diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..4f450db
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,16 @@
+
+
+# ============================================================
+# AI client instructions (not version controlled)
+# ============================================================
+.claude/
+.gemini/
+/GEMINI.md
+/MOKOAI.md
+.mokoai/
+
+# ============================================================
+# Local wiki clone (not version controlled)
+# ============================================================
+wiki/
+docs/
diff --git a/.mokogit/workflows/auto-bump.yml b/.mokogit/workflows/auto-bump.yml
index fba253e..2a69125 100644
--- a/.mokogit/workflows/auto-bump.yml
+++ b/.mokogit/workflows/auto-bump.yml
@@ -22,7 +22,7 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
 
 permissions:
   contents: write
diff --git a/.mokogit/workflows/auto-release.yml b/.mokogit/workflows/auto-release.yml
index d6438cb..436396d 100644
--- a/.mokogit/workflows/auto-release.yml
+++ b/.mokogit/workflows/auto-release.yml
@@ -52,9 +52,9 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  GIT_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-  GIT_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_ORG: ${{ vars.MOKOGIT_ORG || github.repository_owner }}
+  GIT_REPO: ${{ vars.MOKOGIT_REPO || github.event.repository.name }}
 
 permissions:
   contents: write
diff --git a/.mokogit/workflows/branch-cleanup.yml b/.mokogit/workflows/branch-cleanup.yml
index 183b1df..1941449 100644
--- a/.mokogit/workflows/branch-cleanup.yml
+++ b/.mokogit/workflows/branch-cleanup.yml
@@ -36,7 +36,7 @@ jobs:
         env:
           MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           REPO: ${{ github.repository }}
-          API_BASE: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          API_BASE: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
           BRANCH: ${{ github.event.pull_request.head.ref }}
         run: |
           set -euo pipefail
diff --git a/.mokogit/workflows/cascade-dev.yml b/.mokogit/workflows/cascade-dev.yml
index 6c7e26a..d5cd8eb 100644
--- a/.mokogit/workflows/cascade-dev.yml
+++ b/.mokogit/workflows/cascade-dev.yml
@@ -44,7 +44,7 @@ jobs:
       - name: Force dev to main
         env:
           TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
-          SERVER: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
diff --git a/.mokogit/workflows/ci-issue-reporter.yml b/.mokogit/workflows/ci-issue-reporter.yml
index ede368d..0388f85 100644
--- a/.mokogit/workflows/ci-issue-reporter.yml
+++ b/.mokogit/workflows/ci-issue-reporter.yml
@@ -5,10 +5,10 @@
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogit/workflows/ci-issue-reporter.yml
 # VERSION: 01.00.00
-# BRIEF: Reusable workflow — creates/updates a MokoGIT issue when a CI gate fails.
+# BRIEF: Reusable workflow � creates/updates a MokoGIT issue when a CI gate fails.
 #        Clones MokoCLI and runs cli/ci_issue_reporter.sh.
 
 name: "Universal: CI Issue Reporter"
@@ -50,19 +50,26 @@ jobs:
       - name: Clone MokoCLI
         env:
           MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
         run: |
-          MOKOGIT_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
           git clone --depth 1 --filter=blob:none --sparse "${MOKOGIT_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
           cd /tmp/mokocli && git sparse-checkout set cli/ci_issue_reporter.sh
 
       - name: Report CI failure
         env:
           MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
-          MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          # Route all workflow_call inputs through env vars — referencing ${{ inputs.* }}
+          # directly in a run: block interpolates at YAML-parse time and is a shell-injection
+          # vector. Shell variables are not re-parsed, so a crafted input can't break out.
+          INPUT_GATE: ${{ inputs.gate }}
+          INPUT_DETAILS: ${{ inputs.details }}
+          INPUT_SEVERITY: ${{ inputs.severity }}
+          INPUT_WORKFLOW: ${{ inputs.workflow }}
         run: |
           chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh
           /tmp/mokocli/cli/ci_issue_reporter.sh \
-            --gate "${{ inputs.gate }}" \
-            --details "${{ inputs.details }}" \
-            --severity "${{ inputs.severity }}" \
-            --workflow "${{ inputs.workflow }}"
+            --gate "$INPUT_GATE" \
+            --details "$INPUT_DETAILS" \
+            --severity "$INPUT_SEVERITY" \
+            --workflow "$INPUT_WORKFLOW"
diff --git a/.mokogit/workflows/cleanup.yml b/.mokogit/workflows/cleanup.yml
index 9c13931..9d97dba 100644
--- a/.mokogit/workflows/cleanup.yml
+++ b/.mokogit/workflows/cleanup.yml
@@ -21,7 +21,7 @@ permissions:
   contents: write
 
 env:
-  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   cleanup:
diff --git a/.mokogit/workflows/issue-branch.yml b/.mokogit/workflows/issue-branch.yml
index e736ca8..67a5da2 100644
--- a/.mokogit/workflows/issue-branch.yml
+++ b/.mokogit/workflows/issue-branch.yml
@@ -19,7 +19,7 @@ permissions:
   issues: write
 
 env:
-  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   create-branch:
diff --git a/.mokogit/workflows/pr-check.yml b/.mokogit/workflows/pr-check.yml
index 1c75f14..3978c8e 100644
--- a/.mokogit/workflows/pr-check.yml
+++ b/.mokogit/workflows/pr-check.yml
@@ -505,7 +505,7 @@ jobs:
           MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           REPO: ${{ github.repository }}
           BRANCH: ${{ github.head_ref }}
-          MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
         run: |
           curl -s -X POST             "${MOKOGIT_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${MOKOGIT_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
           echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY
diff --git a/.mokogit/workflows/pr-metadata-check.yml b/.mokogit/workflows/pr-metadata-check.yml
index 01d4ddc..b1316e7 100644
--- a/.mokogit/workflows/pr-metadata-check.yml
+++ b/.mokogit/workflows/pr-metadata-check.yml
@@ -20,9 +20,9 @@ permissions:
   contents: read
 
 env:
-  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  GIT_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-  GIT_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_ORG: ${{ vars.MOKOGIT_ORG || github.repository_owner }}
+  GIT_REPO: ${{ vars.MOKOGIT_REPO || github.event.repository.name }}
 
 jobs:
   validate-metadata:
diff --git a/.mokogit/workflows/pre-release.yml b/.mokogit/workflows/pre-release.yml
index a1e5b62..4f8919e 100644
--- a/.mokogit/workflows/pre-release.yml
+++ b/.mokogit/workflows/pre-release.yml
@@ -40,9 +40,9 @@ permissions:
   contents: write
 
 env:
-  GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  GIT_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-  GIT_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+  GIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_ORG: ${{ vars.MOKOGIT_ORG || github.repository_owner }}
+  GIT_REPO: ${{ vars.MOKOGIT_REPO || github.event.repository.name }}
 
 jobs:
   build:
diff --git a/.mokogit/workflows/rc-revert.yml b/.mokogit/workflows/rc-revert.yml
index e28d4bb..d25b7c9 100644
--- a/.mokogit/workflows/rc-revert.yml
+++ b/.mokogit/workflows/rc-revert.yml
@@ -32,7 +32,7 @@ jobs:
         env:
           BRANCH: ${{ github.event.pull_request.head.ref }}
           REPO: ${{ github.repository }}
-          GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          GIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
           TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
           set -euo pipefail