fix: route all decorative CLI output to stderr

All display methods (banner, progress, section, status, log, table,
summary box, divider, step) now write to stderr via a new display()
helper. This ensures stdout is reserved for machine-readable data,
fixing CI pipelines that capture CLI output with $() or redirect to
$GITHUB_OUTPUT.

Root cause: version_read.php banner was written to stdout, so
  VERSION=$(php version_read.php --path .)
captured the box-drawing characters along with the version string,
corrupting $GITHUB_OUTPUT and breaking downstream release steps.

Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.mokogitea/workflows/auto-release.yml

@@ -7,7 +7,7 @@
 # INGROUP: moko-platform.Release
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
 # PATH: /templates/workflows/universal/auto-release.yml.template
-# VERSION: 05.00.00
+# VERSION: 09.23.00
 # BRIEF: Universal build & release � detects platform from manifest.xml
 #
 # +========================================================================+
@@ -102,14 +102,13 @@ jobs:
         run: |
           php /tmp/moko-platform-api/cli/release_publish.php \
             --path . --stability rc --bump minor --branch rc \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
-            --skip-update-stream
+            --token "${{ secrets.MOKOGITEA_TOKEN }}"
 
       - name: Summary
         if: always()
         run: |
           echo "## Promoted to Release Candidate" >> $GITHUB_STEP_SUMMARY
-          echo "Branch renamed to rc, minor bump, RC release built (updates.xml managed by Gitea Pages)" >> $GITHUB_STEP_SUMMARY
+          echo "Branch renamed to rc, minor bump, RC + lesser stream releases built, updates.xml synced" >> $GITHUB_STEP_SUMMARY
 
   # ── Merged PR → Build & Release (or promote RC to stable) ────────────────────
   release:
@@ -132,19 +131,6 @@ jobs:
           git config --local user.name "gitea-actions[bot]"
           git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
-      - name: Check for merge conflict markers
-        run: |
-          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
-          if [ -n "$CONFLICTS" ]; then
-            echo "::error::Merge conflict markers found — aborting release"
-            echo "## Release Blocked: Conflict Markers" >> $GITHUB_STEP_SUMMARY
-            echo '```' >> $GITHUB_STEP_SUMMARY
-            echo "$CONFLICTS" >> $GITHUB_STEP_SUMMARY
-            echo '```' >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-          echo "No conflict markers found"
-
       - name: Setup moko-platform tools
         env:
           MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
@@ -168,8 +154,7 @@ jobs:
         run: |
           php /tmp/moko-platform-api/cli/release_publish.php \
             --path . --stability stable --bump minor --branch main \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
-            --skip-update-stream
+            --token "${{ secrets.MOKOGITEA_TOKEN }}"
 
       # -- STEP 9: Mirror to GitHub (stable only) --------------------------------
       - name: "Step 9: Mirror release to GitHub"

.mokogitea/workflows/pr-check.yml

@@ -1,508 +1,236 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: moko-platform.CI
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
-# PATH: /templates/workflows/universal/pr-check.yml.template
-# VERSION: 09.23.00
-# BRIEF: PR gate — branch policy + code validation before merge
-
-name: "Universal: PR Check"
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, edited]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  # ── Branch Policy ──────────────────────────────────────────────────────
-  branch-policy:
-    name: Branch Policy
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check branch merge target
-        run: |
-          HEAD="${{ github.head_ref }}"
-          BASE="${{ github.base_ref }}"
-
-          echo "PR: ${HEAD} → ${BASE}"
-
-          ALLOWED=true
-          REASON=""
-
-          case "$HEAD" in
-            feature/*|feat/*)
-              if [ "$BASE" != "dev" ]; then
-                ALLOWED=false
-                REASON="Feature branches must target 'dev', not '${BASE}'"
-              fi
-              ;;
-            fix/*|bugfix/*)
-              if [ "$BASE" != "dev" ]; then
-                ALLOWED=false
-                REASON="Fix branches must target 'dev', not '${BASE}'"
-              fi
-              ;;
-            patch/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
-                ALLOWED=false
-                REASON="Patch branches must target 'dev' or 'rc', not '${BASE}'"
-              fi
-              ;;
-            hotfix/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "main" ]; then
-                ALLOWED=false
-                REASON="Hotfix branches can only target 'dev' or 'main', not '${BASE}'"
-              fi
-              ;;
-            rc)
-              if [ "$BASE" != "main" ]; then
-                ALLOWED=false
-                REASON="RC branch can only merge into 'main', not '${BASE}'"
-              fi
-              ;;
-            dev)
-              if [ "$BASE" != "main" ]; then
-                ALLOWED=false
-                REASON="Dev branch can only merge into 'main', not '${BASE}'"
-              fi
-              ;;
-          esac
-
-          if [ "$ALLOWED" = false ]; then
-            echo "::error::${REASON}"
-            echo "## Branch Policy Violation" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "${REASON}" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
-            echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-
-          echo "Branch policy: OK (${HEAD} → ${BASE})"
-          echo "## Branch Policy: Passed" >> $GITHUB_STEP_SUMMARY
-
-  # ── Code Validation ────────────────────────────────────────────────────
-  validate:
-    name: Validate PR
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Check for merge conflict markers
-        run: |
-          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
-          if [ -n "$CONFLICTS" ]; then
-            echo "::error::Merge conflict markers found in source files"
-            echo "## Conflict Markers Found" >> $GITHUB_STEP_SUMMARY
-            echo '```' >> $GITHUB_STEP_SUMMARY
-            echo "$CONFLICTS" >> $GITHUB_STEP_SUMMARY
-            echo '```' >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-          echo "No conflict markers found"
-
-      - name: Detect platform
-        id: platform
-        run: |
-          # Read platform from XML manifest (<platform> tag) or plain text fallback
-          PLATFORM=$(sed -n 's/.*<platform>\([^<]*\)<\/platform>.*/\1/p' .mokogitea/manifest.xml 2>/dev/null | head -1)
-          [ -z "$PLATFORM" ] && PLATFORM=$(cat .mokogitea/manifest.xml 2>/dev/null | tr -d '[:space:]')
-          [ -z "$PLATFORM" ] && PLATFORM="generic"
-          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
-
-      - name: Setup PHP
-        if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
-        run: |
-          if ! command -v php &> /dev/null; then
-            sudo apt-get update -qq
-            sudo apt-get install -y -qq php-cli php-mbstring php-xml >/dev/null 2>&1
-          fi
-
-      - name: PHP syntax check
-        if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
-        run: |
-          ERRORS=0
-          while IFS= read -r -d '' file; do
-            if ! php -l "$file" 2>&1 | grep -q "No syntax errors"; then
-              ERRORS=$((ERRORS + 1))
-            fi
-          done < <(find . -name "*.php" -not -path "./.git/*" -not -path "./vendor/*" -print0)
-          echo "PHP lint: ${ERRORS} error(s)"
-          [ "$ERRORS" -eq 0 ] || { echo "::error::PHP syntax errors found"; exit 1; }
-
-      - name: Joomla JEXEC guard check
-        if: steps.platform.outputs.platform == 'joomla'
-        run: |
-          ERRORS=0
-          while IFS= read -r -d '' file; do
-            # Skip vendor, node_modules, and index.html stub files
-            case "$file" in ./vendor/*|./node_modules/*) continue ;; esac
-            # Check first 10 lines for JEXEC or JPATH guard
-            if ! head -20 "$file" | grep -qE "defined\s*\(\s*['\"](_JEXEC|JPATH_BASE|\\\\JPATH_PLATFORM)['\"]"; then
-              echo "::error file=${file}::Missing JEXEC guard: ${file}"
-              ERRORS=$((ERRORS + 1))
-            fi
-          done < <(find . -name "*.php" -path "*/src/*" -not -path "./.git/*" -not -path "./vendor/*" -print0)
-          if [ "$ERRORS" -gt 0 ]; then
-            echo "::error::${ERRORS} PHP file(s) missing defined('_JEXEC') or die guard"
-            echo "## JEXEC Guard Check: Failed" >> $GITHUB_STEP_SUMMARY
-            echo "${ERRORS} file(s) in src/ are missing the Joomla execution guard." >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-          echo "JEXEC guard: OK"
-
-      - name: Joomla directory listing protection
-        if: steps.platform.outputs.platform == 'joomla'
-        run: |
-          MISSING=0
-          SOURCE_DIR="src"
-          [ ! -d "$SOURCE_DIR" ] && exit 0
-          while IFS= read -r dir; do
-            if [ ! -f "${dir}/index.html" ]; then
-              echo "::warning::Missing index.html in ${dir} (directory listing protection)"
-              MISSING=$((MISSING + 1))
-            fi
-          done < <(find "$SOURCE_DIR" -type d -not -path "./.git/*" -not -path "*/vendor/*" -not -path "*/node_modules/*")
-          if [ "$MISSING" -gt 0 ]; then
-            echo "## Directory Protection" >> $GITHUB_STEP_SUMMARY
-            echo "${MISSING} director(ies) missing index.html" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "Directory protection: ${MISSING} missing (advisory)"
-
-      - name: Joomla script file and asset checks
-        if: steps.platform.outputs.platform == 'joomla'
-        run: |
-          ERRORS=0
-          MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
-          [ -z "$MANIFEST" ] && exit 0
-          MANIFEST_DIR=$(dirname "$MANIFEST")
-
-          # Check scriptfile exists if declared
-          SCRIPTFILE=$(sed -n 's/.*<scriptfile>\([^<]*\)<\/scriptfile>.*/\1/p' "$MANIFEST" 2>/dev/null)
-          if [ -n "$SCRIPTFILE" ]; then
-            if [ ! -f "${MANIFEST_DIR}/${SCRIPTFILE}" ]; then
-              echo "::error::Manifest declares <scriptfile>${SCRIPTFILE}</scriptfile> but file not found at ${MANIFEST_DIR}/${SCRIPTFILE}"
-              ERRORS=$((ERRORS + 1))
-            else
-              echo "Script file: ${MANIFEST_DIR}/${SCRIPTFILE} (OK)"
-            fi
-          fi
-
-          # Require joomla.asset.json and validate it
-          ASSET_JSON=$(find "$MANIFEST_DIR" -name "joomla.asset.json" -not -path "./.git/*" 2>/dev/null | head -1)
-          if [ -z "$ASSET_JSON" ]; then
-            echo "::error::joomla.asset.json not found — Joomla asset system is required"
-            ERRORS=$((ERRORS + 1))
-          else
-            if command -v php &> /dev/null; then
-              php -r "json_decode(file_get_contents('$ASSET_JSON')); if(json_last_error()!==JSON_ERROR_NONE){echo json_last_error_msg();exit(1);}" 2>&1 || {
-                echo "::error::joomla.asset.json is not valid JSON"
-                ERRORS=$((ERRORS + 1))
-              }
-            fi
-            echo "joomla.asset.json: valid"
-          fi
-
-          # Validate all XML files in src/ are well-formed
-          XML_ERRORS=0
-          if command -v php &> /dev/null; then
-            while IFS= read -r -d '' xmlfile; do
-              if ! php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('$xmlfile'); if(!\$x){foreach(libxml_get_errors() as \$e) echo trim(\$e->message) . ' in $xmlfile'; exit(1);}" 2>&1; then
-                XML_ERRORS=$((XML_ERRORS + 1))
-              fi
-            done < <(find "$MANIFEST_DIR" -name "*.xml" -not -path "./.git/*" -print0)
-          fi
-          if [ "$XML_ERRORS" -gt 0 ]; then
-            echo "::error::${XML_ERRORS} XML file(s) are malformed"
-            ERRORS=$((ERRORS + 1))
-          else
-            echo "XML well-formedness: OK"
-          fi
-
-          [ "$ERRORS" -gt 0 ] && exit 1
-          echo "Joomla asset checks: OK"
-
-      - name: Validate platform manifest
-        run: |
-          PLATFORM="${{ steps.platform.outputs.platform }}"
-          case "$PLATFORM" in
-            joomla)
-              MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
-              if [ -z "$MANIFEST" ]; then
-                echo "::warning::No Joomla manifest found (WaaS site)"
-                exit 0
-              fi
-              echo "Manifest: ${MANIFEST}"
-              if command -v php &> /dev/null; then
-                php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('$MANIFEST'); if(!\$x){foreach(libxml_get_errors() as \$e) echo \$e->message; exit(1);}" || { echo "::error::Manifest XML is malformed"; exit 1; }
-              fi
-              for ELEMENT in name version description; do
-                grep -q "<${ELEMENT}>" "$MANIFEST" || { echo "::error::Missing <${ELEMENT}> in manifest"; exit 1; }
-              done
-              # Block legacy raw/branch update server URLs on MokoGitea
-              RAW_URLS=$(grep -n 'raw/branch' "$MANIFEST" | grep -i 'mokoconsulting\|mokogitea\|git\.mokoconsulting\.tech' || true)
-              if [ -n "$RAW_URLS" ]; then
-                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the Gitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
-                echo "$RAW_URLS"
-                exit 1
-              fi
-              echo "Joomla manifest valid"
-              ;;
-            dolibarr)
-              MOD_FILE=$(find . -maxdepth 4 -name "mod*.class.php" ! -path "./.git/*" -exec grep -l 'extends DolibarrModules' {} \; 2>/dev/null | head -1)
-              if [ -z "$MOD_FILE" ]; then
-                echo "::error::No mod*.class.php found"
-                exit 1
-              fi
-              echo "Dolibarr module: ${MOD_FILE}"
-              ;;
-            *)
-              echo "Generic platform — no manifest validation"
-              ;;
-          esac
-
-      - name: Check update stream format
-        run: |
-          PLATFORM="${{ steps.platform.outputs.platform }}"
-          case "$PLATFORM" in
-            joomla)
-              if [ -f "updates.xml" ]; then
-                if command -v php &> /dev/null; then
-                  php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('updates.xml'); if(!\$x){foreach(libxml_get_errors() as \$e) echo \$e->message; exit(1);}" || { echo "::error::updates.xml is malformed"; exit 1; }
-                fi
-                echo "updates.xml valid"
-              fi
-              ;;
-            dolibarr)
-              [ -f "update.txt" ] && echo "update.txt present" || echo "::warning::No update.txt"
-              ;;
-          esac
-
-      - name: Validate Joomla language files
-        if: steps.platform.outputs.platform == 'joomla'
-        run: |
-          ERRORS=0
-          WARNINGS=0
-
-          # Require both en-GB and en-US language directories
-          LANG_ROOT=$(find . -path "*/language" -type d -not -path "./.git/*" 2>/dev/null | head -1)
-          if [ -z "$LANG_ROOT" ]; then
-            echo "No language/ directory found — skipping"
-            exit 0
-          fi
-
-          if [ ! -d "$LANG_ROOT/en-GB" ]; then
-            echo "::error::Missing en-GB language directory (${LANG_ROOT}/en-GB)"
-            ERRORS=$((ERRORS + 1))
-          fi
-          if [ ! -d "$LANG_ROOT/en-US" ]; then
-            echo "::error::Missing en-US language directory (${LANG_ROOT}/en-US)"
-            ERRORS=$((ERRORS + 1))
-          fi
-
-          # Check that en-GB and en-US have matching .ini files
-          if [ -d "$LANG_ROOT/en-GB" ] && [ -d "$LANG_ROOT/en-US" ]; then
-            for GB_INI in "$LANG_ROOT/en-GB"/*.ini; do
-              [ ! -f "$GB_INI" ] && continue
-              US_INI="$LANG_ROOT/en-US/$(basename "$GB_INI")"
-              if [ ! -f "$US_INI" ]; then
-                echo "::error::$(basename "$GB_INI") exists in en-GB but missing from en-US"
-                ERRORS=$((ERRORS + 1))
-              fi
-            done
-            for US_INI in "$LANG_ROOT/en-US"/*.ini; do
-              [ ! -f "$US_INI" ] && continue
-              GB_INI="$LANG_ROOT/en-GB/$(basename "$US_INI")"
-              if [ ! -f "$GB_INI" ]; then
-                echo "::error::$(basename "$US_INI") exists in en-US but missing from en-GB"
-                ERRORS=$((ERRORS + 1))
-              fi
-            done
-          fi
-
-          # Find all .ini language files
-          INI_FILES=$(find . -path "*/language/*/*.ini" -not -path "./.git/*" 2>/dev/null)
-          if [ -z "$INI_FILES" ]; then
-            echo "No .ini language files found"
-            [ "$ERRORS" -gt 0 ] && exit 1
-            exit 0
-          fi
-
-          echo "Found $(echo "$INI_FILES" | wc -l) language file(s)"
-
-          for FILE in $INI_FILES; do
-            FNAME=$(basename "$FILE")
-            LINENUM=0
-            SEEN_KEYS=""
-
-            while IFS= read -r line || [ -n "$line" ]; do
-              LINENUM=$((LINENUM + 1))
-
-              # Skip empty lines and comments
-              [ -z "$line" ] && continue
-              echo "$line" | grep -qE '^\s*;' && continue
-              echo "$line" | grep -qE '^\s*$' && continue
-
-              # Must match KEY="VALUE" format
-              if ! echo "$line" | grep -qE '^[A-Z_][A-Z0-9_]*=".*"$'; then
-                echo "::error file=${FILE},line=${LINENUM}::Malformed line: ${line}"
-                ERRORS=$((ERRORS + 1))
-                continue
-              fi
-
-              # Extract key and check for duplicates
-              KEY=$(echo "$line" | sed 's/=.*//')
-              if echo "$SEEN_KEYS" | grep -qx "$KEY"; then
-                echo "::error file=${FILE},line=${LINENUM}::Duplicate key: ${KEY}"
-                ERRORS=$((ERRORS + 1))
-              fi
-              SEEN_KEYS="${SEEN_KEYS}
-          ${KEY}"
-            done < "$FILE"
-
-            echo "  ${FILE}: checked ${LINENUM} lines"
-          done
-
-          # Cross-check en-GB vs en-US key consistency
-          GB_DIR=$(find . -path "*/language/en-GB" -type d -not -path "./.git/*" 2>/dev/null | head -1)
-          US_DIR=$(find . -path "*/language/en-US" -type d -not -path "./.git/*" 2>/dev/null | head -1)
-
-          if [ -n "$GB_DIR" ] && [ -n "$US_DIR" ]; then
-            for GB_FILE in "$GB_DIR"/*.ini; do
-              [ ! -f "$GB_FILE" ] && continue
-              FNAME=$(basename "$GB_FILE")
-              US_FILE="$US_DIR/$FNAME"
-              [ ! -f "$US_FILE" ] && continue
-
-              GB_KEYS=$(grep -oP '^[A-Z_][A-Z0-9_]*(?==)' "$GB_FILE" 2>/dev/null | sort)
-              US_KEYS=$(grep -oP '^[A-Z_][A-Z0-9_]*(?==)' "$US_FILE" 2>/dev/null | sort)
-
-              # Keys in en-GB but not en-US
-              MISSING_US=$(comm -23 <(echo "$GB_KEYS") <(echo "$US_KEYS"))
-              if [ -n "$MISSING_US" ]; then
-                echo "::warning::Keys in en-GB/$FNAME but missing from en-US/$FNAME:"
-                echo "$MISSING_US" | while read -r k; do echo "  - $k"; done
-                WARNINGS=$((WARNINGS + 1))
-              fi
-
-              # Keys in en-US but not en-GB
-              MISSING_GB=$(comm -13 <(echo "$GB_KEYS") <(echo "$US_KEYS"))
-              if [ -n "$MISSING_GB" ]; then
-                echo "::warning::Keys in en-US/$FNAME but missing from en-GB/$FNAME:"
-                echo "$MISSING_GB" | while read -r k; do echo "  - $k"; done
-                WARNINGS=$((WARNINGS + 1))
-              fi
-            done
-          fi
-
-          {
-            echo "### Language File Validation"
-            echo "| Metric | Count |"
-            echo "|---|---|"
-            echo "| Files checked | $(echo "$INI_FILES" | wc -l) |"
-            echo "| Errors | ${ERRORS} |"
-            echo "| Warnings | ${WARNINGS} |"
-          } >> $GITHUB_STEP_SUMMARY
-
-          if [ "$ERRORS" -gt 0 ]; then
-            echo "::error::Language validation failed with ${ERRORS} error(s)"
-            exit 1
-          fi
-          echo "Language files: OK (${WARNINGS} warning(s))"
-
-      - name: Check changelog has unreleased entry
-        run: |
-          if [ ! -f "CHANGELOG.md" ]; then
-            echo "::warning::No CHANGELOG.md found"
-            exit 0
-          fi
-          # Check for content under [Unreleased] section
-          if ! grep -q "## \[Unreleased\]" CHANGELOG.md; then
-            echo "::error::CHANGELOG.md missing [Unreleased] section"
-            exit 1
-          fi
-          # Check there's at least one entry (Added/Changed/Fixed/Removed) under Unreleased
-          UNRELEASED_CONTENT=$(sed -n '/## \[Unreleased\]/,/## \[/p' CHANGELOG.md | grep -cE '^\s*-\s' || true)
-          if [ "$UNRELEASED_CONTENT" -eq 0 ]; then
-            echo "::error::CHANGELOG.md [Unreleased] section has no entries. Add a changelog entry describing your changes."
-            echo "## Changelog Check: Failed" >> $GITHUB_STEP_SUMMARY
-            echo "The \`[Unreleased]\` section in CHANGELOG.md has no entries." >> $GITHUB_STEP_SUMMARY
-            echo "Add a line like \`- Description of your change\` under a heading (\`### Added\`, \`### Changed\`, \`### Fixed\`, etc.)" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-          echo "Changelog: ${UNRELEASED_CONTENT} entry/entries in [Unreleased]"
-
-      - name: Verify package source
-        run: |
-          SOURCE_DIR="src"
-          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
-          if [ ! -d "$SOURCE_DIR" ]; then
-            echo "::warning::No src/ or htdocs/ directory"
-            exit 0
-          fi
-          FILE_COUNT=$(find "$SOURCE_DIR" -type f | wc -l)
-          echo "Source: ${FILE_COUNT} files"
-          [ "$FILE_COUNT" -gt 0 ] || { echo "::error::Source directory is empty"; exit 1; }
-
-  # ── Pre-Release RC Build ─────────────────────────────────────────────────
-  pre-release:
-    name: Build RC Package
-    runs-on: ubuntu-latest
-    needs: [branch-policy, validate]
-
-    steps:
-      - name: Trigger RC pre-release
-        env:
-          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          REPO: ${{ github.repository }}
-          BRANCH: ${{ github.head_ref }}
-          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-        run: |
-          curl -s -X POST             "${GITEA_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${GITEA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
-          echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY
-          echo "Triggered RC build on branch \`${BRANCH}\`" >> $GITHUB_STEP_SUMMARY
-
-  # ── Issue Reporter ──────────────────────────────────────────────────────
-  report-issues:
-    name: Report Issues
-    runs-on: ubuntu-latest
-    needs: [branch-policy, validate]
-    if: >-
-      always() &&
-      needs.validate.result == 'failure'
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          sparse-checkout: automation/ci-issue-reporter.sh
-          sparse-checkout-cone-mode: false
-
-      - name: "File issue for PR validation failure"
-        env:
-          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-        run: |
-          chmod +x automation/ci-issue-reporter.sh
-          ./automation/ci-issue-reporter.sh \
-            --gate "PR Validation" \
-            --workflow "PR Check" \
-            --severity error \
-            --details "PR validation failed (syntax, manifest, changelog, or source checks). See the CI run for the specific check that failed."
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: moko-platform.CI
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
+# PATH: /templates/workflows/universal/pr-check.yml.template
+# VERSION: 09.23.00
+# BRIEF: PR gate — branch policy + code validation before merge
+
+name: "Universal: PR Check"
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  # ── Branch Policy ──────────────────────────────────────────────────────
+  branch-policy:
+    name: Branch Policy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check branch merge target
+        run: |
+          HEAD="${{ github.head_ref }}"
+          BASE="${{ github.base_ref }}"
+
+          echo "PR: ${HEAD} → ${BASE}"
+
+          ALLOWED=true
+          REASON=""
+
+          case "$HEAD" in
+            feature/*|feat/*)
+              if [ "$BASE" != "dev" ]; then
+                ALLOWED=false
+                REASON="Feature branches must target 'dev', not '${BASE}'"
+              fi
+              ;;
+            fix/*|bugfix/*)
+              if [ "$BASE" != "dev" ]; then
+                ALLOWED=false
+                REASON="Fix branches must target 'dev', not '${BASE}'"
+              fi
+              ;;
+            patch/*)
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
+                ALLOWED=false
+                REASON="Patch branches must target 'dev' or 'rc', not '${BASE}'"
+              fi
+              ;;
+            hotfix/*)
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "main" ]; then
+                ALLOWED=false
+                REASON="Hotfix branches can only target 'dev' or 'main', not '${BASE}'"
+              fi
+              ;;
+            rc)
+              if [ "$BASE" != "main" ]; then
+                ALLOWED=false
+                REASON="RC branch can only merge into 'main', not '${BASE}'"
+              fi
+              ;;
+            dev)
+              if [ "$BASE" != "main" ]; then
+                ALLOWED=false
+                REASON="Dev branch can only merge into 'main', not '${BASE}'"
+              fi
+              ;;
+          esac
+
+          if [ "$ALLOWED" = false ]; then
+            echo "::error::${REASON}"
+            echo "## Branch Policy Violation" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "${REASON}" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
+            echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+          echo "Branch policy: OK (${HEAD} → ${BASE})"
+          echo "## Branch Policy: Passed" >> $GITHUB_STEP_SUMMARY
+
+  # ── Code Validation ────────────────────────────────────────────────────
+  validate:
+    name: Validate PR
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Detect platform
+        id: platform
+        run: |
+          # Read platform from XML manifest (<platform> tag) or plain text fallback
+          PLATFORM=$(sed -n 's/.*<platform>\([^<]*\)<\/platform>.*/\1/p' .mokogitea/manifest.xml 2>/dev/null | head -1)
+          [ -z "$PLATFORM" ] && PLATFORM=$(cat .mokogitea/manifest.xml 2>/dev/null | tr -d '[:space:]')
+          [ -z "$PLATFORM" ] && PLATFORM="generic"
+          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
+
+      - name: Setup PHP
+        if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
+        run: |
+          if ! command -v php &> /dev/null; then
+            sudo apt-get update -qq
+            sudo apt-get install -y -qq php-cli php-mbstring php-xml >/dev/null 2>&1
+          fi
+
+      - name: PHP syntax check
+        if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
+        run: |
+          ERRORS=0
+          while IFS= read -r -d '' file; do
+            if ! php -l "$file" 2>&1 | grep -q "No syntax errors"; then
+              ERRORS=$((ERRORS + 1))
+            fi
+          done < <(find . -name "*.php" -not -path "./.git/*" -not -path "./vendor/*" -print0)
+          echo "PHP lint: ${ERRORS} error(s)"
+          [ "$ERRORS" -eq 0 ] || { echo "::error::PHP syntax errors found"; exit 1; }
+
+      - name: Validate platform manifest
+        run: |
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          case "$PLATFORM" in
+            joomla)
+              MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
+              if [ -z "$MANIFEST" ]; then
+                echo "::warning::No Joomla manifest found (WaaS site)"
+                exit 0
+              fi
+              echo "Manifest: ${MANIFEST}"
+              if command -v php &> /dev/null; then
+                php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('$MANIFEST'); if(!\$x){foreach(libxml_get_errors() as \$e) echo \$e->message; exit(1);}" || { echo "::error::Manifest XML is malformed"; exit 1; }
+              fi
+              for ELEMENT in name version description; do
+                grep -q "<${ELEMENT}>" "$MANIFEST" || { echo "::error::Missing <${ELEMENT}> in manifest"; exit 1; }
+              done
+              echo "Joomla manifest valid"
+              ;;
+            dolibarr)
+              MOD_FILE=$(find . -maxdepth 4 -name "mod*.class.php" ! -path "./.git/*" -exec grep -l 'extends DolibarrModules' {} \; 2>/dev/null | head -1)
+              if [ -z "$MOD_FILE" ]; then
+                echo "::error::No mod*.class.php found"
+                exit 1
+              fi
+              echo "Dolibarr module: ${MOD_FILE}"
+              ;;
+            *)
+              echo "Generic platform — no manifest validation"
+              ;;
+          esac
+
+      - name: Check update stream format
+        run: |
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          case "$PLATFORM" in
+            joomla)
+              if [ -f "updates.xml" ]; then
+                if command -v php &> /dev/null; then
+                  php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('updates.xml'); if(!\$x){foreach(libxml_get_errors() as \$e) echo \$e->message; exit(1);}" || { echo "::error::updates.xml is malformed"; exit 1; }
+                fi
+                echo "updates.xml valid"
+              fi
+              ;;
+            dolibarr)
+              [ -f "update.txt" ] && echo "update.txt present" || echo "::warning::No update.txt"
+              ;;
+          esac
+
+      - name: Check changelog has unreleased entry
+        run: |
+          if [ ! -f "CHANGELOG.md" ]; then
+            echo "::warning::No CHANGELOG.md found"
+            exit 0
+          fi
+          # Check for content under [Unreleased] section
+          if ! grep -q "## \[Unreleased\]" CHANGELOG.md; then
+            echo "::error::CHANGELOG.md missing [Unreleased] section"
+            exit 1
+          fi
+          # Check there's at least one entry (Added/Changed/Fixed/Removed) under Unreleased
+          UNRELEASED_CONTENT=$(sed -n '/## \[Unreleased\]/,/## \[/p' CHANGELOG.md | grep -cE '^\s*-\s' || true)
+          if [ "$UNRELEASED_CONTENT" -eq 0 ]; then
+            echo "::error::CHANGELOG.md [Unreleased] section has no entries. Add a changelog entry describing your changes."
+            echo "## Changelog Check: Failed" >> $GITHUB_STEP_SUMMARY
+            echo "The \`[Unreleased]\` section in CHANGELOG.md has no entries." >> $GITHUB_STEP_SUMMARY
+            echo "Add a line like \`- Description of your change\` under a heading (\`### Added\`, \`### Changed\`, \`### Fixed\`, etc.)" >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+          echo "Changelog: ${UNRELEASED_CONTENT} entry/entries in [Unreleased]"
+
+      - name: Verify package source
+        run: |
+          SOURCE_DIR="src"
+          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
+          if [ ! -d "$SOURCE_DIR" ]; then
+            echo "::warning::No src/ or htdocs/ directory"
+            exit 0
+          fi
+          FILE_COUNT=$(find "$SOURCE_DIR" -type f | wc -l)
+          echo "Source: ${FILE_COUNT} files"
+          [ "$FILE_COUNT" -gt 0 ] || { echo "::error::Source directory is empty"; exit 1; }
+
+  # ── Pre-Release RC Build ─────────────────────────────────────────────────
+  pre-release:
+    name: Build RC Package
+    runs-on: ubuntu-latest
+    needs: [branch-policy, validate]
+
+    steps:
+      - name: Trigger RC pre-release
+        env:
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          REPO: ${{ github.repository }}
+          BRANCH: ${{ github.head_ref }}
+          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+        run: |
+          curl -s -X POST             "${GITEA_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${GITEA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
+          echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY
+          echo "Triggered RC build on branch \`${BRANCH}\`" >> $GITHUB_STEP_SUMMARY

build/index.md

@@ -0,0 +1,19 @@
+# Build Index: /api/build
+
+## Purpose
+
+This folder contains build system management and compilation scripts.
+
+## Quick Links
+
+- [README](./README.md) - Build scripts documentation
+
+## Scripts
+
+- [moko-make](./moko-make) - Build system wrapper
+- [resolve_makefile.py](./resolve_makefile.py) - Makefile resolution
+
+## Metadata
+
+- **Document Type:** index
+- **Auto-generated:** This file is manually maintained for ignored directory

build/moko-make

@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Moko Build Wrapper
+# Automatically finds and uses appropriate Makefile from MokoStandards
+
+set -e
+
+# Colors
+COLOR_RESET="\033[0m"
+COLOR_GREEN="\033[32m"
+COLOR_BLUE="\033[34m"
+COLOR_RED="\033[31m"
+
+# Find MokoStandards root
+find_mokostandards() {
+    # Check environment variable
+    if [ -n "$MOKOSTANDARDS_ROOT" ] && [ -d "$MOKOSTANDARDS_ROOT/templates/build" ]; then
+        echo "$MOKOSTANDARDS_ROOT"
+        return 0
+    fi
+    
+    # Check adjacent directories
+    if [ -d "../MokoStandards/templates/build" ]; then
+        echo "$(cd ../MokoStandards && pwd)"
+        return 0
+    fi
+    
+    if [ -d "../../MokoStandards/templates/build" ]; then
+        echo "$(cd ../../MokoStandards && pwd)"
+        return 0
+    fi
+    
+    # Check home directory
+    if [ -d "$HOME/.mokostandards/templates/build" ]; then
+        echo "$HOME/.mokostandards"
+        return 0
+    fi
+    
+    # Check system location
+    if [ -d "/opt/mokostandards/templates/build" ]; then
+        echo "/opt/mokostandards"
+        return 0
+    fi
+    
+    return 1
+}
+
+# Find appropriate Makefile
+find_makefile() {
+    # Check for local Makefile
+    if [ -f "Makefile" ]; then
+        echo "Makefile"
+        return 0
+    fi
+    
+    # Check for .moko/Makefile
+    if [ -f ".moko/Makefile" ]; then
+        echo ".moko/Makefile"
+        return 0
+    fi
+    
+    # Find MokoStandards
+    MOKO_ROOT=$(find_mokostandards)
+    if [ $? -ne 0 ]; then
+        echo -e "${COLOR_RED}✗${COLOR_RESET} MokoStandards repository not found" >&2
+        echo -e "${COLOR_BLUE}Hint:${COLOR_RESET} Set MOKOSTANDARDS_ROOT or clone adjacent" >&2
+        return 1
+    fi
+    
+    # Detect project type
+    if [ -d "core/modules" ] && ls core/modules/mod*.class.php >/dev/null 2>&1; then
+        echo "$MOKO_ROOT/templates/build/dolibarr/Makefile"
+        return 0
+    fi
+    
+    # Check for Joomla XML files
+    shopt -s nullglob  # Prevent glob expansion if no matches
+    for xml in *.xml; do
+        if [ -f "$xml" ]; then
+            if grep -q 'type="component"' "$xml" 2>/dev/null; then
+                echo "$MOKO_ROOT/templates/build/joomla/Makefile.component"
+                return 0
+            elif grep -q 'type="module"' "$xml" 2>/dev/null; then
+                echo "$MOKO_ROOT/templates/build/joomla/Makefile.module"
+                return 0
+            elif grep -q 'type="plugin"' "$xml" 2>/dev/null; then
+                echo "$MOKO_ROOT/templates/build/joomla/Makefile.plugin"
+                return 0
+            fi
+        fi
+    done
+    shopt -u nullglob
+    
+    echo -e "${COLOR_RED}✗${COLOR_RESET} Could not detect project type" >&2
+    return 1
+}
+
+# Main execution
+MAKEFILE=$(find_makefile)
+if [ $? -ne 0 ]; then
+    exit 1
+fi
+
+# Show which Makefile we're using
+if [[ "$MAKEFILE" == *"MokoStandards"* ]] || [[ "$MAKEFILE" == *".mokostandards"* ]]; then
+    echo -e "${COLOR_BLUE}ℹ${COLOR_RESET} Using MokoStandards template"
+fi
+
+# Run make with the found Makefile
+exec make -f "$MAKEFILE" "$@"

cli/release_publish.php

@@ -34,7 +34,6 @@ class ReleasePublishCli extends CliFramework
         $this->addArgument('--org', 'Organization', '');
         $this->addArgument('--repo', 'Repository name', '');
         $this->addArgument('--repo-url', 'Repository URL for git auth', '');
-        $this->addArgument('--skip-update-stream', 'Skip updates.xml generation and sync (managed externally)', false);
     }
 
     protected function run(): int
@@ -47,8 +46,7 @@ class ReleasePublishCli extends CliFramework
         $giteaUrl  = $this->getArgument('--gitea-url') ?: (getenv('GITEA_URL') ?: 'https://git.mokoconsulting.tech');
         $org       = $this->getArgument('--org') ?: (getenv('GITEA_ORG') ?: '');
         $repo      = $this->getArgument('--repo') ?: (getenv('GITEA_REPO') ?: '');
-        $repoUrl           = $this->getArgument('--repo-url');
-        $skipUpdateStream  = $this->getArgument('--skip-update-stream');
+        $repoUrl   = $this->getArgument('--repo-url');
 
         if (empty($stability) || empty($token)) {
             $this->log('ERROR', "Usage: release_publish.php --stability <dev|alpha|beta|rc|stable> --token TOKEN [options]");
@@ -297,71 +295,66 @@ class ReleasePublishCli extends CliFramework
         // -- Step 4: No lesser stream copies --
         echo "\n--- Step 4: Skipped (no lesser stream copies) ---\n";
 
-        if ($skipUpdateStream) {
-            echo "\n--- Step 5: Skipped (--skip-update-stream) ---\n";
-            echo "\n--- Step 6: Skipped (--skip-update-stream) ---\n";
-        } else {
-            // -- Step 5: Update ONLY this stream in updates.xml --
-            echo "\n--- Step 5: Update {$stability} stream in updates.xml ---\n";
-            $streamsToWrite = [$stability];
+        // -- Step 5: Update ONLY this stream in updates.xml --
+        echo "\n--- Step 5: Update {$stability} stream in updates.xml ---\n";
+        $streamsToWrite = [$stability];
 
-            foreach ($streamsToWrite as $stream) {
-                $streamVersion = $releaseVersion;
-                $shaFlag = !empty($sha256) ? "--sha {$sha256}" : '';
-
-                echo "  Writing {$stream} stream: {$streamVersion}\n";
-                if (!$this->dryRun) {
-                    passthru("{$php} {$cli}/updates_xml_build.php --path " . escapeshellarg($path)
-                        . " --version " . escapeshellarg($streamVersion)
-                        . " --stability " . escapeshellarg($stream)
-                        . " --gitea-url " . escapeshellarg($giteaUrl)
-                        . " --org " . escapeshellarg($org)
-                        . " --repo " . escapeshellarg($repo)
-                        . " {$shaFlag} 2>&1");
-                }
-            }
-
-            // -- Step 6: Commit updates.xml and sync to all branches --
-            echo "\n--- Step 6: Commit and sync updates.xml ---\n";
-            $root = realpath($path) ?: $path;
+        foreach ($streamsToWrite as $stream) {
+            $streamVersion = $releaseVersion;
+            $shaFlag = !empty($sha256) ? "--sha {$sha256}" : '';
 
+            echo "  Writing {$stream} stream: {$streamVersion}\n";
             if (!$this->dryRun) {
-                $cdX = PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ";
-                $cdRt = $cdX . escapeshellarg($root);
-                $diffCheck = trim((string) @shell_exec(
-                    $cdRt . " && git diff --quiet updates.xml"
-                    . " 2>&1 && echo clean || echo dirty"
-                ));
-                if ($diffCheck === 'dirty') {
-                    @shell_exec($cdRt . " && git add updates.xml");
-                    $chMsg = "chore: update channels for"
-                        . " {$releaseVersion} [skip ci]";
-                    @shell_exec(
-                        $cdRt . " && git commit -m "
-                        . escapeshellarg($chMsg)
-                        . " --author=\"gitea-actions[bot]"
-                        . " <gitea-actions[bot]@mokoconsulting.tech>\""
-                    );
-                    @shell_exec(
-                        $cdRt . " && git push origin "
-                        . escapeshellarg($branch) . " 2>&1"
-                    );
-                    echo "  Committed updates.xml\n";
-                }
-
-                // Sync to all branches
-                passthru("{$php} {$cli}/updates_xml_sync.php --path " . escapeshellarg($path)
-                    . " --current " . escapeshellarg($branch) . " --all"
-                    . " --version " . escapeshellarg($releaseVersion)
-                    . " --token " . escapeshellarg($token)
+                passthru("{$php} {$cli}/updates_xml_build.php --path " . escapeshellarg($path)
+                    . " --version " . escapeshellarg($streamVersion)
+                    . " --stability " . escapeshellarg($stream)
                     . " --gitea-url " . escapeshellarg($giteaUrl)
                     . " --org " . escapeshellarg($org)
-                    . " --repo " . escapeshellarg($repo) . " 2>&1");
-            } else {
-                echo "[DRY-RUN] Would commit updates.xml and sync to all branches\n";
+                    . " --repo " . escapeshellarg($repo)
+                    . " {$shaFlag} 2>&1");
             }
         }
 
+        // -- Step 6: Commit updates.xml and sync to all branches --
+        echo "\n--- Step 6: Commit and sync updates.xml ---\n";
+        $root = realpath($path) ?: $path;
+
+        if (!$this->dryRun) {
+            $cdX = PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ";
+            $cdRt = $cdX . escapeshellarg($root);
+            $diffCheck = trim((string) @shell_exec(
+                $cdRt . " && git diff --quiet updates.xml"
+                . " 2>&1 && echo clean || echo dirty"
+            ));
+            if ($diffCheck === 'dirty') {
+                @shell_exec($cdRt . " && git add updates.xml");
+                $chMsg = "chore: update channels for"
+                    . " {$releaseVersion} [skip ci]";
+                @shell_exec(
+                    $cdRt . " && git commit -m "
+                    . escapeshellarg($chMsg)
+                    . " --author=\"gitea-actions[bot]"
+                    . " <gitea-actions[bot]@mokoconsulting.tech>\""
+                );
+                @shell_exec(
+                    $cdRt . " && git push origin "
+                    . escapeshellarg($branch) . " 2>&1"
+                );
+                echo "  Committed updates.xml\n";
+            }
+
+            // Sync to all branches
+            passthru("{$php} {$cli}/updates_xml_sync.php --path " . escapeshellarg($path)
+                . " --current " . escapeshellarg($branch) . " --all"
+                . " --version " . escapeshellarg($releaseVersion)
+                . " --token " . escapeshellarg($token)
+                . " --gitea-url " . escapeshellarg($giteaUrl)
+                . " --org " . escapeshellarg($org)
+                . " --repo " . escapeshellarg($repo) . " 2>&1");
+        } else {
+            echo "[DRY-RUN] Would commit updates.xml and sync to all branches\n";
+        }
+
         echo "\n=== Release published: {$releaseVersion} ===\n";
 
         // Output for CI

cli/version_auto_bump.php

@@ -109,10 +109,18 @@ class VersionAutoBumpCli extends CliFramework
             echo "{$line}\n";
         }
 
-        // Step 2: Read version
+        // Step 2: Read version (--quiet suppresses banner so only the version is output)
         $versionOutput = [];
-        exec("{$php} {$cli}/version_read.php --path " . escapeshellarg($path) . " 2>&1", $versionOutput, $versionRc);
-        $version = trim($versionOutput[0] ?? '');
+        exec("{$php} {$cli}/version_read.php --path " . escapeshellarg($path) . " --quiet 2>&1", $versionOutput, $versionRc);
+        // Take the last non-empty line — the version is always the final output
+        $version = '';
+        foreach (array_reverse($versionOutput) as $line) {
+            $line = trim($line);
+            if (preg_match('/^\d{2}\.\d{2}\.\d{2}/', $line)) {
+                $version = $line;
+                break;
+            }
+        }
 
         if (empty($version)) {
             echo "No version found — skipping\n";

cli/version_set_platform.php

@@ -53,6 +53,12 @@ class VersionSetPlatformCli extends CliFramework
         // Strip any existing suffix(es) before applying the correct one
         $version = preg_replace('/(-(dev|alpha|beta|rc))+$/', '', $version);
 
+        // Validate version format — must be XX.YY.ZZ to prevent XML corruption
+        if (!preg_match('/^\d{2}\.\d{2}\.\d{2}$/', $version)) {
+            $this->log('ERROR', "Invalid version format: '{$version}' — expected XX.YY.ZZ");
+            return 1;
+        }
+
         // Append stability suffix for non-stable releases
         $stabilitySuffixMap = [
             'stable'            => '',

lib/Enterprise/CliFramework.php

@@ -141,6 +141,26 @@ abstract class CliFramework
     /** @var float Script start time for elapsed-time reporting. */
     private float $startTime;
 
+    // =========================================================================
+    // Display output — all decorative output goes to stderr
+    // =========================================================================
+
+    /**
+     * Write decorative/diagnostic output to stderr.
+     *
+     * All non-data output (banners, progress bars, section headers, status
+     * lines, log messages) MUST use this method so that stdout is reserved
+     * for machine-readable data.  This ensures that shell captures like
+     *   VERSION=$(php version_read.php --path .)
+     * only receive the actual data, not decorative text.
+     *
+     * @since 04.00.16
+     */
+    protected function display(string $text): void
+    {
+        fwrite(STDERR, $text);
+    }
+
     // =========================================================================
     // Constructor
     // =========================================================================
@@ -326,14 +346,14 @@ abstract class CliFramework
     protected function printHelp(): void
     {
         $w = $this->termWidth();
-        echo $this->c(self::C_BOLD . self::C_CYAN, $this->scriptName);
+        $this->display($this->c(self::C_BOLD . self::C_CYAN, $this->scriptName));
         if ($this->description !== '') {
-            echo ' — ' . $this->description;
+            $this->display(' — ' . $this->description);
         }
-        echo "\n";
-        echo $this->c(self::C_DIM, str_repeat(self::BOX_H, $w)) . "\n\n";
-        echo $this->c(self::C_BOLD, 'Usage:') . "  php {$this->scriptName}.php [options]\n\n";
-        echo $this->c(self::C_BOLD, 'Options:') . "\n";
+        $this->display("\n");
+        $this->display($this->c(self::C_DIM, str_repeat(self::BOX_H, $w)) . "\n\n");
+        $this->display($this->c(self::C_BOLD, 'Usage:') . "  php {$this->scriptName}.php [options]\n\n");
+        $this->display($this->c(self::C_BOLD, 'Options:') . "\n");
 
         $builtIn = [
             '--help'     => ['desc' => 'Show this help message',             'default' => null],
@@ -348,16 +368,16 @@ abstract class CliFramework
             $hint    = ($default !== null && $default !== false)
                 ? $this->c(self::C_DIM, "  (default: {$default})")
                 : '';
-            printf(
+            $this->display(sprintf(
                 "  %s%-22s%s%s%s\n",
                 self::C_CYAN,
                 $name,
                 self::C_RESET,
                 $def['desc'],
                 $hint
-            );
+            ));
         }
-        echo "\n";
+        $this->display("\n");
     }
 
     // =========================================================================
@@ -378,23 +398,23 @@ abstract class CliFramework
         $titleLine   = $this->padRight($titleStyled, $inner, strlen($titleRaw));
         $descLine    = ($desc !== '') ? $this->padRight(" {$desc}", $inner) : null;
 
-        echo "\n";
-        echo $this->c(
+        $this->display("\n");
+        $this->display($this->c(
             self::C_CYAN,
             self::BOX_TL . str_repeat(self::BOX_H, $inner) . self::BOX_TR
-        ) . "\n";
-        echo $this->c(self::C_CYAN, self::BOX_V)
+        ) . "\n");
+        $this->display($this->c(self::C_CYAN, self::BOX_V)
             . $this->c(self::C_BOLD, $titleLine)
-            . $this->c(self::C_CYAN, self::BOX_V) . "\n";
+            . $this->c(self::C_CYAN, self::BOX_V) . "\n");
         if ($descLine !== null) {
-            echo $this->c(self::C_CYAN, self::BOX_V)
+            $this->display($this->c(self::C_CYAN, self::BOX_V)
                 . $this->c(self::C_DIM, $descLine)
-                . $this->c(self::C_CYAN, self::BOX_V) . "\n";
+                . $this->c(self::C_CYAN, self::BOX_V) . "\n");
         }
-        echo $this->c(
+        $this->display($this->c(
             self::C_CYAN,
             self::BOX_BL . str_repeat(self::BOX_H, $inner) . self::BOX_BR
-        ) . "\n\n";
+        ) . "\n\n");
     }
 
     /** Print the dry-run notice box. */
@@ -403,18 +423,18 @@ abstract class CliFramework
         $w   = min($this->termWidth(), 70);
         $msg = '  ' . self::ICON_DRY . '  DRY-RUN MODE — no changes will be written  ';
         $row = $this->padRight($msg, $w - 2);
-        echo $this->c(
+        $this->display($this->c(
             self::C_YELLOW . self::C_BOLD,
             self::BOX_TL . str_repeat(self::BOX_H, $w - 2) . self::BOX_TR
-        ) . "\n";
-        echo $this->c(
+        ) . "\n");
+        $this->display($this->c(
             self::C_YELLOW . self::C_BOLD,
             self::BOX_V . $row . self::BOX_V
-        ) . "\n";
-        echo $this->c(
+        ) . "\n");
+        $this->display($this->c(
             self::C_YELLOW . self::C_BOLD,
             self::BOX_BL . str_repeat(self::BOX_H, $w - 2) . self::BOX_BR
-        ) . "\n\n";
+        ) . "\n\n");
     }
 
     // =========================================================================
@@ -435,11 +455,11 @@ abstract class CliFramework
         $w    = $this->termWidth();
         $text = " {$title} ";
         $fill = max(0, $w - strlen($text) - 4);
-        echo "\n";
-        echo $this->c(
+        $this->display("\n");
+        $this->display($this->c(
             self::C_CYAN,
             str_repeat(self::BOX_H, 2) . $text . str_repeat(self::BOX_H, $fill)
-        ) . "\n\n";
+        ) . "\n\n");
     }
 
     /** Print a plain horizontal divider. */
@@ -449,7 +469,7 @@ abstract class CliFramework
             return;
         }
         $this->clearProgress();
-        echo $this->c(self::C_DIM, str_repeat(self::BOX_H, $this->termWidth())) . "\n";
+        $this->display($this->c(self::C_DIM, str_repeat(self::BOX_H, $this->termWidth())) . "\n");
     }
 
     // =========================================================================
@@ -495,11 +515,7 @@ abstract class CliFramework
 
         $line = "{$ts} {$icon} {$badge} {$text}\n";
 
-        if ($level === 'ERROR') {
-            fwrite(STDERR, $line);
-        } else {
-            echo $line;
-        }
+        $this->display($line);
     }
 
     /** Log a success message. */
@@ -564,7 +580,7 @@ abstract class CliFramework
             ? '  ' . $this->c(self::C_DIM, "— {$detail}")
             : '';
 
-        echo '  ' . $this->c($color . self::C_BOLD, $icon) . '  ' . $label . $suffix . "\n";
+        $this->display('  ' . $this->c($color . self::C_BOLD, $icon) . '  ' . $label . $suffix . "\n");
     }
 
     // =========================================================================
@@ -601,10 +617,10 @@ abstract class CliFramework
         $line = "  [{$bar}] {$percent}  {$counter}{$suffix}";
 
         if ($newline) {
-            echo "\r{$line}\n";
+            $this->display("\r{$line}\n");
             $this->progressActive = false;
         } else {
-            echo "\r{$line}";
+            $this->display("\r{$line}");
             $this->progressActive = true;
         }
     }
@@ -613,7 +629,7 @@ abstract class CliFramework
     protected function clearProgress(): void
     {
         if ($this->progressActive) {
-            echo "\r" . str_repeat(' ', $this->termWidth()) . "\r";
+            $this->display("\r" . str_repeat(' ', $this->termWidth()) . "\r");
             $this->progressActive = false;
         }
     }
@@ -644,8 +660,8 @@ abstract class CliFramework
         $maxKey = max(array_map('strlen', array_keys($rows)));
         $inner  = $maxKey + 20;
 
-        echo "\n";
-        echo $this->c($color, self::BOX_TL . str_repeat(self::BOX_H, $inner) . self::BOX_TR) . "\n";
+        $this->display("\n");
+        $this->display($this->c($color, self::BOX_TL . str_repeat(self::BOX_H, $inner) . self::BOX_TR) . "\n");
 
         foreach ($rows as $label => $value) {
             $valStr    = (string) $value;
@@ -653,10 +669,10 @@ abstract class CliFramework
             $padding   = $inner - strlen($label) - $valVis - 4;
             $row       = '  ' . $this->c(self::C_BOLD, $label)
                 . str_repeat(' ', max(1, $padding)) . $valStr . '  ';
-            echo $this->c($color, self::BOX_V) . $row . $this->c($color, self::BOX_V) . "\n";
+            $this->display($this->c($color, self::BOX_V) . $row . $this->c($color, self::BOX_V) . "\n");
         }
 
-        echo $this->c($color, self::BOX_BL . str_repeat(self::BOX_H, $inner) . self::BOX_BR) . "\n\n";
+        $this->display($this->c($color, self::BOX_BL . str_repeat(self::BOX_H, $inner) . self::BOX_BR) . "\n\n");
     }
 
     /**
@@ -702,7 +718,7 @@ abstract class CliFramework
         $this->clearProgress();
         $badge = $this->c(self::C_BOLD . self::C_MAGENTA, "Step {$current}/{$total}");
         $arrow = $this->c(self::C_DIM, self::ICON_INFO);
-        echo "\n{$badge}  {$arrow}  {$title}\n";
+        $this->display("\n{$badge}  {$arrow}  {$title}\n");
     }
 
     // =========================================================================
@@ -964,13 +980,13 @@ abstract class CliFramework
         }
 
         // Header.
-        echo $sep . "\n";
+        $this->display($sep . "\n");
         $headerLine = '|';
         foreach ($headers as $i => $h) {
             $headerLine .= ' ' . $this->c(self::C_BOLD, str_pad($h, $widths[$i])) . ' |';
         }
-        echo $headerLine . "\n";
-        echo $sep . "\n";
+        $this->display($headerLine . "\n");
+        $this->display($sep . "\n");
 
         // Rows.
         foreach ($rows as $row) {
@@ -978,9 +994,9 @@ abstract class CliFramework
             foreach ($row as $i => $cell) {
                 $line .= ' ' . str_pad((string) $cell, $widths[$i]) . ' |';
             }
-            echo $line . "\n";
+            $this->display($line . "\n");
         }
-        echo $sep . "\n";
+        $this->display($sep . "\n");
     }
 }