo "level=${BUMP}" >> "$GITHUB_OUTPUT"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          echo "Bump level: ${BUMP} (from branch: ${HEAD_REF})"
-          SEMVER_TAG="v${VERSION}"
+
-
+      - name: "Publish stable release"
-          echo "Creating semver tag: ${SEMVER_TAG}"
+        run: |
-
+          BUMP_FLAG=""
-          # Create the git tag via API
+          if [ "${{ steps.bump.outputs.level }}" != "none" ]; then
-          HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" \
+            BUMP_FLAG="--bump ${{ steps.bump.outputs.level }}"
-            -X POST -H "Authorization: token ${TOKEN}" \
+          fi
-            -H "Content-Type: application/json" \
+          php ${MOKO_CLI}/release_publish.php \
-            "${API_BASE}/tags" \
+            --path . --stability stable ${BUMP_FLAG} --branch main \
-            -d "{\"tag_name\":\"${SEMVER_TAG}\",\"target\":\"main\",\"message\":\"Release ${VERSION}\"}" 2>/dev/null || echo "000")
+            --token "${{ secrets.MOKOGITEA_TOKEN }}"
-
+
-          if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
+      - name: "Read published version"
-            echo "Created semver tag: ${SEMVER_TAG}"
+        id: version
-          elif [ "$HTTP_CODE" = "409" ]; then
+        run: |
-            echo "Semver tag ${SEMVER_TAG} already exists (skipped)"
+          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null || echo "")
-          else
+          VERSION=$(echo "$VERSION" | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
-            echo "::warning::Failed to create semver tag ${SEMVER_TAG} (HTTP ${HTTP_CODE})"
+          [ -z "$VERSION" ] && VERSION="00.00.00" && echo "skip=true" >> "$GITHUB_OUTPUT"
-          fi
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-
+          PLATFORM="${{ steps.platform.outputs.platform }}"
-          echo "semver_tag=${SEMVER_TAG}" >> "$GITHUB_OUTPUT"
+          if [[ "$PLATFORM" == joomla* ]]; then
-
+            echo "tag=stable" >> "$GITHUB_OUTPUT"
-      - name: Update release notes and promote changelog
+            echo "release_tag=stable" >> "$GITHUB_OUTPUT"
-        run: |
+          else
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+            echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+            echo "release_tag=v${VERSION}" >> "$GITHUB_OUTPUT"
-
+          fi
-          # Get the stable release info (version and ID)
+          echo "branch=main" >> "$GITHUB_OUTPUT"
-          RELEASE_JSON=$(curl -sf -H "Authorization: token ${TOKEN}" \
+          echo "Published version: ${VERSION}"
-            "${API_BASE}/releases/tags/stable" 2>/dev/null || echo '{}')
+
-          RELEASE_ID=$(python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" <<< "$RELEASE_JSON" 2>/dev/null || true)
+      - name: "Create semver tag for non-Joomla repos"
-          # Extract version from release name (e.g. "06.17.00" or "v06.17.00")
+        id: semver
-          VERSION=$(python3 -c "
+        if: |
-          import json, sys, re
+          steps.version.outputs.skip != 'true' &&
-          r = json.load(sys.stdin)
+          !startsWith(steps.platform.outputs.platform, 'joomla')
-          name = r.get('name', '')
+        run: |
-          m = re.search(r'(\d+\.\d+\.\d+)', name)
+          VERSION="${{ steps.version.outputs.version }}"
-          print(m.group(1) if m else '')
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          " <<< "$RELEASE_JSON" 2>/dev/null || true)
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-
+          SEMVER_TAG="v${VERSION}"
-          # Extract [Unreleased] section from changelog
+
-          NOTES=""
+          echo "Creating semver tag: ${SEMVER_TAG}"
-          if [ -f "CHANGELOG.md" ]; then
+
-            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
+          # Create the git tag via API
-          fi
+          HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" \
-          [ -z "$NOTES" ] && NOTES="Stable release"
+            -X POST -H "Authorization: token ${TOKEN}" \
-
+            -H "Content-Type: application/json" \
-          # Update release body via API
+            "${API_BASE}/tags" \
-          if [ -n "$RELEASE_ID" ]; then
+            -d "{\"tag_name\":\"${SEMVER_TAG}\",\"target\":\"main\",\"message\":\"Release ${VERSION}\"}" 2>/dev/null || echo "000")
-            python3 -c "
+
-          import json, urllib.request
+          if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
-          body = open('/dev/stdin').read()
+            echo "Created semver tag: ${SEMVER_TAG}"
-          payload = json.dumps({'body': body}).encode()
+          elif [ "$HTTP_CODE" = "409" ]; then
-          req = urllib.request.Request(
+            echo "Semver tag ${SEMVER_TAG} already exists (skipped)"
-              '${API_BASE}/releases/${RELEASE_ID}',
+          else
-              data=payload, method='PATCH',
+            echo "::warning::Failed to create semver tag ${SEMVER_TAG} (HTTP ${HTTP_CODE})"
-              headers={
+          fi
-                  'Authorization': 'token ${TOKEN}',
+
-                  'Content-Type': 'application/json'
+          echo "semver_tag=${SEMVER_TAG}" >> "$GITHUB_OUTPUT"
-              })
+
-          urllib.request.urlopen(req)
+      - name: Update release notes and promote changelog
-          " <<< "$NOTES"
+        run: |
-            echo "Release notes updated from CHANGELOG.md"
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          fi
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-
+
-          # Promote [Unreleased] → [version] in CHANGELOG.md and reset
+          # Get the stable release info (version and ID)
-          if [ -n "$VERSION" ] && [ -f "CHANGELOG.md" ]; then
+          RELEASE_JSON=$(curl -sf -H "Authorization: token ${TOKEN}" \
-            DATE=$(date +%Y-%m-%d)
+            "${API_BASE}/releases/tags/stable" 2>/dev/null || echo '{}')
-            python3 -c "
+          RELEASE_ID=$(python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" <<< "$RELEASE_JSON" 2>/dev/null || true)
-          import sys
+          # Extract version from release name (e.g. "06.17.00" or "v06.17.00")
-          version, date = sys.argv[1], sys.argv[2]
+          VERSION=$(python3 -c "
-          content = open('CHANGELOG.md').read()
+          import json, sys, re
-          old = '## [Unreleased]'
+          r = json.load(sys.stdin)
-          new = f'## [Unreleased]\n\n## [{version}] --- {date}'
+          name = r.get('name', '')
-          content = content.replace(old, new, 1)
+          m = re.search(r'(\d+\.\d+\.\d+)', name)
-          open('CHANGELOG.md', 'w').write(content)
+          print(m.group(1) if m else '')
-          " "$VERSION" "$DATE"
+          " <<< "$RELEASE_JSON" 2>/dev/null || true)
-            git add CHANGELOG.md
+
-            git commit -m "chore: promote changelog [Unreleased] → [${VERSION}]" || true
+          # Extract [Unreleased] section from changelog
-            git push origin main || true
+          NOTES=""
-            echo "Changelog promoted: [Unreleased] → [${VERSION}]"
+          if [ -f "CHANGELOG.md" ]; then
-          fi
+            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
-
+          fi
-      # -- STEP 9: Mirror to GitHub (stable only) --------------------------------
+          [ -z "$NOTES" ] && NOTES="Stable release"
-      - name: "Step 9: Mirror release to GitHub"
+
-        if: >-
+          # Update release body via API
-          steps.version.outputs.skip != 'true' &&
+          if [ -n "$RELEASE_ID" ]; then
-          secrets.GH_MIRROR_TOKEN != ''
+            python3 -c "
-        continue-on-error: true
+          import json, urllib.request
-        run: |
+          body = open('/dev/stdin').read()
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
+          payload = json.dumps({'body': body}).encode()
-          RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
+          req = urllib.request.Request(
-          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
+              '${API_BASE}/releases/${RELEASE_ID}',
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+              data=payload, method='PATCH',
-          php ${MOKO_CLI}/release_mirror.php \
+              headers={
-            --version "$VERSION" --tag "$RELEASE_TAG" \
+                  'Authorization': 'token ${TOKEN}',
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+                  'Content-Type': 'application/json'
-            --gh-token "${{ secrets.GH_MIRROR_TOKEN }}" --gh-repo "$GH_REPO" \
+              })
-            --branch main 2>&1 || true
+          urllib.request.urlopen(req)
-          echo "GitHub mirror updated" >> $GITHUB_STEP_SUMMARY
+          " <<< "$NOTES"
-
+            echo "Release notes updated from CHANGELOG.md"
-      # -- STEP 10: Sync main branch to GitHub mirror ----------------------------
+          fi
-      - name: "Step 10: Push main to GitHub mirror"
+
-        if: >-
+          # Promote [Unreleased] → [version] in CHANGELOG.md and reset
-          steps.version.outputs.skip != 'true' &&
+          if [ -n "$VERSION" ] && [ -f "CHANGELOG.md" ]; then
-          secrets.GH_MIRROR_TOKEN != ''
+            DATE=$(date +%Y-%m-%d)
-        continue-on-error: true
+            python3 -c "
-        run: |
+          import sys
-          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
+          version, date = sys.argv[1], sys.argv[2]
-          GH_ORG=$(echo "$GH_REPO" | cut -d/ -f1)
+          content = open('CHANGELOG.md').read()
-          GH_NAME=$(echo "$GH_REPO" | cut -d/ -f2)
+          old = '## [Unreleased]'
-          git remote add github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git" 2>/dev/null || \
+          new = f'## [Unreleased]\n\n## [{version}] --- {date}'
-            git remote set-url github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git"
+          content = content.replace(old, new, 1)
-          git fetch origin main --depth=1
+          open('CHANGELOG.md', 'w').write(content)
-          git push github origin/main:refs/heads/main --force 2>/dev/null \
+          " "$VERSION" "$DATE"
-            && echo "main branch pushed to GitHub mirror" \
+            git add CHANGELOG.md
-            || echo "WARNING: GitHub mirror push failed"
+            git commit -m "chore: promote changelog [Unreleased] → [${VERSION}]" || true
-
+            git push origin main || true
-      - name: "Step 11: Delete rc branch and recreate dev from main"
+            echo "Changelog promoted: [Unreleased] → [${VERSION}]"
-        if: steps.version.outputs.skip != 'true'
+          fi
-        continue-on-error: true
+
-        run: |
+      # -- STEP 9: Mirror to GitHub (stable only) --------------------------------
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+      - name: "Step 9: Mirror release to GitHub"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+        if: >-
-
+          steps.version.outputs.skip != 'true' &&
-          # Delete rc branch (ephemeral — created by promote-rc)
+          secrets.GH_MIRROR_TOKEN != ''
-          curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
+        continue-on-error: true
-            "${API_BASE}/branches/rc" 2>/dev/null \
+        run: |
-            && echo "Deleted rc branch" || echo "rc branch not found"
+          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-
+          RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
-          # Delete dev branch
+          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
-          curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-            "${API_BASE}/branches/dev" 2>/dev/null && echo "Deleted dev branch"
+          php ${MOKO_CLI}/release_mirror.php \
-
+            --version "$VERSION" --tag "$RELEASE_TAG" \
-          # Recreate dev from main (now includes version bump + changelog promotion)
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
-          curl -sf -X POST -H "Authorization: token ${TOKEN}" \
+            --gh-token "${{ secrets.GH_MIRROR_TOKEN }}" --gh-repo "$GH_REPO" \
-            -H "Content-Type: application/json" \
+            --branch main 2>&1 || true
-            "${API_BASE}/branches" \
+          echo "GitHub mirror updated" >> $GITHUB_STEP_SUMMARY
-            -d '{"new_branch_name":"dev","old_branch_name":"main"}' 2>/dev/null && echo "Recreated dev from main"
+
-
+      # -- STEP 10: Sync main branch to GitHub mirror ----------------------------
-          echo "Pre-release branches cleaned, dev reset from main" >> $GITHUB_STEP_SUMMARY
+      - name: "Step 10: Push main to GitHub mirror"
-
+        if: >-
-      - name: "Step 12: Create version branch from main"
+          steps.version.outputs.skip != 'true' &&
-        if: steps.version.outputs.skip != 'true'
+          secrets.GH_MIRROR_TOKEN != ''
-        continue-on-error: true
+        continue-on-error: true
-        run: |
+        run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          GH_ORG=$(echo "$GH_REPO" | cut -d/ -f1)
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
+          GH_NAME=$(echo "$GH_REPO" | cut -d/ -f2)
-          BRANCH_NAME="version/${VERSION}"
+          git remote add github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git" 2>/dev/null || \
-          MAIN_SHA=$(git rev-parse HEAD)
+            git remote set-url github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git"
-
+          git fetch origin main --depth=1
-          # Delete old version branch if it exists (same version re-release)
+          git push github origin/main:refs/heads/main --force 2>/dev/null \
-          curl -sf -X DELETE -H "Authorization: token ${TOKEN}"             "${API_BASE}/branches/${BRANCH_NAME}" 2>/dev/null && echo "Deleted old ${BRANCH_NAME}"
+            && echo "main branch pushed to GitHub mirror" \
-
+            || echo "WARNING: GitHub mirror push failed"
-          # Create version/XX.YY.ZZ from main
+
-          curl -sf -X POST -H "Authorization: token ${TOKEN}"             -H "Content-Type: application/json"             "${API_BASE}/branches"             -d "{\"new_branch_name\":\"${BRANCH_NAME}\",\"old_branch_name\":\"main\"}" 2>/dev/null             && echo "Created ${BRANCH_NAME} from main (${MAIN_SHA})"             || echo "WARNING: ${BRANCH_NAME} creation failed"
+      - name: "Step 11: Delete rc branch (dev reset moved to cascade-dev.yml)"
-
+        if: steps.version.outputs.skip != 'true'
-          echo "Version branch created: ${BRANCH_NAME} (${MAIN_SHA})" >> $GITHUB_STEP_SUMMARY
+        continue-on-error: true
-
+        run: |
-
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-      # -- Dolibarr post-release: Reset dev version -----------------------------
+
-      - name: "Post-release: Reset dev version"
+          # Delete rc branch (ephemeral — created by promote-rc)
-        if: steps.version.outputs.skip != 'true'
+          curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
-        continue-on-error: true
+            "${API_BASE}/branches/rc" 2>/dev/null \
-        run: |
+            && echo "Deleted rc branch" || echo "rc branch not found"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+
-          php ${MOKO_CLI}/version_reset_dev.php \
+          # dev is reset from main by the dedicated "Cascade Main -> Dev" workflow
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "${API_BASE}" \
+          # (cascade-dev.yml), which runs after this release completes.
-            --branch dev --path . 2>&1 || true
+          echo "rc cleaned; dev reset handled by cascade-dev.yml" >> $GITHUB_STEP_SUMMARY
-
+
-      # -- Summary --------------------------------------------------------------
+      - name: "Step 12: Create version branch from main"
-      - name: Pipeline Summary
+        if: steps.version.outputs.skip != 'true'
-        if: always()
+        continue-on-error: true
-        run: |
+        run: |
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          PLATFORM="${{ steps.platform.outputs.platform }}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-          if [ "${{ steps.version.outputs.skip }}" = "true" ]; then
+          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-            echo "## Release Skipped" >> $GITHUB_STEP_SUMMARY
+          BRANCH_NAME="version/${VERSION}"
-            echo "No VERSION in README.md" >> $GITHUB_STEP_SUMMARY
+          MAIN_SHA=$(git rev-parse HEAD)
-          elif [ "${{ steps.check.outputs.already_released }}" = "true" ]; then
+
-            echo "## Already Released — ${VERSION}" >> $GITHUB_STEP_SUMMARY
+          # Delete old version branch if it exists (same version re-release)
-          else
+          curl -sf -X DELETE -H "Authorization: token ${TOKEN}"             "${API_BASE}/branches/${BRANCH_NAME}" 2>/dev/null && echo "Deleted old ${BRANCH_NAME}"
-            echo "" >> $GITHUB_STEP_SUMMARY
+
-            echo "## Build & Release Complete (${PLATFORM})" >> $GITHUB_STEP_SUMMARY
+          # Create version/XX.YY.ZZ from main
-            echo "" >> $GITHUB_STEP_SUMMARY
+          curl -sf -X POST -H "Authorization: token ${TOKEN}"             -H "Content-Type: application/json"             "${API_BASE}/branches"             -d "{\"new_branch_name\":\"${BRANCH_NAME}\",\"old_branch_name\":\"main\"}" 2>/dev/null             && echo "Created ${BRANCH_NAME} from main (${MAIN_SHA})"             || echo "WARNING: ${BRANCH_NAME} creation failed"
-            echo "| Step | Result |" >> $GITHUB_STEP_SUMMARY
+
-            echo "|------|--------|" >> $GITHUB_STEP_SUMMARY
+          echo "Version branch created: ${BRANCH_NAME} (${MAIN_SHA})" >> $GITHUB_STEP_SUMMARY
-            echo "| Platform | \`${PLATFORM}\` |" >> $GITHUB_STEP_SUMMARY
+
-            echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
+
-            echo "| Branch | \`${{ steps.version.outputs.branch }}\` |" >> $GITHUB_STEP_SUMMARY
+
-            echo "| Tag | \`${{ steps.version.outputs.tag }}\` |" >> $GITHUB_STEP_SUMMARY
+      # -- Dolibarr post-release: Reset dev version -----------------------------
-            echo "| Release | [View](${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
+      - name: "Post-release: Reset dev version"
-          fi
+        if: steps.version.outputs.skip != 'true'
+        continue-on-error: true
+        run: |
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          php ${MOKO_CLI}/version_reset_dev.php \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "${API_BASE}" \
+            --branch dev --path . 2>&1 || true
+
+      # -- Summary --------------------------------------------------------------
+      - name: Pipeline Summary
+        if: always()
+        run: |
+          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          if [ "${{ steps.version.outputs.skip }}" = "true" ]; then
+            echo "## Release Skipped" >> $GITHUB_STEP_SUMMARY
+            echo "No VERSION in README.md" >> $GITHUB_STEP_SUMMARY
+          elif [ "${{ steps.check.outputs.already_released }}" = "true" ]; then
+            echo "## Already Released — ${VERSION}" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "## Build & Release Complete (${PLATFORM})" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "| Step | Result |" >> $GITHUB_STEP_SUMMARY
+            echo "|------|--------|" >> $GITHUB_STEP_SUMMARY
+            echo "| Platform | \`${PLATFORM}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Branch | \`${{ steps.version.outputs.branch }}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Tag | \`${{ steps.version.outputs.tag }}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Release | [View](${MOKOGITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
+          fi

.mokogitea/workflows/branch-cleanup.yml

@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/branch-cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Delete feature branches after PR merge
@@ -33,7 +33,8 @@ jobs:
         run: |
           BRANCH="${{ github.event.pull_request.head.ref }}"
           API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
-          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
+          # URL-encode the branch name's slashes (no PHP dependency on the runner)
+          ENCODED=$(printf '%s' "${BRANCH}" | sed 's|/|%2F|g')
 
           STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
             -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \

.mokogitea/workflows/cascade-dev.yml

@@ -1,10 +1,106 @@
-# DISABLED — auto-release Step 11 recreates dev from main after every release.
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-# Cascade-dev is redundant and causes version conflicts when both main and dev
+#
-# have different version numbers in templateDetails.xml / manifest.xml.
+# SPDX-License-Identifier: GPL-3.0-or-later
-name: "Cascade Main → Dev (DISABLED)"
+#
-on: workflow_dispatch
+# FILE INFORMATION
+# DEFGROUP: MokoGitea.Workflow
+# INGROUP: MokoStandards.Cascade
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogitea/workflows/cascade-dev.yml
+# VERSION: 02.00.00
+# BRIEF: Cascade main -> dev via PR; auto-merge only if conflict-free, else notify
+
+name: "Cascade Main -> Dev"
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+env:
+  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  # ntfy destination is configured via repo or org variables (org vars are inherited).
+  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
+  NTFY_TOPIC: ${{ vars.CASCADE_NTFY_TOPIC || vars.NTFY_TOPIC || 'gitea-releases' }}
+
 jobs:
-  noop:
+  cascade:
+    name: Cascade main -> dev
     runs-on: ubuntu-latest
     steps:
-      - run: echo "Cascade disabled — auto-release handles dev recreation"
+      - name: Open main -> dev PR (auto-merge if clean, else notify)
+        env:
+          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -uo pipefail
+          API="${MOKOGITEA_URL}/api/v1/repos/${REPO}"
+          AUTH="Authorization: token ${TOKEN}"
+          jqnum() { python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('$1',''))" 2>/dev/null; }
+
+          # 0. dev must exist
+          if ! curl -sf -H "$AUTH" "${API}/branches/dev" >/dev/null 2>&1; then
+            echo "No dev branch - nothing to cascade."; exit 0
+          fi
+
+          # 1. is main ahead of dev?
+          AHEAD=$(curl -sf -H "$AUTH" "${API}/compare/dev...main" \
+            | python3 -c "import sys,json; print(json.load(sys.stdin).get('total_commits',0))" 2>/dev/null || echo 0)
+          if [ "${AHEAD:-0}" -eq 0 ]; then
+            echo "dev already up to date with main."; exit 0
+          fi
+          echo "main is ${AHEAD} commit(s) ahead of dev."
+
+          # 2. reuse an open main->dev PR, else create one
+          PR=$(curl -sf -H "$AUTH" "${API}/pulls?state=open&base=dev" \
+            | python3 -c "import sys,json; d=json.load(sys.stdin); print(next((str(p['number']) for p in d if p.get('head',{}).get('ref')=='main'), ''))" 2>/dev/null || echo "")
+          if [ -z "$PR" ]; then
+            RESP=$(curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/pulls" \
+              -d '{"head":"main","base":"dev","title":"chore(sync): cascade main -> dev","body":"Automated cascade of main into dev. Auto-merges only if conflict-free; otherwise left open for manual resolution."}')
+            PR=$(printf '%s' "$RESP" | jqnum number)
+            if [ -z "$PR" ]; then
+              echo "::warning::Could not open cascade PR: $RESP"; exit 0
+            fi
+            echo "Opened cascade PR #${PR}"
+          else
+            echo "Reusing open cascade PR #${PR}"
+          fi
+
+          # 3. wait for MokoGitea to compute mergeability (conflict detection)
+          MERGEABLE=""
+          for _ in 1 2 3 4 5 6; do
+            MERGEABLE=$(curl -sf -H "$AUTH" "${API}/pulls/${PR}" | jqnum mergeable)
+            case "$MERGEABLE" in True|False) break ;; esac
+            sleep 3
+          done
+          echo "mergeable=${MERGEABLE}"
+
+          notify() {
+            curl -sS \
+              -H "Title: ${REPO}: dev cascade needs manual merge" \
+              -H "Tags: warning,twisted_rightwards_arrows" \
+              -H "Priority: high" \
+              -H "Click: ${MOKOGITEA_URL}/${REPO}/pulls/${PR}" \
+              -d "main -> dev cascade PR #${PR} $1 It was NOT auto-merged; resolve it manually." \
+              "${NTFY_URL}/${NTFY_TOPIC}" || true
+          }
+
+          # 4. auto-merge only if conflict-free; otherwise notify
+          if [ "$MERGEABLE" = "True" ]; then
+            CODE=$(curl -s -o /tmp/merge.json -w "%{http_code}" -H "$AUTH" -H "Content-Type: application/json" \
+              -X POST "${API}/pulls/${PR}/merge" -d '{"Do":"merge","merge_when_checks_succeed":true}')
+            if [ "$CODE" -ge 200 ] && [ "$CODE" -lt 300 ]; then
+              echo "Cascade PR #${PR} merged (or scheduled to merge when checks pass)."
+            else
+              echo "::warning::Auto-merge returned HTTP ${CODE}: $(cat /tmp/merge.json)"
+              notify "could not be auto-merged (HTTP ${CODE})."
+            fi
+          else
+            echo "::warning::Cascade PR #${PR} has conflicts (mergeable=${MERGEABLE}); sending notification."
+            notify "has conflicts and cannot be merged automatically."
+          fi

.mokogitea/workflows/ci-generic.yml

@@ -3,16 +3,22 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.gitea/workflows/ci-generic.yml
+# PATH: /.mokogitea/workflows/ci-generic.yml
 # VERSION: 01.00.00
 # BRIEF: CI pipeline — lint, validate, and test for generic projects (PHP + Node.js)
 
 name: "Generic: Project CI"
 
 on:
+  pull_request:
+    branches:
+      - main
+      - dev
+      - dev/**
+      - rc/**
   workflow_dispatch:
 
 permissions:
@@ -26,6 +32,8 @@ jobs:
   lint:
     name: Lint & Validate
     runs-on: ubuntu-latest
+    # Skip on template repos (Template-*) — they hold placeholder scaffolding, not buildable source.
+    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
 
     steps:
       - name: Checkout
@@ -124,6 +132,9 @@ jobs:
     name: Tests
     runs-on: ubuntu-latest
     needs: lint
+    # Run only when lint succeeded; always() forces evaluation so a skipped
+    # lint (e.g. template repos) skips this job cleanly instead of hanging.
+    if: ${{ always() && needs.lint.result == 'success' }}
 
     steps:
       - name: Checkout

.mokogitea/workflows/ci-issue-reporter.yml

@@ -0,0 +1,68 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGitea.Workflow
+# INGROUP: mokocli.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogitea/workflows/ci-issue-reporter.yml
+# VERSION: 01.00.00
+# BRIEF: Reusable workflow — creates/updates a MokoGitea issue when a CI gate fails.
+#        Clones MokoCLI and runs cli/ci_issue_reporter.sh.
+
+name: "Universal: CI Issue Reporter"
+
+on:
+  workflow_call:
+    inputs:
+      gate:
+        description: "CI gate name (e.g. PR Validation, Repository Health)"
+        required: true
+        type: string
+      details:
+        description: "Human-readable failure description"
+        required: true
+        type: string
+      severity:
+        description: "error or warning"
+        required: false
+        type: string
+        default: "error"
+      workflow:
+        description: "Workflow name for the issue title"
+        required: false
+        type: string
+        default: ""
+    secrets:
+      MOKOGITEA_TOKEN:
+        required: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  report:
+    name: "Report: ${{ inputs.gate }}"
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Clone MokoCLI
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+        run: |
+          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          git clone --depth 1 --filter=blob:none --sparse "${MOKOGITEA_URL}/MokoConsulting/MokoCLI.git" /tmp/mokocli
+          cd /tmp/mokocli && git sparse-checkout set cli/ci_issue_reporter.sh
+
+      - name: Report CI failure
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+        run: |
+          chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh
+          /tmp/mokocli/cli/ci_issue_reporter.sh \
+            --gate "${{ inputs.gate }}" \
+            --details "${{ inputs.details }}" \
+            --severity "${{ inputs.severity }}" \
+            --workflow "${{ inputs.workflow }}"

.mokogitea/workflows/ci-platform.yml

@@ -115,7 +115,7 @@ jobs:
 
       - name: "PHPCS (PSR-12)"
         run: |
-          vendor/bin/phpcs --standard=phpcs.xml --report=summary --warning-severity=0 lib/ validate/ automation/ 2>&1 || {
+          vendor/bin/phpcs --standard=phpcs.xml --report=summary --warning-severity=0 lib/ validate/ 2>&1 || {
             echo "::error::PHPCS found coding standard violations"
             echo "### PHPCS" >> $GITHUB_STEP_SUMMARY
             echo "Coding standard violations detected. Run \`composer phpcs\` locally." >> $GITHUB_STEP_SUMMARY
@@ -453,8 +453,8 @@ jobs:
            needs.governance.result == 'failure' ||
            needs.templates.result == 'failure')
         env:
-          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
         run: |
           chmod +x automation/ci-issue-reporter.sh
           REPORTER="./automation/ci-issue-reporter.sh"

.mokogitea/workflows/cleanup.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Maintenance
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.gitea/workflows/cleanup.yml
+# PATH: /.mokogitea/workflows/cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Scheduled cleanup — delete merged branches and old workflow runs
 
@@ -21,7 +21,7 @@ permissions:
   contents: write
 
 env:
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   cleanup:
@@ -33,30 +33,30 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.GA_TOKEN }}
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
 
       - name: Delete merged branches
         env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
         run: |
           echo "=== Merged Branch Cleanup ==="
-          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
 
           # List branches via API
-          BRANCHES=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
+          BRANCHES=$(curl -sS -H "Authorization: token ${MOKOGITEA_TOKEN}" \
             "${API}/branches?limit=50" | jq -r '.[].name')
 
           DELETED=0
           for BRANCH in $BRANCHES; do
             # Skip protected branches
             case "$BRANCH" in
-              main|master|develop|release/*|hotfix/*) continue ;;
+              main|master|dev|develop|rc|beta|alpha|release|release/*|production|stable|staging|hotfix/*|version/*) continue ;;
             esac
 
             # Check if branch is merged into main
             if git merge-base --is-ancestor "origin/${BRANCH}" origin/main 2>/dev/null; then
               echo "  Deleting merged branch: ${BRANCH}"
-              curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
+              curl -sS -X DELETE -H "Authorization: token ${MOKOGITEA_TOKEN}" \
                 "${API}/branches/${BRANCH}" 2>/dev/null || true
               DELETED=$((DELETED + 1))
             fi
@@ -66,20 +66,20 @@ jobs:
 
       - name: Clean old workflow runs
         env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
         run: |
           echo "=== Workflow Run Cleanup ==="
-          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
           CUTOFF=$(date -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -v-30d +%Y-%m-%dT%H:%M:%SZ)
 
           # Get old completed runs
-          RUNS=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
+          RUNS=$(curl -sS -H "Authorization: token ${MOKOGITEA_TOKEN}" \
             "${API}/actions/runs?status=completed&limit=50" | \
             jq -r ".workflow_runs[] | select(.created_at < \"${CUTOFF}\") | .id" 2>/dev/null)
 
           DELETED=0
           for RUN_ID in $RUNS; do
-            curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
+            curl -sS -X DELETE -H "Authorization: token ${MOKOGITEA_TOKEN}" \
               "${API}/actions/runs/${RUN_ID}" 2>/dev/null || true
             DELETED=$((DELETED + 1))
           done

.mokogitea/workflows/composer-publish.yml

@@ -13,7 +13,7 @@ on:
   workflow_dispatch:
 
 env:
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   publish:
@@ -49,7 +49,7 @@ jobs:
       - name: Verify Gitea registry
         run: |
           echo "Gitea Composer registry auto-publishes from tags."
-          echo "Package available at: ${GITEA_URL}/api/packages/MokoConsulting/composer"
+          echo "Package available at: ${MOKOGITEA_URL}/api/packages/MokoConsulting/composer"
           echo "Install: composer require mokoconsulting/mokocli"
 
       # Packagist — notify of new version (points to GitHub mirror which Packagist can access)

.mokogitea/workflows/deploy-manual.yml

@@ -1,126 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.Deploy
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards-API
-# PATH: /templates/workflows/joomla/deploy-manual.yml.template
-# VERSION: 04.07.00
-# BRIEF: Manual SFTP deploy to dev server for Joomla repos
-
-name: "Universal: Deploy to Dev (Manual)"
-
-on:
-  workflow_dispatch:
-    inputs:
-      clear_remote:
-        description: 'Delete all remote files before uploading'
-        required: false
-        default: 'false'
-        type: boolean
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-permissions:
-  contents: read
-
-jobs:
-  deploy:
-    name: SFTP Deploy to Dev
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Setup PHP
-        run: |
-          php -v && composer --version
-
-      - name: Setup MokoStandards tools
-        env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
-          MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
-        run: |
-          git clone --depth 1 --branch main --quiet \
-            "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
-            /tmp/mokostandards-api 2>/dev/null || true
-          if [ -d "/tmp/mokostandards-api" ] && [ -f "/tmp/mokostandards-api/composer.json" ]; then
-            cd /tmp/mokostandards-api && composer install --no-dev --no-interaction --quiet 2>/dev/null || true
-          fi
-
-      - name: Check FTP configuration
-        id: check
-        env:
-          HOST: ${{ vars.DEV_FTP_HOST }}
-          PATH_VAR: ${{ vars.DEV_FTP_PATH }}
-          PORT: ${{ vars.DEV_FTP_PORT }}
-        run: |
-          if [ -z "$HOST" ] || [ -z "$PATH_VAR" ]; then
-            echo "DEV_FTP_HOST or DEV_FTP_PATH not configured -- cannot deploy"
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          echo "skip=false" >> "$GITHUB_OUTPUT"
-          echo "host=$HOST" >> "$GITHUB_OUTPUT"
-
-          REMOTE="${PATH_VAR%/}"
-          echo "remote=$REMOTE" >> "$GITHUB_OUTPUT"
-
-          [ -z "$PORT" ] && PORT="22"
-          echo "port=$PORT" >> "$GITHUB_OUTPUT"
-
-      - name: Deploy via SFTP
-        if: steps.check.outputs.skip != 'true'
-        env:
-          SFTP_KEY: ${{ secrets.DEV_FTP_KEY }}
-          SFTP_PASS: ${{ secrets.DEV_FTP_PASSWORD }}
-          SFTP_USER: ${{ vars.DEV_FTP_USERNAME }}
-        run: |
-          SOURCE_DIR="src"
-          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
-          [ ! -d "$SOURCE_DIR" ] && { echo "No src/ or htdocs/ -- nothing to deploy"; exit 0; }
-
-          printf '{"host":"%s","port":%s,"username":"%s","remotePath":"%s"' \
-            "${{ steps.check.outputs.host }}" "${{ steps.check.outputs.port }}" "$SFTP_USER" "${{ steps.check.outputs.remote }}" \
-            > /tmp/sftp-config.json
-
-          if [ -n "$SFTP_KEY" ]; then
-            echo "$SFTP_KEY" > /tmp/deploy_key
-            chmod 600 /tmp/deploy_key
-            printf ',"privateKeyPath":"/tmp/deploy_key"}' >> /tmp/sftp-config.json
-          else
-            printf ',"password":"%s"}' "$SFTP_PASS" >> /tmp/sftp-config.json
-          fi
-
-          DEPLOY_ARGS=(--path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json)
-          [ "${{ inputs.clear_remote }}" = "true" ] && DEPLOY_ARGS+=(--clear-remote)
-
-          PLATFORM=$(php /tmp/mokostandards-api/cli/platform_detect.php --path . 2>/dev/null || true)
-          if [ "$PLATFORM" = "waas-component" ] && [ -f "/tmp/mokostandards-api/deploy/deploy-joomla.php" ]; then
-            php /tmp/mokostandards-api/deploy/deploy-joomla.php "${DEPLOY_ARGS[@]}"
-          else
-            php /tmp/mokostandards-api/deploy/deploy-sftp.php "${DEPLOY_ARGS[@]}"
-          fi
-
-          rm -f /tmp/deploy_key /tmp/sftp-config.json
-
-      - name: Summary
-        if: always()
-        run: |
-          if [ "${{ steps.check.outputs.skip }}" = "true" ]; then
-            echo "### Deploy Skipped -- FTP not configured" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "### Manual Dev Deploy Complete" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
-            echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
-            echo "| Host | \`${{ steps.check.outputs.host }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Remote | \`${{ steps.check.outputs.remote }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Clear | ${{ inputs.clear_remote }} |" >> $GITHUB_STEP_SUMMARY
-          fi

.mokogitea/workflows/gitleaks.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Security
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards-API
-# PATH: /templates/workflows/gitleaks.yml.template
+# PATH: /.mokogitea/workflows/gitleaks.yml
 # VERSION: 01.00.00
 # BRIEF: Secret scanning — detect leaked credentials, API keys, and tokens
 #

.mokogitea/workflows/issue-branch.yml

@@ -5,7 +5,7 @@
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
 # INGROUP: mokocli.Automation
-# VERSION: 09.41.00
+# VERSION: 01.00.00
 # BRIEF: Auto-create feature branch when an issue is opened
 
 name: "Universal: Issue Branch"
@@ -19,7 +19,7 @@ permissions:
   issues: write
 
 env:
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   create-branch:
@@ -28,8 +28,8 @@ jobs:
     steps:
       - name: Create branch and comment
         run: |
-          TOKEN="${{ secrets.GA_TOKEN }}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
           ISSUE_NUM="${{ github.event.issue.number }}"
           ISSUE_TITLE="${{ github.event.issue.title }}"
 
@@ -58,7 +58,7 @@ jobs:
             echo "Created branch: ${BRANCH}"
 
             # Comment on issue with branch link
-            REPO_URL="${GITEA_URL}/${{ github.repository }}"
+            REPO_URL="${MOKOGITEA_URL}/${{ github.repository }}"
             BODY="Branch created: [\`${BRANCH}\`](${REPO_URL}/src/branch/${BRANCH})\n\n\`\`\`bash\ngit fetch origin\ngit checkout ${BRANCH}\n\`\`\`"
 
             curl -sf -X POST \

.mokogitea/workflows/notify.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Notifications
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.gitea/workflows/notify.yml
+# PATH: /.mokogitea/workflows/notify.yml
 # VERSION: 01.00.00
 # BRIEF: Push notifications via ntfy on release success or workflow failure
 
@@ -15,9 +15,9 @@ name: "Universal: Notifications"
 on:
   workflow_run:
     workflows:
-      - "Joomla Build & Release"
+      - "Universal: Build & Release"
-      - "Joomla Extension CI"
+      - "Joomla: Extension CI"
-      - "Deploy"
+      - "Generic: Project CI"
     types:
       - completed
 

.mokogitea/workflows/pre-release.yml

@@ -3,11 +3,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /templates/workflows/universal/pre-release.yml.template
+# PATH: /.mokogitea/workflows/pre-release.yml
-# VERSION: 05.01.00
+# VERSION: 05.02.00
 # BRIEF: Auto pre-release on push to dev/alpha/beta/rc branches
 
 name: "Universal: Pre-Release"
@@ -48,9 +48,13 @@ jobs:
   build:
     name: "Build Pre-Release (${{ inputs.stability || github.ref_name }})"
     runs-on: release
+    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
     if: >-
-      github.event_name == 'workflow_dispatch' ||
+      !startsWith(github.event.repository.name, 'Template-') &&
-      github.event_name == 'push'
+      (
+        github.event_name == 'workflow_dispatch' ||
+        github.event_name == 'push'
+      )
 
     steps:
       - name: Checkout
@@ -59,6 +63,11 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.MOKOGITEA_TOKEN }}
           ref: ${{ github.ref_name }}
+          submodules: recursive
+
+      - name: Update submodules to main
+        run: |
+          git submodule foreach --quiet 'git checkout main && git pull --quiet origin main' 2>/dev/null || true
 
       - name: Setup mokocli tools
         env:
@@ -75,7 +84,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
             echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
@@ -147,8 +156,8 @@ jobs:
           fi
 
           # Commit version bump
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
+          git config --local user.name "mokogitea-actions[bot]"
           git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
           git add -A
           git diff --cached --quiet || {

.mokogitea/workflows/rc-revert.yml

@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/rc-revert.yml
 # VERSION: 09.23.00
 # BRIEF: Rename rc/ branch back to dev/ when PR is closed without merge
@@ -25,16 +25,25 @@ jobs:
     runs-on: ubuntu-latest
     if: >-
       github.event.pull_request.merged == false &&
-      startsWith(github.event.pull_request.head.ref, 'rc/')
+      startsWith(github.event.pull_request.head.ref, 'rc/') &&
+      !startsWith(github.event.repository.name, 'Template-')
 
     steps:
       - name: Rename branch
+        env:
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+          REPO: ${{ github.repository }}
+          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
         run: |
-          BRANCH="${{ github.event.pull_request.head.ref }}"
+          set -euo pipefail
+          # BRANCH is attacker-controlled (PR head ref). Strict allowlist before ANY use.
+          if ! printf '%s' "$BRANCH" | grep -Eq '^rc/[A-Za-z0-9._/-]+$'; then
+            echo "::error::Refusing unsafe branch name: $BRANCH"; exit 1
+          fi
           SUFFIX="${BRANCH#rc/}"
           DEV_BRANCH="dev/${SUFFIX}"
-          API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
+          API="${GITEA_URL}/api/v1/repos/${REPO}/branches"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
 
           # Create dev/ branch from rc/ branch
           STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X POST \
@@ -42,25 +51,22 @@ jobs:
             -H "Content-Type: application/json" \
             -d "{\"new_branch_name\": \"${DEV_BRANCH}\", \"old_branch_name\": \"${BRANCH}\"}" \
             "${API}" 2>/dev/null || true)
-
           if [ "$STATUS" = "201" ]; then
-            echo "Created branch: ${DEV_BRANCH}" >> $GITHUB_STEP_SUMMARY
+            echo "Created branch: ${DEV_BRANCH}" >> "$GITHUB_STEP_SUMMARY"
           else
-            echo "::error::Failed to create ${DEV_BRANCH} from ${BRANCH} (HTTP ${STATUS})"
+            echo "::error::Failed to create ${DEV_BRANCH} from ${BRANCH} (HTTP ${STATUS})"; exit 1
-            exit 1
           fi
 
-          # Delete rc/ branch
+          # Read BRANCH from the environment inside PHP (getenv, no string interpolation -> no PHP injection)
-          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
+          ENCODED=$(php -r 'echo rawurlencode(getenv("BRANCH"));')
           STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
             -H "Authorization: token ${TOKEN}" \
             "${API}/${ENCODED}" 2>/dev/null || true)
-
           if [ "$STATUS" = "204" ]; then
-            echo "Deleted branch: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
+            echo "Deleted branch: ${BRANCH}" >> "$GITHUB_STEP_SUMMARY"
           else
             echo "::warning::Failed to delete ${BRANCH} (HTTP ${STATUS})"
           fi
 
-          echo "### RC Reverted" >> $GITHUB_STEP_SUMMARY
+          echo "### RC Reverted" >> "$GITHUB_STEP_SUMMARY"
-          echo "${BRANCH} → ${DEV_BRANCH}" >> $GITHUB_STEP_SUMMARY
+          echo "${BRANCH} → ${DEV_BRANCH}" >> "$GITHUB_STEP_SUMMARY"

.mokogitea/workflows/sync-feature-versions.yml

@@ -22,7 +22,7 @@ permissions:
   contents: write
 
 env:
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   sync:

.mokogitea/workflows/sync-on-merge.yml

@@ -0,0 +1,32 @@
+name: Sync Workflows to Repos
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.mokogitea/workflows/**'
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    if: ${{ startsWith(github.event.repository.name, 'Template-') }}
+    steps:
+      - name: Checkout mokocli
+        uses: actions/checkout@v4
+        with:
+          repository: MokoConsulting/MokoCLI
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
+
+      - name: Setup PHP
+        uses: https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/raw/branch/main/actions/setup-php@v1
+        with:
+          php-version: '8.1'
+
+      - name: Install dependencies
+        run: composer install --no-dev --no-interaction
+
+      - name: Sync workflows to generic repos
+        run: php automation/bulk_sync.php --platform generic --org MokoConsulting --workflows-only --auto-merge --token "${{ secrets.MOKOGITEA_TOKEN }}"
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}

.mokogitea/workflows/version-set.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow.Template
+# DEFGROUP: MokoGitea.Workflow.Template
 # INGROUP: MokoStandards.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
 # PATH: /.mokogitea/workflows/version-set.yml
@@ -34,6 +34,7 @@ jobs:
   set-version:
     name: Set Version to ${{ inputs.version }}
     runs-on: ubuntu-latest
+    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
 
     steps:
       - name: Validate version format
@@ -48,7 +49,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.MOKOGITEA_TOKEN || secrets.GA_TOKEN || github.token }}
+          token: ${{ secrets.MOKOGITEA_TOKEN || github.token }}
           ref: ${{ inputs.branch || github.ref }}
           fetch-depth: 1
 

.mokogitea/workflows/workflow-sync-trigger.yml

@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/workflow-sync-trigger.yml
 # VERSION: 01.01.00
 # BRIEF: Trigger workflow sync to live repos when a PR is merged to main
@@ -13,6 +13,7 @@
 name: "Universal: Workflow Sync Trigger"
 
 on:
+  workflow_dispatch:
   pull_request:
     types: [closed]
     branches:
@@ -26,8 +27,10 @@ jobs:
     name: Sync workflows to live repos
     runs-on: ubuntu-latest
     if: >-
-      github.event.pull_request.merged == true &&
+      startsWith(github.event.repository.name, 'Template-') &&
-      !contains(github.event.pull_request.title, '[skip sync]')
+      (github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true &&
+      !contains(github.event.pull_request.title, '[skip sync]')))
 
     steps:
       - name: Determine platform from repo name
@@ -49,8 +52,14 @@ jobs:
         env:
           MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
         run: |
-          GITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
-          git clone --depth 1 "${GITEA_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
+          git clone --depth 1 "${MOKOGITEA_URL}/MokoConsulting/MokoCLI.git" /tmp/mokocli
+
+      - name: Install PHP
+        run: |
+          if ! command -v php &> /dev/null; then
+            apt-get update -qq && apt-get install -y -qq php-cli php-json php-curl > /dev/null 2>&1
+          fi
 
       - name: Install dependencies
         run: |

CHANGELOG.md

@@ -4,7 +4,7 @@ SPDX-License-Identifier: GPL-3.0-or-later
 FILE INFORMATION
 DEFGROUP: MokoCli.Root
 INGROUP: MokoCli
-REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
+REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 PATH: /CHANGELOG.md
 BRIEF: Release changelog
 -->
@@ -12,12 +12,17 @@ BRIEF: Release changelog
 # Changelog
 ## [Unreleased]
 
-## [09.41.00] --- 2026-06-25
+## [09.43.00] --- 2026-07-05
 
-## [09.40.00] --- 2026-06-25
+## [09.43.00] --- 2026-07-05
 
-## [09.40.00] --- 2026-06-25
+## [09.42.00] --- 2026-07-04
 
-## [09.39.00] --- 2026-06-25
+## [09.42.00] --- 2026-07-04
 
-## [09.39.00] --- 2026-06-25
+### Fixed
+- branch_rename.php: force-update the target branch ref in place instead of delete+recreate, so `moko repo:rename-branch` works when the target (e.g. `rc`) is a protected branch that cannot be deleted — previously the delete silently failed and the recreate returned HTTP 409
+
+## [09.42.00] --- 2026-07-04
+
+## [09.42.00] --- 2026-07-04

CONTRIBUTING.md

@@ -34,7 +34,7 @@ feature/* ──PR──> dev ──draft PR──> (renamed to rc) ──merge
 7. **Merging to main** triggers the stable release pipeline:
    - Minor version bump (e.g., `02.09.xx` → `02.10.00`)
    - Stability suffix stripped (clean version)
-   - Gitea release created with ZIP/tar.gz packages
+   - MokoGitea release created with ZIP/tar.gz packages
    - `updates.xml` updated (Joomla extensions)
    - `dev` branch recreated from `main`
 

PLUGIN_SCRIPTS.md

@@ -2,8 +2,8 @@
 Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 SPDX-License-Identifier: GPL-3.0-or-later
 FILE INFORMATION
-DEFGROUP: MokoPlatform.Root
+DEFGROUP: MokoCLI.Root
-INGROUP: MokoPlatform
+INGROUP: MokoCLI
 REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 PATH: /PLUGIN_SCRIPTS.md
 BRIEF: Plugin system CLI documentation

README.md

@@ -2,11 +2,11 @@
 Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 SPDX-License-Identifier: GPL-3.0-or-later
 FILE INFORMATION
-DEFGROUP: MokoPlatform.Root
+DEFGROUP: MokoCLI.Root
-INGROUP: MokoPlatform
+INGROUP: MokoCLI
 REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 PATH: /README.md
-VERSION: 09.41.00
+VERSION: 09.43.00
 BRIEF: Project overview and documentation
 -->
 
@@ -16,7 +16,7 @@ BRIEF: Project overview and documentation
 
 PHP implementation of mokocli — enterprise standards, automation framework, workflow templates, and bulk sync tooling.
 
-> **Primary platform**: [Gitea — git.mokoconsulting.tech](https://git.mokoconsulting.tech/MokoConsulting/MokoCli-API)
+> **Primary platform**: [MokoGitea — git.mokoconsulting.tech](https://git.mokoconsulting.tech/MokoConsulting/MokoCli-API)
 > **Backup mirror**: [GitHub](https://github.com/MokoConsulting/MokoCli-API) *(read-only mirror)*
 
 ## What Lives Here
@@ -25,7 +25,7 @@ PHP implementation of mokocli — enterprise standards, automation framework, wo
 |-----------|---------|
 | `lib/Enterprise/` | 38 PHP enterprise library classes (platform adapters, sync, validation, plugins) |
 | `cli/` | CLI scripts (archive, create, release, sync rulesets, version management) |
-| `automation/` | Bulk sync, push files, repo cleanup, Gitea migration |
+| `automation/` | Bulk sync, push files, repo cleanup, MokoGitea migration |
 | `validate/` | 18 validation scripts (health, structure, secrets, syntax, drift) |
 | `templates/` | **Workflow templates** and config templates synced to governed repos |
 | `definitions/` | Repository structure definitions (`.tf` format) |
@@ -42,7 +42,7 @@ composer require mokoconsulting-tech/enterprise
 
 ### Composer Registry
 
-This package is served from Gitea package registry. Add this to your `composer.json`:
+This package is served from MokoGitea package registry. Add this to your `composer.json`:
 
 ```json
 {
@@ -73,10 +73,10 @@ vendor/bin/moko inventory -- --path .
 | Variable | Purpose |
 |----------|---------|
 | `GIT_PLATFORM` | `gitea` (default) or `github` |
-| `GA_TOKEN` | Gitea API / Gitea Actions token |
+| `GA_TOKEN` | MokoGitea API / MokoGitea Actions token |
 | `GH_TOKEN` | GitHub API token (for mirror sync) |
-| `GITEA_URL` | Gitea instance URL (default: `https://git.mokoconsulting.tech`) |
+| `GITEA_URL` | MokoGitea instance URL (default: `https://git.mokoconsulting.tech`) |
-| `GITEA_ORG` | Gitea organization (default: `MokoConsulting`) |
+| `GITEA_ORG` | MokoGitea organization (default: `MokoConsulting`) |
 
 ## License
 

analysis/index.md

@@ -2,8 +2,8 @@
 Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 SPDX-License-Identifier: GPL-3.0-or-later
 FILE INFORMATION
-DEFGROUP: MokoPlatform.Index
+DEFGROUP: MokoCLI.Index
-INGROUP: MokoPlatform.Analysis
+INGROUP: MokoCLI.Analysis
 REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 PATH: /analysis/index.md
 BRIEF: Analysis directory index

cli/audit_query.php

@@ -14,8 +14,8 @@
  * (at your option) any later version.
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.CLI
+ * DEFGROUP: MokoCLI.Enterprise.CLI
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/audit_query.php
  * BRIEF: Search, filter, and export audit logs

cli/branch_rename.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/branch_rename.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Rename a git branch via Gitea API (create new, update PR, delete old)
  */
 
@@ -64,26 +64,46 @@ class BranchRenameCli extends CliFramework
             return 1;
         }
 
-        // Step 2: Delete target branch if it already exists
+        // Step 2: Point the target branch at the source commit.
+        // If the target already exists (e.g. a protected `rc` branch that cannot be
+        // deleted), force-update its ref in place instead of delete+recreate: deleting a
+        // protected branch fails, which then makes the recreate return HTTP 409.
+        $sourceSha = '';
+        if (isset($check['body']['commit']['id']) && is_string($check['body']['commit']['id'])) {
+            $sourceSha = $check['body']['commit']['id'];
+        }
         $targetCheck = $this->apiRequest('GET', "{$apiBase}/branches/{$to}", $headers);
         if ($targetCheck['code'] === 200) {
-            echo "Target branch '{$to}' already exists — deleting\n";
+            echo "Target branch '{$to}' already exists - force-updating to {$from}
+";
             if (!$this->dryRun) {
-                $this->apiRequest('DELETE', "{$apiBase}/branches/{$to}", $headers);
+                if ($sourceSha === '') {
+                    $this->log('ERROR', "Cannot resolve HEAD commit of source '{$from}'");
+                    return 1;
+                }
+                $ref = $this->apiRequest('PATCH', "{$apiBase}/git/refs/heads/{$to}", $headers, [
+                    'sha'   => $sourceSha,
+                    'force' => true,
+                ]);
+                if ($ref['code'] < 200 || $ref['code'] >= 300) {
+                    $this->log('ERROR', "Failed to force-update '{$to}': HTTP {$ref['code']} (needs force-push perm)");
+                    $this->log('ERROR', json_encode($ref['body']));
+                    return 1;
+                }
             }
-        }
+        } else {
-
+            echo "Creating branch: {$to} (from {$from})
-        // Step 3: Create new branch from source
+";
-        echo "Creating branch: {$to} (from {$from})\n";
+            if (!$this->dryRun) {
-        if (!$this->dryRun) {
+                $create = $this->apiRequest('POST', "{$apiBase}/branches", $headers, [
-            $create = $this->apiRequest('POST', "{$apiBase}/branches", $headers, [
+                    'new_branch_name' => $to,
-                'new_branch_name' => $to,
+                    'old_branch_name' => $from,
-                'old_branch_name' => $from,
+                ]);
-            ]);
+                if ($create['code'] < 200 || $create['code'] >= 300) {
-            if ($create['code'] < 200 || $create['code'] >= 300) {
+                    $this->log('ERROR', "Failed to create branch '{$to}': HTTP {$create['code']}");
-                $this->log('ERROR', "Failed to create branch '{$to}': HTTP {$create['code']}");
+                    $this->log('ERROR', json_encode($create['body']));
-                $this->log('ERROR', json_encode($create['body']));
+                    return 1;
-                return 1;
+                }
             }
         }
 

cli/bulk_workflow_push.php

@@ -12,7 +12,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/bulk_workflow_push.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Push a workflow file to all governed repos via the Gitea Contents API
  */
 

cli/bulk_workflow_trigger.php

@@ -12,7 +12,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/bulk_workflow_trigger.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Trigger a workflow across multiple repos at once
  */
 

cli/ci_issue_reporter.sh

@@ -0,0 +1,230 @@
+#!/usr/bin/env bash
+# ============================================================================
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Automation.CI
+# INGROUP: mokocli.CLI
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoCLI
+# PATH: /cli/ci_issue_reporter.sh
+# VERSION: 10.00.00
+# BRIEF: Creates or updates a Gitea issue when a CI gate fails.
+#        Deduplicates by searching open issues with the "ci-auto" label
+#        whose title matches the gate. If a matching issue exists, a comment
+#        is appended instead of opening a duplicate.
+# ============================================================================
+
+set -euo pipefail
+
+# ── Defaults ────────────────────────────────────────────────────────────────
+MOKOGITEA_URL="${MOKOGITEA_URL:-https://git.mokoconsulting.tech}"
+MOKOGITEA_TOKEN="${MOKOGITEA_TOKEN:-}"
+REPO="${GITHUB_REPOSITORY:-}"
+RUN_URL="${GITHUB_SERVER_URL:-${MOKOGITEA_URL}}/${REPO}/actions/runs/${GITHUB_RUN_ID:-0}"
+LABEL_NAME="ci-auto"
+LABEL_COLOR="#e11d48"
+
+GATE=""
+DETAILS=""
+SEVERITY="error"
+WORKFLOW=""
+
+# ── Parse arguments ─────────────────────────────────────────────────────────
+usage() {
+  cat <<EOF
+Usage: ci_issue_reporter.sh --gate NAME --details TEXT [OPTIONS]
+
+Required:
+  --gate      CI gate name (e.g. "Code Quality", "Self-Health")
+  --details   Human-readable failure description
+
+Optional:
+  --severity  "error" (default) or "warning"
+  --workflow  Workflow name for the issue title
+  --repo      owner/repo (default: \$GITHUB_REPOSITORY)
+  --run-url   URL to the CI run (auto-detected from env)
+  --token     Gitea API token (default: \$MOKOGITEA_TOKEN)
+  --url       Gitea base URL (default: \$MOKOGITEA_URL)
+EOF
+  exit 1
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --gate)     GATE="$2";       shift 2 ;;
+    --details)  DETAILS="$2";    shift 2 ;;
+    --severity) SEVERITY="$2";   shift 2 ;;
+    --workflow) WORKFLOW="$2";   shift 2 ;;
+    --repo)     REPO="$2";      shift 2 ;;
+    --run-url)  RUN_URL="$2";   shift 2 ;;
+    --token)    MOKOGITEA_TOKEN="$2"; shift 2 ;;
+    --url)      MOKOGITEA_URL="$2"; shift 2 ;;
+    -h|--help)  usage ;;
+    *)          echo "Unknown option: $1"; usage ;;
+  esac
+done
+
+[[ -z "$GATE" ]]             && { echo "ERROR: --gate is required"; usage; }
+[[ -z "$DETAILS" ]]          && { echo "ERROR: --details is required"; usage; }
+[[ -z "$MOKOGITEA_TOKEN" ]]  && { echo "ERROR: MOKOGITEA_TOKEN not set"; exit 1; }
+[[ -z "$REPO" ]]             && { echo "ERROR: GITHUB_REPOSITORY not set"; exit 1; }
+
+API="${MOKOGITEA_URL}/api/v1/repos/${REPO}"
+
+# ── Build title ─────────────────────────────────────────────────────────────
+if [[ -n "$WORKFLOW" ]]; then
+  TITLE="[CI] ${WORKFLOW}: ${GATE} failed"
+else
+  TITLE="[CI] ${GATE} failed"
+fi
+
+# ── Ensure label exists ─────────────────────────────────────────────────────
+ensure_label() {
+  local exists
+  exists=$(curl -sf -o /dev/null -w '%{http_code}' \
+    -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+    "${API}/labels" 2>/dev/null || echo "000")
+
+  if [[ "$exists" == "200" ]]; then
+    local found
+    found=$(curl -sf \
+      -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+      "${API}/labels" 2>/dev/null \
+      | grep -o "\"name\":\"${LABEL_NAME}\"" || true)
+
+    if [[ -z "$found" ]]; then
+      curl -sf -X POST \
+        -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+        -H "Content-Type: application/json" \
+        "${API}/labels" \
+        -d "{\"name\":\"${LABEL_NAME}\",\"color\":\"${LABEL_COLOR}\",\"description\":\"Auto-created by CI issue reporter\"}" \
+        > /dev/null 2>&1 || true
+    fi
+  fi
+}
+
+# ── Search for existing open issue ──────────────────────────────────────────
+find_existing_issue() {
+  local query
+  query=$(printf '%s' "[CI] ${GATE}" | sed 's/ /%20/g; s/\[/%5B/g; s/\]/%5D/g')
+
+  local response
+  response=$(curl -sf \
+    -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+    "${API}/issues?type=issues&state=open&labels=${LABEL_NAME}&q=${query}&limit=5" \
+    2>/dev/null || echo "[]")
+
+  echo "$response" \
+    | grep -oP '"number":\s*\K[0-9]+' \
+    | head -1
+}
+
+# ── Build issue body ────────────────────────────────────────────────────────
+build_body() {
+  local severity_badge
+  if [[ "$SEVERITY" == "error" ]]; then
+    severity_badge="**Severity:** Error"
+  else
+    severity_badge="**Severity:** Warning"
+  fi
+
+  cat <<BODY
+## CI Gate Failure: ${GATE}
+
+${severity_badge}
+**Workflow:** ${WORKFLOW:-unknown}
+**Branch:** ${GITHUB_REF_NAME:-unknown}
+**Commit:** \`${GITHUB_SHA:0:8}\`
+**Run:** [View CI run](${RUN_URL})
+
+### Details
+
+${DETAILS}
+
+### Resolution
+
+Fix the issue described above and push a new commit. This issue will be closed automatically when the gate passes, or can be closed manually.
+
+---
+*Auto-created by [ci-issue-reporter](${MOKOGITEA_URL}/MokoConsulting/MokoCLI/src/branch/main/cli/ci_issue_reporter.sh)*
+BODY
+}
+
+# ── Build comment body (for existing issues) ────────────────────────────────
+build_comment() {
+  cat <<COMMENT
+### CI failure recurrence
+
+**Branch:** ${GITHUB_REF_NAME:-unknown}
+**Commit:** \`${GITHUB_SHA:0:8}\`
+**Run:** [View CI run](${RUN_URL})
+
+${DETAILS}
+COMMENT
+}
+
+# ── Main ────────────────────────────────────────────────────────────────────
+ensure_label
+
+EXISTING=$(find_existing_issue)
+
+if [[ -n "$EXISTING" ]]; then
+  COMMENT_BODY=$(build_comment)
+  COMMENT_JSON=$(printf '%s' "$COMMENT_BODY" | python3 -c "
+import sys, json
+print(json.dumps({'body': sys.stdin.read()}))" 2>/dev/null)
+
+  HTTP=$(curl -sf -o /dev/null -w '%{http_code}' -X POST \
+    -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+    -H "Content-Type: application/json" \
+    "${API}/issues/${EXISTING}/comments" \
+    -d "${COMMENT_JSON}" 2>/dev/null || echo "000")
+
+  if [[ "$HTTP" == "201" ]]; then
+    echo "Commented on existing issue #${EXISTING}"
+  else
+    echo "WARNING: Failed to comment on issue #${EXISTING} (HTTP ${HTTP})"
+  fi
+else
+  ISSUE_BODY=$(build_body)
+  ISSUE_JSON=$(python3 -c "
+import sys, json
+body = sys.stdin.read()
+print(json.dumps({
+    'title': sys.argv[1],
+    'body': body,
+    'labels': []
+}))" "$TITLE" <<< "$ISSUE_BODY" 2>/dev/null)
+
+  RESPONSE=$(curl -sf -X POST \
+    -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+    -H "Content-Type: application/json" \
+    "${API}/issues" \
+    -d "${ISSUE_JSON}" 2>/dev/null || echo "{}")
+
+  ISSUE_NUM=$(echo "$RESPONSE" | grep -oP '"number":\s*\K[0-9]+' | head -1)
+
+  if [[ -n "$ISSUE_NUM" ]]; then
+    LABEL_ID=$(curl -sf \
+      -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+      "${API}/labels" 2>/dev/null \
+      | grep -oP "\"id\":\s*\K[0-9]+(?=[^}]*\"name\":\s*\"${LABEL_NAME}\")" \
+      | head -1 || true)
+
+    if [[ -n "$LABEL_ID" ]]; then
+      curl -sf -X POST \
+        -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+        -H "Content-Type: application/json" \
+        "${API}/issues/${ISSUE_NUM}/labels" \
+        -d "{\"labels\":[${LABEL_ID}]}" \
+        > /dev/null 2>&1 || true
+    fi
+
+    echo "Created issue #${ISSUE_NUM}: ${TITLE}"
+  else
+    echo "WARNING: Failed to create issue"
+    echo "Response: ${RESPONSE}"
+  fi
+fi

cli/client_dashboard.php

@@ -12,7 +12,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/client_dashboard.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Generate unified client dashboard HTML
  */
 

cli/client_inventory.php

@@ -12,7 +12,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/client_inventory.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Discover and list all client-waas repos with their server configuration status
  */
 

cli/client_provision.php

@@ -12,7 +12,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/client_provision.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Provision a new client environment end-to-end
  */
 
@@ -104,7 +104,7 @@ class ClientProvisionCli extends CliFramework
             'variables' => 'setVariables',
             'secrets' => 'setSecrets',
             'monitoring' => 'setupMonitoring',
-            'summary' => 'printSummary',
+            'summary' => 'printProvisioningSummary',
         ];
 
         $exitCode = 0;
@@ -383,7 +383,7 @@ class ClientProvisionCli extends CliFramework
         return 0;
     }
 
-    private function printSummary(): int
+    private function printProvisioningSummary(): int
     {
         $vars = $this->config['variables'] ?? [];
         $secrets = $this->config['secrets'] ?? [];

cli/deploy_joomla.php

@@ -8,8 +8,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.CLI
+ * DEFGROUP: MokoCLI.CLI
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/deploy_joomla.php
  * BRIEF: Smart Joomla deploy — routes files to correct server directories by extension type

cli/grafana_dashboard.php

@@ -12,7 +12,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/grafana_dashboard.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Manage Grafana dashboards via API
  */
 

cli/joomla_build.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/joomla_build.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Build a Joomla extension ZIP from manifest — all types supported
  * NOTE: Called by pre-release and auto-release workflows.
  */

cli/joomla_metadata_validate.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/joomla_metadata_validate.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Validate MokoGitea repo metadata against Joomla extension manifest XML
  */
 

cli/manifest_detect.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/manifest_detect.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Auto-detect manifest fields from source files and optionally push to API
  */
 

cli/manifest_integrity.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/manifest_integrity.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Cross-check manifest API fields against repo contents across the org
  */
 

cli/manifest_licensing.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/manifest_licensing.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Ensure licensing tags (updateservers, dlid) in Joomla extension manifests
  */
 

cli/manifest_read.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/manifest_read.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Read repo metadata from Gitea manifest API, auto-detect the rest
  */
 

cli/platform_detect.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/platform_detect.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Auto-detect repository platform type and optionally update manifest
  */
 

cli/release.php

@@ -40,7 +40,6 @@ class ReleaseCli extends CliFramework
         $bulkSyncFile = file_exists("{$repoRoot}/.mokogitea/workflows/bulk-repo-sync.yml")
             ? "{$repoRoot}/.mokogitea/workflows/bulk-repo-sync.yml"
             : "{$repoRoot}/.github/workflows/bulk-repo-sync.yml";
-        $cleanupFile = "{$repoRoot}/templates/workflows/shared/repository-cleanup.yml.template";
 
         // -- Step 1: Read current version --
         $readme = "{$repoRoot}/README.md";

cli/release_cascade.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/release_cascade.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Cascade release zip to all lower stability channels
  */
 

cli/release_package.php

@@ -270,12 +270,90 @@ class ReleasePackageCli extends CliFramework
                     }
                 }
 
+                // Check if sub-source is itself a Joomla package (nested package)
+                $nestedPkgManifests = glob("{$subSourceDir}/pkg_*.xml") ?: [];
+                $isNestedPackage = !empty($nestedPkgManifests) && is_dir("{$subSourceDir}/packages");
+
                 $subZip = new \ZipArchive();
                 if ($subZip->open($subZipPath, \ZipArchive::CREATE | \ZipArchive::OVERWRITE) !== true) {
                     $this->log('ERROR', "Failed to create sub-package ZIP: {$subZipPath}");
                     continue;
                 }
-                $this->addDirToZip($subZip, $subSourceDir, '', $this->excludePatterns);
+
+                if ($isNestedPackage) {
+                    // Build nested package: zip each sub-extension, then assemble
+                    echo "  Building nested package: {$subName}\n";
+                    $nestedPkgDirs = glob("{$subSourceDir}/packages/*", GLOB_ONLYDIR) ?: [];
+
+                    $nestedManifested = [];
+                    foreach ($nestedPkgManifests as $npmf) {
+                        $npmXml = @simplexml_load_file($npmf);
+                        if ($npmXml && isset($npmXml->files)) {
+                            foreach ($npmXml->files->file as $fn) {
+                                $nzn = pathinfo((string) $fn, PATHINFO_FILENAME);
+                                if (!empty($nzn)) {
+                                    $nestedManifested[$nzn] = true;
+                                }
+                            }
+                        }
+                    }
+
+                    // Use a subdirectory to avoid filename collisions with outer ZIPs
+                    $nestedOutputDir = "{$outputDir}/nested_{$subName}";
+                    @mkdir($nestedOutputDir, 0755, true);
+
+                    foreach ($nestedPkgDirs as $npd) {
+                        $nestedSubName = basename($npd);
+                        if (!empty($nestedManifested) && !isset($nestedManifested[$nestedSubName])) {
+                            continue;
+                        }
+                        $nestedSubZipPath = "{$nestedOutputDir}/{$nestedSubName}.zip";
+                        $nsZip = new \ZipArchive();
+                        if ($nsZip->open($nestedSubZipPath, \ZipArchive::CREATE | \ZipArchive::OVERWRITE) !== true) {
+                            continue;
+                        }
+                        $this->addDirToZip($nsZip, $npd, '', $this->excludePatterns);
+                        $nsZip->close();
+                        $subZip->addFile($nestedSubZipPath, "packages/{$nestedSubName}.zip");
+                        echo "    Nested sub: {$nestedSubName}.zip\n";
+                    }
+
+                    // Patch nested manifest: ensure folder="packages" so Joomla finds sub-ZIPs
+                    foreach ($nestedPkgManifests as $npmf) {
+                        $npmContent = file_get_contents($npmf);
+                        if ($npmContent !== false
+                            && strpos($npmContent, '<files>') !== false
+                            && strpos($npmContent, 'folder="packages"') === false
+                        ) {
+                            $npmContent = str_replace('<files>', '<files folder="packages">', $npmContent);
+                            file_put_contents($npmf, $npmContent);
+                            echo "    Fixed: added folder=\"packages\" to " . basename($npmf) . "\n";
+                        }
+                    }
+
+                    // Add top-level files (manifest, script, etc.) with exclude filter
+                    $nestedTopFiles = array_merge(
+                        glob("{$subSourceDir}/*.xml") ?: [],
+                        glob("{$subSourceDir}/*.php") ?: []
+                    );
+                    foreach ($nestedTopFiles as $ntf) {
+                        if (!$this->isExcluded(basename($ntf), $this->excludePatterns)) {
+                            $subZip->addFile($ntf, basename($ntf));
+                        }
+                    }
+
+                    // Add all top-level directories except packages/
+                    $nestedTopDirs = glob("{$subSourceDir}/*", GLOB_ONLYDIR) ?: [];
+                    foreach ($nestedTopDirs as $ntd) {
+                        $ndName = basename($ntd);
+                        if ($ndName === 'packages') {
+                            continue;
+                        }
+                        $this->addDirToZip($subZip, $ntd, $ndName, $this->excludePatterns);
+                    }
+                } else {
+                    $this->addDirToZip($subZip, $subSourceDir, '', $this->excludePatterns);
+                }
                 $subZip->close();
 
                 $zip->addFile($subZipPath, "packages/{$subName}.zip");

cli/release_publish.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/release_publish.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Publish a release and create copies for all lesser stability streams.
  */
 

cli/scaffold_client.php

@@ -12,7 +12,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/scaffold_client.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Scaffold a new client-waas repo from Template-Client-WaaS with pre-configured settings
  */
 

cli/theme_vars_check.php

@@ -0,0 +1,294 @@
+#!/usr/bin/env php
+<?php
+
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: mokocli.CLI
+ * INGROUP: mokocli
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+ * PATH: /cli/theme_vars_check.php
+ * BRIEF: Validate a client MokoOnyx theme package — required CSS variables
+ *        (derived dynamically from the MokoOnyx standard theme) are defined in
+ *        the client's light/dark custom CSS, required files exist, the manifest
+ *        is sane, and (optionally) the repo's Gitea metadata is set.
+ *
+ * Standalone (no CliFramework dependency) so it runs even when the shared
+ * framework autoloader is unavailable.
+ *
+ * Usage:
+ *   php theme_vars_check.php --path . --reference /tmp/mokoonyx [--github-output]
+ *       [--api-base <url> --repo <owner/repo> --token <token>]
+ */
+
+declare(strict_types=1);
+
+$opts = getopt('', ['path:', 'reference:', 'github-output', 'api-base:', 'repo:', 'token:']);
+$path = isset($opts['path']) && is_string($opts['path']) && $opts['path'] !== '' ? $opts['path'] : '.';
+$ref  = isset($opts['reference']) && is_string($opts['reference']) ? $opts['reference'] : '';
+$gh   = array_key_exists('github-output', $opts);
+
+$root = realpath($path);
+if ($root === false) { $root = $path; }
+
+$src = is_dir("$root/src") ? "$root/src" : (is_dir("$root/source") ? "$root/source" : null);
+if ($src === null) {
+    fwrite(STDERR, "ERROR: no src/ or source/ directory under $root\n");
+    exit(1);
+}
+
+$errors  = 0;
+$summary = [];
+$fail = function (string $msg) use (&$errors, &$summary): void {
+    echo "  [FAIL] $msg\n";
+    $summary[] = "FAIL: $msg";
+    $errors++;
+};
+$ok    = function (string $msg): void { echo "  [ok]   $msg\n"; };
+$note  = function (string $msg): void { echo "  [note] $msg\n"; };
+
+/** Extract the set of CSS custom-property names DEFINED in a CSS string. */
+$definedVars = static function (string $css): array {
+    // Matches "--name:" at a declaration position (not var(--name) uses).
+    preg_match_all('/(?:^|[\s;{])(--[a-z0-9_-]+)\s*:/i', $css, $m);
+    return array_values(array_unique(array_map('strtolower', $m[1] ?? [])));
+};
+
+/** Find the MokoOnyx standard theme file for a mode inside a reference checkout. */
+$findStandard = static function (string $ref, string $mode): ?string {
+    if ($ref === '') { return null; }
+    foreach ([
+        "$ref/source/media/css/theme/$mode.standard.css",
+        "$ref/media/templates/site/mokoonyx/css/theme/$mode.standard.css",
+        "$ref/$mode.standard.css",
+    ] as $cand) {
+        if (is_file($cand)) { return $cand; }
+    }
+    return null;
+};
+
+$cssDir   = "$src/media/templates/site/mokoonyx/css";
+$themeDir = "$cssDir/theme";
+$manifest = "$src/templateDetails.xml";
+$customs  = ['light' => "$themeDir/light.custom.css", 'dark' => "$themeDir/dark.custom.css"];
+
+echo "MokoOnyx theme validation: $src\n\n";
+
+// 1) Required files -------------------------------------------------------
+echo "=== Required files ===\n";
+$requiredFiles = [
+    'templateDetails.xml'    => $manifest,
+    'theme/light.custom.css' => $customs['light'],
+    'theme/dark.custom.css'  => $customs['dark'],
+    'user.css'               => "$cssDir/user.css",
+];
+foreach ($requiredFiles as $label => $file) {
+    is_file($file) ? $ok("$label present") : $fail("missing required file: $label");
+}
+
+// 1b) Forbidden committed files ------------------------------------------
+echo "\n=== Forbidden files ===\n";
+$scan = static function (string $dir, array $skip) use (&$scan): array {
+    $out = [];
+    foreach (scandir($dir) ?: [] as $e) {
+        if ($e === '.' || $e === '..') { continue; }
+        $p = "$dir/$e";
+        if (is_dir($p)) {
+            if (in_array($e, $skip, true)) { continue; }
+            $out = array_merge($out, $scan($p, $skip));
+        } else {
+            $out[] = $p;
+        }
+    }
+    return $out;
+};
+$forbidden = [];
+if (is_dir("$root/.claude")) { $forbidden[] = '.claude/'; }
+foreach ($scan($root, ['.git', 'vendor', 'node_modules']) as $f) {
+    $b   = basename($f);
+    $rel = ltrim(str_replace('\\', '/', substr($f, strlen($root))), '/');
+    if ($b === '.mcp.json' || $b === 'TODO.md'
+        || fnmatch('.mcp_*.json', $b) || fnmatch('sftp-config*.json', $b)
+        || fnmatch('*.min.css', $b) || fnmatch('*.min.js', $b)) {
+        $forbidden[] = $rel;
+    }
+}
+$forbidden = array_values(array_unique($forbidden));
+if ($forbidden) {
+    $shown = array_slice($forbidden, 0, 10);
+    $more  = count($forbidden) - count($shown);
+    $fail('forbidden file(s) committed: ' . implode(', ', $shown) . ($more > 0 ? " (+$more more)" : ''));
+} else {
+    $ok('no forbidden files committed');
+}
+
+// 2) CSS variables — required set derived from the MokoOnyx standard theme
+echo "\n=== CSS variables vs MokoOnyx standard theme ===\n";
+if ($ref === '') {
+    $note('no --reference given; skipping variable parity check');
+} else {
+    foreach ($customs as $mode => $customFile) {
+        $std = $findStandard($ref, $mode);
+        if ($std === null) {
+            $fail("$mode: standard theme not found under reference '$ref'");
+            continue;
+        }
+        if (!is_file($customFile)) {
+            continue; // already reported missing
+        }
+        $required = $definedVars((string) file_get_contents($std));
+        $defined  = $definedVars((string) file_get_contents($customFile));
+        $missing  = array_values(array_diff($required, $defined));
+        if ($missing) {
+            $shown = array_slice($missing, 0, 15);
+            $more  = count($missing) - count($shown);
+            $fail("$mode mode missing " . count($missing) . '/' . count($required)
+                . ' standard variable(s): ' . implode(', ', $shown) . ($more > 0 ? " (+$more more)" : ''));
+        } else {
+            $ok("$mode mode defines all " . count($required) . ' standard variables');
+        }
+    }
+}
+
+// 3) Manifest sanity ------------------------------------------------------
+echo "\n=== Manifest (templateDetails.xml) ===\n";
+if (is_file($manifest)) {
+    $xml = @simplexml_load_file($manifest);
+    if ($xml === false) {
+        $fail('templateDetails.xml is not well-formed XML');
+    } else {
+        $version = isset($xml->version) ? trim((string) $xml->version) : '';
+        $version !== '' ? $ok("version $version") : $fail('<version> is missing or empty');
+
+        $server = isset($xml->updateservers->server) ? trim((string) $xml->updateservers->server) : '';
+        if ($server === '') {
+            $fail('<updateservers><server> is missing');
+        } elseif (strpos($server, '/raw/branch/') !== false) {
+            $fail('update server uses a legacy raw/branch URL; use the dynamic MokoGitea feed');
+        } else {
+            $ok("update server: $server");
+        }
+
+        isset($xml->dlid) ? $ok('<dlid> license-key field present')
+            : $fail('<dlid prefix="dlid=" suffix=""/> is missing');
+
+        // Element naming convention (MokoOnyx client theme file package)
+        $type    = trim((string) ($xml['type'] ?? ''));
+        $element = isset($xml->element) ? trim((string) $xml->element) : '';
+        if ($type === 'file' && $element !== '') {
+            strpos($element, 'file_mokoonyx_') === 0
+                ? $ok("element naming ok ($element)")
+                : $fail("element '$element' should start with 'file_mokoonyx_' for a MokoOnyx client theme package");
+        }
+
+        // Required manifest fields
+        foreach (['name', 'element', 'author', 'creationDate'] as $field) {
+            (isset($xml->$field) && trim((string) $xml->$field) !== '')
+                ? $ok("<$field> present")
+                : $fail("<$field> is missing or empty");
+        }
+
+        // scriptfile (if declared) must exist
+        if (isset($xml->scriptfile)) {
+            $sf = trim((string) $xml->scriptfile);
+            is_file("$src/$sf") ? $ok("scriptfile '$sf' present")
+                : $fail("<scriptfile> references '$sf' which is not in src/");
+        }
+
+        // Fileset integrity — every referenced file/folder must exist in src/
+        if (isset($xml->fileset)) {
+            $missingFs = [];
+            foreach ($xml->fileset->files as $files) {
+                $folder  = trim((string) ($files['folder'] ?? ''));
+                $baseDir = $folder !== '' ? "$src/$folder" : $src;
+                foreach ($files->filename as $fn) {
+                    $rel = ($folder !== '' ? "$folder/" : '') . trim((string) $fn);
+                    if (!is_file("$baseDir/" . trim((string) $fn))) { $missingFs[] = $rel; }
+                }
+                foreach ($files->folder as $fd) {
+                    $rel = ($folder !== '' ? "$folder/" : '') . trim((string) $fd) . '/';
+                    if (!is_dir("$baseDir/" . trim((string) $fd))) { $missingFs[] = $rel; }
+                }
+            }
+            if ($missingFs) {
+                $shown = array_slice($missingFs, 0, 10);
+                $more  = count($missingFs) - count($shown);
+                $fail('fileset references ' . count($missingFs) . ' missing path(s): '
+                    . implode(', ', $shown) . ($more > 0 ? " (+$more more)" : ''));
+            } else {
+                $ok('all fileset paths exist in src/');
+            }
+        }
+    }
+}
+
+// 4) Repository metadata via Gitea API (optional) -------------------------
+$apiBase = isset($opts['api-base']) && is_string($opts['api-base']) ? rtrim($opts['api-base'], '/') : '';
+$repoSlug = isset($opts['repo']) && is_string($opts['repo']) ? trim($opts['repo']) : '';
+$token   = isset($opts['token']) && is_string($opts['token']) ? trim($opts['token']) : '';
+if ($apiBase !== '' && $repoSlug !== '' && $token !== '') {
+    echo "\n=== Repository metadata (Gitea API) ===\n";
+    $url  = "$apiBase/repos/$repoSlug";
+    $ctx  = stream_context_create(['http' => [
+        'method'        => 'GET',
+        'header'        => "Authorization: token $token\r\nAccept: application/json\r\n",
+        'ignore_errors' => true,
+        'timeout'       => 15,
+    ]]);
+    $resp = @file_get_contents($url, false, $ctx);
+    $data = $resp !== false ? json_decode($resp, true) : null;
+    if (!is_array($data) || !isset($data['name'])) {
+        $fail("could not read repo metadata from Gitea API ($url)");
+    } else {
+        trim((string) ($data['description'] ?? '')) !== '' ? $ok('description set')
+            : $fail('repo description is empty');
+        trim((string) ($data['website'] ?? '')) !== '' ? $ok('website set: ' . $data['website'])
+            : $fail('repo website is empty');
+        $topics = $data['topics'] ?? [];
+        (is_array($topics) && count($topics) > 0) ? $ok(count($topics) . ' topic(s) set')
+            : $fail('repo has no topics');
+
+        // Required topics
+        $requiredTopics = ['joomla', 'client-waas', 'mokoonyx'];
+        $haveTopics     = array_map('strtolower', is_array($topics) ? $topics : []);
+        $missingTopics  = array_values(array_diff($requiredTopics, $haveTopics));
+        $missingTopics
+            ? $fail('missing required topic(s): ' . implode(', ', $missingTopics))
+            : $ok('required topics present (' . implode(', ', $requiredTopics) . ')');
+
+        ((string) ($data['default_branch'] ?? '')) === 'main' ? $ok('default branch is main')
+            : $fail("default branch is '" . ($data['default_branch'] ?? '') . "' (expected main)");
+
+        // Branch protection on main
+        $bresp = @file_get_contents("$apiBase/repos/$repoSlug/branches/main", false, $ctx);
+        $bdata = $bresp !== false ? json_decode($bresp, true) : null;
+        if (is_array($bdata) && array_key_exists('protected', $bdata)) {
+            $bdata['protected'] ? $ok('main branch is protected')
+                : $fail('main branch is not protected');
+        } else {
+            $note('could not read branch protection state for main');
+        }
+    }
+} else {
+    echo "\n=== Repository metadata (Gitea API) ===\n";
+    $note('API args not provided; skipping repo metadata check');
+}
+
+// Output / exit -----------------------------------------------------------
+echo "\n";
+if ($gh && ($f = getenv('GITHUB_STEP_SUMMARY'))) {
+    $md = "## MokoOnyx Theme Validation\n\n";
+    $md .= $errors === 0
+        ? "All checks passed.\n"
+        : implode("\n", array_map(static fn ($l) => "- $l", $summary)) . "\n";
+    @file_put_contents($f, $md, FILE_APPEND);
+}
+
+if ($errors > 0) {
+    echo "FAILED: $errors issue(s) found.\n";
+    exit(1);
+}
+echo "All MokoOnyx theme validation checks passed.\n";
+exit(0);

cli/updates_xml_sync.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/updates_xml_sync.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Sync updates.xml to target branches via Gitea API
  * NOTE: Called by pre-release and auto-release workflows after updates.xml
  *       is modified on the current branch. Pushes the file to other branches

cli/version_auto_bump.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/version_auto_bump.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Auto patch-bump, set stability suffix, and commit — single CLI replacing inline workflow bash
  */
 

cli/version_bump.php

@@ -214,7 +214,8 @@ class VersionBumpCli extends CliFramework
                     $newContent = preg_replace(
                         $xmlPattern,
                         '${1}' . $newBase . '</version>',
-                        $content
+                        $content,
+                        1
                     );
                 } else {
                     $xmlPattern = '#<version>\d{2}\.\d{2}\.\d{2}'
@@ -222,9 +223,13 @@ class VersionBumpCli extends CliFramework
                     $newContent = preg_replace(
                         $xmlPattern,
                         "<version>{$newFull}</version>",
-                        $content
+                        $content,
+                        1
                     );
                 }
+                if ($newContent !== null) {
+                    $newContent = preg_replace('#(\s*<version>[^<]*</version>)\s*<version>[^<]*</version>#', '$1', $newContent);
+                }
                 if ($newContent !== null && $newContent !== $content) {
                     file_put_contents($xmlFile, $newContent);
                     $updatedFiles[] = substr($xmlFile, strlen($root) + 1);
@@ -384,7 +389,7 @@ class VersionBumpCli extends CliFramework
     /**
      * Scan git release tags for the highest version across all channels.
      *
-     * Checks release names like "MokoSuiteClient (VERSION: 09.41.00)" in
+     * Checks release names like "MokoSuiteClient (VERSION: 09.43.00)" in
      * git tags (stable, release-candidate, development, etc.) to find the
      * highest version that has been released on any channel.
      */

cli/version_check.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/version_check.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Validate version consistency across README, manifests, and sub-packages
  */
 
@@ -131,9 +131,11 @@ class VersionCheckCli extends CliFramework
                     $updated = preg_replace(
                         $vPat,
                         "<version>{$highestVersion}</version>",
-                        $content
+                        $content,
+                        1
                     );
                     if ($updated !== null) {
+                        $updated = preg_replace('#(\s*<version>[^<]*</version>)\s*<version>[^<]*</version>#', '$1', $updated);
                         file_put_contents($mokoManifest, $updated);
                     } echo "  Fixed: .mokogitea/manifest.xml -> {$highestVersion}\n";
                 }
@@ -185,8 +187,9 @@ class VersionCheckCli extends CliFramework
                     if (!file_exists($file)) {
                         continue;
                     } $content = file_get_contents($file);
-                    $updated = preg_replace('#<version>[^<]*</version>#', "<version>{$highestVersion}</version>", $content);
+                    $updated = preg_replace('#<version>[^<]*</version>#', "<version>{$highestVersion}</version>", $content, 1);
                     if ($updated !== null) {
+                        $updated = preg_replace('#(\s*<version>[^<]*</version>)\s*<version>[^<]*</version>#', '$1', $updated);
                         file_put_contents($file, $updated);
                     } echo "  Fixed: {$source} -> {$highestVersion}\n";
                 }

cli/version_set_platform.php

@@ -164,8 +164,12 @@ class VersionSetPlatformCli extends CliFramework
                 $updated = preg_replace(
                     '|<version>[^<]*</version>|',
                     "<version>{$version}</version>",
-                    $content
+                    $content,
+                    1
                 );
+                if ($updated !== null) {
+                    $updated = preg_replace('#(\s*<version>[^<]*</version>)\s*<version>[^<]*</version>#', '$1', $updated);
+                }
                 if ($updated !== null && $updated !== $content) {
                     file_put_contents($file, $updated);
                     $relPath = str_replace($root . '/', '', $file);

cli/wiki_sync.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/wiki_sync.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Sync select wiki pages from mokocli to all template repos
  */
 

cli/workflow_sync.php

@@ -10,7 +10,7 @@
  * INGROUP: mokocli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/workflow_sync.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Sync workflows from Generic → platform templates → live repos based on manifest.platform
  */
 

composer.json

@@ -71,8 +71,8 @@
     ],
     "scripts": {
         "test": "phpunit",
-        "phpcs": "phpcs --standard=phpcs.xml lib/ validate/ automation/",
+        "phpcs": "phpcs --standard=phpcs.xml lib/ validate/",
-        "phpstan": "phpstan analyse -c phpstan.neon lib/ validate/ automation/",
+        "phpstan": "phpstan analyse -c phpstan.neon lib/ validate/",
         "psalm": "psalm --config=psalm.xml",
         "check": [
             "@phpcs",

deploy/backup-before-deploy.php

@@ -8,11 +8,11 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /deploy/backup-before-deploy.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Snapshot Joomla directories before deployment for rollback capability
  */
 

deploy/deploy-and-verify.php

@@ -4,8 +4,8 @@
 /* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
  * SPDX-License-Identifier: GPL-3.0-or-later
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /deploy/deploy-and-verify.php
  * BRIEF: Deploy with automatic health check and rollback on failure

deploy/deploy-dolibarr.php

@@ -8,11 +8,11 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /deploy/deploy-dolibarr.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Deploy Dolibarr module files to a remote server via SFTP/rsync
  */
 

deploy/deploy-joomla.php

@@ -8,8 +8,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /deploy/deploy-joomla.php
  * BRIEF: Smart Joomla deploy — routes files to correct Joomla directories based on XML manifest

deploy/deploy-sftp.php

@@ -8,8 +8,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /deploy/deploy-sftp.php
  * BRIEF: Deploy a repository src/ directory to a remote web server via SFTP

deploy/health-check.php

@@ -8,11 +8,11 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /deploy/health-check.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Post-deploy health check — verify a Joomla site is responding correctly
  */
 

deploy/rollback-joomla.php

@@ -8,11 +8,11 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /deploy/rollback-joomla.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Rollback a Joomla deployment by restoring from a pre-deploy snapshot
  */
 

deploy/sync-joomla.php

@@ -8,11 +8,11 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Scripts.Deploy
+ * DEFGROUP: MokoCLI.Scripts.Deploy
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /deploy/sync-joomla.php
- * VERSION: 09.41.00
+ * VERSION: 09.43.00
  * BRIEF: Sync Joomla site directories between two servers via rsync over SSH
  */
 

fix/fix_line_endings.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Scripts.Fix
+ * DEFGROUP: MokoCLI.Scripts.Fix
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /fix/fix_line_endings.php
  * BRIEF: CLI script to normalise CRLF/CR to LF in tracked source files

fix/fix_permissions.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Scripts.Fix
+ * DEFGROUP: MokoCLI.Scripts.Fix
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /fix/fix_permissions.php
  * BRIEF: CLI script to normalise file permissions (dirs 755, files 644, scripts 755)

fix/fix_tabs.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Scripts.Fix
+ * DEFGROUP: MokoCLI.Scripts.Fix
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /fix/fix_tabs.php
  * BRIEF: CLI script to convert tabs to spaces in tracked source files

fix/fix_trailing_spaces.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Scripts.Fix
+ * DEFGROUP: MokoCLI.Scripts.Fix
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /fix/fix_trailing_spaces.php
  * BRIEF: CLI script to remove trailing whitespace from tracked source files

fix/index.md

@@ -2,8 +2,8 @@
 Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 SPDX-License-Identifier: GPL-3.0-or-later
 FILE INFORMATION
-DEFGROUP: MokoPlatform.Index
+DEFGROUP: MokoCLI.Index
-INGROUP: MokoPlatform.Fix
+INGROUP: MokoCLI.Fix
 REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 PATH: /fix/index.md
 BRIEF: Fix directory index

index.md

@@ -2,8 +2,8 @@
 Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 SPDX-License-Identifier: GPL-3.0-or-later
 FILE INFORMATION
-DEFGROUP: MokoPlatform.Root
+DEFGROUP: MokoCLI.Root
-INGROUP: MokoPlatform
+INGROUP: MokoCLI
 REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 PATH: /index.md
 BRIEF: Scripts directory index
@@ -61,7 +61,7 @@ Shared library code
 - GitHub client
 
 ### [Wiki](https://git.mokoconsulting.tech/MokoConsulting/mokocli/wiki)
-All documentation lives in the Gitea wiki.
+All documentation lives in the MokoGitea wiki.
 
 ### [Tests](tests/)
 Test scripts

lib/CliBase.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Lib
+ * DEFGROUP: MokoCLI.Lib
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/CliBase.php
  * BRIEF: Standalone base CLI class for scripts that do not use CliFramework

lib/Common.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Lib
+ * DEFGROUP: MokoCLI.Lib
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Common.php
  * BRIEF: Common utility functions for scripts

lib/Enterprise/AbstractProjectPlugin.php

@@ -9,8 +9,8 @@ declare(strict_types=1);
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Plugins
+ * DEFGROUP: MokoCLI.Enterprise.Plugins
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/AbstractProjectPlugin.php
  * BRIEF: Abstract base class for project plugins
@@ -23,7 +23,7 @@ namespace MokoCli;
  *
  * Provides common functionality for all project type plugins
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @version 1.0.0
  */
 abstract class AbstractProjectPlugin implements ProjectPluginInterface

lib/Enterprise/ApiClient.php

@@ -9,8 +9,8 @@ declare(strict_types=1);
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.API
+ * DEFGROUP: MokoCLI.Enterprise.API
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/ApiClient.php
  * BRIEF: HTTP API client library
@@ -31,7 +31,7 @@ declare(strict_types=1);
  *
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @version 04.00.04
  * @author mokocli Team
  * @license GPL-3.0-or-later

lib/Enterprise/AuditLogger.php

@@ -22,13 +22,13 @@ declare(strict_types=1);
  * (at your option) any later version.
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Audit
+ * DEFGROUP: MokoCLI.Enterprise.Audit
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/AuditLogger.php
  * BRIEF: Enterprise audit logging
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @version 04.00.04
  * @author mokocli Team
  * @license GPL-3.0-or-later

lib/Enterprise/CheckpointManager.php

@@ -10,13 +10,13 @@ declare(strict_types=1);
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Checkpoint
+ * DEFGROUP: MokoCLI.Enterprise.Checkpoint
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/CheckpointManager.php
  * BRIEF: Checkpoint manager for resumable operations
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @version 04.00.04
  * @author mokocli Team
  * @license GPL-3.0-or-later

lib/Enterprise/CliFramework.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.CLI
+ * DEFGROUP: MokoCLI.Enterprise.CLI
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/CliFramework.php
  * BRIEF: CliFramework — unified base class for all mokocli CLI scripts

lib/Enterprise/Config.php

@@ -9,8 +9,8 @@ declare(strict_types=1);
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Config
+ * DEFGROUP: MokoCLI.Enterprise.Config
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/Config.php
  * BRIEF: Configuration manager
@@ -32,7 +32,7 @@ declare(strict_types=1);
  *
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @version 04.00.04
  * @author mokocli Team
  * @license GPL-3.0-or-later

lib/Enterprise/ConfigValidator.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise
+ * DEFGROUP: MokoCLI.Enterprise
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/ConfigValidator.php
  * BRIEF: Validate project config against plugin JSON schema

lib/Enterprise/EnterpriseReadinessValidator.php

@@ -8,8 +8,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise
+ * DEFGROUP: MokoCLI.Enterprise
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/EnterpriseReadinessValidator.php
  * BRIEF: Enterprise readiness validation library

lib/Enterprise/ErrorRecovery.php

@@ -17,13 +17,13 @@ declare(strict_types=1);
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Recovery
+ * DEFGROUP: MokoCLI.Enterprise.Recovery
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/ErrorRecovery.php
  * BRIEF: Error recovery framework
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @version 04.00.04
  * @author mokocli Team
  * @license GPL-3.0-or-later

lib/Enterprise/FileFixUtility.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise
+ * DEFGROUP: MokoCLI.Enterprise
- * INGROUP: MokoPlatform.Lib
+ * INGROUP: MokoCLI.Lib
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/FileFixUtility.php
  * BRIEF: Utility class for fixing file formatting issues (line endings, permissions, tabs, trailing spaces)

lib/Enterprise/GitHubAdapter.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Platform
+ * DEFGROUP: MokoCLI.Enterprise.Platform
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/GitHubAdapter.php
  * BRIEF: GitHub implementation of GitPlatformAdapter
@@ -31,7 +31,7 @@ use RuntimeException;
  * - Topics: PUT with {"names": [...]}
  * - Workflow dir: .github/workflows
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @since   04.06.10
  * @see     GitPlatformAdapter
  */

lib/Enterprise/GitPlatformAdapter.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Platform
+ * DEFGROUP: MokoCLI.Enterprise.Platform
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/GitPlatformAdapter.php
  * BRIEF: Interface defining all git platform operations for GitHub/Gitea abstraction
@@ -25,7 +25,7 @@ namespace MokoCli;
  * Implementations exist for GitHub (GitHubAdapter) and Gitea (MokoGiteaAdapter),
  * allowing scripts to work against either platform transparently.
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @version 04.06.10
  */
 interface GitPlatformAdapter

lib/Enterprise/InputValidator.php

@@ -9,8 +9,8 @@ declare(strict_types=1);
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Validation
+ * DEFGROUP: MokoCLI.Enterprise.Validation
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/InputValidator.php
  * BRIEF: Input validation library
@@ -31,7 +31,7 @@ declare(strict_types=1);
  *
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @version 04.00.04
  * @author mokocli Team
  * @license GPL-3.0-or-later

lib/Enterprise/ManifestParser.php

@@ -8,8 +8,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise
+ * DEFGROUP: MokoCLI.Enterprise
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/ManifestParser.php
  * BRIEF: Parser for the XML-based manifest.xml repository manifest
@@ -28,7 +28,7 @@ use SimpleXMLElement;
  * Reads, writes, and validates the manifest.xml repository manifest.
  * The file uses XML format (no file extension) and lives at .mokogitea/manifest.xml.
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @version 04.07.00
  */
 class ManifestParser

lib/Enterprise/MetricsCollector.php

@@ -9,8 +9,8 @@ declare(strict_types=1);
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Metrics
+ * DEFGROUP: MokoCLI.Enterprise.Metrics
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/MetricsCollector.php
  * BRIEF: Metrics collection framework
@@ -46,7 +46,7 @@ declare(strict_types=1);
  *
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @version 04.00.04
  * @author mokocli Team
  * @license GPL-3.0-or-later

lib/Enterprise/MokoGiteaAdapter.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Platform
+ * DEFGROUP: MokoCLI.Enterprise.Platform
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/MokoGiteaAdapter.php
  * BRIEF: Gitea implementation of GitPlatformAdapter
@@ -33,7 +33,7 @@ use RuntimeException;
  * - Branch protection: flat API (not rulesets)
  * - Workflow dir: .mokogitea/workflows
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @since   04.06.10
  * @see     GitPlatformAdapter
  */

lib/Enterprise/PackageBuilder.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise
+ * DEFGROUP: MokoCLI.Enterprise
- * INGROUP: MokoPlatform.Lib
+ * INGROUP: MokoCLI.Lib
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/PackageBuilder.php
  * BRIEF: Builds release packages for generic, Dolibarr module, and Joomla component projects

lib/Enterprise/PlatformAdapterFactory.php

@@ -7,8 +7,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Platform
+ * DEFGROUP: MokoCLI.Enterprise.Platform
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/PlatformAdapterFactory.php
  * BRIEF: Factory for creating platform-specific GitPlatformAdapter instances
@@ -33,7 +33,7 @@ use RuntimeException;
  * $repos = $adapter->listOrgRepos('mokoconsulting-tech');
  * ```
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @version 04.06.10
  *
  * @since 04.00.00

lib/Enterprise/PluginFactory.php

@@ -9,8 +9,8 @@ declare(strict_types=1);
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Plugins
+ * DEFGROUP: MokoCLI.Enterprise.Plugins
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/PluginFactory.php
  * BRIEF: Plugin factory for project type detection
@@ -23,7 +23,7 @@ namespace MokoCli;
  *
  * Provides convenient methods for plugin instantiation with dependency injection
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @version 1.0.0
  */
 class PluginFactory

lib/Enterprise/PluginRegistry.php

@@ -9,8 +9,8 @@ declare(strict_types=1);
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Plugins
+ * DEFGROUP: MokoCLI.Enterprise.Plugins
- * INGROUP: MokoPlatform.Enterprise
+ * INGROUP: MokoCLI.Enterprise
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/PluginRegistry.php
  * BRIEF: Plugin registry for available project plugins
@@ -35,7 +35,7 @@ use MokoCli\Plugins\McpServerPlugin;
  *
  * Manages plugin discovery, registration, and lifecycle
  *
- * @package MokoPlatform\Enterprise
+ * @package MokoCLI\Enterprise
  * @version 1.0.0
  */
 class PluginRegistry

lib/Enterprise/Plugins/ApiPlugin.php

@@ -8,8 +8,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Plugins
+ * DEFGROUP: MokoCLI.Enterprise.Plugins
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/Plugins/ApiPlugin.php
  * BRIEF: Enterprise plugin for API/Microservices projects

lib/Enterprise/Plugins/DocumentationPlugin.php

@@ -8,8 +8,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Plugins
+ * DEFGROUP: MokoCLI.Enterprise.Plugins
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/Plugins/DocumentationPlugin.php
  * BRIEF: Enterprise plugin for documentation projects

lib/Enterprise/Plugins/DolibarrPlugin.php

@@ -8,8 +8,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Plugins
+ * DEFGROUP: MokoCLI.Enterprise.Plugins
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/Plugins/DolibarrPlugin.php
  * BRIEF: Enterprise plugin for Dolibarr modules

lib/Enterprise/Plugins/GenericPlugin.php

@@ -8,8 +8,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Plugins
+ * DEFGROUP: MokoCLI.Enterprise.Plugins
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/Plugins/GenericPlugin.php
  * BRIEF: Enterprise plugin for generic projects

lib/Enterprise/Plugins/JoomlaPlugin.php

@@ -8,8 +8,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoPlatform.Enterprise.Plugins
+ * DEFGROUP: MokoCLI.Enterprise.Plugins
- * INGROUP: MokoPlatform
+ * INGROUP: MokoCLI
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /lib/Enterprise/Plugins/JoomlaPlugin.php
  * BRIEF: Enterprise plugin for Joomla projects