fix(ci): harden branch-cleanup.yml against Actions injection (sync from Template-Generic)

Case-sensitive gitea->git: brand MokoGitea->MokoGIT, MOKOGITEA_TOKEN->
MOKOGIT_TOKEN, GITEA_URL/ORG/REPO->GIT_*, gitea-actions[bot]->git-actions,
ntfy gitea-*->git-*, .mokogitea/->.mokogit/. Protected: literal .gitea and
git.mokoconsulting.tech.

Claude-Session: https://claude.ai/code/session_01DQEMmJPe61ya7HDfA6BHP8

.mokogit/ISSUE_TEMPLATE/config.yml

@@ -8,7 +8,7 @@ contact_links:
     url: https://mokoconsulting.tech/
     about: Get help or ask questions through our website
   - name: 📚 MokoStandards Documentation
-    url: https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki
+    url: https://git.mokoconsulting.tech/MokoConsulting/.mokogit/wiki
     about: View our coding standards and best practices
   - name: 🔒 Report a Security Vulnerability
     url: https://git.mokoconsulting.tech/mokoconsulting-tech/.github-private/security/advisories/new

.mokogit/ISSUE_TEMPLATE/feature_request.md

@@ -37,7 +37,7 @@ If you have ideas about how this could be implemented, share them here:
 Add any other context, mockups, or screenshots about the feature request here.
 
 ## Relevant Standards
-Does this relate to any standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)?
+Does this relate to any standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogit/wiki)?
 - [ ] Accessibility (WCAG 2.1 AA)
 - [ ] Localization (en_US/en_GB)
 - [ ] Security best practices

.mokogit/ISSUE_TEMPLATE/security.md

@@ -35,7 +35,7 @@ Use this template only for:
 <!-- Describe how this could be addressed -->
 
 ## Standards Reference
-Does this relate to security standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)?
+Does this relate to security standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogit/wiki)?
 - [ ] SPDX license identifiers
 - [ ] Secret management
 - [ ] Dependency security

.mokogit/branch-protection.yml

@@ -1,7 +1,7 @@
 # Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 # SPDX-License-Identifier: GPL-3.0-or-later
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Git.Workflow
 # INGROUP: moko-platform.Automation
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
 # PATH: /.gitea/workflows/branch-protection.yml
@@ -42,8 +42,8 @@ on:
         default: ''
 
 env:
-  GITEA_URL: https://git.mokoconsulting.tech
+  GIT_URL: https://git.mokoconsulting.tech
-  GITEA_ORG: MokoConsulting
+  GIT_ORG: MokoConsulting
 
 permissions:
   contents: read
@@ -59,10 +59,10 @@ jobs:
         env:
           GA_TOKEN: ${{ secrets.GA_TOKEN }}
         run: |
-          API="${GITEA_URL}/api/v1"
+          API="${GIT_URL}/api/v1"
 
           # Platform/standards/infra repos to exclude
-          EXCLUDE="gitea-org-config org-profile gitea-private .mokogitea-private MokoStandards moko-platform MokoTesting"
+          EXCLUDE="git-org-config org-profile git-private .mokogit-private MokoStandards moko-platform MokoTesting"
           EXCLUDE="$EXCLUDE MokoStandards-Template-Client MokoStandards-Template-Dolibarr MokoStandards-Template-Generic MokoStandards-Template-Joomla MokoDoliProjTemplate"
 
           if [ -n "${{ inputs.repos }}" ]; then
@@ -75,7 +75,7 @@ jobs:
             while true; do
               BATCH=$(curl -sS \
                 -H "Authorization: token ${GA_TOKEN}" \
-                "${API}/orgs/${GITEA_ORG}/repos?page=${PAGE}&limit=50" \
+                "${API}/orgs/${GIT_ORG}/repos?page=${PAGE}&limit=50" \
                 | jq -r '.[].name // empty')
               [ -z "$BATCH" ] && break
               REPOS="$REPOS $BATCH"
@@ -108,7 +108,7 @@ jobs:
           GA_TOKEN: ${{ secrets.GA_TOKEN }}
           DRY_RUN: ${{ inputs.dry_run || 'false' }}
         run: |
-          API="${GITEA_URL}/api/v1"
+          API="${GIT_URL}/api/v1"
           REPOS="${{ steps.repos.outputs.repos }}"
 
           SUCCESS=0
@@ -215,7 +215,7 @@ jobs:
               curl -sS -o /dev/null -w "" \
                 -X DELETE \
                 -H "Authorization: token ${GA_TOKEN}" \
-                "${API}/repos/${GITEA_ORG}/${REPO}/branch_protections/${ENCODED_NAME}" 2>/dev/null || true
+                "${API}/repos/${GIT_ORG}/${REPO}/branch_protections/${ENCODED_NAME}" 2>/dev/null || true
 
               # Create rule
               RESPONSE=$(curl -sS -w "\n%{http_code}" \
@@ -223,7 +223,7 @@ jobs:
                 -H "Authorization: token ${GA_TOKEN}" \
                 -H "Content-Type: application/json" \
                 -d "$RULE" \
-                "${API}/repos/${GITEA_ORG}/${REPO}/branch_protections")
+                "${API}/repos/${GIT_ORG}/${REPO}/branch_protections")
 
               HTTP=$(echo "$RESPONSE" | tail -1)
               BODY=$(echo "$RESPONSE" | sed '$d')

.mokogit/workflows/auto-bump.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Git.Workflow
 # INGROUP: mokocli.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
-# PATH: /.mokogitea/workflows/auto-bump.yml
+# PATH: /.mokogit/workflows/auto-bump.yml
 # VERSION: 09.02.00
 # BRIEF: Auto patch-bump version on every push to dev (skips merge commits)
 
@@ -22,7 +22,7 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 
 permissions:
   contents: write
@@ -40,7 +40,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          token: ${{ secrets.MOKOGIT_TOKEN }}
           fetch-depth: 1
 
       - name: Setup mokocli tools
@@ -52,7 +52,7 @@ jobs:
             echo "MOKO_CLI=/opt/mokocli/cli" >> "$GITHUB_ENV"
           else
             git clone --depth 1 --branch main --quiet \
-              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/mokocli.git" \
+              "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/mokocli.git" \
               /tmp/mokocli
             cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
             echo "MOKO_CLI=/tmp/mokocli/cli" >> "$GITHUB_ENV"
@@ -62,5 +62,5 @@ jobs:
         run: |
           php ${MOKO_CLI}/version_auto_bump.php \
             --path . --branch "${GITHUB_REF_NAME}" \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" \
-            --repo-url "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+            --repo-url "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"

.mokogit/workflows/auto-release.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Git.Workflow
 # INGROUP: mokocli.Release
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
 # PATH: /templates/workflows/universal/auto-release.yml.template
@@ -43,9 +43,9 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  GIT_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+  GIT_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
 
 permissions:
   contents: write
@@ -63,12 +63,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          token: ${{ secrets.MOKOGIT_TOKEN }}
           fetch-depth: 1
 
       - name: Setup mokocli tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
         run: |
           if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
@@ -91,28 +91,28 @@ jobs:
         run: |
           php ${MOKO_CLI}/branch_rename.php \
             --from "${{ github.event.pull_request.head.ref || 'dev' }}" --to rc \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" \
-            --api-base "${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}" \
+            --api-base "${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}" \
             --pr "${{ github.event.pull_request.number }}"
 
       - name: Checkout rc and configure git
         run: |
           git fetch origin rc
           git checkout rc
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "git-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
+          git config --local user.name "git-actions[bot]"
-          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
       - name: Publish RC release
         run: |
           php ${MOKO_CLI}/release_publish.php \
             --path . --stability rc --bump minor --branch rc \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}"
+            --token "${{ secrets.MOKOGIT_TOKEN }}"
 
       - name: Update RC release notes from CHANGELOG.md
         run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
 
           # Extract [Unreleased] section from changelog
           NOTES=""
@@ -161,14 +161,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          token: ${{ secrets.MOKOGIT_TOKEN }}
           fetch-depth: 0
 
       - name: Configure git for bot pushes
         run: |
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "git-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
+          git config --local user.name "git-actions[bot]"
-          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
       - name: Check for merge conflict markers
         run: |
@@ -185,7 +185,7 @@ jobs:
 
       - name: Setup mokocli tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_MIRROR_TOKEN }}"}}'
         run: |
@@ -232,7 +232,7 @@ jobs:
           fi
           php ${MOKO_CLI}/release_publish.php \
             --path . --stability stable ${BUMP_FLAG} --branch main \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}"
+            --token "${{ secrets.MOKOGIT_TOKEN }}"
 
       - name: "Read published version"
         id: version
@@ -248,8 +248,8 @@ jobs:
 
       - name: Update release notes and promote changelog
         run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
 
           # Get the stable release info (version and ID)
           RELEASE_JSON=$(curl -sf -H "Authorization: token ${TOKEN}" \
@@ -317,10 +317,10 @@ jobs:
           VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
           RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
           GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
           php ${MOKO_CLI}/release_mirror.php \
             --version "$VERSION" --tag "$RELEASE_TAG" \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "$API_BASE" \
             --gh-token "${{ secrets.GH_MIRROR_TOKEN }}" --gh-repo "$GH_REPO" \
             --branch main 2>&1 || true
           echo "GitHub mirror updated" >> $GITHUB_STEP_SUMMARY
@@ -346,8 +346,8 @@ jobs:
         if: steps.version.outputs.skip != 'true'
         continue-on-error: true
         run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
 
           # Delete rc branch (ephemeral — created by promote-rc)
           curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
@@ -370,8 +370,8 @@ jobs:
         if: steps.version.outputs.skip != 'true'
         continue-on-error: true
         run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
           VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
           BRANCH_NAME="version/${VERSION}"
           MAIN_SHA=$(git rev-parse HEAD)
@@ -391,9 +391,9 @@ jobs:
         if: steps.version.outputs.skip != 'true'
         continue-on-error: true
         run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
           php ${MOKO_CLI}/version_reset_dev.php \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "${API_BASE}" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "${API_BASE}" \
             --branch dev --path . 2>&1 || true
 
       # -- Summary --------------------------------------------------------------
@@ -417,5 +417,5 @@ jobs:
             echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
             echo "| Branch | \`${{ steps.version.outputs.branch }}\` |" >> $GITHUB_STEP_SUMMARY
             echo "| Tag | \`${{ steps.version.outputs.tag }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Release | [View](${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
+            echo "| Release | [View](${GIT_URL}/${GIT_ORG}/${GIT_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
           fi

.mokogit/workflows/branch-cleanup.yml

@@ -0,0 +1,60 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogit/workflows/branch-cleanup.yml
+# VERSION: 01.00.00
+# BRIEF: Delete feature branches after PR merge
+
+name: "Branch Cleanup"
+
+on:
+  pull_request:
+    types: [closed]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  cleanup:
+    name: Delete merged branch
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.head.ref != 'dev' &&
+      github.event.pull_request.head.ref != 'main'
+
+    steps:
+      - name: Delete source branch
+        # SECURITY: the PR head ref is attacker-controllable. Pass it (and the
+        # repo/token) through env so the Actions engine cannot splice it into the
+        # shell source, and validate it to a safe charset before use.
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          REPO: ${{ github.repository }}
+          API_BASE: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+        run: |
+          set -euo pipefail
+          if ! printf '%s' "${BRANCH}" | grep -Eq '^[A-Za-z0-9._/-]+$'; then
+            echo "::error::unsafe branch name; refusing to proceed"; exit 1
+          fi
+          API="${API_BASE}/api/v1/repos/${REPO}/branches"
+          # URL-encode the branch name's slashes (no PHP dependency on the runner)
+          ENCODED=$(printf '%s' "${BRANCH}" | sed 's|/|%2F|g')
+
+          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
+            -H "Authorization: token ${MOKOGIT_TOKEN}" \
+            "${API}/${ENCODED}" 2>/dev/null || true)
+
+          if [ "$STATUS" = "204" ]; then
+            echo "Deleted branch: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
+          elif [ "$STATUS" = "404" ]; then
+            echo "Branch already deleted: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "::warning::Failed to delete branch ${BRANCH} (HTTP ${STATUS})"
+          fi

.mokogit/workflows/ci-generic.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Git.Workflow
 # INGROUP: MokoStandards.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.gitea/workflows/ci-generic.yml

.mokogit/workflows/ci-joomla.yml

@@ -5,7 +5,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow.Template
+# DEFGROUP: Git.Workflow.Template
 # INGROUP: MokoStandards.CI
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
 # PATH: /templates/workflows/joomla/ci-joomla.yml.template
@@ -47,8 +47,8 @@ jobs:
 
       - name: Setup mokocli tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN || secrets.GA_TOKEN || github.token }}
-          MOKO_CLONE_HOST: ${{ secrets.MOKOGITEA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
+          MOKO_CLONE_HOST: ${{ secrets.MOKOGIT_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
         run: |
           if [ -d "/opt/mokocli" ] || [ -d "/tmp/mokocli" ]; then
             echo "mokocli already available on runner — skipping clone"
@@ -895,7 +895,7 @@ jobs:
           BRANCH: ${{ github.head_ref }}
         run: |
           curl -s -X POST \
-            "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches" \
+            "${GIT_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches" \
             -H "Authorization: token ${GA_TOKEN}" \
             -H "Content-Type: application/json" \
             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"

.mokogit/workflows/cleanup.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Git.Workflow
 # INGROUP: MokoStandards.Maintenance
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
 # PATH: /.gitea/workflows/cleanup.yml
@@ -21,7 +21,7 @@ permissions:
   contents: write
 
 env:
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   cleanup:
@@ -40,7 +40,7 @@ jobs:
           GA_TOKEN: ${{ secrets.GA_TOKEN }}
         run: |
           echo "=== Merged Branch Cleanup ==="
-          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${GIT_URL}/api/v1/repos/${{ github.repository }}"
 
           # List branches via API
           BRANCHES=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
@@ -69,7 +69,7 @@ jobs:
           GA_TOKEN: ${{ secrets.GA_TOKEN }}
         run: |
           echo "=== Workflow Run Cleanup ==="
-          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${GIT_URL}/api/v1/repos/${{ github.repository }}"
           CUTOFF=$(date -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -v-30d +%Y-%m-%dT%H:%M:%SZ)
 
           # Get old completed runs

.mokogit/workflows/gitleaks.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Git.Workflow
 # INGROUP: MokoStandards.Security
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
 # PATH: /templates/workflows/gitleaks.yml.template
@@ -34,7 +34,7 @@ permissions:
 
 env:
   NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
-  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'gitea-security' }}
+  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'git-security' }}
 
 jobs:
   gitleaks:

.mokogit/workflows/issue-branch.yml

@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGIT.Workflow
-# INGROUP: mokocli.Automation
+# INGROUP: MokoCLI.Automation
-# VERSION: 01.00.33
+# VERSION: 01.00.00
 # BRIEF: Auto-create feature branch when an issue is opened
 
 name: "Universal: Issue Branch"
@@ -19,7 +19,7 @@ permissions:
   issues: write
 
 env:
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   create-branch:
@@ -27,14 +27,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Create branch and comment
+        # SECURITY: never interpolate github.event.* into a run: script — the
+        # Actions engine splices the raw value into the shell source (command
+        # injection via a crafted issue title). Pass everything through env so
+        # the values arrive as ordinary shell variables that are not re-parsed.
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          REPO: ${{ github.repository }}
+          ISSUE_NUM: ${{ github.event.issue.number }}
+          ISSUE_TITLE: ${{ github.event.issue.title }}
         run: |
-          TOKEN="${{ secrets.GA_TOKEN }}"
+          TOKEN="${MOKOGIT_TOKEN}"
-          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${MOKOGIT_URL}/api/v1/repos/${REPO}"
-          ISSUE_NUM="${{ github.event.issue.number }}"
-          ISSUE_TITLE="${{ github.event.issue.title }}"
 
-          # Build slug from title: lowercase, replace non-alnum with dash, trim
+          # Build slug from title: lowercase, replace non-alnum with dash, trim.
-          SLUG=$(echo "${ISSUE_TITLE}" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//' | cut -c1-40)
+          # printf (not echo) so a title beginning with "-" is not read as flags.
+          SLUG=$(printf '%s' "${ISSUE_TITLE}" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//' | cut -c1-40)
           BRANCH="feature/${ISSUE_NUM}-${SLUG}"
 
           # Check dev branch exists
@@ -58,7 +66,7 @@ jobs:
             echo "Created branch: ${BRANCH}"
 
             # Comment on issue with branch link
-            REPO_URL="${GITEA_URL}/${{ github.repository }}"
+            REPO_URL="${MOKOGIT_URL}/${REPO}"
             BODY="Branch created: [\`${BRANCH}\`](${REPO_URL}/src/branch/${BRANCH})\n\n\`\`\`bash\ngit fetch origin\ngit checkout ${BRANCH}\n\`\`\`"
 
             curl -sf -X POST \

.mokogit/workflows/notify.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Git.Workflow
 # INGROUP: MokoStandards.Notifications
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
 # PATH: /.gitea/workflows/notify.yml
@@ -26,7 +26,7 @@ permissions:
 
 env:
   NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
-  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'gitea-releases' }}
+  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'git-releases' }}
 
 jobs:
   notify:

.mokogit/workflows/pr-check.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Git.Workflow
 # INGROUP: moko-platform.CI
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
 # PATH: /templates/workflows/universal/pr-check.yml.template
@@ -148,8 +148,8 @@ jobs:
         id: platform
         run: |
           # Read platform from XML manifest (<platform> tag) or plain text fallback
-          PLATFORM=$(sed -n 's/.*<platform>\([^<]*\)<\/platform>.*/\1/p' .mokogitea/manifest.xml 2>/dev/null | head -1)
+          PLATFORM=$(sed -n 's/.*<platform>\([^<]*\)<\/platform>.*/\1/p' .mokogit/manifest.xml 2>/dev/null | head -1)
-          [ -z "$PLATFORM" ] && PLATFORM=$(cat .mokogitea/manifest.xml 2>/dev/null | tr -d '[:space:]')
+          [ -z "$PLATFORM" ] && PLATFORM=$(cat .mokogit/manifest.xml 2>/dev/null | tr -d '[:space:]')
           [ -z "$PLATFORM" ] && PLATFORM="generic"
           echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
 
@@ -282,10 +282,10 @@ jobs:
               for ELEMENT in name version description; do
                 grep -q "<${ELEMENT}>" "$MANIFEST" || { echo "::error::Missing <${ELEMENT}> in manifest"; exit 1; }
               done
-              # Block legacy raw/branch update server URLs on MokoGitea
+              # Block legacy raw/branch update server URLs on MokoGIT
-              RAW_URLS=$(grep -n 'raw/branch' "$MANIFEST" | grep -i 'mokoconsulting\|mokogitea\|git\.mokoconsulting\.tech' || true)
+              RAW_URLS=$(grep -n 'raw/branch' "$MANIFEST" | grep -i 'mokoconsulting\|mokogit\|git\.mokoconsulting\.tech' || true)
               if [ -n "$RAW_URLS" ]; then
-                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the Gitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
+                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGIT. Use the Git Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
                 echo "$RAW_URLS"
                 exit 1
               fi
@@ -496,12 +496,12 @@ jobs:
     steps:
       - name: Trigger RC pre-release
         env:
-          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           REPO: ${{ github.repository }}
           BRANCH: ${{ github.head_ref }}
-          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
         run: |
-          curl -s -X POST             "${GITEA_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${GITEA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
+          curl -s -X POST             "${GIT_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${GIT_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
           echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY
           echo "Triggered RC build on branch \`${BRANCH}\`" >> $GITHUB_STEP_SUMMARY
 
@@ -523,8 +523,8 @@ jobs:
 
       - name: "File issue for PR validation failure"
         env:
-          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
-          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
         run: |
           chmod +x automation/ci-issue-reporter.sh
           ./automation/ci-issue-reporter.sh \

.mokogit/workflows/pr-metadata-check.yml

@@ -3,12 +3,12 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Git.Workflow
 # INGROUP: mokocli.Validation
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /templates/workflows/joomla/pr-metadata-check.yml.template
 # VERSION: 01.00.00
-# BRIEF: Validate MokoGitea metadata matches Joomla extension manifest on PRs
+# BRIEF: Validate MokoGIT metadata matches Joomla extension manifest on PRs
 
 name: "Joomla: Metadata Validation"
 
@@ -20,9 +20,9 @@ permissions:
   contents: read
 
 env:
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  GIT_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+  GIT_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
 
 jobs:
   validate-metadata:
@@ -35,7 +35,7 @@ jobs:
 
       - name: Setup mokocli tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
         run: |
           if [ -f /opt/mokocli/cli/joomla_metadata_validate.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
@@ -55,14 +55,14 @@ jobs:
 
       - name: Validate metadata against Joomla manifest
         env:
-          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
           php ${MOKO_CLI}/joomla_metadata_validate.php \
             --path . \
-            --token "${GITEA_TOKEN}" \
+            --token "${GIT_TOKEN}" \
-            --org "${GITEA_ORG}" \
+            --org "${GIT_ORG}" \
-            --repo "${GITEA_REPO}" \
+            --repo "${GIT_REPO}" \
-            --api-base "${GITEA_URL}/api/v1" \
+            --api-base "${GIT_URL}/api/v1" \
             --ci
 
           if [ $? -ne 0 ]; then

.mokogit/workflows/pre-release.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Git.Workflow
 # INGROUP: mokocli.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /templates/workflows/universal/pre-release.yml.template
@@ -40,9 +40,9 @@ permissions:
   contents: write
 
 env:
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  GIT_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+  GIT_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
 
 jobs:
   build:
@@ -57,12 +57,12 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          token: ${{ secrets.MOKOGIT_TOKEN }}
           ref: ${{ github.ref_name }}
 
       - name: Setup mokocli tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
         run: |
           # Use pre-installed /opt/mokocli if available (updated by cron every 6h)
@@ -135,9 +135,9 @@ jobs:
           fi
 
           # Commit version bump
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "git-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
+          git config --local user.name "git-actions[bot]"
-          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
           git add -A
           git diff --cached --quiet || {
             git commit -m "chore(version): pre-release bump to ${VERSION} [skip ci]"
@@ -147,12 +147,12 @@ jobs:
           # Auto-detect element via manifest_element.php
           php ${MOKO_CLI}/manifest_element.php \
             --path . --version "$VERSION" --stability "$STABILITY" \
-            --repo "${GITEA_REPO}" --github-output
+            --repo "${GIT_REPO}" --github-output
 
           # Read back element outputs
           EXT_ELEMENT=$(grep '^ext_element=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
           ZIP_NAME=$(grep '^zip_name=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
-          [ -z "$EXT_ELEMENT" ] && EXT_ELEMENT=$(echo "${GITEA_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
+          [ -z "$EXT_ELEMENT" ] && EXT_ELEMENT=$(echo "${GIT_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
           [ -z "$ZIP_NAME" ] && ZIP_NAME="${EXT_ELEMENT}-${VERSION}.zip"
 
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
@@ -169,17 +169,17 @@ jobs:
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
           VERSION="${{ steps.meta.outputs.version }}"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
           php ${MOKO_CLI}/release_create.php \
             --path . --version "$VERSION" --tag "$TAG" \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "$API_BASE" \
-            --repo "${GITEA_REPO}" --branch "${{ github.ref_name }}" --prerelease
+            --repo "${GIT_REPO}" --branch "${{ github.ref_name }}" --prerelease
 
       - name: Update release notes from CHANGELOG.md
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
           VERSION="${{ steps.meta.outputs.version }}"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
 
           # Extract [Unreleased] section from changelog (everything between [Unreleased] and next ## heading)
           if [ -f "CHANGELOG.md" ]; then
@@ -190,7 +190,7 @@ jobs:
           fi
 
           # Update release body via API
-          RELEASE_ID=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
+          RELEASE_ID=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGIT_TOKEN }}" \
             "${API_BASE}/releases/tags/${TAG}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
 
           if [ -n "$RELEASE_ID" ]; then
@@ -202,7 +202,7 @@ jobs:
               '${API_BASE}/releases/${RELEASE_ID}',
               data=payload, method='PATCH',
               headers={
-                  'Authorization': 'token ${{ secrets.MOKOGITEA_TOKEN }}',
+                  'Authorization': 'token ${{ secrets.MOKOGIT_TOKEN }}',
                   'Content-Type': 'application/json'
               })
           urllib.request.urlopen(req)
@@ -215,20 +215,20 @@ jobs:
         run: |
           VERSION="${{ steps.meta.outputs.version }}"
           TAG="${{ steps.meta.outputs.tag }}"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
           php ${MOKO_CLI}/release_package.php \
             --path . --version "$VERSION" --tag "$TAG" \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "$API_BASE" \
-            --repo "${GITEA_REPO}" --output /tmp || true
+            --repo "${GIT_REPO}" --output /tmp || true
 
-      # updates.xml is generated dynamically by MokoGitea license server
+      # updates.xml is generated dynamically by MokoGIT license server
       # No need to build, commit, or sync updates.xml from workflows
 
       - name: "Delete lesser pre-release channels (cascade)"
         continue-on-error: true
         run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
 
           php ${MOKO_CLI}/release_cascade.php \
             --stability "${{ steps.meta.outputs.stability }}" \

.mokogit/workflows/rc-revert.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Git.Workflow
 # INGROUP: mokocli.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
-# PATH: /.mokogitea/workflows/rc-revert.yml
+# PATH: /.mokogit/workflows/rc-revert.yml
 # VERSION: 09.23.00
 # BRIEF: Rename rc/ branch back to dev/ when PR is closed without merge
 
@@ -34,7 +34,7 @@ jobs:
           SUFFIX="${BRANCH#rc/}"
           DEV_BRANCH="dev/${SUFFIX}"
           API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
 
           # Create dev/ branch from rc/ branch
           STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X POST \

.mokogit/workflows/repo-health.yml

@@ -6,7 +6,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Git.Workflow
 # INGROUP: mokocli.Validation
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
 # PATH: /templates/workflows/joomla/repo_health.yml.template
@@ -45,7 +45,7 @@ env:
   SCRIPTS_ALLOWED_DIRS: scripts,scripts/fix,scripts/lib,scripts/release,scripts/run,scripts/validate
 
   # Repo health policy
-  REPO_REQUIRED_ARTIFACTS: README.md,LICENSE,CHANGELOG.md,CONTRIBUTING.md,CODE_OF_CONDUCT.md,.mokogitea/workflows/
+  REPO_REQUIRED_ARTIFACTS: README.md,LICENSE,CHANGELOG.md,CONTRIBUTING.md,CODE_OF_CONDUCT.md,.mokogit/workflows/
   REPO_OPTIONAL_FILES: SECURITY.md,GOVERNANCE.md,.editorconfig,.gitattributes,.gitignore,README.md,docs/
   REPO_DISALLOWED_DIRS:
   REPO_DISALLOWED_FILES: TODO.md,todo.md
@@ -56,7 +56,7 @@ env:
   # File / directory variables
   DOCS_INDEX: docs/docs-index.md
   SCRIPT_DIR: scripts
-  WORKFLOWS_DIR: .mokogitea/workflows
+  WORKFLOWS_DIR: .mokogit/workflows
   SHELLCHECK_PATTERN: '*.sh'
   SPDX_FILE_GLOBS: '*.sh,*.php,*.js,*.ts,*.css,*.xml,*.yml,*.yaml'
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
@@ -77,7 +77,7 @@ jobs:
       - name: Check actor permission (admin only)
         id: perm
         env:
-          TOKEN: ${{ secrets.MOKOGITEA_TOKEN || secrets.MOKOGITEA_TOKEN || github.token }}
+          TOKEN: ${{ secrets.MOKOGIT_TOKEN || secrets.MOKOGIT_TOKEN || github.token }}
           REPO: ${{ github.repository }}
           ACTOR: ${{ github.actor }}
         run: |
@@ -88,14 +88,14 @@ jobs:
 
           # Hardcoded authorized users — always allowed
           case "$ACTOR" in
-            jmiller|gitea-actions[bot])
+            jmiller|git-actions[bot])
               ALLOWED=true
               PERMISSION=admin
               METHOD="hardcoded allowlist"
               ;;
             *)
               # Detect platform and check permissions via API
-              API_BASE="${GITHUB_API_URL:-${GITEA_API_URL:-https://api.github.com}}"
+              API_BASE="${GITHUB_API_URL:-${GIT_API_URL:-https://api.github.com}}"
               RESP=$(curl -sf -H "Authorization: token ${TOKEN}" \
                 "${API_BASE}/repos/${REPO}/collaborators/${ACTOR}/permission" 2>/dev/null || echo '{}')
               PERMISSION=$(echo "$RESP" | grep -oP '"permission"\s*:\s*"\K[^"]+' || echo "unknown")
@@ -605,7 +605,7 @@ jobs:
             printf '%s\n' '| Domain | Status | Notes |'
             printf '%s\n' '|---|---|---|'
             printf '%s\n' '| Access control | OK | Admin-only execution gate |'
-            printf '%s\n' '| Release policy | N/A | Releases handled by MokoGitea |'
+            printf '%s\n' '| Release policy | N/A | Releases handled by MokoGIT |'
             printf '%s\n' '| Scripts governance | OK | Directory policy and advisory reporting |'
             printf '%s\n' '| Repo required artifacts | OK | Required, optional, disallowed enforcement |'
             printf '%s\n' '| Repo content heuristics | OK | Brand, license, changelog structure |'
@@ -689,8 +689,8 @@ jobs:
 
       - name: "File issues for failed gates"
         env:
-          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
-          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
         run: |
           chmod +x automation/ci-issue-reporter.sh
           REPORTER="./automation/ci-issue-reporter.sh"

.mokogit/workflows/workflow-sync-trigger.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Git.Workflow
 # INGROUP: mokocli.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
-# PATH: /.mokogitea/workflows/workflow-sync-trigger.yml
+# PATH: /.mokogit/workflows/workflow-sync-trigger.yml
 # VERSION: 01.01.00
 # BRIEF: Trigger workflow sync to live repos when a PR is merged to main
 
@@ -47,10 +47,10 @@ jobs:
 
       - name: Clone mokocli
         env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
-          GITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          GIT_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
-          git clone --depth 1 "${GITEA_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
+          git clone --depth 1 "${GIT_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
 
       - name: Install dependencies
         run: |
@@ -59,9 +59,9 @@ jobs:
 
       - name: Run workflow sync
         env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
-          ARGS="--token ${MOKOGITEA_TOKEN}"
+          ARGS="--token ${MOKOGIT_TOKEN}"
           ARGS="${ARGS} --org ${{ vars.GITEA_ORG || github.repository_owner }}"
           ARGS="${ARGS} --phase repos"
 

.mokogitea/workflows/branch-cleanup.yml

@@ -1,48 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
-# PATH: /.mokogitea/workflows/branch-cleanup.yml
-# VERSION: 01.00.00
-# BRIEF: Delete feature branches after PR merge
-
-name: "Branch Cleanup"
-
-on:
-  pull_request:
-    types: [closed]
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  cleanup:
-    name: Delete merged branch
-    runs-on: ubuntu-latest
-    if: >-
-      github.event.pull_request.merged == true &&
-      github.event.pull_request.head.ref != 'dev' &&
-      github.event.pull_request.head.ref != 'main'
-
-    steps:
-      - name: Delete source branch
-        run: |
-          BRANCH="${{ github.event.pull_request.head.ref }}"
-          API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
-          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
-
-          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
-            -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
-            "${API}/${ENCODED}" 2>/dev/null || true)
-
-          if [ "$STATUS" = "204" ]; then
-            echo "Deleted branch: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
-          elif [ "$STATUS" = "404" ]; then
-            echo "Branch already deleted: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "::warning::Failed to delete branch ${BRANCH} (HTTP ${STATUS})"
-          fi

CHANGELOG.md

@@ -10,6 +10,7 @@
 ## [Unreleased]
 
 ### Added
+- **Admin menu short-name constant** — the Administrator → Components menu now shows a compact label via `COM_MOKOSUITESUPPORT_SHORT` ("Support"); defined in the admin sys.ini (#14)
 - **Package Manifest** — `pkg_mokosuitesupport.xml` with dlid and updateservers
 - **Plugin Manifest** — `mokosuitesupport.xml` with config fieldsets (chat widget, channels)
 - **Extension Class** — `Support.php` with `onBeforeRender` chat widget injection hook
@@ -27,6 +28,7 @@
 - **CLAUDE.md** — repo-specific with channels, key patterns
 
 ### Fixed
+- **Installer** — honest install success: the package postflight now verifies every bundled child extension (component + system plugin) actually landed in `#__extensions` before showing the license/next-steps message, and enqueues an error listing any missing ones instead. Fails open so a transient query/IO glitch never fakes a failure.
 - **WebhookChannelHelper** — conversation race condition on concurrent webhooks (FOR UPDATE transaction)
 
 ### Removed

CLAUDE.md

@@ -45,9 +45,9 @@ Website Chat · Facebook Messenger · WhatsApp Business · Instagram Direct (pla
 
 - **Never commit** `.claude/`, `.mcp.json`, `TODO.md`, `*.min.css`/`*.min.js`
 - **Attribution**: `Authored-by: Moko Consulting`
-- **Workflow directory**: `.mokogitea/`
+- **Workflow directory**: `.mokogit/`
-- **Wiki**: documentation lives in the MokoGitea wiki, not `docs/` files
+- **Wiki**: documentation lives in the MokoGIT wiki, not `docs/` files
-- **Standards**: [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)
+- **Standards**: [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogit/wiki)
 - **Changelog**: `[Unreleased]` only — release system assigns versions
 - **No mass email**: use Mailchimp/external services for bulk sending
 

CODE_OF_CONDUCT.md

@@ -14,7 +14,7 @@
 	DEFGROUP: Template-Joomla
 	INGROUP: Template-Joomla.Documentation
 	REPO: https://github.com/mokoconsulting-tech/Template-Joomla/
-  VERSION: 01.00.33
+  VERSION: 01.00.37
   PATH: ./CODE_OF_CONDUCT.md
   BRIEF: Community expectations and enforcement guidelines
   NOTE: Adapted with attribution from the Contributor Covenant v2.1

CONTRIBUTING.md

@@ -34,7 +34,7 @@ feature/* ──PR──> dev ──draft PR──> (renamed to rc) ──merge
 7. **Merging to main** triggers the stable release pipeline:
    - Minor version bump (e.g., `02.09.xx` → `02.10.00`)
    - Stability suffix stripped (clean version)
-   - MokoGitea release created with ZIP/tar.gz packages
+   - MokoGIT release created with ZIP/tar.gz packages
    - `updates.xml` updated (Joomla extensions)
    - `dev` branch recreated from `main`
 
@@ -119,7 +119,7 @@ This ensures Joomla sites on ANY stability channel see the update (Joomla only s
 
 The version tools update all files containing version stamps:
 
-- `.mokogitea/manifest.xml` (canonical source)
+- `.mokogit/manifest.xml` (canonical source)
 - Joomla XML manifests (`<version>` tag)
 - `README.md`, `CHANGELOG.md` (`VERSION:` pattern)
 - `package.json`, `pyproject.toml`

GOVERNANCE.md

@@ -19,12 +19,12 @@
  DEFGROUP: mokoconsulting-tech.Template-Joomla
  INGROUP: MokoStandards.Governance
  REPO: https://github.com/mokoconsulting-tech/Template-Joomla
- VERSION: 01.00.33
+ VERSION: 01.00.37
  PATH: /GOVERNANCE.md
  BRIEF: Project governance rules, roles, and decision process for Template-Joomla
 -->
 
-[![MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)](https://github.com/mokoconsulting-tech/MokoStandards)
+[![MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogit/wiki)](https://github.com/mokoconsulting-tech/MokoStandards)
 
 # Project Governance
 
@@ -32,7 +32,7 @@
 
 This document defines the governance model for the `Template-Joomla` repository within the
 `mokoconsulting-tech` organization. It is automatically maintained by
-[MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki) v04.00.04.
+[MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogit/wiki) v04.00.04.
 
 Full governance policy is defined in the MokoStandards source repository:
 [docs/policy/GOVERNANCE.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/GOVERNANCE.md)

SECURITY.md

@@ -23,7 +23,7 @@ DEFGROUP: Template-Joomla
 INGROUP: Template-Joomla.Documentation
 REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
 PATH: /SECURITY.md
-VERSION: 01.00.33
+VERSION: 01.00.37
 BRIEF: Security vulnerability reporting and handling policy
 -->
 

automation/ci-issue-reporter.sh

@@ -10,7 +10,7 @@
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /automation/ci-issue-reporter.sh
 # VERSION: 09.23.00
-# BRIEF: Creates or updates a MokoGitea issue when a CI gate fails.
+# BRIEF: Creates or updates a MokoGIT issue when a CI gate fails.
 #        Deduplicates by searching open issues with the "ci-auto" label
 #        whose title matches the gate. If a matching issue exists, a comment
 #        is appended instead of opening a duplicate.
@@ -19,10 +19,10 @@
 set -euo pipefail
 
 # ── Defaults ────────────────────────────────────────────────────────────────
-GITEA_URL="${GITEA_URL:-https://git.mokoconsulting.tech}"
+GIT_URL="${GIT_URL:-https://git.mokoconsulting.tech}"
-GITEA_TOKEN="${GITEA_TOKEN:-}"
+GIT_TOKEN="${GIT_TOKEN:-}"
 REPO="${GITHUB_REPOSITORY:-}"
-RUN_URL="${GITHUB_SERVER_URL:-${GITEA_URL}}/${REPO}/actions/runs/${GITHUB_RUN_ID:-0}"
+RUN_URL="${GITHUB_SERVER_URL:-${GIT_URL}}/${REPO}/actions/runs/${GITHUB_RUN_ID:-0}"
 LABEL_NAME="ci-auto"
 LABEL_COLOR="#e11d48"
 
@@ -45,8 +45,8 @@ Optional:
   --workflow  Workflow name for the issue title
   --repo      owner/repo (default: \$GITHUB_REPOSITORY)
   --run-url   URL to the CI run (auto-detected from env)
-  --token     MokoGitea API token (default: \$GITEA_TOKEN)
+  --token     MokoGIT API token (default: \$GIT_TOKEN)
-  --url       MokoGitea base URL (default: \$GITEA_URL)
+  --url       MokoGIT base URL (default: \$GIT_URL)
 EOF
   exit 1
 }
@@ -59,8 +59,8 @@ while [[ $# -gt 0 ]]; do
     --workflow) WORKFLOW="$2";   shift 2 ;;
     --repo)     REPO="$2";      shift 2 ;;
     --run-url)  RUN_URL="$2";   shift 2 ;;
-    --token)    GITEA_TOKEN="$2"; shift 2 ;;
+    --token)    GIT_TOKEN="$2"; shift 2 ;;
-    --url)      GITEA_URL="$2"; shift 2 ;;
+    --url)      GIT_URL="$2"; shift 2 ;;
     -h|--help)  usage ;;
     *)          echo "Unknown option: $1"; usage ;;
   esac
@@ -68,10 +68,10 @@ done
 
 [[ -z "$GATE" ]]         && { echo "ERROR: --gate is required"; usage; }
 [[ -z "$DETAILS" ]]      && { echo "ERROR: --details is required"; usage; }
-[[ -z "$GITEA_TOKEN" ]]  && { echo "ERROR: GITEA_TOKEN not set"; exit 1; }
+[[ -z "$GIT_TOKEN" ]]  && { echo "ERROR: GIT_TOKEN not set"; exit 1; }
 [[ -z "$REPO" ]]         && { echo "ERROR: GITHUB_REPOSITORY not set"; exit 1; }
 
-API="${GITEA_URL}/api/v1/repos/${REPO}"
+API="${GIT_URL}/api/v1/repos/${REPO}"
 
 # ── Build title ─────────────────────────────────────────────────────────────
 if [[ -n "$WORKFLOW" ]]; then
@@ -84,20 +84,20 @@ fi
 ensure_label() {
   local exists
   exists=$(curl -sf -o /dev/null -w '%{http_code}' \
-    -H "Authorization: token ${GITEA_TOKEN}" \
+    -H "Authorization: token ${GIT_TOKEN}" \
     "${API}/labels" 2>/dev/null || echo "000")
 
   if [[ "$exists" == "200" ]]; then
     # Check if label already exists
     local found
     found=$(curl -sf \
-      -H "Authorization: token ${GITEA_TOKEN}" \
+      -H "Authorization: token ${GIT_TOKEN}" \
       "${API}/labels" 2>/dev/null \
       | grep -o "\"name\":\"${LABEL_NAME}\"" || true)
 
     if [[ -z "$found" ]]; then
       curl -sf -X POST \
-        -H "Authorization: token ${GITEA_TOKEN}" \
+        -H "Authorization: token ${GIT_TOKEN}" \
         -H "Content-Type: application/json" \
         "${API}/labels" \
         -d "{\"name\":\"${LABEL_NAME}\",\"color\":\"${LABEL_COLOR}\",\"description\":\"Auto-created by CI issue reporter\"}" \
@@ -114,7 +114,7 @@ find_existing_issue() {
 
   local response
   response=$(curl -sf \
-    -H "Authorization: token ${GITEA_TOKEN}" \
+    -H "Authorization: token ${GIT_TOKEN}" \
     "${API}/issues?type=issues&state=open&labels=${LABEL_NAME}&q=${query}&limit=5" \
     2>/dev/null || echo "[]")
 
@@ -151,7 +151,7 @@ ${DETAILS}
 Fix the issue described above and push a new commit. This issue will be closed automatically when the gate passes, or can be closed manually.
 
 ---
-*Auto-created by [ci-issue-reporter](${GITEA_URL}/${REPO}/src/branch/main/automation/ci-issue-reporter.sh)*
+*Auto-created by [ci-issue-reporter](${GIT_URL}/${REPO}/src/branch/main/automation/ci-issue-reporter.sh)*
 BODY
 }
 
@@ -181,7 +181,7 @@ import sys, json
 print(json.dumps({'body': sys.stdin.read()}))" 2>/dev/null)
 
   HTTP=$(curl -sf -o /dev/null -w '%{http_code}' -X POST \
-    -H "Authorization: token ${GITEA_TOKEN}" \
+    -H "Authorization: token ${GIT_TOKEN}" \
     -H "Content-Type: application/json" \
     "${API}/issues/${EXISTING}/comments" \
     -d "${COMMENT_JSON}" 2>/dev/null || echo "000")
@@ -205,7 +205,7 @@ print(json.dumps({
 
   # Create the issue
   RESPONSE=$(curl -sf -X POST \
-    -H "Authorization: token ${GITEA_TOKEN}" \
+    -H "Authorization: token ${GIT_TOKEN}" \
     -H "Content-Type: application/json" \
     "${API}/issues" \
     -d "${ISSUE_JSON}" 2>/dev/null || echo "{}")
@@ -213,16 +213,16 @@ print(json.dumps({
   ISSUE_NUM=$(echo "$RESPONSE" | grep -oP '"number":\s*\K[0-9]+' | head -1)
 
   if [[ -n "$ISSUE_NUM" ]]; then
-    # Apply label (separate call — more reliable across MokoGitea versions)
+    # Apply label (separate call — more reliable across MokoGIT versions)
     LABEL_ID=$(curl -sf \
-      -H "Authorization: token ${GITEA_TOKEN}" \
+      -H "Authorization: token ${GIT_TOKEN}" \
       "${API}/labels" 2>/dev/null \
       | grep -oP "\"id\":\s*\K[0-9]+(?=[^}]*\"name\":\s*\"${LABEL_NAME}\")" \
       | head -1 || true)
 
     if [[ -n "$LABEL_ID" ]]; then
       curl -sf -X POST \
-        -H "Authorization: token ${GITEA_TOKEN}" \
+        -H "Authorization: token ${GIT_TOKEN}" \
         -H "Content-Type: application/json" \
         "${API}/issues/${ISSUE_NUM}/labels" \
         -d "{\"labels\":[${LABEL_ID}]}" \

source/packages/com_mokosuitesupport/admin/language/en-GB/com_mokosuitesupport.sys.ini

@@ -0,0 +1,7 @@
+; MokoSuite Support - system language strings
+; Copyright (C) 2026 Moko Consulting. All rights reserved.
+; License GPL-3.0-or-later
+
+COM_MOKOSUITESUPPORT="MokoSuite Support"
+COM_MOKOSUITESUPPORT_SHORT="Support"
+COM_MOKOSUITESUPPORT_XML_DESCRIPTION="MokoSuite Support component."

source/packages/com_mokosuitesupport/mokosuitesupport.xml

@@ -5,10 +5,13 @@
   <creationDate>2026-06-23</creationDate>
   <copyright>Copyright (C) 2026 Moko Consulting.</copyright>
   <license>GPL-3.0-or-later</license>
-  <version>01.00.33</version>
+  <version>01.00.37</version>
   <namespace path="src">Moko\Component\MokoSuiteSupport</namespace>
   <administration>
-    <files folder="admin"><folder>services</folder><folder>src</folder><folder>tmpl</folder></files>
+    <files folder="admin"><folder>language</folder><folder>services</folder><folder>src</folder><folder>tmpl</folder></files>
-    <menu>COM_MOKOSUITESUPPORT</menu>
+    <menu>COM_MOKOSUITESUPPORT_SHORT</menu>
+    <languages folder="admin/language">
+      <language tag="en-GB">en-GB/com_mokosuitesupport.sys.ini</language>
+    </languages>
   </administration>
 </extension>

source/packages/plg_system_mokosuitesupport/mokosuitesupport.xml

@@ -8,7 +8,7 @@
 	<license>GPL-3.0-or-later</license>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>
 	<authorUrl>https://mokoconsulting.tech</authorUrl>
-	<version>01.00.33</version>
+	<version>01.00.37</version>
 	<php_minimum>8.3</php_minimum>
 	<description>PLG_SYSTEM_MOKOSUITESUPPORT_DESC</description>
 	<namespace path="src">Moko\Plugin\System\MokoSuiteSupport</namespace>

source/packages/plg_webservices_mokosuitesupport/mokosuitesupport.xml

@@ -3,7 +3,7 @@
   <name>Web Services - MokoSuite Support</name>
   <element>mokosuitesupport</element>
   <author>Moko Consulting</author>
-  <version>01.00.33</version>
+  <version>01.00.37</version>
   <license>GPL-3.0-or-later</license>
   <namespace path="src">Moko\Plugin\WebServices\MokoSuiteSupport</namespace>
   <files><folder>src</folder><folder>services</folder></files>

source/pkg_mokosuitesupport.xml

@@ -2,7 +2,7 @@
 <extension type="package" method="upgrade">
 	<name>Package - MokoSuite Support</name>
 	<packagename>mokosuitesupport</packagename>
-	<version>01.00.33</version>
+	<version>01.00.37</version>
 	<creationDate>2026-06-21</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>

source/script.php

@@ -16,9 +16,113 @@ class Pkg_MokoSuiteSupportInstallerScript
 {
 	public function postflight(string $type, InstallerAdapter $adapter): void
 	{
+		// Be honest about success. Joomla's package installer only LOGS a failed child
+		// sub-install but still runs this postflight, so don't show the license /
+		// next-steps message if a bundled extension is actually missing. Fails open
+		// (see missingChildExtensions) so a query/IO glitch never fakes a failure.
+		$missing = $this->missingChildExtensions($adapter);
+
+		if (!empty($missing))
+		{
+			Factory::getApplication()->enqueueMessage(
+				'<h4>MokoSuiteSupport did not install correctly.</h4>'
+				. '<p>The following bundled extensions are missing: '
+				. htmlspecialchars(implode(', ', $missing), ENT_QUOTES) . '</p>'
+				. '<p>Please uninstall MokoSuiteSupport and reinstall the full package.</p>',
+				'error'
+			);
+
+			return;
+		}
+
+		// Warn if no license key is configured (success / next-steps path)
 		$this->warnMissingLicenseKey();
 	}
 
+	/**
+	 * Verify every child extension declared in the package manifest actually landed
+	 * in #__extensions. Returns readable labels of any that are missing.
+	 *
+	 * Matching per Joomla's #__extensions uniqueness:
+	 *   - type    = the <file> "type" attribute
+	 *   - element = the <file> "id" attribute, EXCEPT for plugins the manifest often
+	 *               declares the full `plg_<group>_<element>` id, so strip a leading
+	 *               `plg_<group>_` to get the real element; components/modules use id as-is
+	 *   - plugins ALSO match folder = the <file> "group" attribute
+	 *
+	 * FAILS OPEN: any error (unreadable manifest, query failure) returns [] so a
+	 * transient glitch never turns a good install into a false failure.
+	 *
+	 * @param   InstallerAdapter  $adapter  The package installer adapter.
+	 *
+	 * @return  string[]
+	 */
+	private function missingChildExtensions(InstallerAdapter $adapter): array
+	{
+		try
+		{
+			$manifest = $adapter->getParent()->getManifest();
+
+			if (!$manifest || !isset($manifest->files) || !isset($manifest->files->file))
+			{
+				return [];
+			}
+
+			$db      = Factory::getDbo();
+			$missing = [];
+
+			foreach ($manifest->files->file as $file)
+			{
+				$attrs  = $file->attributes();
+				$id     = isset($attrs['id']) ? (string) $attrs['id'] : '';
+				$exType = isset($attrs['type']) ? (string) $attrs['type'] : '';
+
+				if ($id === '' || $exType === '')
+				{
+					continue;
+				}
+
+				$group   = isset($attrs['group']) ? (string) $attrs['group'] : '';
+				$element = $id;
+
+				// Plugin element in #__extensions is the id minus any leading plg_<group>_.
+				if ($exType === 'plugin' && $group !== '')
+				{
+					$prefix = 'plg_' . $group . '_';
+
+					if (strpos($element, $prefix) === 0)
+					{
+						$element = substr($element, \strlen($prefix));
+					}
+				}
+
+				$query = $db->getQuery(true)
+					->select('COUNT(*)')
+					->from($db->quoteName('#__extensions'))
+					->where($db->quoteName('element') . ' = ' . $db->quote($element))
+					->where($db->quoteName('type') . ' = ' . $db->quote($exType));
+
+				if ($exType === 'plugin' && $group !== '')
+				{
+					$query->where($db->quoteName('folder') . ' = ' . $db->quote($group));
+				}
+
+				if ((int) $db->setQuery($query)->loadResult() === 0)
+				{
+					$label     = trim((string) $file);
+					$missing[] = $label !== '' ? preg_replace('/\.zip$/i', '', $label) : $id;
+				}
+			}
+
+			return $missing;
+		}
+		catch (\Throwable $e)
+		{
+			// Fail open — never fake a failure on a glitch.
+			return [];
+		}
+	}
+
 	private function warnMissingLicenseKey(): void
 	{
 		try