chore(version): pre-release bump to 01.00.41-dev [skip ci]

Merge pull request 'docs(changelog): note admin menu short-name constant' (#17 ) from jmiller/changelog-short-constant into dev
docs(changelog): note admin menu short-name constant (#13 )
2026-07-12 21:41:10 +00:00 · 2026-07-12 21:39:26 +00:00 · 2026-07-12 16:35:10 -05:00
35 changed files with 497 additions and 3414 deletions
@@ -8,7 +8,7 @@ contact_links:
    url: https://mokoconsulting.tech/
    about: Get help or ask questions through our website
  - name: 📚 MokoStandards Documentation
-    url: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+    url: https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki
    about: View our coding standards and best practices
  - name: 🔒 Report a Security Vulnerability
    url: https://git.mokoconsulting.tech/mokoconsulting-tech/.github-private/security/advisories/new
@@ -37,7 +37,7 @@ If you have ideas about how this could be implemented, share them here:
 Add any other context, mockups, or screenshots about the feature request here.
 ## Relevant Standards
-Does this relate to any standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/MokoStandards)?
+Does this relate to any standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)?
 - [ ] Accessibility (WCAG 2.1 AA)
 - [ ] Localization (en_US/en_GB)
 - [ ] Security best practices
@@ -35,7 +35,7 @@ Use this template only for:
 <!-- Describe how this could be addressed -->
 ## Standards Reference
-Does this relate to security standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/MokoStandards)?
+Does this relate to security standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)?
 - [ ] SPDX license identifiers
 - [ ] Secret management
 - [ ] Dependency security
@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoCLI.Release
+# INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/auto-bump.yml
 # VERSION: 09.02.00
 # BRIEF: Auto patch-bump version on every push to dev (skips merge commits)
@@ -22,7 +22,7 @@ on:
 env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 permissions:
  contents: write
@@ -34,8 +34,7 @@ jobs:
    if: >-
      !contains(github.event.head_commit.message, '[skip ci]') &&
      !contains(github.event.head_commit.message, '[skip bump]') &&
-      !startsWith(github.event.head_commit.message, 'Merge pull request') &&
+      !startsWith(github.event.head_commit.message, 'Merge pull request')
      !startsWith(github.event.repository.name, 'Template-')
    steps:
      - name: Checkout
@@ -44,7 +43,7 @@ jobs:
          token: ${{ secrets.MOKOGITEA_TOKEN }}
          fetch-depth: 1
-      - name: Setup MokoCLI tools
+      - name: Setup mokocli tools
        run: |
          if ! command -v composer &> /dev/null; then
            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
@@ -3,18 +3,18 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoCLI.Release
+# INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
-# PATH: /.mokogitea/workflows/auto-release.yml
+# PATH: /templates/workflows/universal/auto-release.yml.template
-# VERSION: 05.01.00
+# VERSION: 05.00.00
-# BRIEF: Universal build & release � detects platform from metadata API
+# BRIEF: Universal build & release � detects platform from manifest.xml
 #
 # +=======================================================================+
 # |              UNIVERSAL BUILD & RELEASE PIPELINE                        |
 # +=======================================================================+
 # |                                                                        |
-# |  Reads metadata API (joomla|dolibarr|generic) to branch logic.       |
+# |  Reads manifest.xml (joomla|dolibarr|generic) to branch logic.       |
 # |                                                                        |
 # |  Platform-specific:                                                    |
 # |    joomla:   XML manifest, type-prefixed packages                      |
@@ -27,18 +27,9 @@ name: "Universal: Build & Release"
 on:
  pull_request:
-    types: [opened, synchronize, closed]
+    types: [opened, closed]
    branches:
      - main
    paths-ignore:
      - '.mokogitea/workflows/**'
      - '*.md'
      - 'wiki/**'
      - '.editorconfig'
      - '.gitignore'
      - '.gitattributes'
      - '.gitmessage'
      - 'LICENSE' 
  workflow_dispatch:
    inputs:
      action:
@@ -52,7 +43,7 @@ on:
 env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
@@ -64,14 +55,9 @@ jobs:
  promote-rc:
    name: Promote to RC
    runs-on: release
    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
    if: >-
-      !startsWith(github.event.repository.name, 'Template-') &&
+      (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
-      (
+      (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
        (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
        (github.event.action == 'synchronize' && github.event.pull_request.merged != true) ||
        (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
      )
    steps:
      - name: Checkout repository
@@ -79,9 +65,8 @@ jobs:
        with:
          token: ${{ secrets.MOKOGITEA_TOKEN }}
          fetch-depth: 1
          submodules: recursive
-      - name: Setup MokoCLI tools
+      - name: Setup mokocli tools
        env:
          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
@@ -104,43 +89,18 @@ jobs:
      - name: Rename branch to rc
        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          php ${MOKO_CLI}/branch_rename.php \
-          AUTH="Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}"
+            --from "${{ github.event.pull_request.head.ref || 'dev' }}" --to rc \
-          FROM="${{ github.event.pull_request.head.ref || 'dev' }}"
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
-          PR="${{ github.event.pull_request.number }}"
+            --api-base "${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}" \
-
+            --pr "${{ github.event.pull_request.number }}"
          # Resolve the source branch HEAD commit.
          SRC_JSON=$(curl -sf -H "$AUTH" "${API_BASE}/branches/${FROM}") \
            || { echo "::error::Source branch ${FROM} not found"; exit 1; }
          SRC_SHA=$(printf '%s' "$SRC_JSON" | python3 -c "import sys, json; print(json.load(sys.stdin)['commit']['id'])" 2>/dev/null || true)
          [ -n "$SRC_SHA" ] || { echo "::error::Could not resolve HEAD of ${FROM}"; exit 1; }
          # Point rc at the source commit via git push. Gitea's git/refs PATCH API
          # returns HTTP 405 on ANY protected branch (force or not, even for a user in
          # the force-push allowlist), so it cannot move a protected rc. git push honors
          # the push + force-push allowlists and creates rc if it is absent.
          PUSH_URL="https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@${MOKOGITEA_URL#https://}/${GITEA_ORG}/${GITEA_REPO}.git"
          git config --global user.name "mokogitea-actions[bot]"
          git config --global user.email "actions@mokoconsulting.tech"
          git fetch --no-tags "$PUSH_URL" "${FROM}"
          git push --force "$PUSH_URL" "FETCH_HEAD:refs/heads/rc" \
            || { echo "::error::Failed to point rc at ${FROM} (${SRC_SHA}) via git push"; exit 1; }
          echo "rc set to ${FROM} (${SRC_SHA})"
          # Repoint the PR at rc, then delete the old source branch (non-fatal).
          if [ -n "$PR" ]; then
            curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
              "${API_BASE}/pulls/${PR}" -d '{"head":"rc"}' >/dev/null || true
          fi
          curl -s -X DELETE -H "$AUTH" "${API_BASE}/branches/${FROM}" >/dev/null || true
          echo "Renamed ${FROM} -> rc"
      - name: Checkout rc and configure git
        run: |
          git fetch origin rc
          git checkout rc
-          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "mokogitea-actions[bot]"
+          git config --local user.name "gitea-actions[bot]"
          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
      - name: Publish RC release
@@ -151,7 +111,7 @@ jobs:
      - name: Update RC release notes from CHANGELOG.md
        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
          # Extract [Unreleased] section from changelog
@@ -193,13 +153,9 @@ jobs:
  release:
    name: Build & Release Pipeline
    runs-on: release
    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
    if: >-
-      !startsWith(github.event.repository.name, 'Template-') &&
+      github.event.pull_request.merged == true ||
-      (
+      (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
        github.event.pull_request.merged == true ||
        (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
      )
    steps:
      - name: Checkout repository
@@ -207,12 +163,11 @@ jobs:
        with:
          token: ${{ secrets.MOKOGITEA_TOKEN }}
          fetch-depth: 0
          submodules: recursive
      - name: Configure git for bot pushes
        run: |
-          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "mokogitea-actions[bot]"
+          git config --local user.name "gitea-actions[bot]"
          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
      - name: Check for merge conflict markers
@@ -228,7 +183,7 @@ jobs:
          fi
          echo "No conflict markers found"
-      - name: Setup MokoCLI tools
+      - name: Setup mokocli tools
        env:
          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
@@ -304,7 +259,7 @@ jobs:
          !startsWith(steps.platform.outputs.platform, 'joomla')
        run: |
          VERSION="${{ steps.version.outputs.version }}"
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
          SEMVER_TAG="v${VERSION}"
@@ -329,7 +284,7 @@ jobs:
      - name: Update release notes and promote changelog
        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
          # Get the stable release info (version and ID)
@@ -374,47 +329,13 @@ jobs:
          if [ -n "$VERSION" ] && [ -f "CHANGELOG.md" ]; then
            DATE=$(date +%Y-%m-%d)
            python3 -c "
-          import sys, re
+          import sys
          version, date = sys.argv[1], sys.argv[2]
-          lines = open('CHANGELOG.md').read().split('\n')
+          content = open('CHANGELOG.md').read()
-          h2 = re.compile(r'^##\s+\[([^\]]+)\]')
+          old = '## [Unreleased]'
-          header, sections, cur = [], [], None
+          new = f'## [Unreleased]\n\n## [{version}] --- {date}'
-          for ln in lines:
+          content = content.replace(old, new, 1)
-              m = h2.match(ln)
+          open('CHANGELOG.md', 'w').write(content)
              if m:
                  if cur: sections.append(cur)
                  cur = {'label': m.group(1).strip(), 'head': ln, 'body': []}
              elif cur is None:
                  header.append(ln)
              else:
                  cur['body'].append(ln)
          if cur: sections.append(cur)
          def nonempty(b): return any(x.strip() for x in b)
          def trim(b):
              b = b[:]
              while b and not b[0].strip(): b.pop(0)
              while b and not b[-1].strip(): b.pop()
              return b
          unreleased, order, bykey = [], [], {}
          for s in sections:
              key = s['label'].lower()
              if key == 'unreleased':
                  if nonempty(s['body']): unreleased += s['body']
                  continue
              if not nonempty(s['body']): continue                 # drop blank release sections
              if key in bykey: bykey[key]['body'] += [''] + s['body']  # merge duplicate heading (never drop content)
              else: bykey[key] = s; order.append(key)
          rest, seen = [bykey[k] for k in order], set(order)
          out = []
          htxt = '\n'.join(header).rstrip()
          if htxt: out += [htxt, '']
          out += ['## [Unreleased]', '']
          promote = bool(unreleased) and version.lower() not in seen
          if unreleased and not promote: out += trim(unreleased) + ['']
          if promote: out += ['## [%s] --- %s' % (version, date), ''] + trim(unreleased) + ['']
          for s in rest: out += [s['head'], ''] + trim(s['body']) + ['']
          res = re.sub(r'\n{3,}', '\n\n', '\n'.join(out)).rstrip('\n') + '\n'
          open('CHANGELOG.md', 'w').write(res)
          " "$VERSION" "$DATE"
            git add CHANGELOG.md
            git commit -m "chore: promote changelog [Unreleased] → [${VERSION}]" || true
@@ -432,7 +353,7 @@ jobs:
          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
          RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          php ${MOKO_CLI}/release_mirror.php \
            --version "$VERSION" --tag "$RELEASE_TAG" \
            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
@@ -457,11 +378,11 @@ jobs:
            && echo "main branch pushed to GitHub mirror" \
            || echo "WARNING: GitHub mirror push failed"
-      - name: "Step 11: Delete rc branch (dev reset moved to cascade-dev.yml)"
+      - name: "Step 11: Delete rc branch and recreate dev from main"
        if: steps.version.outputs.skip != 'true'
        continue-on-error: true
        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
          # Delete rc branch (ephemeral — created by promote-rc)
@@ -469,15 +390,23 @@ jobs:
            "${API_BASE}/branches/rc" 2>/dev/null \
            && echo "Deleted rc branch" || echo "rc branch not found"
-          # dev is reset from main by the dedicated "Cascade Main -> Dev" workflow
+          # Delete dev branch
-          # (cascade-dev.yml), which runs after this release completes.
+          curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
-          echo "rc cleaned; dev reset handled by cascade-dev.yml" >> $GITHUB_STEP_SUMMARY
+            "${API_BASE}/branches/dev" 2>/dev/null && echo "Deleted dev branch"
          # Recreate dev from main (now includes version bump + changelog promotion)
          curl -sf -X POST -H "Authorization: token ${TOKEN}" \
            -H "Content-Type: application/json" \
            "${API_BASE}/branches" \
            -d '{"new_branch_name":"dev","old_branch_name":"main"}' 2>/dev/null && echo "Recreated dev from main"
          echo "Pre-release branches cleaned, dev reset from main" >> $GITHUB_STEP_SUMMARY
      - name: "Step 12: Create version branch from main"
        if: steps.version.outputs.skip != 'true'
        continue-on-error: true
        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
          BRANCH_NAME="version/${VERSION}"
@@ -498,7 +427,7 @@ jobs:
        if: steps.version.outputs.skip != 'true'
        continue-on-error: true
        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          php ${MOKO_CLI}/version_reset_dev.php \
            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "${API_BASE}" \
            --branch dev --path . 2>&1 || true
@@ -524,5 +453,5 @@ jobs:
            echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
            echo "| Branch | \`${{ steps.version.outputs.branch }}\` |" >> $GITHUB_STEP_SUMMARY
            echo "| Tag | \`${{ steps.version.outputs.tag }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Release | [View](${MOKOGITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
+            echo "| Release | [View](${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
          fi
@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoCLI.Universal
+# INGROUP: MokoStandards.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/branch-cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Delete feature branches after PR merge
@@ -33,8 +33,7 @@ jobs:
        run: |
          BRANCH="${{ github.event.pull_request.head.ref }}"
          API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
-          # URL-encode the branch name's slashes (no PHP dependency on the runner)
+          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
          ENCODED=$(printf '%s' "${BRANCH}" | sed 's|/|%2F|g')
          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
            -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
@@ -1,190 +1,10 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# DISABLED — auto-release Step 11 recreates dev from main after every release.
-#
+# Cascade-dev is redundant and causes version conflicts when both main and dev
-# SPDX-License-Identifier: GPL-3.0-or-later
+# have different version numbers in templateDetails.xml / manifest.xml.
-#
+name: "Cascade Main → Dev (DISABLED)"
-# FILE INFORMATION
+on: workflow_dispatch
 # DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoCLI.Cascade
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/cascade-dev.yml
 # VERSION: 02.01.00
 # BRIEF: Cascade main -> dev; auto-merge clean, auto-resolve VERSION-stamp-only conflicts, else notify
 name: "Cascade Main -> Dev"
 on:
  push:
    branches:
      - main
  # Daily safety net: catches drift even when main only received [skip ci] pushes
  # (which never fire the push trigger above). Off-round minute to avoid a fleet-wide spike.
  schedule:
    - cron: '23 7 * * *'
  workflow_dispatch:
 permissions:
  contents: write
  pull-requests: write
 env:
  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
  # ntfy destination is configured via repo or org variables (org vars are inherited).
  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
  NTFY_TOPIC: ${{ vars.CASCADE_NTFY_TOPIC || vars.NTFY_TOPIC || 'gitea-releases' }}
 jobs:
-  cascade:
+  noop:
    name: Cascade main -> dev
    runs-on: ubuntu-latest
    steps:
-      - name: Checkout (full history for merge/resolve)
+      - run: echo "Cascade disabled — auto-release handles dev recreation"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.MOKOGITEA_TOKEN }}
      - name: Cascade main -> dev (auto-resolve version stamps, else notify)
        env:
          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
          REPO: ${{ github.repository }}
        run: |
          set -uo pipefail
          API="${MOKOGITEA_URL}/api/v1/repos/${REPO}"
          AUTH="Authorization: token ${TOKEN}"
          jqget() { python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('$1',''))" 2>/dev/null; }
          # 0. dev must exist
          if ! curl -sf -H "$AUTH" "${API}/branches/dev" >/dev/null 2>&1; then
            echo "No dev branch - nothing to cascade."; exit 0
          fi
          # 1. is main ahead of dev?
          AHEAD=$(curl -sf -H "$AUTH" "${API}/compare/dev...main" \
            | python3 -c "import sys,json; print(json.load(sys.stdin).get('total_commits',0))" 2>/dev/null || echo 0)
          if [ "${AHEAD:-0}" -eq 0 ]; then
            echo "dev already up to date with main."; exit 0
          fi
          echo "main is ${AHEAD} commit(s) ahead of dev."
          # 2. reuse an open main->dev PR, else create one
          PR=$(curl -sf -H "$AUTH" "${API}/pulls?state=open&base=dev" \
            | python3 -c "import sys,json; d=json.load(sys.stdin); print(next((str(p['number']) for p in d if p.get('head',{}).get('ref')=='main'), ''))" 2>/dev/null || echo "")
          if [ -z "$PR" ]; then
            RESP=$(curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/pulls" \
              -d '{"head":"main","base":"dev","title":"chore(sync): cascade main -> dev","body":"Automated cascade of main into dev. Auto-merges when conflict-free, auto-resolves VERSION-stamp-only conflicts, otherwise left open for manual resolution."}')
            PR=$(printf '%s' "$RESP" | jqget number)
            if [ -z "$PR" ]; then
              echo "::warning::Could not open cascade PR: $RESP"; exit 0
            fi
            echo "Opened cascade PR #${PR}"
          else
            echo "Reusing open cascade PR #${PR}"
          fi
          notify() {
            curl -sS \
              -H "Title: ${REPO}: dev cascade needs manual merge" \
              -H "Tags: warning,twisted_rightwards_arrows" \
              -H "Priority: high" \
              -H "Click: ${MOKOGITEA_URL}/${REPO}/pulls/${PR}" \
              -d "main -> dev cascade PR #${PR} $1 It was NOT auto-merged; resolve it manually." \
              "${NTFY_URL}/${NTFY_TOPIC}" || true
          }
          # 3. wait for MokoGitea to compute mergeability (conflict detection)
          MERGEABLE=""
          for _ in 1 2 3 4 5 6; do
            MERGEABLE=$(curl -sf -H "$AUTH" "${API}/pulls/${PR}" | jqget mergeable)
            case "$MERGEABLE" in True|False) break ;; esac
            sleep 3
          done
          echo "mergeable=${MERGEABLE}"
          # 4a. conflict-free -> merge via API (existing behaviour)
          if [ "$MERGEABLE" = "True" ]; then
            CODE=$(curl -s -o /tmp/merge.json -w "%{http_code}" -H "$AUTH" -H "Content-Type: application/json" \
              -X POST "${API}/pulls/${PR}/merge" -d '{"Do":"merge","merge_when_checks_succeed":true}')
            if [ "$CODE" -ge 200 ] && [ "$CODE" -lt 300 ]; then
              echo "Cascade PR #${PR} merged (or scheduled to merge when checks pass)."
              exit 0
            fi
            echo "::warning::Auto-merge returned HTTP ${CODE}: $(cat /tmp/merge.json)"
            notify "could not be auto-merged (HTTP ${CODE})."
            exit 0
          fi
          # 4b. conflicts -> try to auto-resolve if they are ONLY VERSION-stamp lines.
          echo "PR not cleanly mergeable; checking whether conflicts are VERSION-stamp-only..."
          git config user.name  "MokoGitea Cascade"
          git config user.email "actions@mokoconsulting.tech"
          git fetch --quiet origin main dev
          git checkout -B dev origin/dev
          if git merge --no-ff --no-commit origin/main >/dev/null 2>&1; then
            # Became clean at git level (e.g. mergeability was still computing) -> commit + push.
            git commit -m "chore(sync): cascade main -> dev [skip ci]" >/dev/null
            git push origin dev
            echo "Cascade merged cleanly at git level and pushed to dev."
            exit 0
          fi
          CONFLICTS=$(git diff --name-only --diff-filter=U)
          echo "Conflicted files:"; echo "${CONFLICTS}"
          # A conflict is "stamp-only" when every line inside every conflict block matches
          # a version-stamp pattern (VERSION: header, <version> element, or CHANGELOG title).
          is_stamp_only() {
            awk '
              /^<<<<<<< /   { inc=1; next }
              inc && /^=======$/ { next }
              /^>>>>>>> /   { inc=0; next }
              inc { if ($0 !~ /(VERSION:|<version>|# Changelog)/) { bad=1 } }
              END { exit(bad ? 1 : 0) }
            ' "$1"
          }
          # Resolve a stamp-only file by keeping dev (ours) for the conflicting lines,
          # preserving all auto-merged content around them.
          keep_ours() {
            awk '
              /^<<<<<<< /   { inc=1; side="ours"; next }
              inc && /^=======$/ { side="theirs"; next }
              /^>>>>>>> /   { inc=0; next }
              { if (!inc) { print; next } if (side=="ours") print }
            ' "$1" > "$1.resolved" && mv "$1.resolved" "$1"
          }
          ALL_STAMP=1
          for f in ${CONFLICTS}; do
            if ! is_stamp_only "$f"; then
              echo "::notice::$f has non-stamp conflicts -> manual resolution required."
              ALL_STAMP=0; break
            fi
          done
          if [ "$ALL_STAMP" != "1" ]; then
            git merge --abort || true
            notify "has non-version-stamp conflicts and cannot be auto-resolved."
            exit 0
          fi
          echo "All conflicts are VERSION-stamp-only; resolving in favour of dev."
          for f in ${CONFLICTS}; do
            keep_ours "$f"
            git add "$f"
          done
          # Best-effort: normalise stamps to dev's version if mokocli is available.
          if [ -f /opt/mokocli/cli/version_check.php ]; then
            php /opt/mokocli/cli/version_check.php --fix || true
            git add -A
          fi
          git commit -m "chore(sync): cascade main -> dev (auto-resolved version stamps) [skip ci]" >/dev/null
          git push origin dev
          echo "Cascade auto-resolved and pushed to dev."
          # Close the now-redundant PR (its changes are in dev) with an explanatory comment.
          curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/issues/${PR}/comments" \
            -d '{"body":"Auto-resolved VERSION-stamp-only conflicts and pushed the merge to dev. Closing."}' >/dev/null || true
          curl -s -H "$AUTH" -H "Content-Type: application/json" -X PATCH "${API}/pulls/${PR}" \
            -d '{"state":"closed"}' >/dev/null || true
@@ -3,22 +3,16 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoCLI.CI
+# INGROUP: MokoStandards.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/ci-generic.yml
+# PATH: /.gitea/workflows/ci-generic.yml
 # VERSION: 01.00.00
 # BRIEF: CI pipeline — lint, validate, and test for generic projects (PHP + Node.js)
 name: "Generic: Project CI"
 on:
  pull_request:
    branches:
      - main
      - dev
      - dev/**
      - rc/**
  workflow_dispatch:
 permissions:
@@ -32,8 +26,6 @@ jobs:
  lint:
    name: Lint & Validate
    runs-on: ubuntu-latest
    # Skip on template repos (Template-*) — they hold placeholder scaffolding, not buildable source.
    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
    steps:
      - name: Checkout
@@ -131,11 +123,7 @@ jobs:
  test:
    name: Tests
    runs-on: ubuntu-latest
-    # Independent job (no `needs: lint`): the MokoGitea Actions scheduler does not
+    needs: lint
    # offer the dependent 2nd job of a needs-chain to runners, so it stalls in
    # "waiting" and is reaped by ABANDONED_JOB_TIMEOUT. Guard template repos
    # directly (same condition lint uses) instead of gating on lint's result.
    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
    steps:
      - name: Checkout
@@ -1,68 +1 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+IyBDb3B5cmlnaHQgKEMpIDIwMjYgTW9rbyBDb25zdWx0aW5nIDxoZWxsb0Btb2tvY29uc3VsdGluZy50ZWNoPgojCiMgU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEdQTC0zLjAtb3ItbGF0ZXIKIwojIEZJTEUgSU5GT1JNQVRJT04KIyBERUZHUk9VUDogR2l0ZWEuV29ya2Zsb3cKIyBJTkdST1VQOiBtb2tvY2xpLlVuaXZlcnNhbAojIFJFUE86IGh0dHBzOi8vZ2l0Lm1va29jb25zdWx0aW5nLnRlY2gvTW9rb0NvbnN1bHRpbmcvbW9rb2NsaQojIFBBVEg6IC8ubW9rb2dpdGVhL3dvcmtmbG93cy9jaS1pc3N1ZS1yZXBvcnRlci55bWwKIyBWRVJTSU9OOiAwMS4wMC4wMAojIEJSSUVGOiBSZXVzYWJsZSB3b3JrZmxvdyDigJQgY3JlYXRlcy91cGRhdGVzIGEgR2l0ZWEgaXNzdWUgd2hlbiBhIENJIGdhdGUgZmFpbHMuCiMgICAgICAgIENsb25lcyBNb2tvQ0xJIGFuZCBydW5zIGNsaS9jaV9pc3N1ZV9yZXBvcnRlci5zaC4KCm5hbWU6ICJVbml2ZXJzYWw6IENJIElzc3VlIFJlcG9ydGVyIgoKb246CiAgd29ya2Zsb3dfY2FsbDoKICAgIGlucHV0czoKICAgICAgZ2F0ZToKICAgICAgICBkZXNjcmlwdGlvbjogIkNJIGdhdGUgbmFtZSAoZS5nLiBQUiBWYWxpZGF0aW9uLCBSZXBvc2l0b3J5IEhlYWx0aCkiCiAgICAgICAgcmVxdWlyZWQ6IHRydWUKICAgICAgICB0eXBlOiBzdHJpbmcKICAgICAgZGV0YWlsczoKICAgICAgICBkZXNjcmlwdGlvbjogIkh1bWFuLXJlYWRhYmxlIGZhaWx1cmUgZGVzY3JpcHRpb24iCiAgICAgICAgcmVxdWlyZWQ6IHRydWUKICAgICAgICB0eXBlOiBzdHJpbmcKICAgICAgc2V2ZXJpdHk6CiAgICAgICAgZGVzY3JpcHRpb246ICJlcnJvciBvciB3YXJuaW5nIgogICAgICAgIHJlcXVpcmVkOiBmYWxzZQogICAgICAgIHR5cGU6IHN0cmluZwogICAgICAgIGRlZmF1bHQ6ICJlcnJvciIKICAgICAgd29ya2Zsb3c6CiAgICAgICAgZGVzY3JpcHRpb246ICJXb3JrZmxvdyBuYW1lIGZvciB0aGUgaXNzdWUgdGl0bGUiCiAgICAgICAgcmVxdWlyZWQ6IGZhbHNlCiAgICAgICAgdHlwZTogc3RyaW5nCiAgICAgICAgZGVmYXVsdDogIiIKICAgIHNlY3JldHM6CiAgICAgIE1PS09HSVRFQV9UT0tFTjoKICAgICAgICByZXF1aXJlZDogdHJ1ZQoKZW52OgogIEZPUkNFX0pBVkFTQ1JJUFRfQUNUSU9OU19UT19OT0RFMjQ6IHRydWUKCmpvYnM6CiAgcmVwb3J0OgogICAgbmFtZTogIlJlcG9ydDogJHt7IGlucHV0cy5nYXRlIH19IgogICAgcnVucy1vbjogdWJ1bnR1LWxhdGVzdAoKICAgIHN0ZXBzOgogICAgICAtIG5hbWU6IENsb25lIE1va29DTEkKICAgICAgICBlbnY6CiAgICAgICAgICBNT0tPR0lURUFfVE9LRU46ICR7eyBzZWNyZXRzLk1PS09HSVRFQV9UT0tFTiB9fQogICAgICAgIHJ1bjogfAogICAgICAgICAgTU9LT0dJVEVBX1VSTD0iJHt7IHZhcnMuR0lURUFfVVJMIHx8ICdodHRwczovL2dpdC5tb2tvY29uc3VsdGluZy50ZWNoJyB9fSIKICAgICAgICAgIGdpdCBjbG9uZSAtLWRlcHRoIDEgLS1maWx0ZXI9YmxvYjpub25lIC0tc3BhcnNlICIke01PS09HSVRFQV9VUkx9L01va29Db25zdWx0aW5nL01va29DTEkuZ2l0IiAvdG1wL21va29jbGkKICAgICAgICAgIGNkIC90bXAvbW9rb2NsaSAmJiBnaXQgc3BhcnNlLWNoZWNrb3V0IHNldCBjbGkvY2lfaXNzdWVfcmVwb3J0ZXIuc2gKCiAgICAgIC0gbmFtZTogUmVwb3J0IENJIGZhaWx1cmUKICAgICAgICBlbnY6CiAgICAgICAgICBNT0tPR0lURUFfVE9LRU46ICR7eyBzZWNyZXRzLk1PS09HSVRFQV9UT0tFTiB9fQogICAgICAgICAgTU9LT0dJVEVBX1VSTDogJHt7IHZhcnMuR0lURUFfVVJMIHx8ICdodHRwczovL2dpdC5tb2tvY29uc3VsdGluZy50ZWNoJyB9fQogICAgICAgIHJ1bjogfAogICAgICAgICAgY2htb2QgK3ggL3RtcC9tb2tvY2xpL2NsaS9jaV9pc3N1ZV9yZXBvcnRlci5zaAogICAgICAgICAgL3RtcC9tb2tvY2xpL2NsaS9jaV9pc3N1ZV9yZXBvcnRlci5zaCBcCiAgICAgICAgICAgIC0tZ2F0ZSAiJHt7IGlucHV0cy5nYXRlIH19IiBcCiAgICAgICAgICAgIC0tZGV0YWlscyAiJHt7IGlucHV0cy5kZXRhaWxzIH19IiBcCiAgICAgICAgICAgIC0tc2V2ZXJpdHkgIiR7eyBpbnB1dHMuc2V2ZXJpdHkgfX0iIFwKICAgICAgICAgICAgLS13b3JrZmxvdyAiJHt7IGlucHV0cy53b3JrZmxvdyB9fSIK
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoCLI.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/ci-issue-reporter.yml
 # VERSION: 01.00.00
 # BRIEF: Reusable workflow — creates/updates a MokoGitea issue when a CI gate fails.
 #        Clones MokoCLI and runs cli/ci_issue_reporter.sh.
 name: "Universal: CI Issue Reporter"
 on:
  workflow_call:
    inputs:
      gate:
        description: "CI gate name (e.g. PR Validation, Repository Health)"
        required: true
        type: string
      details:
        description: "Human-readable failure description"
        required: true
        type: string
      severity:
        description: "error or warning"
        required: false
        type: string
        default: "error"
      workflow:
        description: "Workflow name for the issue title"
        required: false
        type: string
        default: ""
    secrets:
      MOKOGITEA_TOKEN:
        required: true
 env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 jobs:
  report:
    name: "Report: ${{ inputs.gate }}"
    runs-on: ubuntu-latest
    steps:
      - name: Clone MokoCLI
        env:
          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
        run: |
          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
          git clone --depth 1 --filter=blob:none --sparse "${MOKOGITEA_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
          cd /tmp/mokocli && git sparse-checkout set cli/ci_issue_reporter.sh
      - name: Report CI failure
        env:
          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
          MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
        run: |
          chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh
          /tmp/mokocli/cli/ci_issue_reporter.sh \
            --gate "${{ inputs.gate }}" \
            --details "${{ inputs.details }}" \
            --severity "${{ inputs.severity }}" \
            --workflow "${{ inputs.workflow }}"
@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoCLI.Maintenance
+# INGROUP: MokoStandards.Maintenance
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.mokogitea/workflows/cleanup.yml
+# PATH: /.gitea/workflows/cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Scheduled cleanup — delete merged branches and old workflow runs
@@ -21,7 +21,7 @@ permissions:
  contents: write
 env:
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 jobs:
  cleanup:
@@ -33,30 +33,30 @@ jobs:
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          token: ${{ secrets.GA_TOKEN }}
      - name: Delete merged branches
        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN }}
        run: |
          echo "=== Merged Branch Cleanup ==="
-          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
          # List branches via API
-          BRANCHES=$(curl -sS -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+          BRANCHES=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
            "${API}/branches?limit=50" | jq -r '.[].name')
          DELETED=0
          for BRANCH in $BRANCHES; do
            # Skip protected branches
            case "$BRANCH" in
-              main|master|dev|develop|rc|beta|alpha|release|release/*|production|stable|staging|hotfix/*|version/*) continue ;;
+              main|master|develop|release/*|hotfix/*) continue ;;
            esac
            # Check if branch is merged into main
            if git merge-base --is-ancestor "origin/${BRANCH}" origin/main 2>/dev/null; then
              echo "  Deleting merged branch: ${BRANCH}"
-              curl -sS -X DELETE -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+              curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
                "${API}/branches/${BRANCH}" 2>/dev/null || true
              DELETED=$((DELETED + 1))
            fi
@@ -66,20 +66,20 @@ jobs:
      - name: Clean old workflow runs
        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN }}
        run: |
          echo "=== Workflow Run Cleanup ==="
-          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
          CUTOFF=$(date -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -v-30d +%Y-%m-%dT%H:%M:%SZ)
          # Get old completed runs
-          RUNS=$(curl -sS -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+          RUNS=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
            "${API}/actions/runs?status=completed&limit=50" | \
            jq -r ".workflow_runs[] | select(.created_at < \"${CUTOFF}\") | .id" 2>/dev/null)
          DELETED=0
          for RUN_ID in $RUNS; do
-            curl -sS -X DELETE -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+            curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
              "${API}/actions/runs/${RUN_ID}" 2>/dev/null || true
            DELETED=$((DELETED + 1))
          done
@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoCLI.Security
+# INGROUP: MokoStandards.Security
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
-# PATH: /.mokogitea/workflows/gitleaks.yml
+# PATH: /templates/workflows/gitleaks.yml.template
 # VERSION: 01.00.00
 # BRIEF: Secret scanning — detect leaked credentials, API keys, and tokens
 #
@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoCLI.Automation
+# INGROUP: mokocli.Automation
-# VERSION: 01.00.42
+# VERSION: 01.00.41
 # BRIEF: Auto-create feature branch when an issue is opened
 name: "Universal: Issue Branch"
@@ -19,7 +19,7 @@ permissions:
  issues: write
 env:
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 jobs:
  create-branch:
@@ -28,8 +28,8 @@ jobs:
    steps:
      - name: Create branch and comment
        run: |
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          TOKEN="${{ secrets.GA_TOKEN }}"
-          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
          ISSUE_NUM="${{ github.event.issue.number }}"
          ISSUE_TITLE="${{ github.event.issue.title }}"
@@ -58,7 +58,7 @@ jobs:
            echo "Created branch: ${BRANCH}"
            # Comment on issue with branch link
-            REPO_URL="${MOKOGITEA_URL}/${{ github.repository }}"
+            REPO_URL="${GITEA_URL}/${{ github.repository }}"
            BODY="Branch created: [\`${BRANCH}\`](${REPO_URL}/src/branch/${BRANCH})\n\n\`\`\`bash\ngit fetch origin\ngit checkout ${BRANCH}\n\`\`\`"
            curl -sf -X POST \
@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoCLI.Notifications
+# INGROUP: MokoStandards.Notifications
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.mokogitea/workflows/notify.yml
+# PATH: /.gitea/workflows/notify.yml
 # VERSION: 01.00.00
 # BRIEF: Push notifications via ntfy on release success or workflow failure
@@ -15,9 +15,9 @@ name: "Universal: Notifications"
 on:
  workflow_run:
    workflows:
-      - "Universal: Build & Release"
+      - "Joomla Build & Release"
-      - "Joomla: Extension CI"
+      - "Joomla Extension CI"
-      - "Generic: Project CI"
+      - "Deploy"
    types:
      - completed
@@ -46,13 +46,13 @@ jobs:
          WORKFLOW="${{ github.event.workflow_run.name }}"
          URL="${{ github.event.workflow_run.html_url }}"
-          curl -sS --retry 3 --retry-connrefused --retry-delay 2 --max-time 20 \
+          curl -sS \
            -H "Title: ${REPO} released" \
            -H "Tags: white_check_mark,package" \
            -H "Priority: default" \
            -H "Click: ${URL}" \
            -d "${WORKFLOW} completed successfully." \
-            "${NTFY_URL}/${NTFY_TOPIC}" || echo "::warning::ntfy notification could not be delivered (non-fatal)"
+            "${NTFY_URL}/${NTFY_TOPIC}"
      - name: Notify on failure
        if: github.event.workflow_run.conclusion == 'failure'
@@ -61,10 +61,10 @@ jobs:
          WORKFLOW="${{ github.event.workflow_run.name }}"
          URL="${{ github.event.workflow_run.html_url }}"
-          curl -sS --retry 3 --retry-connrefused --retry-delay 2 --max-time 20 \
+          curl -sS \
            -H "Title: ${REPO} workflow failed" \
            -H "Tags: x,warning" \
            -H "Priority: high" \
            -H "Click: ${URL}" \
            -d "${WORKFLOW} failed. Check the run for details." \
-            "${NTFY_URL}/${NTFY_TOPIC}" || echo "::warning::ntfy notification could not be delivered (non-fatal)"
+            "${NTFY_URL}/${NTFY_TOPIC}"
@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoCLI.CI
+# INGROUP: moko-platform.CI
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
-# PATH: /.mokogitea/workflows/pr-check.yml
+# PATH: /templates/workflows/universal/pr-check.yml.template
 # VERSION: 09.23.00
 # BRIEF: PR gate — branch policy + code validation before merge
@@ -47,15 +47,15 @@ jobs:
              fi
              ;;
            fix/*|bugfix/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "main" ]; then
+              if [ "$BASE" != "dev" ]; then
                ALLOWED=false
-                REASON="Fix branches must target 'dev' or 'main', not '${BASE}'"
+                REASON="Fix branches must target 'dev', not '${BASE}'"
              fi
              ;;
            patch/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ] && [ "$BASE" != "main" ]; then
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
                ALLOWED=false
-                REASON="Patch branches must target 'dev', 'rc', or 'main', not '${BASE}'"
+                REASON="Patch branches must target 'dev' or 'rc', not '${BASE}'"
              fi
              ;;
            hotfix/*)
@@ -86,8 +86,7 @@ jobs:
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
            echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`fix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
            echo "- \`patch/*\` → \`dev\`, \`rc\`, or \`main\`" >> $GITHUB_STEP_SUMMARY
            echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
            echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
            echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
@@ -97,80 +96,6 @@ jobs:
          echo "Branch policy: OK (${HEAD} → ${BASE})"
          echo "## Branch Policy: Passed" >> $GITHUB_STEP_SUMMARY
  # ── Docs Update Gate (main PRs) ─────────────────────────────────────────
  require-docs:
    name: Require Docs Update
    runs-on: ubuntu-latest
    # Enforce only on PRs merging into main: README.md + CHANGELOG.md must both be updated.
    if: ${{ github.base_ref == 'main' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Require README.md and CHANGELOG.md in the PR diff
        run: |
          BASE="${{ github.event.pull_request.base.sha }}"
          HEAD="${{ github.event.pull_request.head.sha }}"
          CHANGED="$(git diff --name-only "$BASE" "$HEAD" 2>/dev/null || true)"
          if [ -z "$CHANGED" ]; then
            git fetch -q origin "${{ github.base_ref }}" 2>/dev/null || true
            CHANGED="$(git diff --name-only "origin/${{ github.base_ref }}...HEAD" 2>/dev/null || true)"
          fi
          echo "Changed files in PR:"
          echo "$CHANGED"
          MISSING=""
          echo "$CHANGED" | grep -qxE 'README\.md' || MISSING="README.md"
          echo "$CHANGED" | grep -qxE 'CHANGELOG\.md' || MISSING="${MISSING:+$MISSING, }CHANGELOG.md"
          if [ -n "$MISSING" ]; then
            echo "::error::PRs into main must update: ${MISSING}"
            {
              echo "## Docs Update Required"
              echo ""
              echo "PRs merging into \`main\` must update both **README.md** and **CHANGELOG.md**."
              echo ""
              echo "Not updated in this PR: **${MISSING}**"
            } >> "$GITHUB_STEP_SUMMARY"
            exit 1
          fi
          echo "Docs update present (README.md + CHANGELOG.md)"
          echo "## Docs Update: Passed" >> "$GITHUB_STEP_SUMMARY"
  # ── Wiki Update Reminder (main PRs, non-blocking) ───────────────────────
  wiki-reminder:
    name: Wiki Update Reminder
    runs-on: ubuntu-latest
    if: ${{ github.base_ref == 'main' }}
    steps:
      - name: Remind to update the wiki
        env:
          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
          SERVER: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
          REPO: ${{ github.repository }}
          PR: ${{ github.event.pull_request.number }}
        run: |
          set -uo pipefail
          {
            echo "## Wiki Update Reminder"
            echo ""
            echo "Docs are **wiki-first** at MokoConsulting. If this change affects behavior, usage, configuration, or standards, update the repo wiki:"
            echo ""
            echo "- ${SERVER}/${REPO}/wiki"
            echo ""
            echo "_Non-blocking reminder._"
          } >> "$GITHUB_STEP_SUMMARY"
          # Post a single PR comment (idempotent via hidden marker); best-effort, never fails.
          API="${SERVER}/api/v1/repos/${REPO}/issues/${PR}/comments"
          if [ -n "${TOKEN:-}" ] && [ -n "${PR:-}" ]; then
            existing="$(curl -sf -H "Authorization: token ${TOKEN}" "$API" 2>/dev/null | grep -c 'wiki-reminder' || true)"
            if [ "${existing:-0}" -eq 0 ]; then
              curl -sf -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" -X POST "$API" \
                -d '{"body":"<!-- wiki-reminder -->\n\n**Wiki reminder:** docs are wiki-first -- if this PR changes behavior, usage, config, or standards, please update the repo wiki before/after merge. _(non-blocking)_"}' >/dev/null 2>&1 || true
            fi
          fi
          echo "Wiki reminder emitted (non-blocking)."
  # ── Secret Scanning ──────────────────────────────────────────────────
  gitleaks:
    name: Secret Scan
@@ -201,8 +126,6 @@ jobs:
  validate:
    name: Validate PR
    runs-on: ubuntu-latest
    # Skip on template repos (Template-*) — no real manifest/source/changelog to validate.
    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
    steps:
      - name: Checkout
@@ -210,7 +133,7 @@ jobs:
      - name: Check for merge conflict markers
        run: |
-          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --exclude-dir='.git' --exclude-dir='.mokogitea' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
+          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
          if [ -n "$CONFLICTS" ]; then
            echo "::error::Merge conflict markers found in source files"
            echo "## Conflict Markers Found" >> $GITHUB_STEP_SUMMARY
@@ -224,12 +147,11 @@ jobs:
      - name: Detect platform
        id: platform
        run: |
-          # Platform comes from the MokoGitea metadata API (public GET).
+          # Read platform from XML manifest (<platform> tag) or plain text fallback
-          API="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${GITHUB_REPOSITORY}/metadata"
+          PLATFORM=$(sed -n 's/.*<platform>\([^<]*\)<\/platform>.*/\1/p' .mokogitea/manifest.xml 2>/dev/null | head -1)
-          PLATFORM="$(curl -sf "$API" 2>/dev/null | python3 -c "import sys, json; print(json.load(sys.stdin).get('platform') or '')" 2>/dev/null || true)"
+          [ -z "$PLATFORM" ] && PLATFORM=$(cat .mokogitea/manifest.xml 2>/dev/null | tr -d '[:space:]')
          [ -z "$PLATFORM" ] && PLATFORM="generic"
          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
          echo "Detected platform: $PLATFORM"
      - name: Setup PHP
        if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
@@ -258,9 +180,8 @@ jobs:
          while IFS= read -r -d '' file; do
            # Skip vendor, node_modules, and index.html stub files
            case "$file" in ./vendor/*|./node_modules/*) continue ;; esac
-            # Scan the whole file for the JEXEC/JPATH guard: it is placed after
+            # Check first 10 lines for JEXEC or JPATH guard
-            # the SPDX/file-header docblock, which commonly runs past 20 lines.
+            if ! head -20 "$file" | grep -qE "defined\s*\(\s*['\"](_JEXEC|JPATH_BASE|\\\\JPATH_PLATFORM)['\"]"; then
            if ! grep -qE "defined\s*\(\s*['\"](_JEXEC|JPATH_BASE|\\\\JPATH_PLATFORM)['\"]" "$file"; then
              echo "::error file=${file}::Missing JEXEC guard: ${file}"
              ERRORS=$((ERRORS + 1))
            fi
@@ -351,7 +272,7 @@ jobs:
            joomla)
              MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
              if [ -z "$MANIFEST" ]; then
-                echo "::warning::No Joomla manifest found (MokoSuite site)"
+                echo "::warning::No Joomla manifest found (WaaS site)"
                exit 0
              fi
              echo "Manifest: ${MANIFEST}"
@@ -364,7 +285,7 @@ jobs:
              # Block legacy raw/branch update server URLs on MokoGitea
              RAW_URLS=$(grep -n 'raw/branch' "$MANIFEST" | grep -i 'mokoconsulting\|mokogitea\|git\.mokoconsulting\.tech' || true)
              if [ -n "$RAW_URLS" ]; then
-                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the MokoGitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
+                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the Gitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
                echo "$RAW_URLS"
                exit 1
              fi
@@ -571,33 +492,43 @@ jobs:
    name: Build RC Package
    runs-on: ubuntu-latest
    needs: [branch-policy, validate]
    # Run only when both gates succeeded; always() forces evaluation so a skipped
    # validate (e.g. template repos) skips this job cleanly instead of hanging.
    if: ${{ always() && needs.branch-policy.result == 'success' && needs.validate.result == 'success' }}
    steps:
      - name: Trigger RC pre-release
        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
          REPO: ${{ github.repository }}
          BRANCH: ${{ github.head_ref }}
-          MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
        run: |
-          curl -s -X POST             "${MOKOGITEA_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${MOKOGITEA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
+          curl -s -X POST             "${GITEA_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${GITEA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
          echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY
          echo "Triggered RC build on branch \`${BRANCH}\`" >> $GITHUB_STEP_SUMMARY
  # ── Issue Reporter ──────────────────────────────────────────────────────
  report-issues:
    name: Report Issues
    runs-on: ubuntu-latest
    needs: [branch-policy, validate]
    if: >-
      always() &&
      needs.validate.result == 'failure'
-    uses: ./.mokogitea/workflows/ci-issue-reporter.yml
+
-    with:
+    steps:
-      gate: "PR Validation"
+      - name: Checkout
-      workflow: "PR Check"
+        uses: actions/checkout@v4
-      severity: error
+        with:
-      details: "PR validation failed (syntax, manifest, changelog, or source checks). See the CI run for the specific check that failed."
+          sparse-checkout: automation/ci-issue-reporter.sh
-    secrets: inherit
+          sparse-checkout-cone-mode: false
      - name: "File issue for PR validation failure"
        env:
          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
        run: |
          chmod +x automation/ci-issue-reporter.sh
          ./automation/ci-issue-reporter.sh \
            --gate "PR Validation" \
            --workflow "PR Check" \
            --severity error \
            --details "PR validation failed (syntax, manifest, changelog, or source checks). See the CI run for the specific check that failed."
@@ -3,11 +3,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoCLI.Release
+# INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
-# PATH: /.mokogitea/workflows/pre-release.yml
+# PATH: /templates/workflows/universal/pre-release.yml.template
-# VERSION: 05.02.01
+# VERSION: 05.01.00
 # BRIEF: Auto pre-release on push to dev/alpha/beta/rc branches
 name: "Universal: Pre-Release"
@@ -48,13 +48,9 @@ jobs:
  build:
    name: "Build Pre-Release (${{ inputs.stability || github.ref_name }})"
    runs-on: release
    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
    if: >-
-      !startsWith(github.event.repository.name, 'Template-') &&
+      github.event_name == 'workflow_dispatch' ||
-      (
+      github.event_name == 'push'
        github.event_name == 'workflow_dispatch' ||
        github.event_name == 'push'
      )
    steps:
      - name: Checkout
@@ -63,13 +59,8 @@ jobs:
          fetch-depth: 0
          token: ${{ secrets.MOKOGITEA_TOKEN }}
          ref: ${{ github.ref_name }}
          submodules: recursive
-      - name: Update submodules to main
+      - name: Setup mokocli tools
        run: |
          git submodule foreach --quiet 'git checkout main && git pull --quiet origin main' 2>/dev/null || true
      - name: Setup MokoCLI tools
        env:
          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
@@ -97,20 +88,8 @@ jobs:
          php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
          php ${MOKO_CLI}/manifest_read.php --path . --github-output
      - name: Check platform eligibility (Joomla only)
        id: eligibility
        run: |
          PLATFORM="${{ steps.platform.outputs.platform }}"
          if [[ "$PLATFORM" == joomla* ]] || [[ "$PLATFORM" == "joomla" ]]; then
            echo "proceed=true" >> "$GITHUB_OUTPUT"
          else
            echo "proceed=false" >> "$GITHUB_OUTPUT"
            echo "::notice::Platform '$PLATFORM' — non-Joomla, skipping pre-release auto-bump"
          fi
      - name: Resolve metadata and bump version
        id: meta
        if: steps.eligibility.outputs.proceed == 'true'
        run: |
          # Auto-detect stability from branch name on push, or use input on dispatch
          if [ "${{ github.event_name }}" = "push" ]; then
@@ -156,19 +135,13 @@ jobs:
          fi
          # Commit version bump
-          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "mokogitea-actions[bot]"
+          git config --local user.name "gitea-actions[bot]"
          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
          git add -A
          git diff --cached --quiet || {
            git commit -m "chore(version): pre-release bump to ${VERSION} [skip ci]"
-            # Push the bump commit, but do NOT fail the release if the target branch
+            git push origin HEAD 2>&1
            # is protected and the release identity is not on the push allowlist.
            # The build proceeds from the in-tree bumped version regardless; if the
            # push is rejected, the next run simply re-bumps from the same base.
            if ! git push origin HEAD 2>&1; then
              echo "::warning::Version-bump commit could not be pushed (protected branch?). Building from in-tree version ${VERSION} anyway."
            fi
          }
          # Auto-detect element via manifest_element.php
@@ -193,7 +166,6 @@ jobs:
      - name: Create release
        id: release
        if: steps.eligibility.outputs.proceed == 'true'
        run: |
          TAG="${{ steps.meta.outputs.tag }}"
          VERSION="${{ steps.meta.outputs.version }}"
@@ -204,7 +176,6 @@ jobs:
            --repo "${GITEA_REPO}" --branch "${{ github.ref_name }}" --prerelease
      - name: Update release notes from CHANGELOG.md
        if: steps.eligibility.outputs.proceed == 'true'
        run: |
          TAG="${{ steps.meta.outputs.tag }}"
          VERSION="${{ steps.meta.outputs.version }}"
@@ -241,7 +212,6 @@ jobs:
      - name: Build package and upload
        id: package
        if: steps.eligibility.outputs.proceed == 'true'
        run: |
          VERSION="${{ steps.meta.outputs.version }}"
          TAG="${{ steps.meta.outputs.tag }}"
@@ -255,7 +225,6 @@ jobs:
      # No need to build, commit, or sync updates.xml from workflows
      - name: "Delete lesser pre-release channels (cascade)"
        if: steps.eligibility.outputs.proceed == 'true'
        continue-on-error: true
        run: |
          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoCLI.Universal
+# INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/rc-revert.yml
 # VERSION: 09.23.00
 # BRIEF: Rename rc/ branch back to dev/ when PR is closed without merge
@@ -25,25 +25,16 @@ jobs:
    runs-on: ubuntu-latest
    if: >-
      github.event.pull_request.merged == false &&
-      startsWith(github.event.pull_request.head.ref, 'rc/') &&
+      startsWith(github.event.pull_request.head.ref, 'rc/')
      !startsWith(github.event.repository.name, 'Template-')
    steps:
      - name: Rename branch
        env:
          BRANCH: ${{ github.event.pull_request.head.ref }}
          REPO: ${{ github.repository }}
          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
        run: |
-          set -euo pipefail
+          BRANCH="${{ github.event.pull_request.head.ref }}"
          # BRANCH is attacker-controlled (PR head ref). Strict allowlist before ANY use.
          if ! printf '%s' "$BRANCH" | grep -Eq '^rc/[A-Za-z0-9._/-]+$'; then
            echo "::error::Refusing unsafe branch name: $BRANCH"; exit 1
          fi
          SUFFIX="${BRANCH#rc/}"
          DEV_BRANCH="dev/${SUFFIX}"
-          API="${GITEA_URL}/api/v1/repos/${REPO}/branches"
+          API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
          # Create dev/ branch from rc/ branch
          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X POST \
@@ -51,22 +42,25 @@ jobs:
            -H "Content-Type: application/json" \
            -d "{\"new_branch_name\": \"${DEV_BRANCH}\", \"old_branch_name\": \"${BRANCH}\"}" \
            "${API}" 2>/dev/null || true)
          if [ "$STATUS" = "201" ]; then
-            echo "Created branch: ${DEV_BRANCH}" >> "$GITHUB_STEP_SUMMARY"
+            echo "Created branch: ${DEV_BRANCH}" >> $GITHUB_STEP_SUMMARY
          else
-            echo "::error::Failed to create ${DEV_BRANCH} from ${BRANCH} (HTTP ${STATUS})"; exit 1
+            echo "::error::Failed to create ${DEV_BRANCH} from ${BRANCH} (HTTP ${STATUS})"
            exit 1
          fi
-          # Read BRANCH from the environment inside PHP (getenv, no string interpolation -> no PHP injection)
+          # Delete rc/ branch
-          ENCODED=$(php -r 'echo rawurlencode(getenv("BRANCH"));')
+          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
            -H "Authorization: token ${TOKEN}" \
            "${API}/${ENCODED}" 2>/dev/null || true)
          if [ "$STATUS" = "204" ]; then
-            echo "Deleted branch: ${BRANCH}" >> "$GITHUB_STEP_SUMMARY"
+            echo "Deleted branch: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
          else
            echo "::warning::Failed to delete ${BRANCH} (HTTP ${STATUS})"
          fi
-          echo "### RC Reverted" >> "$GITHUB_STEP_SUMMARY"
+          echo "### RC Reverted" >> $GITHUB_STEP_SUMMARY
-          echo "${BRANCH} → ${DEV_BRANCH}" >> "$GITHUB_STEP_SUMMARY"
+          echo "${BRANCH} → ${DEV_BRANCH}" >> $GITHUB_STEP_SUMMARY
@@ -6,10 +6,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoCLI.Validation
+# INGROUP: mokocli.Validation
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
-# PATH: /.mokogitea/workflows/repo-health.yml
+# PATH: /templates/workflows/joomla/repo_health.yml.template
 # VERSION: 09.23.00
 # BRIEF: Enforces repository guardrails by validating scripts governance, tooling availability, and core repository health artifacts.
 # ============================================================================
@@ -77,7 +77,7 @@ jobs:
      - name: Check actor permission (admin only)
        id: perm
        env:
-          TOKEN: ${{ secrets.MOKOGITEA_TOKEN || github.token }}
+          TOKEN: ${{ secrets.MOKOGITEA_TOKEN || secrets.MOKOGITEA_TOKEN || github.token }}
          REPO: ${{ github.repository }}
          ACTOR: ${{ github.actor }}
        run: |
@@ -88,7 +88,7 @@ jobs:
          # Hardcoded authorized users — always allowed
          case "$ACTOR" in
-            jmiller|mokogitea-actions[bot])
+            jmiller|gitea-actions[bot])
              ALLOWED=true
              PERMISSION=admin
              METHOD="hardcoded allowlist"
@@ -671,30 +671,42 @@ jobs:
  # ═══════════════════════════════════════════════════════════════════════
  # Issue Reporter — file issues for failed gates
  # ═══════════════════════════════════════════════════════════════════════
-  report-scripts:
+  report-issues:
-    name: "Report: Scripts Governance"
+    name: "Report Issues"
-    needs: [access_check, scripts_governance]
+    runs-on: ubuntu-latest
    needs: [access_check, scripts_governance, repo_health]
    if: >-
      always() &&
-      needs.scripts_governance.result == 'failure'
+      (needs.scripts_governance.result == 'failure' ||
-    uses: ./.mokogitea/workflows/ci-issue-reporter.yml
+       needs.repo_health.result == 'failure')
    with:
      gate: "Scripts Governance"
      workflow: "Repo Health"
      severity: error
      details: "Scripts directory policy violations detected. Review required and allowed directories."
    secrets: inherit
-  report-health:
+    steps:
-    name: "Report: Repository Health"
+      - name: Checkout
-    needs: [access_check, repo_health]
+        uses: actions/checkout@v4
-    if: >-
+        with:
-      always() &&
+          sparse-checkout: automation/ci-issue-reporter.sh
-      needs.repo_health.result == 'failure'
+          sparse-checkout-cone-mode: false
-    uses: ./.mokogitea/workflows/ci-issue-reporter.yml
+
-    with:
+      - name: "File issues for failed gates"
-      gate: "Repository Health"
+        env:
-      workflow: "Repo Health"
+          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-      severity: error
+          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-      details: "Repository health checks failed — missing required artifacts, disallowed files, or content warnings. Check the CI run summary."
+        run: |
-    secrets: inherit
+          chmod +x automation/ci-issue-reporter.sh
          REPORTER="./automation/ci-issue-reporter.sh"
          WF="Repo Health"
          report_gate() {
            local gate="$1" result="$2" details="$3"
            if [ "$result" = "failure" ]; then
              "$REPORTER" --gate "$gate" --details "$details" --workflow "$WF" --severity error
            fi
          }
          report_gate "Scripts Governance" \
            "${{ needs.scripts_governance.result }}" \
            "Scripts directory policy violations detected. Review required and allowed directories."
          report_gate "Repository Health" \
            "${{ needs.repo_health.result }}" \
            "Repository health checks failed — missing required artifacts, disallowed files, or content warnings. Check the CI run summary."
@@ -0,0 +1,73 @@
 # Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
 # INGROUP: mokocli.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/workflow-sync-trigger.yml
 # VERSION: 01.01.00
 # BRIEF: Trigger workflow sync to live repos when a PR is merged to main
 name: "Universal: Workflow Sync Trigger"
 on:
  pull_request:
    types: [closed]
    branches:
      - main
 env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 jobs:
  sync:
    name: Sync workflows to live repos
    runs-on: ubuntu-latest
    if: >-
      github.event.pull_request.merged == true &&
      !contains(github.event.pull_request.title, '[skip sync]')
    steps:
      - name: Determine platform from repo name
        id: platform
        run: |
          REPO="${{ github.event.repository.name }}"
          case "$REPO" in
            Template-Joomla)   PLATFORM="joomla" ;;
            Template-Dolibarr) PLATFORM="dolibarr" ;;
            Template-Go)       PLATFORM="go" ;;
            Template-MCP)      PLATFORM="mcp" ;;
            Template-Generic)  PLATFORM="" ;;
            *)                 PLATFORM="" ;;
          esac
          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
          echo "Platform: ${PLATFORM:-all}"
      - name: Clone mokocli
        env:
          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
        run: |
          GITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
          git clone --depth 1 "${GITEA_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
      - name: Install dependencies
        run: |
          cd /tmp/mokocli
          composer install --no-dev --no-interaction --quiet 2>/dev/null || true
      - name: Run workflow sync
        env:
          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
        run: |
          ARGS="--token ${MOKOGITEA_TOKEN}"
          ARGS="${ARGS} --org ${{ vars.GITEA_ORG || github.repository_owner }}"
          ARGS="${ARGS} --phase repos"
          PLATFORM="${{ steps.platform.outputs.platform }}"
          if [ -n "$PLATFORM" ]; then
            ARGS="${ARGS} --platform-filter ${PLATFORM}"
          fi
          php /tmp/mokocli/cli/workflow_sync.php ${ARGS}
@@ -9,7 +9,11 @@
 ## [Unreleased]
 ### Fixed
 - **Honest install success** — the package installer no longer shows the license / next-steps message when a bundled child extension failed to install. A fail-open manifest verifier confirms every child extension landed in `#__extensions` and reports any that are missing.
 ### Added
 - **Admin menu short-name constant** — the Administrator → Components menu now shows a compact label via `COM_MOKOSUITEREALTY_SHORT` ("Realty"); defined in the admin sys.ini (#13)
 - **Package Manifest** — `pkg_mokosuiterealty.xml` with dlid and updateservers
 - **Plugin Manifest** — `mokosuiterealty.xml` with config fieldsets (listing defaults, search settings)
 - **Extension Class** — `Realty.php` SubscriberInterface plugin with autoloadLanguage
@@ -41,8 +41,8 @@ Joomla **package** (`pkg_mokosuiterealty`) — Layer 2 add-on extending MokoSuit
 - **Never commit** `.claude/`, `.mcp.json`, `TODO.md`, `*.min.css`/`*.min.js`
 - **Attribution**: `Authored-by: Moko Consulting`
 - **Workflow directory**: `.mokogitea/`
- **Wiki**: documentation lives in the Gitea wiki, not `docs/` files
+- **Wiki**: documentation lives in the MokoGitea wiki, not `docs/` files
- **Standards**: [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/MokoCLI/wiki)
+- **Standards**: [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)
 - **Changelog**: `[Unreleased]` only — release system assigns versions
 - **No upstream references**: never reference competitor products
@@ -14,7 +14,7 @@
 	DEFGROUP: Template-Joomla
 	INGROUP: Template-Joomla.Documentation
 	REPO: https://github.com/mokoconsulting-tech/Template-Joomla/
-  VERSION: 01.00.42
+  VERSION: 01.00.41
  PATH: ./CODE_OF_CONDUCT.md
  BRIEF: Community expectations and enforcement guidelines
  NOTE: Adapted with attribution from the Contributor Covenant v2.1
@@ -34,7 +34,7 @@ feature/* ──PR──> dev ──draft PR──> (renamed to rc) ──merge
 7. **Merging to main** triggers the stable release pipeline:
   - Minor version bump (e.g., `02.09.xx` → `02.10.00`)
   - Stability suffix stripped (clean version)
-   - Gitea release created with ZIP/tar.gz packages
+   - MokoGitea release created with ZIP/tar.gz packages
   - `updates.xml` updated (Joomla extensions)
   - `dev` branch recreated from `main`
@@ -19,12 +19,12 @@
 DEFGROUP: mokoconsulting-tech.Template-Joomla
 INGROUP: MokoStandards.Governance
 REPO: https://github.com/mokoconsulting-tech/Template-Joomla
- VERSION: 01.00.42
+ VERSION: 01.00.41
 PATH: /GOVERNANCE.md
 BRIEF: Project governance rules, roles, and decision process for Template-Joomla
 -->
-[![MokoStandards](https://img.shields.io/badge/MokoStandards-04.00.04-blue)](https://github.com/mokoconsulting-tech/MokoStandards)
+[![MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)](https://github.com/mokoconsulting-tech/MokoStandards)
 # Project Governance
@@ -32,7 +32,7 @@
 This document defines the governance model for the `Template-Joomla` repository within the
 `mokoconsulting-tech` organization. It is automatically maintained by
-[MokoStandards](https://github.com/mokoconsulting-tech/MokoStandards) v04.00.04.
+[MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki) v04.00.04.
 Full governance policy is defined in the MokoStandards source repository:
 [docs/policy/GOVERNANCE.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/GOVERNANCE.md)
@@ -23,7 +23,7 @@ DEFGROUP: Template-Joomla
 INGROUP: Template-Joomla.Documentation
 REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
 PATH: /SECURITY.md
-VERSION: 01.00.42
+VERSION: 01.00.41
 BRIEF: Security vulnerability reporting and handling policy
 -->
@@ -6,11 +6,11 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Automation.CI
-# INGROUP: moko-platform.Automation
+# INGROUP: mokocli.Automation
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /automation/ci-issue-reporter.sh
 # VERSION: 09.23.00
-# BRIEF: Creates or updates a Gitea issue when a CI gate fails.
+# BRIEF: Creates or updates a MokoGitea issue when a CI gate fails.
 #        Deduplicates by searching open issues with the "ci-auto" label
 #        whose title matches the gate. If a matching issue exists, a comment
 #        is appended instead of opening a duplicate.
@@ -45,8 +45,8 @@ Optional:
  --workflow  Workflow name for the issue title
  --repo      owner/repo (default: \$GITHUB_REPOSITORY)
  --run-url   URL to the CI run (auto-detected from env)
-  --token     Gitea API token (default: \$GITEA_TOKEN)
+  --token     MokoGitea API token (default: \$GITEA_TOKEN)
-  --url       Gitea base URL (default: \$GITEA_URL)
+  --url       MokoGitea base URL (default: \$GITEA_URL)
 EOF
  exit 1
 }
@@ -213,7 +213,7 @@ print(json.dumps({
  ISSUE_NUM=$(echo "$RESPONSE" | grep -oP '"number":\s*\K[0-9]+' | head -1)
  if [[ -n "$ISSUE_NUM" ]]; then
-    # Apply label (separate call — more reliable across Gitea versions)
+    # Apply label (separate call — more reliable across MokoGitea versions)
    LABEL_ID=$(curl -sf \
      -H "Authorization: token ${GITEA_TOKEN}" \
      "${API}/labels" 2>/dev/null \
@@ -0,0 +1,3 @@
 COM_MOKOSUITEREALTY="MokoSuite Realty"
 COM_MOKOSUITEREALTY_SHORT="Realty"
 COM_MOKOSUITEREALTY_XML_DESCRIPTION="MokoSuite Realty component."
@@ -5,10 +5,13 @@
  <creationDate>2026-06-23</creationDate>
  <copyright>Copyright (C) 2026 Moko Consulting.</copyright>
  <license>GPL-3.0-or-later</license>
-  <version>01.00.42</version>
+  <version>01.00.41</version>
  <namespace path="src">Moko\Component\MokoSuiteRealty</namespace>
  <administration>
    <files folder="admin"><folder>services</folder><folder>src</folder><folder>tmpl</folder></files>
-    <menu>COM_MOKOSUITEREALTY</menu>
+    <menu>COM_MOKOSUITEREALTY_SHORT</menu>
    <languages folder="admin/language">
      <language tag="en-GB">en-GB/com_mokosuiterealty.sys.ini</language>
    </languages>
  </administration>
 </extension>
@@ -8,7 +8,7 @@
 	<license>GPL-3.0-or-later</license>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>
 	<authorUrl>https://mokoconsulting.tech</authorUrl>
-	<version>01.00.42</version>
+	<version>01.00.41</version>
 	<php_minimum>8.3</php_minimum>
 	<description>PLG_SYSTEM_MOKOSUITEREALTY_DESC</description>
 	<namespace path="src">Moko\Plugin\System\MokoSuiteRealty</namespace>
@@ -3,7 +3,7 @@
  <name>Web Services - MokoSuite Realty</name>
  <element>mokosuiterealty</element>
  <author>Moko Consulting</author>
-  <version>01.00.42</version>
+  <version>01.00.41</version>
  <license>GPL-3.0-or-later</license>
  <namespace path="src">Moko\Plugin\WebServices\MokoSuiteRealty</namespace>
  <files><folder>src</folder><folder>services</folder></files>
@@ -2,7 +2,7 @@
 <extension type="package" method="upgrade">
 	<name>Package - MokoSuite Realty</name>
 	<packagename>mokosuiterealty</packagename>
-	<version>01.00.42</version>
+	<version>01.00.41</version>
 	<creationDate>2026-06-21</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>
@@ -0,0 +1,169 @@
 <?php
 /**
 * @package     MokoSuiteRealty
 * @subpackage  pkg_mokosuiterealty
 * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
 * @license     GNU General Public License version 3 or later; see LICENSE
 */
 defined('_JEXEC') or die;
 use Joomla\CMS\Factory;
 use Joomla\CMS\Installer\InstallerAdapter;
 use Joomla\CMS\Log\Log;
 /**
 * Package installation script for MokoSuiteRealty.
 */
 class Pkg_MokoSuiteRealtyInstallerScript
 {
 	public function postflight(string $type, InstallerAdapter $adapter): void
 	{
 		// Be honest about success. Joomla's package installer only LOGS a failed child
 		// sub-install but still runs this postflight, so don't show the license /
 		// next-steps message if a bundled extension is actually missing. Fails open
 		// (see missingChildExtensions) so a query/IO glitch never fakes a failure.
 		$missing = $this->missingChildExtensions($adapter);
 		if (!empty($missing))
 		{
 			Factory::getApplication()->enqueueMessage(
 				'<h4>MokoSuiteRealty did not install correctly.</h4>'
 				. '<p>The following bundled extensions are missing: '
 				. htmlspecialchars(implode(', ', $missing), ENT_QUOTES) . '</p>'
 				. '<p>Please uninstall MokoSuiteRealty and reinstall the full package.</p>',
 				'error'
 			);
 			return;
 		}
 		$this->warnMissingLicenseKey();
 	}
 	/**
 	 * Verify every child extension declared in the package manifest actually landed in
 	 * #__extensions. Returns readable labels of any that are missing.
 	 *
 	 * Matching per Joomla's #__extensions uniqueness: type = <file> "type"; element =
 	 * <file> "id" (for plugins, strip a leading plg_<group>_); plugins also match
 	 * folder = <file> "group".
 	 *
 	 * FAILS OPEN: any error returns [] so a transient glitch never fakes a failure.
 	 */
 	private function missingChildExtensions($adapter): array
 	{
 		try
 		{
 			$manifest = $adapter->getParent()->getManifest();
 			if (!$manifest || !isset($manifest->files) || !isset($manifest->files->file))
 			{
 				return [];
 			}
 			$db      = Factory::getDbo();
 			$missing = [];
 			foreach ($manifest->files->file as $file)
 			{
 				$attrs  = $file->attributes();
 				$id     = isset($attrs['id']) ? (string) $attrs['id'] : '';
 				$exType = isset($attrs['type']) ? (string) $attrs['type'] : '';
 				if ($id === '' || $exType === '')
 				{
 					continue;
 				}
 				$group   = isset($attrs['group']) ? (string) $attrs['group'] : '';
 				$element = $id;
 				// Plugin element in #__extensions is the id minus any leading plg_<group>_.
 				if ($exType === 'plugin' && $group !== '')
 				{
 					$prefix = 'plg_' . $group . '_';
 					if (strpos($element, $prefix) === 0)
 					{
 						$element = substr($element, \strlen($prefix));
 					}
 				}
 				$query = $db->getQuery(true)
 					->select('COUNT(*)')
 					->from($db->quoteName('#__extensions'))
 					->where($db->quoteName('element') . ' = ' . $db->quote($element))
 					->where($db->quoteName('type') . ' = ' . $db->quote($exType));
 				if ($exType === 'plugin' && $group !== '')
 				{
 					$query->where($db->quoteName('folder') . ' = ' . $db->quote($group));
 				}
 				if ((int) $db->setQuery($query)->loadResult() === 0)
 				{
 					$label     = trim((string) $file);
 					$missing[] = $label !== '' ? preg_replace('/\.zip$/i', '', $label) : $id;
 				}
 			}
 			return $missing;
 		}
 		catch (\Throwable $e)
 		{
 			// Fail open — never fake a failure on a glitch.
 			return [];
 		}
 	}
 	private function warnMissingLicenseKey(): void
 	{
 		try
 		{
 			$db  = Factory::getDbo();
 			$app = Factory::getApplication();
 			$query = $db->getQuery(true)
 				->select([$db->quoteName('update_site_id'), $db->quoteName('extra_query')])
 				->from($db->quoteName('#__update_sites'))
 				->where('(' . $db->quoteName('name') . ' LIKE ' . $db->quote('%MokoSuiteRealty%')
 					. ' OR ' . $db->quoteName('location') . ' LIKE ' . $db->quote('%MokoSuiteRealty%') . ')')
 				->setLimit(1);
 			$db->setQuery($query);
 			$site = $db->loadObject();
 			if ($site)
 			{
 				$extraQuery = (string) ($site->extra_query ?? '');
 				if (!empty($extraQuery) && strpos($extraQuery, 'dlid=') !== false)
 				{
 					parse_str($extraQuery, $parsed);
 					if (!empty($parsed['dlid']))
 					{
 						return;
 					}
 				}
 				$editUrl = 'index.php?option=com_installer&task=updatesite.edit&update_site_id=' . (int) $site->update_site_id;
 			}
 			else
 			{
 				$editUrl = 'index.php?option=com_installer&view=updatesites';
 			}
 			$app->enqueueMessage(
 				'<strong>Moko Consulting License Key Required</strong> — '
 				. 'No download key is configured. Updates will not be available until a valid license key is entered. '
 				. '<a href="' . $editUrl . '" class="btn btn-sm btn-warning ms-2">Enter License Key</a>',
 				'warning'
 			);
 		}
 		catch (\Throwable $e)
 		{
 			// Silent — avoid breaking install if update_sites query fails
 		}
 	}
 }
Author	SHA1	Message	Date
gitea-actions[bot]	abaf78edf4	chore(version): pre-release bump to 01.00.41-dev [skip ci]	2026-07-12 21:41:10 +00:00
jmiller	5281a4a7b5	Merge pull request 'docs(changelog): note admin menu short-name constant' (#17 ) from jmiller/changelog-short-constant into dev Universal: Auto Version Bump / Version Bump (push) Has been skipped Details Universal: Pre-Release / Build Pre-Release (${{ inputs.stability \|\| github.ref_name }}) (push) Successful in 9s Details	2026-07-12 21:39:26 +00:00
jmiller	c66739d6b9	docs(changelog): note admin menu short-name constant (#13 ) Universal: PR Check / Branch Policy (pull_request) Has been cancelled Details Universal: PR Check / Secret Scan (pull_request) Has been cancelled Details Universal: PR Check / Validate PR (pull_request) Has been cancelled Details Joomla: Metadata Validation / Validate Joomla Metadata (pull_request) Has been cancelled Details Branch Cleanup / Delete merged branch (pull_request) Has been cancelled Details RC Revert / Rename rc/ back to dev/ (pull_request) Has been cancelled Details Universal: PR Check / Build RC Package (pull_request) Has been cancelled Details Universal: PR Check / Report Issues (pull_request) Has been cancelled Details Claude-Session: https://claude.ai/code/session_01B9aZHSWbiiZykJD88pYx8R	2026-07-12 16:35:10 -05:00