From 629c6b02c28d0ae034aeb0db46db16a03badb432 Mon Sep 17 00:00:00 2001
From: Nicolas Brieussel <nicolasbrieussel@Host-001.lan>
Date: Tue, 30 Jun 2026 17:10:46 +0200
Subject: [PATCH] feat: add openbao

---
 .github/copilot-instructions.md               |  79 ---
 .github/workflows/backup_scaleway.yml         | 125 ----
 .gitignore                                    |   2 +
 .specify/extensions.yml                       |  23 -
 .specify/extensions/.registry                 |  19 -
 .specify/extensions/agent-context/README.md   |  57 --
 .../agent-context/agent-context-config.yml    |   4 -
 .../commands/speckit.agent-context.update.md  |  26 -
 .../extensions/agent-context/extension.yml    |  34 -
 .../scripts/bash/update-agent-context.sh      | 200 ------
 .../powershell/update-agent-context.ps1       | 237 -------
 .specify/feature.json                         |   3 -
 .specify/init-options.json                    |   9 -
 .specify/integration.json                     |  15 -
 .specify/integrations/claude.manifest.json    |  17 -
 .specify/integrations/speckit.manifest.json   |  17 -
 .specify/memory/constitution.md               |  50 --
 .specify/scripts/bash/check-prerequisites.sh  | 189 ------
 .specify/scripts/bash/common.sh               | 619 ------------------
 .specify/scripts/bash/create-new-feature.sh   | 299 ---------
 .specify/scripts/bash/setup-plan.sh           |  84 ---
 .specify/scripts/bash/setup-tasks.sh          |  91 ---
 .specify/templates/checklist-template.md      |  40 --
 .specify/templates/constitution-template.md   |  50 --
 .specify/templates/plan-template.md           | 113 ----
 .specify/templates/spec-template.md           | 131 ----
 .specify/templates/tasks-template.md          | 252 -------
 .specify/workflows/speckit/workflow.yml       |  77 ---
 .specify/workflows/workflow-registry.json     |  13 -
 .../local/env/02-cluster-local-example.tfvars |  13 +
 02-cluster/local/env/02-cluster-local.tfvars  |   8 -
 02-cluster/local/main.tf                      |  44 +-
 02-cluster/local/variables.tf                 |  27 +
 03-backup/scaleway/iam.tf                     |   4 +-
 03-backup/scaleway/infisical.tf               |  23 -
 03-backup/scaleway/kms.tf                     | 115 ++++
 03-backup/scaleway/outputs.tf                 |  34 +
 03-backup/scaleway/variables.tf               |   6 +
 03-backup/scaleway/version.tf                 |  29 +-
 mise.toml                                     |   2 +-
 modules/README.md                             |  12 -
 41 files changed, 266 insertions(+), 2926 deletions(-)
 delete mode 100644 .github/copilot-instructions.md
 delete mode 100644 .github/workflows/backup_scaleway.yml
 delete mode 100644 .specify/extensions.yml
 delete mode 100644 .specify/extensions/.registry
 delete mode 100644 .specify/extensions/agent-context/README.md
 delete mode 100644 .specify/extensions/agent-context/agent-context-config.yml
 delete mode 100644 .specify/extensions/agent-context/commands/speckit.agent-context.update.md
 delete mode 100644 .specify/extensions/agent-context/extension.yml
 delete mode 100755 .specify/extensions/agent-context/scripts/bash/update-agent-context.sh
 delete mode 100644 .specify/extensions/agent-context/scripts/powershell/update-agent-context.ps1
 delete mode 100644 .specify/feature.json
 delete mode 100644 .specify/init-options.json
 delete mode 100644 .specify/integration.json
 delete mode 100644 .specify/integrations/claude.manifest.json
 delete mode 100644 .specify/integrations/speckit.manifest.json
 delete mode 100644 .specify/memory/constitution.md
 delete mode 100755 .specify/scripts/bash/check-prerequisites.sh
 delete mode 100755 .specify/scripts/bash/common.sh
 delete mode 100755 .specify/scripts/bash/create-new-feature.sh
 delete mode 100755 .specify/scripts/bash/setup-plan.sh
 delete mode 100755 .specify/scripts/bash/setup-tasks.sh
 delete mode 100644 .specify/templates/checklist-template.md
 delete mode 100644 .specify/templates/constitution-template.md
 delete mode 100644 .specify/templates/plan-template.md
 delete mode 100644 .specify/templates/spec-template.md
 delete mode 100644 .specify/templates/tasks-template.md
 delete mode 100644 .specify/workflows/speckit/workflow.yml
 delete mode 100644 .specify/workflows/workflow-registry.json
 create mode 100644 02-cluster/local/env/02-cluster-local-example.tfvars
 delete mode 100644 02-cluster/local/env/02-cluster-local.tfvars
 delete mode 100644 03-backup/scaleway/infisical.tf
 create mode 100644 03-backup/scaleway/kms.tf
 delete mode 100644 modules/README.md

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
deleted file mode 100644
index c3ea3d9..0000000
--- a/.github/copilot-instructions.md
+++ /dev/null
@@ -1,79 +0,0 @@
----
-name: "IntegratedDynamic Infrastructure - Configuration"
-description: "Conventions de projet et préférences de codage pour l'infrastructure"
----
-
-# Instructions pour GitHub Copilot
-
-## Onboarding
-
-### Gestion des dépendances
-
-Les dépendances du projet sont gérées via **mise**.
-
-**Installation** :
-```bash
-mise install
-```
-
-ℹ️ **Automatique** : Une fois `mise.toml` modifié, `mise install` se lance automatiquement via un hook.
-
-## Conventions de code
-
-### Branches
-
-Je dois TOUJOURS utiliser [Conventional Branch](https://conventional-branch.github.io/).
-
-Format strict:
-```
-<type>/<description>
-```
-
-Types: `feature/`, `bugfix/`, `hotfix/`, `ci/`, `chore/`
-
-Exemples:
-- `feature/add-authentication-middleware`
-- `bugfix/fix-memory-leak`
-- `ci/add-github-actions-workflow`
-
-Règles obligatoires:
-- Minuscules, chiffres, hyphens et dots uniquement
-- Pas de hyphens/dots consécutifs ou aux extrémités
-- Inclure ticket number si applicable: `feature/issue-456-add-auth`
-
-### Commits
-
-Utiliser [Conventional Commits](https://www.conventionalcommits.org/) :
-```
-<type>[scope]: <description>
-```
-
-Types : `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `chore`
-
-### Pull Requests
-
-**Titre** : Doit être descriptif et clair. Format recommandé avec type et description.
-```
-<type>: Clear description of what the PR does
-```
-
-**Body** : Contexte, changements, issues liées (via `Closes #123`), et instructions de test.
-
-**Comportement automatique** : Après chaque `commit` + `push` sur une branche, créer automatiquement une PR en **draft** (si elle n'existe pas déjà) avec titre et body appropriés.
-
-Utiliser [Conventional Comments](https://conventionalcomments.org/) pour les reviews :
-```
-<label> [decorations]: <subject>
-```
-
-Labels : `praise`, `nitpick`, `suggestion`, `issue`, `todo`, `question`, `thought`
-
-Voir [CONTRIBUTING.md](../CONTRIBUTING.md) pour plus de détails.
-
-## Structure du projet
-
-## Technologies et frameworks
-
-## Pratiques de développement
-
-## Points importants à retenir
diff --git a/.github/workflows/backup_scaleway.yml b/.github/workflows/backup_scaleway.yml
deleted file mode 100644
index 043e17c..0000000
--- a/.github/workflows/backup_scaleway.yml
+++ /dev/null
@@ -1,125 +0,0 @@
-name: Terraform — Scaleway backup bucket
-
-# Drives 03-backup/scaleway through the .github/actions/terraform composite action.
-#
-# Domain restriction — NO DESTROY in CI (FR-013):
-#   The backup domain is intentionally permanent infrastructure. Destroying the
-#   bucket from CI would silently erase production backups. Destruction must be
-#   a deliberate admin action with elevated credentials outside of this pipeline.
-#   Enforcement is layered:
-#     1. No `destroy` option in workflow_dispatch (this file).
-#     2. No `schedule → destroy` mapping in the command-resolution step.
-#     3. `prevent_destroy = true` in 03-backup/scaleway/main.tf blocks
-#        `terraform destroy` even if someone runs it manually against this root.
-#
-# Trigger → command mapping:
-#   pull_request  → plan   (safety check, never mutates state)
-#   push to main  → apply  (the only automated mutation path)
-#   workflow_dispatch → plan | apply  (operator override, explicit choice)
-#
-# State R/W uses the org state role (vars.AWS_TF_STATE_ROLE_ARN).
-# Scaleway creds come from the `scaleway` environment.
-
-on:
-  pull_request:
-    paths:
-      - '03-backup/scaleway/**'
-      - '.github/actions/terraform/**'
-      - '.github/workflows/backup_scaleway.yml'
-  push:
-    branches: [main]
-    paths:
-      - '03-backup/scaleway/**'
-      - '.github/actions/terraform/**'
-      - '.github/workflows/backup_scaleway.yml'
-  workflow_dispatch:
-    inputs:
-      command:
-        description: 'Terraform command. destroy is not available — see domain restriction above.'
-        type: choice
-        options: [plan, apply]
-        default: plan
-
-# Concurrency is keyed on the Terraform workspace, not the branch.
-# cancel-in-progress is false: Terraform state corruption from mid-run
-# interrupts is far worse than waiting in queue.
-concurrency:
-  group: backup-scaleway-03-backup-dev-bucket
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-jobs:
-  terraform:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    environment: scaleway
-    permissions:
-      id-token: write # mint OIDC tokens for AWS + Infisical
-      contents: read
-    env:
-      SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
-      SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
-      SCW_DEFAULT_ORGANIZATION_ID: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }}
-      SCW_DEFAULT_PROJECT_ID: ${{ vars.SCW_DEFAULT_PROJECT_ID }}
-      INFISICAL_MACHINE_IDENTITY_ID: ${{ vars.INFISICAL_MACHINE_IDENTITY_ID }}
-    steps:
-      - name: Assert state role ARN is present
-        env:
-          ROLE_ARN: ${{ vars.AWS_TF_STATE_ROLE_ARN }}
-        run: |
-          if [ -z "$ROLE_ARN" ]; then
-            echo "::error::vars.AWS_TF_STATE_ROLE_ARN is not set (provisioned by 01-iam/ci-managed/aws-state-access)."
-            exit 1
-          fi
-
-      # Maps the GitHub event to a Terraform command.
-      # push → apply is the only automated mutation path (main branch only, per `on.push.branches`).
-      # workflow_dispatch lets an operator force plan or apply without a code change.
-      # Everything else (pull_request, etc.) stays read-only with plan.
-      - name: Resolve terraform command
-        id: cmd
-        env:
-          EVENT: ${{ github.event_name }}
-          DISPATCH_CMD: ${{ github.event.inputs.command }}
-        run: |
-          case "$EVENT" in
-            push)              cmd=apply ;;
-            workflow_dispatch) cmd="${DISPATCH_CMD:-plan}" ;;
-            *)                 cmd=plan ;;
-          esac
-          echo "command=$cmd" >> "$GITHUB_OUTPUT"
-          echo "Resolved terraform command: $cmd (event: $EVENT)"
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-          fetch-depth: 1
-
-      - uses: ./.github/actions/terraform
-        with:
-          root: 03-backup/scaleway
-          tfvars-file: 03-backup-dev-bucket.tfvars
-          command: ${{ steps.cmd.outputs.command }}
-          aws-role-arn: ${{ vars.AWS_TF_STATE_ROLE_ARN }}
-
-      # The backup bucket is permanent infrastructure — state always exists regardless
-      # of the terraform command. Read outputs unconditionally so downstream steps
-      # always have the live values from state rather than hardcoded strings.
-      - name: Read Terraform outputs
-        id: tf-outputs
-        run: |
-          outputs=$(terraform -chdir=03-backup/scaleway output -json)
-          echo "bucket_name=$(echo "$outputs" | jq -r '.bucket_name.value')" >> "$GITHUB_OUTPUT"
-          echo "bucket_region=$(echo "$outputs" | jq -r '.bucket_region.value')" >> "$GITHUB_OUTPUT"
-
-      - name: Verify backup bucket exists
-        if: steps.cmd.outputs.command == 'apply'
-        env:
-          BUCKET_NAME: ${{ steps.tf-outputs.outputs.bucket_name }}
-          BUCKET_REGION: ${{ steps.tf-outputs.outputs.bucket_region }}
-        run: |
-          curl -fsSL https://raw.githubusercontent.com/scaleway/scaleway-cli/master/scripts/get.sh | sh
-          export PATH="$HOME/.local/bin:$PATH"
-          scw object bucket get "$BUCKET_NAME" --region "$BUCKET_REGION"
diff --git a/.gitignore b/.gitignore
index f30d2f8..c70a600 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,3 +35,5 @@ override.tf.json
 # Ignore CLI configuration files
 .terraformrc
 terraform.rc
+
+.specify
diff --git a/.specify/extensions.yml b/.specify/extensions.yml
deleted file mode 100644
index 5415714..0000000
--- a/.specify/extensions.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-installed:
-- agent-context
-settings:
-  auto_execute_hooks: true
-hooks:
-  after_specify:
-  - extension: agent-context
-    command: speckit.agent-context.update
-    enabled: true
-    optional: true
-    priority: 10
-    prompt: Execute speckit.agent-context.update?
-    description: Refresh agent context after specification
-    condition: null
-  after_plan:
-  - extension: agent-context
-    command: speckit.agent-context.update
-    enabled: true
-    optional: true
-    priority: 10
-    prompt: Execute speckit.agent-context.update?
-    description: Refresh agent context after planning
-    condition: null
diff --git a/.specify/extensions/.registry b/.specify/extensions/.registry
deleted file mode 100644
index 21a7adc..0000000
--- a/.specify/extensions/.registry
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "schema_version": "1.0",
-  "extensions": {
-    "agent-context": {
-      "version": "1.0.0",
-      "source": "local",
-      "manifest_hash": "sha256:9a1dc02d2d0139bb03860392ecacef79183be2c442feda2f9ccaa4e5907b1e47",
-      "enabled": true,
-      "priority": 10,
-      "registered_commands": {
-        "claude": [
-          "speckit.agent-context.update"
-        ]
-      },
-      "registered_skills": [],
-      "installed_at": "2026-06-20T12:54:56.334988+00:00"
-    }
-  }
-}
\ No newline at end of file
diff --git a/.specify/extensions/agent-context/README.md b/.specify/extensions/agent-context/README.md
deleted file mode 100644
index dba004e..0000000
--- a/.specify/extensions/agent-context/README.md
+++ /dev/null
@@ -1,57 +0,0 @@
-# Coding Agent Context Extension
-
-This bundled extension manages the **coding agent context/instruction file** (e.g. `CLAUDE.md`, `.github/copilot-instructions.md`, `AGENTS.md`, `GEMINI.md`, …) for the active integration.
-
-It owns the lifecycle of the managed section delimited by the configurable start/end markers (defaults: `<!-- SPECKIT START -->` / `<!-- SPECKIT END -->`).
-
-## Why an extension?
-
-Not every Spec Kit user wants Spec Kit to write into the coding agent's context file. Extracting this behavior into a dedicated extension lets users:
-
-- **Opt out** entirely with `specify extension disable agent-context` — Spec Kit will then never create or modify the agent context file.
-- **Customize the markers** by editing `.specify/extensions/agent-context/agent-context-config.yml` — both the Python layer and the bundled scripts honor the same `context_markers` value.
-- **Refresh on demand** with `/speckit.agent-context.update`, or automatically through the hooks declared in `extension.yml` (`after_specify`, `after_plan`).
-
-## Commands
-
-| Command | Description |
-|---------|-------------|
-| `speckit.agent-context.update` | Refresh the managed section in the agent context file with the current plan path. |
-
-## Configuration
-
-All configuration flows through the extension's own config file at
-`.specify/extensions/agent-context/agent-context-config.yml`:
-
-```yaml
-# Path to the coding agent context file managed by this extension
-context_file: CLAUDE.md
-
-# Delimiters for the managed Spec Kit section
-context_markers:
-  start: "<!-- SPECKIT START -->"
-  end: "<!-- SPECKIT END -->"
-```
-
-- `context_file` — the project-relative path to the coding agent context file, written by `specify init` and `specify integration install`.
-- `context_markers.start` / `.end` — the delimiters around the managed section. Edit these to use custom markers.
-
-## Requirements
-
-The bundled update scripts require **Python 3** with **PyYAML** for YAML/upsert processing (PowerShell can also use `ConvertFrom-Yaml` when available).
-
-PyYAML ships with the `specify` CLI and is normally available via the same `python3` interpreter. If a hook reports *"PyYAML is required … not available in the current Python environment"*, it means the system `python3` differs from the one used to install Spec Kit. To resolve, run:
-
-```bash
-pip install pyyaml
-# or target the specific interpreter Spec Kit uses:
-/path/to/speckit-python -m pip install pyyaml
-```
-
-## Disable
-
-```bash
-specify extension disable agent-context
-```
-
-When disabled, Spec Kit skips context file creation, updates, and removal (the gates are inside `upsert_context_section()` and `remove_context_section()`).
diff --git a/.specify/extensions/agent-context/agent-context-config.yml b/.specify/extensions/agent-context/agent-context-config.yml
deleted file mode 100644
index 9dc59ba..0000000
--- a/.specify/extensions/agent-context/agent-context-config.yml
+++ /dev/null
@@ -1,4 +0,0 @@
-context_file: CLAUDE.md
-context_markers:
-  start: <!-- SPECKIT START -->
-  end: <!-- SPECKIT END -->
diff --git a/.specify/extensions/agent-context/commands/speckit.agent-context.update.md b/.specify/extensions/agent-context/commands/speckit.agent-context.update.md
deleted file mode 100644
index 02f1706..0000000
--- a/.specify/extensions/agent-context/commands/speckit.agent-context.update.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-description: "Refresh the managed Spec Kit section in the coding agent context file"
----
-
-# Update Coding Agent Context
-
-Refresh the managed Spec Kit section inside the active coding agent's context/instruction file (e.g. `CLAUDE.md`, `.github/copilot-instructions.md`, `AGENTS.md`).
-
-## Behavior
-
-The script reads the agent-context extension config at
-`.specify/extensions/agent-context/agent-context-config.yml` to discover:
-
-- `context_file` — the path of the coding agent context file to manage.
-- `context_markers.start` / `.end` — the delimiters surrounding the managed section. Defaults to `<!-- SPECKIT START -->` and `<!-- SPECKIT END -->` when the field is missing.
-
-It then creates, replaces, or appends the managed block so that the section points at the most recent plan path when one can be discovered (`specs/<feature>/plan.md`).
-
-If `context_file` is empty or the file cannot be located, the command reports nothing to do and exits successfully.
-
-## Execution
-
-- **Bash**: `.specify/extensions/agent-context/scripts/bash/update-agent-context.sh [plan_path]`
-- **PowerShell**: `.specify/extensions/agent-context/scripts/powershell/update-agent-context.ps1 [plan_path]`
-
-When `plan_path` is omitted, the script auto-detects the most recently modified `specs/*/plan.md`.
diff --git a/.specify/extensions/agent-context/extension.yml b/.specify/extensions/agent-context/extension.yml
deleted file mode 100644
index 191069e..0000000
--- a/.specify/extensions/agent-context/extension.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-schema_version: "1.0"
-
-extension:
-  id: agent-context
-  name: "Coding Agent Context"
-  version: "1.0.0"
-  description: "Manages coding agent context/instruction files (e.g., CLAUDE.md, copilot-instructions.md) with project-specific plan references and configurable markers"
-  author: spec-kit-core
-  repository: https://github.com/github/spec-kit
-  license: MIT
-
-requires:
-  speckit_version: ">=0.2.0"
-
-provides:
-  commands:
-    - name: speckit.agent-context.update
-      file: commands/speckit.agent-context.update.md
-      description: "Refresh the managed Spec Kit section in the coding agent context file"
-
-hooks:
-  after_specify:
-    command: speckit.agent-context.update
-    optional: true
-    description: "Refresh agent context after specification"
-  after_plan:
-    command: speckit.agent-context.update
-    optional: true
-    description: "Refresh agent context after planning"
-
-tags:
-  - "agent"
-  - "context"
-  - "core"
diff --git a/.specify/extensions/agent-context/scripts/bash/update-agent-context.sh b/.specify/extensions/agent-context/scripts/bash/update-agent-context.sh
deleted file mode 100755
index 42ce44d..0000000
--- a/.specify/extensions/agent-context/scripts/bash/update-agent-context.sh
+++ /dev/null
@@ -1,200 +0,0 @@
-#!/usr/bin/env bash
-# update-agent-context.sh
-#
-# Refresh the managed Spec Kit section in the coding agent's context file
-# (e.g. CLAUDE.md, .github/copilot-instructions.md, AGENTS.md).
-#
-# Reads `context_file` and `context_markers.{start,end}` from the
-# agent-context extension config:
-#   .specify/extensions/agent-context/agent-context-config.yml
-#
-# Usage: update-agent-context.sh [plan_path]
-#
-# When `plan_path` is omitted, the script picks the most recently modified
-# `specs/*/plan.md` if any exist, otherwise emits the section without a
-# concrete plan path.
-
-set -euo pipefail
-
-PROJECT_ROOT="$(pwd)"
-EXT_CONFIG="$PROJECT_ROOT/.specify/extensions/agent-context/agent-context-config.yml"
-DEFAULT_START="<!-- SPECKIT START -->"
-DEFAULT_END="<!-- SPECKIT END -->"
-
-if [[ ! -f "$EXT_CONFIG" ]]; then
-  echo "agent-context: $EXT_CONFIG not found; nothing to do." >&2
-  exit 0
-fi
-
-# Locate a suitable Python interpreter (python3, then python).
-_python=""
-if command -v python3 >/dev/null 2>&1; then
-  _python="python3"
-elif command -v python >/dev/null 2>&1 && python --version 2>&1 | grep -q "^Python 3"; then
-  _python="python"
-fi
-
-if [[ -z "$_python" ]]; then
-  echo "agent-context: Python 3 not found on PATH; skipping update." >&2
-  exit 0
-fi
-
-# Parse extension config once; emit three newline-separated fields:
-# context_file, context_markers.start, context_markers.end
-if ! _raw_opts="$("$_python" - "$EXT_CONFIG" <<'PY'
-import sys
-try:
-    import yaml
-except ImportError:
-    print(
-        "agent-context: PyYAML is required to parse extension config but is not available "
-        "in the current Python environment.\n"
-        "  To resolve: pip install pyyaml (or install it into the environment used by python3).\n"
-        "  Context file will not be updated until PyYAML is importable.",
-        file=sys.stderr,
-    )
-    sys.exit(2)
-try:
-    with open(sys.argv[1], "r", encoding="utf-8") as fh:
-        data = yaml.safe_load(fh)
-except Exception as exc:
-    print(
-        f"agent-context: unable to parse {sys.argv[1]} ({exc}); cannot update context.",
-        file=sys.stderr,
-    )
-    sys.exit(2)
-if not isinstance(data, dict):
-    data = {}
-def get_str(obj, *keys):
-    node = obj
-    for k in keys:
-        if isinstance(node, dict) and k in node:
-            node = node[k]
-        else:
-            return ""
-    return node if isinstance(node, str) else ""
-print(get_str(data, "context_file"))
-print(get_str(data, "context_markers", "start"))
-print(get_str(data, "context_markers", "end"))
-PY
-)"; then
-  echo "agent-context: skipping update (see above for details)." >&2
-  exit 0
-fi
-
-_opts_lines=()
-while IFS= read -r _line || [[ -n "$_line" ]]; do
-  _opts_lines+=("$_line")
-done < <(printf '%s\n' "$_raw_opts")
-if (( ${#_opts_lines[@]} < 3 )); then
-  echo "agent-context: malformed config parser output; expected 3 lines (context_file, marker_start, marker_end), got ${#_opts_lines[@]}; skipping update." >&2
-  exit 0
-fi
-CONTEXT_FILE="${_opts_lines[0]}"
-MARKER_START="${_opts_lines[1]}"
-MARKER_END="${_opts_lines[2]}"
-
-if [[ -z "$CONTEXT_FILE" ]]; then
-  echo "agent-context: context_file not set in extension config; nothing to do." >&2
-  exit 0
-fi
-
-# Reject absolute paths, backslash separators, and '..' path segments in context_file
-if [[ "$CONTEXT_FILE" == /* ]] || [[ "$CONTEXT_FILE" =~ ^[A-Za-z]: ]]; then
-  echo "agent-context: context_file must be a project-relative path; got '$CONTEXT_FILE'." >&2
-  exit 1
-fi
-if [[ "$CONTEXT_FILE" == *\\* ]]; then
-  echo "agent-context: context_file must not contain backslash separators; got '$CONTEXT_FILE'." >&2
-  exit 1
-fi
-IFS='/' read -ra _cf_parts <<< "$CONTEXT_FILE"
-for _seg in "${_cf_parts[@]}"; do
-  if [[ "$_seg" == ".." ]]; then
-    echo "agent-context: context_file must not contain '..' path segments; got '$CONTEXT_FILE'." >&2
-    exit 1
-  fi
-done
-unset _cf_parts _seg
-
-[[ -z "$MARKER_START" ]] && MARKER_START="$DEFAULT_START"
-[[ -z "$MARKER_END"   ]] && MARKER_END="$DEFAULT_END"
-
-PLAN_PATH="${1:-}"
-if [[ -z "$PLAN_PATH" ]]; then
-  # Pick the most recently modified plan.md one level deep (specs/<feature>/plan.md).
-  # Use find + sort by modification time to avoid ls/head fragility with
-  # spaces in paths or SIGPIPE from pipefail.
-  _plan_abs="$("$_python" - "$PROJECT_ROOT" <<'PY'
-import sys, os
-from pathlib import Path
-specs = Path(sys.argv[1]) / "specs"
-plans = sorted(
-    specs.glob("*/plan.md"),
-    key=lambda p: p.stat().st_mtime,
-    reverse=True,
-)
-print(plans[0] if plans else "")
-PY
-)"
-  if [[ -n "$_plan_abs" ]]; then
-    PLAN_PATH="${_plan_abs#"$PROJECT_ROOT/"}"
-  fi
-fi
-
-CTX_PATH="$PROJECT_ROOT/$CONTEXT_FILE"
-mkdir -p "$(dirname "$CTX_PATH")"
-
-# Build the managed section
-TMP_SECTION="$(mktemp)"
-trap 'rm -f "$TMP_SECTION"' EXIT
-{
-  echo "$MARKER_START"
-  echo "For additional context about technologies to be used, project structure,"
-  echo "shell commands, and other important information, read the current plan"
-  if [[ -n "$PLAN_PATH" ]]; then
-    echo "at $PLAN_PATH"
-  fi
-  echo "$MARKER_END"
-} > "$TMP_SECTION"
-
-"$_python" - "$CTX_PATH" "$MARKER_START" "$MARKER_END" "$TMP_SECTION" <<'PY'
-import sys, os
-ctx_path, start, end, section_path = sys.argv[1:5]
-with open(section_path, "r", encoding="utf-8") as fh:
-    section = fh.read().rstrip("\n") + "\n"
-
-if os.path.exists(ctx_path):
-    with open(ctx_path, "r", encoding="utf-8-sig") as fh:
-        content = fh.read()
-    s = content.find(start)
-    e = content.find(end, s if s != -1 else 0)
-    if s != -1 and e != -1 and e > s:
-        end_of_marker = e + len(end)
-        if end_of_marker < len(content) and content[end_of_marker] == "\r":
-            end_of_marker += 1
-        if end_of_marker < len(content) and content[end_of_marker] == "\n":
-            end_of_marker += 1
-        new_content = content[:s] + section + content[end_of_marker:]
-    elif s != -1:
-        new_content = content[:s] + section
-    elif e != -1:
-        end_of_marker = e + len(end)
-        if end_of_marker < len(content) and content[end_of_marker] == "\r":
-            end_of_marker += 1
-        if end_of_marker < len(content) and content[end_of_marker] == "\n":
-            end_of_marker += 1
-        new_content = section + content[end_of_marker:]
-    else:
-        if content and not content.endswith("\n"):
-            content += "\n"
-        new_content = (content + "\n" + section) if content else section
-else:
-    new_content = section
-
-new_content = new_content.replace("\r\n", "\n").replace("\r", "\n")
-with open(ctx_path, "wb") as fh:
-    fh.write(new_content.encode("utf-8"))
-PY
-
-echo "agent-context: updated $CONTEXT_FILE"
diff --git a/.specify/extensions/agent-context/scripts/powershell/update-agent-context.ps1 b/.specify/extensions/agent-context/scripts/powershell/update-agent-context.ps1
deleted file mode 100644
index dad309c..0000000
--- a/.specify/extensions/agent-context/scripts/powershell/update-agent-context.ps1
+++ /dev/null
@@ -1,237 +0,0 @@
-#!/usr/bin/env pwsh
-# update-agent-context.ps1
-#
-# Refresh the managed Spec Kit section in the coding agent's context file
-# (e.g. CLAUDE.md, .github/copilot-instructions.md, AGENTS.md).
-#
-# Reads `context_file` and `context_markers.{start,end}` from the
-# agent-context extension config:
-#   .specify/extensions/agent-context/agent-context-config.yml
-#
-# Usage: update-agent-context.ps1 [plan_path]
-
-[CmdletBinding()]
-param(
-    [Parameter(Position = 0)]
-    [string]$PlanPath
-)
-
-function Get-ConfigValue {
-    param(
-        [AllowNull()][object]$Object,
-        [Parameter(Mandatory = $true)][string]$Key
-    )
-
-    if ($null -eq $Object) {
-        return $null
-    }
-    if ($Object -is [System.Collections.IDictionary]) {
-        return $Object[$Key]
-    }
-    $prop = $Object.PSObject.Properties[$Key]
-    if ($prop) {
-        return $prop.Value
-    }
-    return $null
-}
-
-function Test-ConfigObject {
-    param(
-        [AllowNull()][object]$Object
-    )
-
-    if ($null -eq $Object) {
-        return $false
-    }
-    if ($Object -is [System.Collections.IDictionary]) {
-        return $true
-    }
-    if ($Object -is [System.Management.Automation.PSCustomObject]) {
-        return $true
-    }
-    return $false
-}
-
-$ErrorActionPreference = 'Stop'
-$DefaultStart = '<!-- SPECKIT START -->'
-$DefaultEnd   = '<!-- SPECKIT END -->'
-$ProjectRoot  = (Get-Location).Path
-$ExtConfig    = Join-Path $ProjectRoot '.specify/extensions/agent-context/agent-context-config.yml'
-
-if (-not (Test-Path -LiteralPath $ExtConfig)) {
-    Write-Warning "agent-context: $ExtConfig not found; nothing to do."
-    exit 0
-}
-
-$Options = $null
-if (Get-Command ConvertFrom-Yaml -ErrorAction SilentlyContinue) {
-    try {
-        $Options = Get-Content -LiteralPath $ExtConfig -Raw | ConvertFrom-Yaml -ErrorAction Stop
-    } catch {
-        # fall through to Python fallback
-    }
-}
-
-if ($null -eq $Options) {
-    # ConvertFrom-Yaml unavailable or failed; fall back to Python+PyYAML.
-    $pythonCmd = $null
-    foreach ($candidate in @('python3', 'python')) {
-        if (Get-Command $candidate -ErrorAction SilentlyContinue) {
-            # Verify it is Python 3
-            $verOut = & $candidate --version 2>&1
-            if ($verOut -match 'Python 3') {
-                $pythonCmd = $candidate
-                break
-            }
-        }
-    }
-
-    if ($pythonCmd) {
-        try {
-            $jsonOut = & $pythonCmd -c @'
-import json
-import sys
-try:
-    import yaml
-except ImportError:
-    print(
-        "agent-context: PyYAML is required to parse extension config; cannot update context.",
-        file=sys.stderr,
-    )
-    sys.exit(2)
-
-try:
-    with open(sys.argv[1], "r", encoding="utf-8") as fh:
-        data = yaml.safe_load(fh)
-except Exception as exc:
-    print(
-        f"agent-context: unable to parse {sys.argv[1]} ({exc}); cannot update context.",
-        file=sys.stderr,
-    )
-    sys.exit(2)
-
-if not isinstance(data, dict):
-    data = {}
-
-print(json.dumps(data))
-'@ $ExtConfig
-            if ($LASTEXITCODE -eq 0 -and $jsonOut) {
-                $Options = $jsonOut | ConvertFrom-Json -ErrorAction Stop
-            }
-        } catch {
-            $Options = $null
-        }
-    }
-
-    if (-not $Options) {
-        Write-Warning "agent-context: unable to parse $ExtConfig; skipping update."
-        exit 0
-    }
-}
-
-if (-not (Test-ConfigObject -Object $Options)) {
-    Write-Warning "agent-context: $ExtConfig must contain a YAML mapping; skipping update."
-    exit 0
-}
-
-$ContextFile = Get-ConfigValue -Object $Options -Key 'context_file'
-if (-not $ContextFile) {
-    Write-Warning 'agent-context: context_file not set in extension config; nothing to do.'
-    exit 0
-}
-
-# Reject absolute paths and '..' path segments in context_file
-if ([System.IO.Path]::IsPathRooted($ContextFile)) {
-    Write-Warning "agent-context: context_file must be a project-relative path; got '$ContextFile'."
-    exit 1
-}
-$cfSegments = $ContextFile -split '[/\\]'
-if ($cfSegments -contains '..') {
-    Write-Warning "agent-context: context_file must not contain '..' path segments; got '$ContextFile'."
-    exit 1
-}
-
-$MarkerStart = $DefaultStart
-$MarkerEnd   = $DefaultEnd
-$cm = Get-ConfigValue -Object $Options -Key 'context_markers'
-if ($cm) {
-    $cmStart = Get-ConfigValue -Object $cm -Key 'start'
-    if ($cmStart -is [string] -and $cmStart) {
-        $MarkerStart = $cmStart
-    }
-    $cmEnd = Get-ConfigValue -Object $cm -Key 'end'
-    if ($cmEnd -is [string] -and $cmEnd) {
-        $MarkerEnd = $cmEnd
-    }
-}
-
-if (-not $PlanPath) {
-    # Discover plan.md exactly one level deep (specs/<feature>/plan.md),
-    # matching the bash glob specs/*/plan.md. Wrap in try/catch so access errors under
-    # $ErrorActionPreference = 'Stop' don't abort the script.
-    try {
-        $specsDir = Join-Path $ProjectRoot 'specs'
-        $candidate = Get-ChildItem -Path $specsDir -Directory -ErrorAction SilentlyContinue |
-            ForEach-Object { Get-Item -LiteralPath (Join-Path $_.FullName 'plan.md') -ErrorAction SilentlyContinue } |
-            Where-Object { $_ } |
-            Sort-Object LastWriteTime -Descending |
-            Select-Object -First 1
-        if ($candidate) {
-            $PlanPath = [System.IO.Path]::GetRelativePath($ProjectRoot, $candidate.FullName).Replace('\','/')
-        }
-    } catch {
-        # Non-fatal: continue without a plan path.
-    }
-}
-
-$CtxPath = Join-Path $ProjectRoot $ContextFile
-$CtxDir  = Split-Path -Parent $CtxPath
-if ($CtxDir -and -not (Test-Path -LiteralPath $CtxDir)) {
-    New-Item -ItemType Directory -Path $CtxDir -Force | Out-Null
-}
-
-$lines = @($MarkerStart,
-           'For additional context about technologies to be used, project structure,',
-           'shell commands, and other important information, read the current plan')
-if ($PlanPath) {
-    $lines += "at $PlanPath"
-}
-$lines += $MarkerEnd
-$Section = ($lines -join "`n") + "`n"
-
-if (Test-Path -LiteralPath $CtxPath) {
-    $rawBytes = [System.IO.File]::ReadAllBytes($CtxPath)
-    # Strip UTF-8 BOM if present
-    if ($rawBytes.Length -ge 3 -and $rawBytes[0] -eq 0xEF -and $rawBytes[1] -eq 0xBB -and $rawBytes[2] -eq 0xBF) {
-        $content = [System.Text.Encoding]::UTF8.GetString($rawBytes, 3, $rawBytes.Length - 3)
-    } else {
-        $content = [System.Text.Encoding]::UTF8.GetString($rawBytes)
-    }
-
-    $s = $content.IndexOf($MarkerStart)
-    $e = if ($s -ge 0) { $content.IndexOf($MarkerEnd, $s) } else { $content.IndexOf($MarkerEnd) }
-
-    if ($s -ge 0 -and $e -ge 0 -and $e -gt $s) {
-        $endOfMarker = $e + $MarkerEnd.Length
-        if ($endOfMarker -lt $content.Length -and $content[$endOfMarker] -eq "`r") { $endOfMarker++ }
-        if ($endOfMarker -lt $content.Length -and $content[$endOfMarker] -eq "`n") { $endOfMarker++ }
-        $newContent = $content.Substring(0, $s) + $Section + $content.Substring($endOfMarker)
-    } elseif ($s -ge 0) {
-        $newContent = $content.Substring(0, $s) + $Section
-    } elseif ($e -ge 0) {
-        $endOfMarker = $e + $MarkerEnd.Length
-        if ($endOfMarker -lt $content.Length -and $content[$endOfMarker] -eq "`r") { $endOfMarker++ }
-        if ($endOfMarker -lt $content.Length -and $content[$endOfMarker] -eq "`n") { $endOfMarker++ }
-        $newContent = $Section + $content.Substring($endOfMarker)
-    } else {
-        if ($content -and -not $content.EndsWith("`n")) { $content += "`n" }
-        if ($content) { $newContent = $content + "`n" + $Section } else { $newContent = $Section }
-    }
-} else {
-    $newContent = $Section
-}
-
-$newContent = $newContent.Replace("`r`n", "`n").Replace("`r", "`n")
-[System.IO.File]::WriteAllText($CtxPath, $newContent, (New-Object System.Text.UTF8Encoding($false)))
-
-Write-Host "agent-context: updated $ContextFile"
diff --git a/.specify/feature.json b/.specify/feature.json
deleted file mode 100644
index 759c4f1..0000000
--- a/.specify/feature.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "feature_directory": "specs/001-backup-s3-foundation"
-}
diff --git a/.specify/init-options.json b/.specify/init-options.json
deleted file mode 100644
index 7e96306..0000000
--- a/.specify/init-options.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "ai": "claude",
-  "ai_skills": true,
-  "feature_numbering": "sequential",
-  "here": true,
-  "integration": "claude",
-  "script": "sh",
-  "speckit_version": "0.11.3"
-}
\ No newline at end of file
diff --git a/.specify/integration.json b/.specify/integration.json
deleted file mode 100644
index 57c6343..0000000
--- a/.specify/integration.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "version": "0.11.3",
-  "integration_state_schema": 1,
-  "installed_integrations": [
-    "claude"
-  ],
-  "integration_settings": {
-    "claude": {
-      "script": "sh",
-      "invoke_separator": "-"
-    }
-  },
-  "integration": "claude",
-  "default_integration": "claude"
-}
diff --git a/.specify/integrations/claude.manifest.json b/.specify/integrations/claude.manifest.json
deleted file mode 100644
index d5e427a..0000000
--- a/.specify/integrations/claude.manifest.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "integration": "claude",
-  "version": "0.11.3",
-  "installed_at": "2026-06-20T12:54:56.308016+00:00",
-  "files": {
-    ".claude/skills/speckit-analyze/SKILL.md": "0c6d0525b97b523851a3ea8fc0efdcf477dfa65bef8c4d976b6da2f220f32c86",
-    ".claude/skills/speckit-clarify/SKILL.md": "eb8907c57e9af2c54952370a45e3fb66cb21a64dc7b3d361615bab914c13becf",
-    ".claude/skills/speckit-constitution/SKILL.md": "c1a044aba243ca6aff627fb5e4404feb6f1108d4f7dd174631bee3ae477d6c15",
-    ".claude/skills/speckit-implement/SKILL.md": "042a0415ce60a5b66adf039da431d9a98cb4897ff330635e0bab0becbbaf3cd2",
-    ".claude/skills/speckit-converge/SKILL.md": "a6acccbb6630f04fa716967c68f3be9da96762805ddd2bf284fad36324c5c876",
-    ".claude/skills/speckit-plan/SKILL.md": "fd0e312109109d09d6b691d232925b54df11681e79e1dc333ad49b210d5efb00",
-    ".claude/skills/speckit-checklist/SKILL.md": "b05086a11d4b98dcb85822e8a468ef30b8353f132b6dac1359080b93833c4666",
-    ".claude/skills/speckit-specify/SKILL.md": "ebe19db388407058a6b078b3a66ea7198cb89795dc75680ba3c457f11bc8bf7a",
-    ".claude/skills/speckit-tasks/SKILL.md": "023b1c75a62dc6fd8bff67855ebb82ec54a8104e727571aa72200c8afcc3f99b",
-    ".claude/skills/speckit-taskstoissues/SKILL.md": "aa1151798a551fb52c439ca75c02d4f2e7b40c6c7d11fc025265cf1230c67cb1"
-  }
-}
diff --git a/.specify/integrations/speckit.manifest.json b/.specify/integrations/speckit.manifest.json
deleted file mode 100644
index 68216a5..0000000
--- a/.specify/integrations/speckit.manifest.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "integration": "speckit",
-  "version": "0.11.3",
-  "installed_at": "2026-06-20T12:54:56.318622+00:00",
-  "files": {
-    ".specify/scripts/bash/common.sh": "af8a16f87b4f9084759c42ff9abf35c0b2a2025dffe58c298758ff86de2923b2",
-    ".specify/scripts/bash/setup-plan.sh": "4eb12c5b00f5c66a7d01b56c90898d320dcef4425d9b96652d57156c84948eda",
-    ".specify/scripts/bash/setup-tasks.sh": "cf21ba2212b4dd5b435c5ea8527500cfd27768b86c0bbc7ebc3207759f118d27",
-    ".specify/scripts/bash/check-prerequisites.sh": "afce0aa8db177320d83aa0b8e3619c06b865fd810781894e4a7a3f81664941ce",
-    ".specify/scripts/bash/create-new-feature.sh": "9ba116b64f0328eb69bc1a195d209074ea38823a73a554160d69df34a74daa65",
-    ".specify/templates/constitution-template.md": "ce7549540fa45543cca797a150201d868e64495fdff39dc38246fb17bd4024b3",
-    ".specify/templates/checklist-template.md": "c37695297e5d3153d64f82c21223509940b13932046c7961c42d1d669516130c",
-    ".specify/templates/tasks-template.md": "fc29a233f6f5a27ca31f1aa46b596af6500c627441c6e62b2bc4a1d721525842",
-    ".specify/templates/spec-template.md": "3945437fc35cd30a5b2bf7beea680337c3516826d3efa5a6b92c4a7eca1ba28e",
-    ".specify/templates/plan-template.md": "cc7f7979cf8d8836ec26492785affd80791d3422a2b745062ec695be8c985ef7"
-  }
-}
diff --git a/.specify/memory/constitution.md b/.specify/memory/constitution.md
deleted file mode 100644
index a4670ff..0000000
--- a/.specify/memory/constitution.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# [PROJECT_NAME] Constitution
-<!-- Example: Spec Constitution, TaskFlow Constitution, etc. -->
-
-## Core Principles
-
-### [PRINCIPLE_1_NAME]
-<!-- Example: I. Library-First -->
-[PRINCIPLE_1_DESCRIPTION]
-<!-- Example: Every feature starts as a standalone library; Libraries must be self-contained, independently testable, documented; Clear purpose required - no organizational-only libraries -->
-
-### [PRINCIPLE_2_NAME]
-<!-- Example: II. CLI Interface -->
-[PRINCIPLE_2_DESCRIPTION]
-<!-- Example: Every library exposes functionality via CLI; Text in/out protocol: stdin/args → stdout, errors → stderr; Support JSON + human-readable formats -->
-
-### [PRINCIPLE_3_NAME]
-<!-- Example: III. Test-First (NON-NEGOTIABLE) -->
-[PRINCIPLE_3_DESCRIPTION]
-<!-- Example: TDD mandatory: Tests written → User approved → Tests fail → Then implement; Red-Green-Refactor cycle strictly enforced -->
-
-### [PRINCIPLE_4_NAME]
-<!-- Example: IV. Integration Testing -->
-[PRINCIPLE_4_DESCRIPTION]
-<!-- Example: Focus areas requiring integration tests: New library contract tests, Contract changes, Inter-service communication, Shared schemas -->
-
-### [PRINCIPLE_5_NAME]
-<!-- Example: V. Observability, VI. Versioning & Breaking Changes, VII. Simplicity -->
-[PRINCIPLE_5_DESCRIPTION]
-<!-- Example: Text I/O ensures debuggability; Structured logging required; Or: MAJOR.MINOR.BUILD format; Or: Start simple, YAGNI principles -->
-
-## [SECTION_2_NAME]
-<!-- Example: Additional Constraints, Security Requirements, Performance Standards, etc. -->
-
-[SECTION_2_CONTENT]
-<!-- Example: Technology stack requirements, compliance standards, deployment policies, etc. -->
-
-## [SECTION_3_NAME]
-<!-- Example: Development Workflow, Review Process, Quality Gates, etc. -->
-
-[SECTION_3_CONTENT]
-<!-- Example: Code review requirements, testing gates, deployment approval process, etc. -->
-
-## Governance
-<!-- Example: Constitution supersedes all other practices; Amendments require documentation, approval, migration plan -->
-
-[GOVERNANCE_RULES]
-<!-- Example: All PRs/reviews must verify compliance; Complexity must be justified; Use [GUIDANCE_FILE] for runtime development guidance -->
-
-**Version**: [CONSTITUTION_VERSION] | **Ratified**: [RATIFICATION_DATE] | **Last Amended**: [LAST_AMENDED_DATE]
-<!-- Example: Version: 2.1.1 | Ratified: 2025-06-13 | Last Amended: 2025-07-16 -->
diff --git a/.specify/scripts/bash/check-prerequisites.sh b/.specify/scripts/bash/check-prerequisites.sh
deleted file mode 100755
index 8377d8e..0000000
--- a/.specify/scripts/bash/check-prerequisites.sh
+++ /dev/null
@@ -1,189 +0,0 @@
-#!/usr/bin/env bash
-
-# Consolidated prerequisite checking script
-#
-# This script provides unified prerequisite checking for Spec-Driven Development workflow.
-# It replaces the functionality previously spread across multiple scripts.
-#
-# Usage: ./check-prerequisites.sh [OPTIONS]
-#
-# OPTIONS:
-#   --json              Output in JSON format
-#   --require-tasks     Require tasks.md to exist (for implementation phase)
-#   --include-tasks     Include tasks.md in AVAILABLE_DOCS list
-#   --paths-only        Only output path variables (no validation)
-#   --help, -h          Show help message
-#
-# OUTPUTS:
-#   JSON mode: {"FEATURE_DIR":"...", "AVAILABLE_DOCS":["..."]}
-#   Text mode: FEATURE_DIR:... \n AVAILABLE_DOCS: \n ✓/✗ file.md
-#   Paths only: REPO_ROOT: ... \n BRANCH: ... \n FEATURE_DIR: ... etc.
-
-set -e
-
-# Parse command line arguments
-JSON_MODE=false
-REQUIRE_TASKS=false
-INCLUDE_TASKS=false
-PATHS_ONLY=false
-
-for arg in "$@"; do
-    case "$arg" in
-        --json)
-            JSON_MODE=true
-            ;;
-        --require-tasks)
-            REQUIRE_TASKS=true
-            ;;
-        --include-tasks)
-            INCLUDE_TASKS=true
-            ;;
-        --paths-only)
-            PATHS_ONLY=true
-            ;;
-        --help|-h)
-            cat << 'EOF'
-Usage: check-prerequisites.sh [OPTIONS]
-
-Consolidated prerequisite checking for Spec-Driven Development workflow.
-
-OPTIONS:
-  --json              Output in JSON format
-  --require-tasks     Require tasks.md to exist (for implementation phase)
-  --include-tasks     Include tasks.md in AVAILABLE_DOCS list
-  --paths-only        Only output path variables (no prerequisite validation)
-  --help, -h          Show this help message
-
-EXAMPLES:
-  # Check task prerequisites (plan.md required)
-  ./check-prerequisites.sh --json
-  
-  # Check implementation prerequisites (plan.md + tasks.md required)
-  ./check-prerequisites.sh --json --require-tasks --include-tasks
-  
-  # Get feature paths only (no validation)
-  ./check-prerequisites.sh --paths-only
-  
-EOF
-            exit 0
-            ;;
-        *)
-            echo "ERROR: Unknown option '$arg'. Use --help for usage information." >&2
-            exit 1
-            ;;
-    esac
-done
-
-# Source common functions
-SCRIPT_DIR="$(CDPATH="" cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/common.sh"
-
-# Get feature paths
-_paths_output=$(get_feature_paths) || { echo "ERROR: Failed to resolve feature paths" >&2; exit 1; }
-eval "$_paths_output"
-unset _paths_output
-
-# If paths-only mode, output paths and exit (no validation)
-if $PATHS_ONLY; then
-    if $JSON_MODE; then
-        # Minimal JSON paths payload (no validation performed)
-        if has_jq; then
-            jq -cn \
-                --arg repo_root "$REPO_ROOT" \
-                --arg branch "$CURRENT_BRANCH" \
-                --arg feature_dir "$FEATURE_DIR" \
-                --arg feature_spec "$FEATURE_SPEC" \
-                --arg impl_plan "$IMPL_PLAN" \
-                --arg tasks "$TASKS" \
-                '{REPO_ROOT:$repo_root,BRANCH:$branch,FEATURE_DIR:$feature_dir,FEATURE_SPEC:$feature_spec,IMPL_PLAN:$impl_plan,TASKS:$tasks}'
-        else
-            printf '{"REPO_ROOT":"%s","BRANCH":"%s","FEATURE_DIR":"%s","FEATURE_SPEC":"%s","IMPL_PLAN":"%s","TASKS":"%s"}\n' \
-                "$(json_escape "$REPO_ROOT")" "$(json_escape "$CURRENT_BRANCH")" "$(json_escape "$FEATURE_DIR")" "$(json_escape "$FEATURE_SPEC")" "$(json_escape "$IMPL_PLAN")" "$(json_escape "$TASKS")"
-        fi
-    else
-        echo "REPO_ROOT: $REPO_ROOT"
-        echo "BRANCH: $CURRENT_BRANCH"
-        echo "FEATURE_DIR: $FEATURE_DIR"
-        echo "FEATURE_SPEC: $FEATURE_SPEC"
-        echo "IMPL_PLAN: $IMPL_PLAN"
-        echo "TASKS: $TASKS"
-    fi
-    exit 0
-fi
-
-# Validate required directories and files
-if [[ ! -d "$FEATURE_DIR" ]]; then
-    echo "ERROR: Feature directory not found: $FEATURE_DIR" >&2
-    echo "Run /speckit-specify first to create the feature structure." >&2
-    exit 1
-fi
-
-if [[ ! -f "$IMPL_PLAN" ]]; then
-    echo "ERROR: plan.md not found in $FEATURE_DIR" >&2
-    echo "Run /speckit-plan first to create the implementation plan." >&2
-    exit 1
-fi
-
-# Check for tasks.md if required
-if $REQUIRE_TASKS && [[ ! -f "$TASKS" ]]; then
-    echo "ERROR: tasks.md not found in $FEATURE_DIR" >&2
-    echo "Run /speckit-tasks first to create the task list." >&2
-    exit 1
-fi
-
-# Build list of available documents
-docs=()
-
-# Always check these optional docs
-[[ -f "$RESEARCH" ]] && docs+=("research.md")
-[[ -f "$DATA_MODEL" ]] && docs+=("data-model.md")
-
-# Check contracts directory (only if it exists and has files)
-if [[ -d "$CONTRACTS_DIR" ]] && [[ -n "$(ls -A "$CONTRACTS_DIR" 2>/dev/null)" ]]; then
-    docs+=("contracts/")
-fi
-
-[[ -f "$QUICKSTART" ]] && docs+=("quickstart.md")
-
-# Include tasks.md if requested and it exists
-if $INCLUDE_TASKS && [[ -f "$TASKS" ]]; then
-    docs+=("tasks.md")
-fi
-
-# Output results
-if $JSON_MODE; then
-    # Build JSON array of documents
-    if has_jq; then
-        if [[ ${#docs[@]} -eq 0 ]]; then
-            json_docs="[]"
-        else
-            json_docs=$(printf '%s\n' "${docs[@]}" | jq -R . | jq -s .)
-        fi
-        jq -cn \
-            --arg feature_dir "$FEATURE_DIR" \
-            --argjson docs "$json_docs" \
-            '{FEATURE_DIR:$feature_dir,AVAILABLE_DOCS:$docs}'
-    else
-        if [[ ${#docs[@]} -eq 0 ]]; then
-            json_docs="[]"
-        else
-            json_docs=$(for d in "${docs[@]}"; do printf '"%s",' "$(json_escape "$d")"; done)
-            json_docs="[${json_docs%,}]"
-        fi
-        printf '{"FEATURE_DIR":"%s","AVAILABLE_DOCS":%s}\n' "$(json_escape "$FEATURE_DIR")" "$json_docs"
-    fi
-else
-    # Text output
-    echo "FEATURE_DIR:$FEATURE_DIR"
-    echo "AVAILABLE_DOCS:"
-    
-    # Show status of each potential document
-    check_file "$RESEARCH" "research.md"
-    check_file "$DATA_MODEL" "data-model.md"
-    check_dir "$CONTRACTS_DIR" "contracts/"
-    check_file "$QUICKSTART" "quickstart.md"
-    
-    if $INCLUDE_TASKS; then
-        check_file "$TASKS" "tasks.md"
-    fi
-fi
diff --git a/.specify/scripts/bash/common.sh b/.specify/scripts/bash/common.sh
deleted file mode 100755
index 70ab89b..0000000
--- a/.specify/scripts/bash/common.sh
+++ /dev/null
@@ -1,619 +0,0 @@
-#!/usr/bin/env bash
-# Common functions and variables for all scripts
-
-# Find repository root by searching upward for .specify directory
-# This is the primary marker for spec-kit projects
-find_specify_root() {
-    local dir="${1:-$(pwd)}"
-    # Normalize to absolute path to prevent infinite loop with relative paths
-    # Use -- to handle paths starting with - (e.g., -P, -L)
-    dir="$(cd -- "$dir" 2>/dev/null && pwd)" || return 1
-    local prev_dir=""
-    while true; do
-        if [ -d "$dir/.specify" ]; then
-            echo "$dir"
-            return 0
-        fi
-        # Stop if we've reached filesystem root or dirname stops changing
-        if [ "$dir" = "/" ] || [ "$dir" = "$prev_dir" ]; then
-            break
-        fi
-        prev_dir="$dir"
-        dir="$(dirname "$dir")"
-    done
-    return 1
-}
-
-# Resolve an explicit SPECIFY_INIT_DIR project override (the directory that
-# *contains* .specify/), for non-interactive / CI use — e.g. running a Spec Kit
-# command against a member project from a monorepo root without cd.
-#
-# Precondition: SPECIFY_INIT_DIR is non-empty. Echoes the validated absolute
-# project root, or prints an error and returns 1. Strict by design: the path
-# must exist and contain .specify/, with no silent fallback to cwd or the
-# script-location default (which would silently write to the wrong project).
-#
-# This is the single resolver: bundled extensions inherit it by sourcing core
-# (e.g. the git extension's create-new-feature-branch) rather than duplicating it.
-resolve_specify_init_dir() {
-    local init_root
-    # Normalize: relative paths resolve against $(pwd); a trailing slash collapses.
-    # CDPATH="" so a relative value cannot be resolved against the caller's CDPATH
-    # (which would also echo to stdout and corrupt the captured path).
-    if ! init_root="$(CDPATH="" cd -- "$SPECIFY_INIT_DIR" 2>/dev/null && pwd)"; then
-        echo "ERROR: SPECIFY_INIT_DIR does not point to an existing directory: $SPECIFY_INIT_DIR" >&2
-        return 1
-    fi
-    if [[ ! -d "$init_root/.specify" ]]; then
-        echo "ERROR: SPECIFY_INIT_DIR is not a Spec Kit project (no .specify/ directory): $init_root" >&2
-        return 1
-    fi
-    printf '%s\n' "$init_root"
-}
-
-# Get repository root, prioritizing .specify directory
-# This prevents using a parent repository when spec-kit is initialized in a subdirectory
-get_repo_root() {
-    # Explicit project override wins (see resolve_specify_init_dir).
-    if [[ -n "${SPECIFY_INIT_DIR:-}" ]]; then
-        resolve_specify_init_dir
-        return
-    fi
-
-    # First, look for .specify directory (spec-kit's own marker)
-    local specify_root
-    if specify_root=$(find_specify_root); then
-        echo "$specify_root"
-        return
-    fi
-
-    # Final fallback to script location
-    local script_dir="$(CDPATH="" cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-    (cd "$script_dir/../../.." && pwd)
-}
-
-# Get current feature name from explicit state only.
-# Returns the feature identifier or empty string if none is set.
-# Feature state is set by SPECIFY_FEATURE (from create-new-feature or
-# the git extension) or implicitly via .specify/feature.json.
-get_current_branch() {
-    if [[ -n "${SPECIFY_FEATURE:-}" ]]; then
-        echo "$SPECIFY_FEATURE"
-        return
-    fi
-
-    # No explicit feature set — caller must handle this via feature.json
-    # in get_feature_paths(). Return empty to signal "unknown".
-    echo ""
-}
-
-# Safely read .specify/feature.json's "feature_directory" value.
-# Prints the raw value (possibly relative) to stdout, or empty string if the file
-# is missing, unparseable, or does not contain the key. Always returns 0 so callers
-# under `set -e` cannot be aborted by parser failure.
-# Parser order mirrors the historical get_feature_paths behavior: jq -> python3 -> grep/sed.
-read_feature_json_feature_directory() {
-    local repo_root="$1"
-    local fj="$repo_root/.specify/feature.json"
-    [[ -f "$fj" ]] || { printf '%s' ''; return 0; }
-
-    local _fd=''
-    if command -v jq >/dev/null 2>&1; then
-        if ! _fd=$(jq -r '.feature_directory // empty' "$fj" 2>/dev/null); then
-            _fd=''
-        fi
-    elif command -v python3 >/dev/null 2>&1; then
-        # Use Python so pretty-printed/multi-line JSON still parses correctly.
-        if ! _fd=$(python3 -c "import json,sys; d=json.load(open(sys.argv[1])); v=d.get('feature_directory'); print(v if v else '')" "$fj" 2>/dev/null); then
-            _fd=''
-        fi
-    else
-        # Last-resort single-line grep/sed fallback. The `|| true` guards against
-        # grep returning 1 (no match) aborting under `set -e` / `pipefail`.
-        _fd=$( { grep -E '"feature_directory"[[:space:]]*:' "$fj" 2>/dev/null || true; } \
-            | head -n 1 \
-            | sed -E 's/^[^:]*:[[:space:]]*"([^"]*)".*$/\1/' )
-    fi
-
-    printf '%s' "$_fd"
-    return 0
-}
-
-# Persist a feature_directory value to .specify/feature.json.
-# Writes only when the file is missing or the value differs from what's stored.
-# Accepts the raw (possibly relative) path — callers should pass the original
-# user-supplied value, not the normalized absolute path.
-_persist_feature_json() {
-    local repo_root="$1"
-    local feature_dir_value="$2"
-    local fj="$repo_root/.specify/feature.json"
-
-    # Strip repo_root prefix if the value is absolute and under repo_root
-    if [[ "$feature_dir_value" == "$repo_root/"* ]]; then
-        feature_dir_value="${feature_dir_value#"$repo_root/"}"
-    fi
-
-    # Read current value (if any) and skip write when unchanged
-    local current_val
-    current_val=$(read_feature_json_feature_directory "$repo_root")
-    if [[ "$current_val" == "$feature_dir_value" ]]; then
-        return 0
-    fi
-
-    # Ensure .specify/ directory exists
-    mkdir -p "$repo_root/.specify"
-
-    # Write feature.json — prefer jq for safe JSON, fall back to printf
-    if command -v jq >/dev/null 2>&1; then
-        jq -cn --arg fd "$feature_dir_value" '{feature_directory:$fd}' > "$fj"
-    else
-        printf '{"feature_directory":"%s"}\n' "$(json_escape "$feature_dir_value")" > "$fj"
-    fi
-}
-
-get_feature_paths() {
-    # Split decl/assignment so a SPECIFY_INIT_DIR validation failure in
-    # get_repo_root propagates as a hard error instead of being masked by `local`.
-    local repo_root
-    repo_root=$(get_repo_root) || return 1
-    local current_branch
-    current_branch=$(get_current_branch)
-
-    # Resolve feature directory.  Priority:
-    #   1. SPECIFY_FEATURE_DIRECTORY env var (explicit override)
-    #   2. .specify/feature.json "feature_directory" key (persisted by specify command)
-    #   3. Error — no feature context available
-    local feature_dir
-    if [[ -n "${SPECIFY_FEATURE_DIRECTORY:-}" ]]; then
-        feature_dir="$SPECIFY_FEATURE_DIRECTORY"
-        # Normalize relative paths to absolute under repo root
-        [[ "$feature_dir" != /* ]] && feature_dir="$repo_root/$feature_dir"
-        # Persist to feature.json so future sessions without the env var still work
-        _persist_feature_json "$repo_root" "$SPECIFY_FEATURE_DIRECTORY"
-    elif [[ -f "$repo_root/.specify/feature.json" ]]; then
-        local _fd
-        _fd=$(read_feature_json_feature_directory "$repo_root")
-        if [[ -n "$_fd" ]]; then
-            feature_dir="$_fd"
-            # Normalize relative paths to absolute under repo root
-            [[ "$feature_dir" != /* ]] && feature_dir="$repo_root/$feature_dir"
-        else
-            echo "ERROR: Feature directory not found. Set SPECIFY_FEATURE_DIRECTORY or ensure .specify/feature.json contains feature_directory." >&2
-            return 1
-        fi
-    else
-        echo "ERROR: Feature directory not found. Set SPECIFY_FEATURE_DIRECTORY or run the specify command to create .specify/feature.json." >&2
-        return 1
-    fi
-
-    # Use printf '%q' to safely quote values, preventing shell injection
-    # via crafted branch names or paths containing special characters
-    printf 'REPO_ROOT=%q\n' "$repo_root"
-    printf 'CURRENT_BRANCH=%q\n' "$current_branch"
-    printf 'FEATURE_DIR=%q\n' "$feature_dir"
-    printf 'FEATURE_SPEC=%q\n' "$feature_dir/spec.md"
-    printf 'IMPL_PLAN=%q\n' "$feature_dir/plan.md"
-    printf 'TASKS=%q\n' "$feature_dir/tasks.md"
-    printf 'RESEARCH=%q\n' "$feature_dir/research.md"
-    printf 'DATA_MODEL=%q\n' "$feature_dir/data-model.md"
-    printf 'QUICKSTART=%q\n' "$feature_dir/quickstart.md"
-    printf 'CONTRACTS_DIR=%q\n' "$feature_dir/contracts"
-}
-
-# Check if jq is available for safe JSON construction
-has_jq() {
-    command -v jq >/dev/null 2>&1
-}
-
-get_invoke_separator() {
-    local repo_root="${1:-$(get_repo_root)}"
-    if [[ "${_SPECIFY_INVOKE_SEPARATOR_CACHE_REPO_ROOT:-}" == "$repo_root" && -n "${_SPECIFY_INVOKE_SEPARATOR_CACHE_VALUE:-}" ]]; then
-        printf '%s\n' "$_SPECIFY_INVOKE_SEPARATOR_CACHE_VALUE"
-        return 0
-    fi
-
-    local integration_json="$repo_root/.specify/integration.json"
-    local separator="."
-    local parsed_with_jq=0
-
-    if [[ -f "$integration_json" ]]; then
-        if command -v jq >/dev/null 2>&1; then
-            local jq_separator
-            if jq_separator=$(jq -r '(.default_integration // .integration // "") as $k | if $k == "" then "." else (.integration_settings[$k].invoke_separator // ".") end' "$integration_json" 2>/dev/null); then
-                parsed_with_jq=1
-                case "$jq_separator" in
-                    "."|"-") separator="$jq_separator" ;;
-                esac
-            fi
-        fi
-
-        if [[ "$parsed_with_jq" -eq 0 ]] && command -v python3 >/dev/null 2>&1; then
-            if separator=$(python3 - "$integration_json" <<'PY' 2>/dev/null
-import json
-import sys
-
-try:
-    with open(sys.argv[1], encoding="utf-8") as fh:
-        state = json.load(fh)
-    key = state.get("default_integration") or state.get("integration") or ""
-    settings = state.get("integration_settings")
-    separator = "."
-    if isinstance(key, str) and isinstance(settings, dict):
-        entry = settings.get(key)
-        if isinstance(entry, dict) and entry.get("invoke_separator") in {".", "-"}:
-            separator = entry["invoke_separator"]
-    print(separator)
-except Exception:
-    print(".")
-PY
-); then
-                case "$separator" in
-                    "."|"-") ;;
-                    *) separator="." ;;
-                esac
-            else
-                separator="."
-            fi
-        fi
-    fi
-
-    _SPECIFY_INVOKE_SEPARATOR_CACHE_REPO_ROOT="$repo_root"
-    _SPECIFY_INVOKE_SEPARATOR_CACHE_VALUE="$separator"
-    printf '%s\n' "$separator"
-}
-
-format_speckit_command() {
-    local command_name="$1"
-    local repo_root="${2:-$(get_repo_root)}"
-    local separator
-    if [[ "${_SPECIFY_INVOKE_SEPARATOR_CACHE_REPO_ROOT:-}" == "$repo_root" && -n "${_SPECIFY_INVOKE_SEPARATOR_CACHE_VALUE:-}" ]]; then
-        separator="$_SPECIFY_INVOKE_SEPARATOR_CACHE_VALUE"
-    else
-        separator=$(get_invoke_separator "$repo_root")
-        _SPECIFY_INVOKE_SEPARATOR_CACHE_REPO_ROOT="$repo_root"
-        _SPECIFY_INVOKE_SEPARATOR_CACHE_VALUE="$separator"
-    fi
-
-    command_name="${command_name#/}"
-    command_name="${command_name#speckit.}"
-    command_name="${command_name#speckit-}"
-    command_name="${command_name//./$separator}"
-
-    printf '/speckit%s%s\n' "$separator" "$command_name"
-}
-
-# Escape a string for safe embedding in a JSON value (fallback when jq is unavailable).
-# Handles backslash, double-quote, and JSON-required control character escapes (RFC 8259).
-json_escape() {
-    local s="$1"
-    s="${s//\\/\\\\}"
-    s="${s//\"/\\\"}"
-    s="${s//$'\n'/\\n}"
-    s="${s//$'\t'/\\t}"
-    s="${s//$'\r'/\\r}"
-    s="${s//$'\b'/\\b}"
-    s="${s//$'\f'/\\f}"
-    # Escape any remaining U+0001-U+001F control characters as \uXXXX.
-    # (U+0000/NUL cannot appear in bash strings and is excluded.)
-    # LC_ALL=C ensures ${#s} counts bytes and ${s:$i:1} yields single bytes,
-    # so multi-byte UTF-8 sequences (first byte >= 0xC0) pass through intact.
-    local LC_ALL=C
-    local i char code
-    for (( i=0; i<${#s}; i++ )); do
-        char="${s:$i:1}"
-        printf -v code '%d' "'$char" 2>/dev/null || code=256
-        if (( code >= 1 && code <= 31 )); then
-            printf '\\u%04x' "$code"
-        else
-            printf '%s' "$char"
-        fi
-    done
-}
-
-check_file() { [[ -f "$1" ]] && echo "  ✓ $2" || echo "  ✗ $2"; }
-check_dir() { [[ -d "$1" && -n $(ls -A "$1" 2>/dev/null) ]] && echo "  ✓ $2" || echo "  ✗ $2"; }
-
-# Resolve a template name to a file path using the priority stack:
-#   1. .specify/templates/overrides/
-#   2. .specify/presets/<preset-id>/templates/ (sorted by priority from .registry)
-#   3. .specify/extensions/<ext-id>/templates/
-#   4. .specify/templates/ (core)
-resolve_template() {
-    local template_name="$1"
-    local repo_root="$2"
-    local base="$repo_root/.specify/templates"
-
-    # Priority 1: Project overrides
-    local override="$base/overrides/${template_name}.md"
-    [ -f "$override" ] && echo "$override" && return 0
-
-    # Priority 2: Installed presets (sorted by priority from .registry)
-    local presets_dir="$repo_root/.specify/presets"
-    if [ -d "$presets_dir" ]; then
-        local registry_file="$presets_dir/.registry"
-        if [ -f "$registry_file" ] && command -v python3 >/dev/null 2>&1; then
-            # Read preset IDs sorted by priority (lower number = higher precedence).
-            # The python3 call is wrapped in an if-condition so that set -e does not
-            # abort the function when python3 exits non-zero (e.g. invalid JSON).
-            local sorted_presets=""
-            if sorted_presets=$(SPECKIT_REGISTRY="$registry_file" python3 -c "
-import json, sys, os
-try:
-    with open(os.environ['SPECKIT_REGISTRY']) as f:
-        data = json.load(f)
-    presets = data.get('presets', {})
-    for pid, meta in sorted(presets.items(), key=lambda x: x[1].get('priority', 10) if isinstance(x[1], dict) else 10):
-        if isinstance(meta, dict) and meta.get('enabled', True) is not False:
-            print(pid)
-except Exception:
-    sys.exit(1)
-" 2>/dev/null); then
-                if [ -n "$sorted_presets" ]; then
-                    # python3 succeeded and returned preset IDs — search in priority order
-                    while IFS= read -r preset_id; do
-                        local candidate="$presets_dir/$preset_id/templates/${template_name}.md"
-                        [ -f "$candidate" ] && echo "$candidate" && return 0
-                    done <<< "$sorted_presets"
-                fi
-                # python3 succeeded but registry has no presets — nothing to search
-            else
-                # python3 failed (missing, or registry parse error) — fall back to unordered directory scan
-                for preset in "$presets_dir"/*/; do
-                    [ -d "$preset" ] || continue
-                    local candidate="$preset/templates/${template_name}.md"
-                    [ -f "$candidate" ] && echo "$candidate" && return 0
-                done
-            fi
-        else
-            # Fallback: alphabetical directory order (no python3 available)
-            for preset in "$presets_dir"/*/; do
-                [ -d "$preset" ] || continue
-                local candidate="$preset/templates/${template_name}.md"
-                [ -f "$candidate" ] && echo "$candidate" && return 0
-            done
-        fi
-    fi
-
-    # Priority 3: Extension-provided templates
-    local ext_dir="$repo_root/.specify/extensions"
-    if [ -d "$ext_dir" ]; then
-        for ext in "$ext_dir"/*/; do
-            [ -d "$ext" ] || continue
-            # Skip hidden directories (e.g. .backup, .cache)
-            case "$(basename "$ext")" in .*) continue;; esac
-            local candidate="$ext/templates/${template_name}.md"
-            [ -f "$candidate" ] && echo "$candidate" && return 0
-        done
-    fi
-
-    # Priority 4: Core templates
-    local core="$base/${template_name}.md"
-    [ -f "$core" ] && echo "$core" && return 0
-
-    # Template not found in any location.
-    # Return 1 so callers can distinguish "not found" from "found".
-    # Callers running under set -e should use: TEMPLATE=$(resolve_template ...) || true
-    return 1
-}
-
-# Resolve a template name to composed content using composition strategies.
-# Reads strategy metadata from preset manifests and composes content
-# from multiple layers using prepend, append, or wrap strategies.
-#
-# Usage: CONTENT=$(resolve_template_content "template-name" "$REPO_ROOT")
-# Returns composed content string on stdout; exit code 1 if not found.
-resolve_template_content() {
-    local template_name="$1"
-    local repo_root="$2"
-    local base="$repo_root/.specify/templates"
-
-    # Collect all layers (highest priority first)
-    local -a layer_paths=()
-    local -a layer_strategies=()
-
-    # Priority 1: Project overrides (always "replace")
-    local override="$base/overrides/${template_name}.md"
-    if [ -f "$override" ]; then
-        layer_paths+=("$override")
-        layer_strategies+=("replace")
-    fi
-
-    # Priority 2: Installed presets (sorted by priority from .registry)
-    local presets_dir="$repo_root/.specify/presets"
-    if [ -d "$presets_dir" ]; then
-        local registry_file="$presets_dir/.registry"
-        local sorted_presets=""
-        if [ -f "$registry_file" ] && command -v python3 >/dev/null 2>&1; then
-            if sorted_presets=$(SPECKIT_REGISTRY="$registry_file" python3 -c "
-import json, sys, os
-try:
-    with open(os.environ['SPECKIT_REGISTRY']) as f:
-        data = json.load(f)
-    presets = data.get('presets', {})
-    for pid, meta in sorted(presets.items(), key=lambda x: x[1].get('priority', 10) if isinstance(x[1], dict) else 10):
-        if isinstance(meta, dict) and meta.get('enabled', True) is not False:
-            print(pid)
-except Exception:
-    sys.exit(1)
-" 2>/dev/null); then
-                if [ -n "$sorted_presets" ]; then
-                    local yaml_warned=false
-                    while IFS= read -r preset_id; do
-                        # Read strategy and file path from preset manifest
-                        local strategy="replace"
-                        local manifest_file=""
-                        local manifest="$presets_dir/$preset_id/preset.yml"
-                        if [ -f "$manifest" ] && command -v python3 >/dev/null 2>&1; then
-                            # Requires PyYAML; falls back to replace/convention if unavailable
-                            local result
-                            local py_stderr
-                            py_stderr=$(mktemp)
-                            result=$(SPECKIT_MANIFEST="$manifest" SPECKIT_TMPL="$template_name" python3 -c "
-import sys, os
-try:
-    import yaml
-except ImportError:
-    print('yaml_missing', file=sys.stderr)
-    print('replace\t')
-    sys.exit(0)
-try:
-    with open(os.environ['SPECKIT_MANIFEST']) as f:
-        data = yaml.safe_load(f)
-    for t in data.get('provides', {}).get('templates', []):
-        if t.get('name') == os.environ['SPECKIT_TMPL'] and t.get('type', 'template') == 'template':
-            print(t.get('strategy', 'replace') + '\t' + t.get('file', ''))
-            sys.exit(0)
-    print('replace\t')
-except Exception:
-    print('replace\t')
-" 2>"$py_stderr")
-                            local parse_status=$?
-                            if [ $parse_status -eq 0 ] && [ -n "$result" ]; then
-                                IFS=$'\t' read -r strategy manifest_file <<< "$result"
-                                strategy=$(printf '%s' "$strategy" | tr '[:upper:]' '[:lower:]')
-                            fi
-                            if [ "$yaml_warned" = false ] && grep -q 'yaml_missing' "$py_stderr" 2>/dev/null; then
-                                echo "Warning: PyYAML not available; composition strategies may be ignored" >&2
-                                yaml_warned=true
-                            fi
-                            rm -f "$py_stderr"
-                        fi
-                        # Try manifest file path first, then convention path
-                        local candidate=""
-                        if [ -n "$manifest_file" ]; then
-                            # Reject absolute paths and parent traversal
-                            case "$manifest_file" in
-                                /*|*../*|../*) manifest_file="" ;;
-                            esac
-                        fi
-                        if [ -n "$manifest_file" ]; then
-                            local mf="$presets_dir/$preset_id/$manifest_file"
-                            [ -f "$mf" ] && candidate="$mf"
-                        fi
-                        if [ -z "$candidate" ]; then
-                            local cf="$presets_dir/$preset_id/templates/${template_name}.md"
-                            [ -f "$cf" ] && candidate="$cf"
-                        fi
-                        if [ -n "$candidate" ]; then
-                            layer_paths+=("$candidate")
-                            layer_strategies+=("$strategy")
-                        fi
-                    done <<< "$sorted_presets"
-                fi
-            else
-                # python3 failed — fall back to unordered directory scan (replace only)
-                for preset in "$presets_dir"/*/; do
-                    [ -d "$preset" ] || continue
-                    local candidate="$preset/templates/${template_name}.md"
-                    if [ -f "$candidate" ]; then
-                        layer_paths+=("$candidate")
-                        layer_strategies+=("replace")
-                    fi
-                done
-            fi
-        else
-            # No python3 or registry — fall back to unordered directory scan (replace only)
-            for preset in "$presets_dir"/*/; do
-                [ -d "$preset" ] || continue
-                local candidate="$preset/templates/${template_name}.md"
-                if [ -f "$candidate" ]; then
-                    layer_paths+=("$candidate")
-                    layer_strategies+=("replace")
-                fi
-            done
-        fi
-    fi
-
-    # Priority 3: Extension-provided templates (always "replace")
-    local ext_dir="$repo_root/.specify/extensions"
-    if [ -d "$ext_dir" ]; then
-        for ext in "$ext_dir"/*/; do
-            [ -d "$ext" ] || continue
-            case "$(basename "$ext")" in .*) continue;; esac
-            local candidate="$ext/templates/${template_name}.md"
-            if [ -f "$candidate" ]; then
-                layer_paths+=("$candidate")
-                layer_strategies+=("replace")
-            fi
-        done
-    fi
-
-    # Priority 4: Core templates (always "replace")
-    local core="$base/${template_name}.md"
-    if [ -f "$core" ]; then
-        layer_paths+=("$core")
-        layer_strategies+=("replace")
-    fi
-
-    local count=${#layer_paths[@]}
-    [ "$count" -eq 0 ] && return 1
-
-    # Check if any layer uses a non-replace strategy
-    local has_composition=false
-    for s in "${layer_strategies[@]}"; do
-        [ "$s" != "replace" ] && has_composition=true && break
-    done
-
-    # If the top (highest-priority) layer is replace, it wins entirely —
-    # lower layers are irrelevant regardless of their strategies.
-    if [ "${layer_strategies[0]}" = "replace" ]; then
-        cat "${layer_paths[0]}"
-        return 0
-    fi
-
-    if [ "$has_composition" = false ]; then
-        cat "${layer_paths[0]}"
-        return 0
-    fi
-
-    # Find the effective base: scan from highest priority (index 0) downward
-    # to find the nearest replace layer. Only compose layers above that base.
-    local base_idx=-1
-    local i
-    for (( i=0; i<count; i++ )); do
-        if [ "${layer_strategies[$i]}" = "replace" ]; then
-            base_idx=$i
-            break
-        fi
-    done
-
-    if [ $base_idx -lt 0 ]; then
-        return 1  # no base layer found
-    fi
-
-    # Read the base content; compose layers above the base (higher priority)
-    local content
-    content=$(cat "${layer_paths[$base_idx]}"; printf x)
-    content="${content%x}"
-
-    for (( i=base_idx-1; i>=0; i-- )); do
-        local path="${layer_paths[$i]}"
-        local strat="${layer_strategies[$i]}"
-        local layer_content
-        # Preserve trailing newlines
-        layer_content=$(cat "$path"; printf x)
-        layer_content="${layer_content%x}"
-
-        case "$strat" in
-            replace) content="$layer_content" ;;
-            prepend) content="$(printf '%s\n\n%s' "$layer_content" "$content")" ;;
-            append)  content="$(printf '%s\n\n%s' "$content" "$layer_content")" ;;
-            wrap)
-                case "$layer_content" in
-                    *'{CORE_TEMPLATE}'*) ;;
-                    *) echo "Error: wrap strategy missing {CORE_TEMPLATE} placeholder" >&2; return 1 ;;
-                esac
-                while [[ "$layer_content" == *'{CORE_TEMPLATE}'* ]]; do
-                    local before="${layer_content%%\{CORE_TEMPLATE\}*}"
-                    local after="${layer_content#*\{CORE_TEMPLATE\}}"
-                    layer_content="${before}${content}${after}"
-                done
-                content="$layer_content"
-                ;;
-            *) echo "Error: unknown strategy '$strat'" >&2; return 1 ;;
-        esac
-    done
-
-    printf '%s' "$content"
-    return 0
-}
diff --git a/.specify/scripts/bash/create-new-feature.sh b/.specify/scripts/bash/create-new-feature.sh
deleted file mode 100755
index c960976..0000000
--- a/.specify/scripts/bash/create-new-feature.sh
+++ /dev/null
@@ -1,299 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-JSON_MODE=false
-DRY_RUN=false
-ALLOW_EXISTING=false
-SHORT_NAME=""
-BRANCH_NUMBER=""
-USE_TIMESTAMP=false
-ARGS=()
-i=1
-while [ $i -le $# ]; do
-    arg="${!i}"
-    case "$arg" in
-        --json)
-            JSON_MODE=true
-            ;;
-        --dry-run)
-            DRY_RUN=true
-            ;;
-        --allow-existing-branch)
-            ALLOW_EXISTING=true
-            ;;
-        --short-name)
-            if [ $((i + 1)) -gt $# ]; then
-                echo 'Error: --short-name requires a value' >&2
-                exit 1
-            fi
-            i=$((i + 1))
-            next_arg="${!i}"
-            # Check if the next argument is another option (starts with --)
-            if [[ "$next_arg" == --* ]]; then
-                echo 'Error: --short-name requires a value' >&2
-                exit 1
-            fi
-            SHORT_NAME="$next_arg"
-            ;;
-        --number)
-            if [ $((i + 1)) -gt $# ]; then
-                echo 'Error: --number requires a value' >&2
-                exit 1
-            fi
-            i=$((i + 1))
-            next_arg="${!i}"
-            if [[ "$next_arg" == --* ]]; then
-                echo 'Error: --number requires a value' >&2
-                exit 1
-            fi
-            BRANCH_NUMBER="$next_arg"
-            ;;
-        --timestamp)
-            USE_TIMESTAMP=true
-            ;;
-        --help|-h)
-            echo "Usage: $0 [--json] [--dry-run] [--allow-existing-branch] [--short-name <name>] [--number N] [--timestamp] <feature_description>"
-            echo ""
-            echo "Options:"
-            echo "  --json              Output in JSON format"
-            echo "  --dry-run           Compute feature name and paths without creating directories or files"
-            echo "  --allow-existing-branch  Reuse an existing feature directory if it already exists"
-            echo "  --short-name <name> Provide a custom short name (2-4 words) for the feature"
-            echo "  --number N          Specify branch number manually (overrides auto-detection)"
-            echo "  --timestamp         Use timestamp prefix (YYYYMMDD-HHMMSS) instead of sequential numbering"
-            echo "  --help, -h          Show this help message"
-            echo ""
-            echo "Examples:"
-            echo "  $0 'Add user authentication system' --short-name 'user-auth'"
-            echo "  $0 'Implement OAuth2 integration for API' --number 5"
-            echo "  $0 --timestamp --short-name 'user-auth' 'Add user authentication'"
-            exit 0
-            ;;
-        *)
-            ARGS+=("$arg")
-            ;;
-    esac
-    i=$((i + 1))
-done
-
-FEATURE_DESCRIPTION="${ARGS[*]}"
-if [ -z "$FEATURE_DESCRIPTION" ]; then
-    echo "Usage: $0 [--json] [--dry-run] [--allow-existing-branch] [--short-name <name>] [--number N] [--timestamp] <feature_description>" >&2
-    exit 1
-fi
-
-# Trim whitespace and validate description is not empty (e.g., user passed only whitespace)
-FEATURE_DESCRIPTION=$(echo "$FEATURE_DESCRIPTION" | sed -E 's/^[[:space:]]+|[[:space:]]+$//g')
-if [ -z "$FEATURE_DESCRIPTION" ]; then
-    echo "Error: Feature description cannot be empty or contain only whitespace" >&2
-    exit 1
-fi
-
-# Function to get highest number from specs directory
-get_highest_from_specs() {
-    local specs_dir="$1"
-    local highest=0
-    
-    if [ -d "$specs_dir" ]; then
-        for dir in "$specs_dir"/*; do
-            [ -d "$dir" ] || continue
-            dirname=$(basename "$dir")
-            # Match sequential prefixes (>=3 digits), but skip timestamp dirs.
-            if echo "$dirname" | grep -Eq '^[0-9]{3,}-' && ! echo "$dirname" | grep -Eq '^[0-9]{8}-[0-9]{6}-'; then
-                number=$(echo "$dirname" | grep -Eo '^[0-9]+')
-                number=$((10#$number))
-                if [ "$number" -gt "$highest" ]; then
-                    highest=$number
-                fi
-            fi
-        done
-    fi
-    
-    echo "$highest"
-}
-
-# Function to clean and format a branch name
-clean_branch_name() {
-    local name="$1"
-    echo "$name" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/-\+/-/g' | sed 's/^-//' | sed 's/-$//'
-}
-
-# Resolve repository root using common.sh functions which prioritize .specify
-SCRIPT_DIR="$(CDPATH="" cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/common.sh"
-
-REPO_ROOT=$(get_repo_root) || exit 1
-
-cd "$REPO_ROOT"
-
-SPECS_DIR="$REPO_ROOT/specs"
-if [ "$DRY_RUN" != true ]; then
-    mkdir -p "$SPECS_DIR"
-fi
-
-# Function to generate branch name with stop word filtering and length filtering
-generate_branch_name() {
-    local description="$1"
-    
-    # Common stop words to filter out
-    local stop_words="^(i|a|an|the|to|for|of|in|on|at|by|with|from|is|are|was|were|be|been|being|have|has|had|do|does|did|will|would|should|could|can|may|might|must|shall|this|that|these|those|my|your|our|their|want|need|add|get|set)$"
-    
-    # Convert to lowercase and split into words
-    local clean_name=$(echo "$description" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/ /g')
-    
-    # Filter words: remove stop words and words shorter than 3 chars (unless they're uppercase acronyms in original)
-    local meaningful_words=()
-    for word in $clean_name; do
-        # Skip empty words
-        [ -z "$word" ] && continue
-        
-        # Keep words that are NOT stop words AND (length >= 3 OR are potential acronyms)
-        if ! echo "$word" | grep -qiE "$stop_words"; then
-            if [ ${#word} -ge 3 ]; then
-                meaningful_words+=("$word")
-            elif echo "$description" | grep -q "\b${word^^}\b"; then
-                # Keep short words if they appear as uppercase in original (likely acronyms)
-                meaningful_words+=("$word")
-            fi
-        fi
-    done
-    
-    # If we have meaningful words, use first 3-4 of them
-    if [ ${#meaningful_words[@]} -gt 0 ]; then
-        local max_words=3
-        if [ ${#meaningful_words[@]} -eq 4 ]; then max_words=4; fi
-        
-        local result=""
-        local count=0
-        for word in "${meaningful_words[@]}"; do
-            if [ $count -ge $max_words ]; then break; fi
-            if [ -n "$result" ]; then result="$result-"; fi
-            result="$result$word"
-            count=$((count + 1))
-        done
-        echo "$result"
-    else
-        # Fallback to original logic if no meaningful words found
-        local cleaned=$(clean_branch_name "$description")
-        echo "$cleaned" | tr '-' '\n' | grep -v '^$' | head -3 | tr '\n' '-' | sed 's/-$//'
-    fi
-}
-
-# Generate branch name
-if [ -n "$SHORT_NAME" ]; then
-    # Use provided short name, just clean it up
-    BRANCH_SUFFIX=$(clean_branch_name "$SHORT_NAME")
-else
-    # Generate from description with smart filtering
-    BRANCH_SUFFIX=$(generate_branch_name "$FEATURE_DESCRIPTION")
-fi
-
-# Warn if --number and --timestamp are both specified
-if [ "$USE_TIMESTAMP" = true ] && [ -n "$BRANCH_NUMBER" ]; then
-    >&2 echo "[specify] Warning: --number is ignored when --timestamp is used"
-    BRANCH_NUMBER=""
-fi
-
-# Determine branch prefix
-if [ "$USE_TIMESTAMP" = true ]; then
-    FEATURE_NUM=$(date +%Y%m%d-%H%M%S)
-    BRANCH_NAME="${FEATURE_NUM}-${BRANCH_SUFFIX}"
-else
-    # Determine branch number from existing feature directories
-    if [ -z "$BRANCH_NUMBER" ]; then
-        HIGHEST=$(get_highest_from_specs "$SPECS_DIR")
-        BRANCH_NUMBER=$((HIGHEST + 1))
-    fi
-
-    # Force base-10 interpretation to prevent octal conversion (e.g., 010 → 8 in octal, but should be 10 in decimal)
-    FEATURE_NUM=$(printf "%03d" "$((10#$BRANCH_NUMBER))")
-    BRANCH_NAME="${FEATURE_NUM}-${BRANCH_SUFFIX}"
-fi
-
-# GitHub enforces a 244-byte limit on branch names
-# Validate and truncate if necessary
-MAX_BRANCH_LENGTH=244
-if [ ${#BRANCH_NAME} -gt $MAX_BRANCH_LENGTH ]; then
-    # Calculate how much we need to trim from suffix
-    # Account for prefix length: timestamp (15) + hyphen (1) = 16, or sequential (3) + hyphen (1) = 4
-    PREFIX_LENGTH=$(( ${#FEATURE_NUM} + 1 ))
-    MAX_SUFFIX_LENGTH=$((MAX_BRANCH_LENGTH - PREFIX_LENGTH))
-    
-    # Truncate suffix at word boundary if possible
-    TRUNCATED_SUFFIX=$(echo "$BRANCH_SUFFIX" | cut -c1-$MAX_SUFFIX_LENGTH)
-    # Remove trailing hyphen if truncation created one
-    TRUNCATED_SUFFIX=$(echo "$TRUNCATED_SUFFIX" | sed 's/-$//')
-    
-    ORIGINAL_BRANCH_NAME="$BRANCH_NAME"
-    BRANCH_NAME="${FEATURE_NUM}-${TRUNCATED_SUFFIX}"
-    
-    >&2 echo "[specify] Warning: Branch name exceeded GitHub's 244-byte limit"
-    >&2 echo "[specify] Original: $ORIGINAL_BRANCH_NAME (${#ORIGINAL_BRANCH_NAME} bytes)"
-    >&2 echo "[specify] Truncated to: $BRANCH_NAME (${#BRANCH_NAME} bytes)"
-fi
-
-FEATURE_DIR="$SPECS_DIR/$BRANCH_NAME"
-SPEC_FILE="$FEATURE_DIR/spec.md"
-
-if [ "$DRY_RUN" != true ]; then
-    if [ -d "$FEATURE_DIR" ] && [ "$ALLOW_EXISTING" != true ]; then
-        if [ "$USE_TIMESTAMP" = true ]; then
-            >&2 echo "Error: Feature directory '$FEATURE_DIR' already exists. Rerun to get a new timestamp or use a different --short-name."
-        else
-            >&2 echo "Error: Feature directory '$FEATURE_DIR' already exists. Please use a different feature name or specify a different number with --number."
-        fi
-        exit 1
-    fi
-
-    mkdir -p "$FEATURE_DIR"
-
-    if [ ! -f "$SPEC_FILE" ]; then
-        TEMPLATE=$(resolve_template "spec-template" "$REPO_ROOT") || true
-        if [ -n "$TEMPLATE" ] && [ -f "$TEMPLATE" ]; then
-            cp "$TEMPLATE" "$SPEC_FILE"
-        else
-            echo "Warning: Spec template not found; created empty spec file" >&2
-            touch "$SPEC_FILE"
-        fi
-    fi
-
-    # Persist to .specify/feature.json so downstream commands can find the feature
-    _persist_feature_json "$REPO_ROOT" "$FEATURE_DIR"
-
-    # Inform the user how to set feature state in their own shell
-    printf '# To persist: export SPECIFY_FEATURE=%q\n' "$BRANCH_NAME" >&2
-    printf '#              export SPECIFY_FEATURE_DIRECTORY=%q\n' "$FEATURE_DIR" >&2
-fi
-
-if $JSON_MODE; then
-    if command -v jq >/dev/null 2>&1; then
-        if [ "$DRY_RUN" = true ]; then
-            jq -cn \
-                --arg branch_name "$BRANCH_NAME" \
-                --arg spec_file "$SPEC_FILE" \
-                --arg feature_num "$FEATURE_NUM" \
-                '{BRANCH_NAME:$branch_name,SPEC_FILE:$spec_file,FEATURE_NUM:$feature_num,DRY_RUN:true}'
-        else
-            jq -cn \
-                --arg branch_name "$BRANCH_NAME" \
-                --arg spec_file "$SPEC_FILE" \
-                --arg feature_num "$FEATURE_NUM" \
-                '{BRANCH_NAME:$branch_name,SPEC_FILE:$spec_file,FEATURE_NUM:$feature_num}'
-        fi
-    else
-        if [ "$DRY_RUN" = true ]; then
-            printf '{"BRANCH_NAME":"%s","SPEC_FILE":"%s","FEATURE_NUM":"%s","DRY_RUN":true}\n' "$(json_escape "$BRANCH_NAME")" "$(json_escape "$SPEC_FILE")" "$(json_escape "$FEATURE_NUM")"
-        else
-            printf '{"BRANCH_NAME":"%s","SPEC_FILE":"%s","FEATURE_NUM":"%s"}\n' "$(json_escape "$BRANCH_NAME")" "$(json_escape "$SPEC_FILE")" "$(json_escape "$FEATURE_NUM")"
-        fi
-    fi
-else
-    echo "BRANCH_NAME: $BRANCH_NAME"
-    echo "SPEC_FILE: $SPEC_FILE"
-    echo "FEATURE_NUM: $FEATURE_NUM"
-    if [ "$DRY_RUN" != true ]; then
-        printf '# To persist in your shell: export SPECIFY_FEATURE=%q\n' "$BRANCH_NAME"
-        printf '#                           export SPECIFY_FEATURE_DIRECTORY=%q\n' "$FEATURE_DIR"
-    fi
-fi
diff --git a/.specify/scripts/bash/setup-plan.sh b/.specify/scripts/bash/setup-plan.sh
deleted file mode 100755
index cb67943..0000000
--- a/.specify/scripts/bash/setup-plan.sh
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-# Parse command line arguments
-JSON_MODE=false
-ARGS=()
-
-for arg in "$@"; do
-    case "$arg" in
-        --json) 
-            JSON_MODE=true 
-            ;;
-        --help|-h) 
-            echo "Usage: $0 [--json]"
-            echo "  --json    Output results in JSON format"
-            echo "  --help    Show this help message"
-            exit 0 
-            ;;
-        *) 
-            ARGS+=("$arg") 
-            ;;
-    esac
-done
-
-# Get script directory and load common functions
-SCRIPT_DIR="$(CDPATH="" cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/common.sh"
-
-# Get all paths and variables from common functions
-_paths_output=$(get_feature_paths) || { echo "ERROR: Failed to resolve feature paths" >&2; exit 1; }
-eval "$_paths_output"
-unset _paths_output
-
-# Ensure the feature directory exists
-mkdir -p "$FEATURE_DIR"
-
-# Copy plan template if plan doesn't already exist
-if [[ -f "$IMPL_PLAN" ]]; then
-    if $JSON_MODE; then
-        echo "Plan already exists at $IMPL_PLAN, skipping template copy" >&2
-    else
-        echo "Plan already exists at $IMPL_PLAN, skipping template copy"
-    fi
-else
-    TEMPLATE=$(resolve_template "plan-template" "$REPO_ROOT") || true
-    if [[ -n "$TEMPLATE" ]] && [[ -f "$TEMPLATE" ]]; then
-        cp "$TEMPLATE" "$IMPL_PLAN"
-        if $JSON_MODE; then
-            echo "Copied plan template to $IMPL_PLAN" >&2
-        else
-            echo "Copied plan template to $IMPL_PLAN"
-        fi
-    else
-        if $JSON_MODE; then
-            echo "Warning: Plan template not found" >&2
-        else
-            echo "Warning: Plan template not found"
-        fi
-        # Create a basic plan file if template doesn't exist
-        touch "$IMPL_PLAN"
-    fi
-fi
-
-# Output results
-if $JSON_MODE; then
-    if has_jq; then
-        jq -cn \
-            --arg feature_spec "$FEATURE_SPEC" \
-            --arg impl_plan "$IMPL_PLAN" \
-            --arg specs_dir "$FEATURE_DIR" \
-            --arg branch "$CURRENT_BRANCH" \
-            '{FEATURE_SPEC:$feature_spec,IMPL_PLAN:$impl_plan,SPECS_DIR:$specs_dir,BRANCH:$branch}'
-    else
-        printf '{"FEATURE_SPEC":"%s","IMPL_PLAN":"%s","SPECS_DIR":"%s","BRANCH":"%s"}\n' \
-            "$(json_escape "$FEATURE_SPEC")" "$(json_escape "$IMPL_PLAN")" "$(json_escape "$FEATURE_DIR")" "$(json_escape "$CURRENT_BRANCH")"
-    fi
-else
-    echo "FEATURE_SPEC: $FEATURE_SPEC"
-    echo "IMPL_PLAN: $IMPL_PLAN" 
-    echo "SPECS_DIR: $FEATURE_DIR"
-    echo "BRANCH: $CURRENT_BRANCH"
-fi
-
diff --git a/.specify/scripts/bash/setup-tasks.sh b/.specify/scripts/bash/setup-tasks.sh
deleted file mode 100755
index ae0d7bd..0000000
--- a/.specify/scripts/bash/setup-tasks.sh
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-# Parse command line arguments
-JSON_MODE=false
-
-for arg in "$@"; do
-    case "$arg" in
-        --json) JSON_MODE=true ;;
-        --help|-h)
-            echo "Usage: $0 [--json]"
-            echo "  --json    Output results in JSON format"
-            echo "  --help    Show this help message"
-            exit 0
-            ;;
-        *) echo "ERROR: Unknown option '$arg'" >&2; exit 1 ;;
-    esac
-done
-
-# Source common functions
-SCRIPT_DIR="$(CDPATH="" cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/common.sh"
-
-# Get feature paths
-_paths_output=$(get_feature_paths) || { echo "ERROR: Failed to resolve feature paths" >&2; exit 1; }
-eval "$_paths_output"
-unset _paths_output
-
-# Validate required files
-if [[ ! -f "$IMPL_PLAN" ]]; then
-    echo "ERROR: plan.md not found in $FEATURE_DIR" >&2
-    echo "Run /speckit-plan first to create the implementation plan." >&2
-    exit 1
-fi
-
-if [[ ! -f "$FEATURE_SPEC" ]]; then
-    echo "ERROR: spec.md not found in $FEATURE_DIR" >&2
-    echo "Run /speckit-specify first to create the feature structure." >&2
-    exit 1
-fi
-
-# Build available docs list
-docs=()
-[[ -f "$RESEARCH" ]] && docs+=("research.md")
-[[ -f "$DATA_MODEL" ]] && docs+=("data-model.md")
-if [[ -d "$CONTRACTS_DIR" ]] && [[ -n "$(ls -A "$CONTRACTS_DIR" 2>/dev/null)" ]]; then
-    docs+=("contracts/")
-fi
-[[ -f "$QUICKSTART" ]] && docs+=("quickstart.md")
-
-# Resolve tasks template through override stack
-TASKS_TEMPLATE=$(resolve_template "tasks-template" "$REPO_ROOT") || true
-if [[ -z "$TASKS_TEMPLATE" ]] || [[ ! -f "$TASKS_TEMPLATE" ]]; then
-    echo "ERROR: Could not resolve required tasks-template from the template override stack for $REPO_ROOT" >&2
-    echo "Template 'tasks-template' was not found in any supported location (overrides, presets, extensions, or shared core). Add an override at .specify/templates/overrides/tasks-template.md, or run 'specify init' / reinstall shared infra to restore the core .specify/templates/tasks-template.md template." >&2
-    exit 1
-fi
-
-# Output results
-if $JSON_MODE; then
-    if has_jq; then
-        if [[ ${#docs[@]} -eq 0 ]]; then
-            json_docs="[]"
-        else
-            json_docs=$(printf '%s\n' "${docs[@]}" | jq -R . | jq -s .)
-        fi
-        jq -cn \
-            --arg feature_dir "$FEATURE_DIR" \
-            --argjson docs "$json_docs" \
-            --arg tasks_template "${TASKS_TEMPLATE:-}" \
-            '{FEATURE_DIR:$feature_dir,AVAILABLE_DOCS:$docs,TASKS_TEMPLATE:$tasks_template}'
-    else
-        if [[ ${#docs[@]} -eq 0 ]]; then
-            json_docs="[]"
-        else
-            json_docs=$(for d in "${docs[@]}"; do printf '"%s",' "$(json_escape "$d")"; done)
-            json_docs="[${json_docs%,}]"
-        fi
-        printf '{"FEATURE_DIR":"%s","AVAILABLE_DOCS":%s,"TASKS_TEMPLATE":"%s"}\n' \
-            "$(json_escape "$FEATURE_DIR")" "$json_docs" "$(json_escape "${TASKS_TEMPLATE:-}")"
-    fi
-else
-    echo "FEATURE_DIR: $FEATURE_DIR"
-    echo "TASKS_TEMPLATE: ${TASKS_TEMPLATE:-not found}"
-    echo "AVAILABLE_DOCS:"
-    check_file "$RESEARCH" "research.md"
-    check_file "$DATA_MODEL" "data-model.md"
-    check_dir "$CONTRACTS_DIR" "contracts/"
-    check_file "$QUICKSTART" "quickstart.md"
-fi
diff --git a/.specify/templates/checklist-template.md b/.specify/templates/checklist-template.md
deleted file mode 100644
index c4aa166..0000000
--- a/.specify/templates/checklist-template.md
+++ /dev/null
@@ -1,40 +0,0 @@
-# [CHECKLIST TYPE] Checklist: [FEATURE NAME]
-
-**Purpose**: [Brief description of what this checklist covers]
-**Created**: [DATE]
-**Feature**: [Link to spec.md or relevant documentation]
-
-**Note**: This checklist is generated by the `/speckit-checklist` command based on feature context and requirements.
-
-<!-- 
-  ============================================================================
-  IMPORTANT: The checklist items below are SAMPLE ITEMS for illustration only.
-  
-  The /speckit-checklist command MUST replace these with actual items based on:
-  - User's specific checklist request
-  - Feature requirements from spec.md
-  - Technical context from plan.md
-  - Implementation details from tasks.md
-  
-  DO NOT keep these sample items in the generated checklist file.
-  ============================================================================
--->
-
-## [Category 1]
-
-- [ ] CHK001 First checklist item with clear action
-- [ ] CHK002 Second checklist item
-- [ ] CHK003 Third checklist item
-
-## [Category 2]
-
-- [ ] CHK004 Another category item
-- [ ] CHK005 Item with specific criteria
-- [ ] CHK006 Final item in this category
-
-## Notes
-
-- Check items off as completed: `[x]`
-- Add comments or findings inline
-- Link to relevant resources or documentation
-- Items are numbered sequentially for easy reference
diff --git a/.specify/templates/constitution-template.md b/.specify/templates/constitution-template.md
deleted file mode 100644
index a4670ff..0000000
--- a/.specify/templates/constitution-template.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# [PROJECT_NAME] Constitution
-<!-- Example: Spec Constitution, TaskFlow Constitution, etc. -->
-
-## Core Principles
-
-### [PRINCIPLE_1_NAME]
-<!-- Example: I. Library-First -->
-[PRINCIPLE_1_DESCRIPTION]
-<!-- Example: Every feature starts as a standalone library; Libraries must be self-contained, independently testable, documented; Clear purpose required - no organizational-only libraries -->
-
-### [PRINCIPLE_2_NAME]
-<!-- Example: II. CLI Interface -->
-[PRINCIPLE_2_DESCRIPTION]
-<!-- Example: Every library exposes functionality via CLI; Text in/out protocol: stdin/args → stdout, errors → stderr; Support JSON + human-readable formats -->
-
-### [PRINCIPLE_3_NAME]
-<!-- Example: III. Test-First (NON-NEGOTIABLE) -->
-[PRINCIPLE_3_DESCRIPTION]
-<!-- Example: TDD mandatory: Tests written → User approved → Tests fail → Then implement; Red-Green-Refactor cycle strictly enforced -->
-
-### [PRINCIPLE_4_NAME]
-<!-- Example: IV. Integration Testing -->
-[PRINCIPLE_4_DESCRIPTION]
-<!-- Example: Focus areas requiring integration tests: New library contract tests, Contract changes, Inter-service communication, Shared schemas -->
-
-### [PRINCIPLE_5_NAME]
-<!-- Example: V. Observability, VI. Versioning & Breaking Changes, VII. Simplicity -->
-[PRINCIPLE_5_DESCRIPTION]
-<!-- Example: Text I/O ensures debuggability; Structured logging required; Or: MAJOR.MINOR.BUILD format; Or: Start simple, YAGNI principles -->
-
-## [SECTION_2_NAME]
-<!-- Example: Additional Constraints, Security Requirements, Performance Standards, etc. -->
-
-[SECTION_2_CONTENT]
-<!-- Example: Technology stack requirements, compliance standards, deployment policies, etc. -->
-
-## [SECTION_3_NAME]
-<!-- Example: Development Workflow, Review Process, Quality Gates, etc. -->
-
-[SECTION_3_CONTENT]
-<!-- Example: Code review requirements, testing gates, deployment approval process, etc. -->
-
-## Governance
-<!-- Example: Constitution supersedes all other practices; Amendments require documentation, approval, migration plan -->
-
-[GOVERNANCE_RULES]
-<!-- Example: All PRs/reviews must verify compliance; Complexity must be justified; Use [GUIDANCE_FILE] for runtime development guidance -->
-
-**Version**: [CONSTITUTION_VERSION] | **Ratified**: [RATIFICATION_DATE] | **Last Amended**: [LAST_AMENDED_DATE]
-<!-- Example: Version: 2.1.1 | Ratified: 2025-06-13 | Last Amended: 2025-07-16 -->
diff --git a/.specify/templates/plan-template.md b/.specify/templates/plan-template.md
deleted file mode 100644
index 92b96c7..0000000
--- a/.specify/templates/plan-template.md
+++ /dev/null
@@ -1,113 +0,0 @@
-# Implementation Plan: [FEATURE]
-
-**Branch**: `[###-feature-name]` | **Date**: [DATE] | **Spec**: [link]
-
-**Input**: Feature specification from `/specs/[###-feature-name]/spec.md`
-
-**Note**: This template is filled in by the `/speckit-plan` command. See `.specify/templates/plan-template.md` for the execution workflow.
-
-## Summary
-
-[Extract from feature spec: primary requirement + technical approach from research]
-
-## Technical Context
-
-<!--
-  ACTION REQUIRED: Replace the content in this section with the technical details
-  for the project. The structure here is presented in advisory capacity to guide
-  the iteration process.
--->
-
-**Language/Version**: [e.g., Python 3.11, Swift 5.9, Rust 1.75 or NEEDS CLARIFICATION]
-
-**Primary Dependencies**: [e.g., FastAPI, UIKit, LLVM or NEEDS CLARIFICATION]
-
-**Storage**: [if applicable, e.g., PostgreSQL, CoreData, files or N/A]
-
-**Testing**: [e.g., pytest, XCTest, cargo test or NEEDS CLARIFICATION]
-
-**Target Platform**: [e.g., Linux server, iOS 15+, WASM or NEEDS CLARIFICATION]
-
-**Project Type**: [e.g., library/cli/web-service/mobile-app/compiler/desktop-app or NEEDS CLARIFICATION]
-
-**Performance Goals**: [domain-specific, e.g., 1000 req/s, 10k lines/sec, 60 fps or NEEDS CLARIFICATION]
-
-**Constraints**: [domain-specific, e.g., <200ms p95, <100MB memory, offline-capable or NEEDS CLARIFICATION]
-
-**Scale/Scope**: [domain-specific, e.g., 10k users, 1M LOC, 50 screens or NEEDS CLARIFICATION]
-
-## Constitution Check
-
-*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
-
-[Gates determined based on constitution file]
-
-## Project Structure
-
-### Documentation (this feature)
-
-```text
-specs/[###-feature]/
-├── plan.md              # This file (/speckit-plan command output)
-├── research.md          # Phase 0 output (/speckit-plan command)
-├── data-model.md        # Phase 1 output (/speckit-plan command)
-├── quickstart.md        # Phase 1 output (/speckit-plan command)
-├── contracts/           # Phase 1 output (/speckit-plan command)
-└── tasks.md             # Phase 2 output (/speckit-tasks command - NOT created by /speckit-plan)
-```
-
-### Source Code (repository root)
-<!--
-  ACTION REQUIRED: Replace the placeholder tree below with the concrete layout
-  for this feature. Delete unused options and expand the chosen structure with
-  real paths (e.g., apps/admin, packages/something). The delivered plan must
-  not include Option labels.
--->
-
-```text
-# [REMOVE IF UNUSED] Option 1: Single project (DEFAULT)
-src/
-├── models/
-├── services/
-├── cli/
-└── lib/
-
-tests/
-├── contract/
-├── integration/
-└── unit/
-
-# [REMOVE IF UNUSED] Option 2: Web application (when "frontend" + "backend" detected)
-backend/
-├── src/
-│   ├── models/
-│   ├── services/
-│   └── api/
-└── tests/
-
-frontend/
-├── src/
-│   ├── components/
-│   ├── pages/
-│   └── services/
-└── tests/
-
-# [REMOVE IF UNUSED] Option 3: Mobile + API (when "iOS/Android" detected)
-api/
-└── [same as backend above]
-
-ios/ or android/
-└── [platform-specific structure: feature modules, UI flows, platform tests]
-```
-
-**Structure Decision**: [Document the selected structure and reference the real
-directories captured above]
-
-## Complexity Tracking
-
-> **Fill ONLY if Constitution Check has violations that must be justified**
-
-| Violation | Why Needed | Simpler Alternative Rejected Because |
-|-----------|------------|-------------------------------------|
-| [e.g., 4th project] | [current need] | [why 3 projects insufficient] |
-| [e.g., Repository pattern] | [specific problem] | [why direct DB access insufficient] |
diff --git a/.specify/templates/spec-template.md b/.specify/templates/spec-template.md
deleted file mode 100644
index ceb2877..0000000
--- a/.specify/templates/spec-template.md
+++ /dev/null
@@ -1,131 +0,0 @@
-# Feature Specification: [FEATURE NAME]
-
-**Feature Branch**: `[###-feature-name]`
-
-**Created**: [DATE]
-
-**Status**: Draft
-
-**Input**: User description: "$ARGUMENTS"
-
-## User Scenarios & Testing *(mandatory)*
-
-<!--
-  IMPORTANT: User stories should be PRIORITIZED as user journeys ordered by importance.
-  Each user story/journey must be INDEPENDENTLY TESTABLE - meaning if you implement just ONE of them,
-  you should still have a viable MVP (Minimum Viable Product) that delivers value.
-
-  Assign priorities (P1, P2, P3, etc.) to each story, where P1 is the most critical.
-  Think of each story as a standalone slice of functionality that can be:
-  - Developed independently
-  - Tested independently
-  - Deployed independently
-  - Demonstrated to users independently
--->
-
-### User Story 1 - [Brief Title] (Priority: P1)
-
-[Describe this user journey in plain language]
-
-**Why this priority**: [Explain the value and why it has this priority level]
-
-**Independent Test**: [Describe how this can be tested independently - e.g., "Can be fully tested by [specific action] and delivers [specific value]"]
-
-**Acceptance Scenarios**:
-
-1. **Given** [initial state], **When** [action], **Then** [expected outcome]
-2. **Given** [initial state], **When** [action], **Then** [expected outcome]
-
----
-
-### User Story 2 - [Brief Title] (Priority: P2)
-
-[Describe this user journey in plain language]
-
-**Why this priority**: [Explain the value and why it has this priority level]
-
-**Independent Test**: [Describe how this can be tested independently]
-
-**Acceptance Scenarios**:
-
-1. **Given** [initial state], **When** [action], **Then** [expected outcome]
-
----
-
-### User Story 3 - [Brief Title] (Priority: P3)
-
-[Describe this user journey in plain language]
-
-**Why this priority**: [Explain the value and why it has this priority level]
-
-**Independent Test**: [Describe how this can be tested independently]
-
-**Acceptance Scenarios**:
-
-1. **Given** [initial state], **When** [action], **Then** [expected outcome]
-
----
-
-[Add more user stories as needed, each with an assigned priority]
-
-### Edge Cases
-
-<!--
-  ACTION REQUIRED: The content in this section represents placeholders.
-  Fill them out with the right edge cases.
--->
-
-- What happens when [boundary condition]?
-- How does system handle [error scenario]?
-
-## Requirements *(mandatory)*
-
-<!--
-  ACTION REQUIRED: The content in this section represents placeholders.
-  Fill them out with the right functional requirements.
--->
-
-### Functional Requirements
-
-- **FR-001**: System MUST [specific capability, e.g., "allow users to create accounts"]
-- **FR-002**: System MUST [specific capability, e.g., "validate email addresses"]
-- **FR-003**: Users MUST be able to [key interaction, e.g., "reset their password"]
-- **FR-004**: System MUST [data requirement, e.g., "persist user preferences"]
-- **FR-005**: System MUST [behavior, e.g., "log all security events"]
-
-*Example of marking unclear requirements:*
-
-- **FR-006**: System MUST authenticate users via [NEEDS CLARIFICATION: auth method not specified - email/password, SSO, OAuth?]
-- **FR-007**: System MUST retain user data for [NEEDS CLARIFICATION: retention period not specified]
-
-### Key Entities *(include if feature involves data)*
-
-- **[Entity 1]**: [What it represents, key attributes without implementation]
-- **[Entity 2]**: [What it represents, relationships to other entities]
-
-## Success Criteria *(mandatory)*
-
-<!--
-  ACTION REQUIRED: Define measurable success criteria.
-  These must be technology-agnostic and measurable.
--->
-
-### Measurable Outcomes
-
-- **SC-001**: [Measurable metric, e.g., "Users can complete account creation in under 2 minutes"]
-- **SC-002**: [Measurable metric, e.g., "System handles 1000 concurrent users without degradation"]
-- **SC-003**: [User satisfaction metric, e.g., "90% of users successfully complete primary task on first attempt"]
-- **SC-004**: [Business metric, e.g., "Reduce support tickets related to [X] by 50%"]
-
-## Assumptions
-
-<!--
-  ACTION REQUIRED: The content in this section represents placeholders.
-  Fill them out with the right assumptions based on reasonable defaults
-  chosen when the feature description did not specify certain details.
--->
-
-- [Assumption about target users, e.g., "Users have stable internet connectivity"]
-- [Assumption about scope boundaries, e.g., "Mobile support is out of scope for v1"]
-- [Assumption about data/environment, e.g., "Existing authentication system will be reused"]
-- [Dependency on existing system/service, e.g., "Requires access to the existing user profile API"]
diff --git a/.specify/templates/tasks-template.md b/.specify/templates/tasks-template.md
deleted file mode 100644
index d46a1f1..0000000
--- a/.specify/templates/tasks-template.md
+++ /dev/null
@@ -1,252 +0,0 @@
----
-
-description: "Task list template for feature implementation"
----
-
-# Tasks: [FEATURE NAME]
-
-**Input**: Design documents from `/specs/[###-feature-name]/`
-
-**Prerequisites**: plan.md (required), spec.md (required for user stories), research.md, data-model.md, contracts/
-
-**Tests**: The examples below include test tasks. Tests are OPTIONAL - only include them if explicitly requested in the feature specification.
-
-**Organization**: Tasks are grouped by user story to enable independent implementation and testing of each story.
-
-## Format: `[ID] [P?] [Story] Description`
-
-- **[P]**: Can run in parallel (different files, no dependencies)
-- **[Story]**: Which user story this task belongs to (e.g., US1, US2, US3)
-- Include exact file paths in descriptions
-
-## Path Conventions
-
-- **Single project**: `src/`, `tests/` at repository root
-- **Web app**: `backend/src/`, `frontend/src/`
-- **Mobile**: `api/src/`, `ios/src/` or `android/src/`
-- Paths shown below assume single project - adjust based on plan.md structure
-
-<!--
-  ============================================================================
-  IMPORTANT: The tasks below are SAMPLE TASKS for illustration purposes only.
-
-  The /speckit-tasks command MUST replace these with actual tasks based on:
-  - User stories from spec.md (with their priorities P1, P2, P3...)
-  - Feature requirements from plan.md
-  - Entities from data-model.md
-  - Endpoints from contracts/
-
-  Tasks MUST be organized by user story so each story can be:
-  - Implemented independently
-  - Tested independently
-  - Delivered as an MVP increment
-
-  DO NOT keep these sample tasks in the generated tasks.md file.
-  ============================================================================
--->
-
-## Phase 1: Setup (Shared Infrastructure)
-
-**Purpose**: Project initialization and basic structure
-
-- [ ] T001 Create project structure per implementation plan
-- [ ] T002 Initialize [language] project with [framework] dependencies
-- [ ] T003 [P] Configure linting and formatting tools
-
----
-
-## Phase 2: Foundational (Blocking Prerequisites)
-
-**Purpose**: Core infrastructure that MUST be complete before ANY user story can be implemented
-
-**⚠️ CRITICAL**: No user story work can begin until this phase is complete
-
-Examples of foundational tasks (adjust based on your project):
-
-- [ ] T004 Setup database schema and migrations framework
-- [ ] T005 [P] Implement authentication/authorization framework
-- [ ] T006 [P] Setup API routing and middleware structure
-- [ ] T007 Create base models/entities that all stories depend on
-- [ ] T008 Configure error handling and logging infrastructure
-- [ ] T009 Setup environment configuration management
-
-**Checkpoint**: Foundation ready - user story implementation can now begin in parallel
-
----
-
-## Phase 3: User Story 1 - [Title] (Priority: P1) 🎯 MVP
-
-**Goal**: [Brief description of what this story delivers]
-
-**Independent Test**: [How to verify this story works on its own]
-
-### Tests for User Story 1 (OPTIONAL - only if tests requested) ⚠️
-
-> **NOTE: Write these tests FIRST, ensure they FAIL before implementation**
-
-- [ ] T010 [P] [US1] Contract test for [endpoint] in tests/contract/test_[name].py
-- [ ] T011 [P] [US1] Integration test for [user journey] in tests/integration/test_[name].py
-
-### Implementation for User Story 1
-
-- [ ] T012 [P] [US1] Create [Entity1] model in src/models/[entity1].py
-- [ ] T013 [P] [US1] Create [Entity2] model in src/models/[entity2].py
-- [ ] T014 [US1] Implement [Service] in src/services/[service].py (depends on T012, T013)
-- [ ] T015 [US1] Implement [endpoint/feature] in src/[location]/[file].py
-- [ ] T016 [US1] Add validation and error handling
-- [ ] T017 [US1] Add logging for user story 1 operations
-
-**Checkpoint**: At this point, User Story 1 should be fully functional and testable independently
-
----
-
-## Phase 4: User Story 2 - [Title] (Priority: P2)
-
-**Goal**: [Brief description of what this story delivers]
-
-**Independent Test**: [How to verify this story works on its own]
-
-### Tests for User Story 2 (OPTIONAL - only if tests requested) ⚠️
-
-- [ ] T018 [P] [US2] Contract test for [endpoint] in tests/contract/test_[name].py
-- [ ] T019 [P] [US2] Integration test for [user journey] in tests/integration/test_[name].py
-
-### Implementation for User Story 2
-
-- [ ] T020 [P] [US2] Create [Entity] model in src/models/[entity].py
-- [ ] T021 [US2] Implement [Service] in src/services/[service].py
-- [ ] T022 [US2] Implement [endpoint/feature] in src/[location]/[file].py
-- [ ] T023 [US2] Integrate with User Story 1 components (if needed)
-
-**Checkpoint**: At this point, User Stories 1 AND 2 should both work independently
-
----
-
-## Phase 5: User Story 3 - [Title] (Priority: P3)
-
-**Goal**: [Brief description of what this story delivers]
-
-**Independent Test**: [How to verify this story works on its own]
-
-### Tests for User Story 3 (OPTIONAL - only if tests requested) ⚠️
-
-- [ ] T024 [P] [US3] Contract test for [endpoint] in tests/contract/test_[name].py
-- [ ] T025 [P] [US3] Integration test for [user journey] in tests/integration/test_[name].py
-
-### Implementation for User Story 3
-
-- [ ] T026 [P] [US3] Create [Entity] model in src/models/[entity].py
-- [ ] T027 [US3] Implement [Service] in src/services/[service].py
-- [ ] T028 [US3] Implement [endpoint/feature] in src/[location]/[file].py
-
-**Checkpoint**: All user stories should now be independently functional
-
----
-
-[Add more user story phases as needed, following the same pattern]
-
----
-
-## Phase N: Polish & Cross-Cutting Concerns
-
-**Purpose**: Improvements that affect multiple user stories
-
-- [ ] TXXX [P] Documentation updates in docs/
-- [ ] TXXX Code cleanup and refactoring
-- [ ] TXXX Performance optimization across all stories
-- [ ] TXXX [P] Additional unit tests (if requested) in tests/unit/
-- [ ] TXXX Security hardening
-- [ ] TXXX Run quickstart.md validation
-
----
-
-## Dependencies & Execution Order
-
-### Phase Dependencies
-
-- **Setup (Phase 1)**: No dependencies - can start immediately
-- **Foundational (Phase 2)**: Depends on Setup completion - BLOCKS all user stories
-- **User Stories (Phase 3+)**: All depend on Foundational phase completion
-  - User stories can then proceed in parallel (if staffed)
-  - Or sequentially in priority order (P1 → P2 → P3)
-- **Polish (Final Phase)**: Depends on all desired user stories being complete
-
-### User Story Dependencies
-
-- **User Story 1 (P1)**: Can start after Foundational (Phase 2) - No dependencies on other stories
-- **User Story 2 (P2)**: Can start after Foundational (Phase 2) - May integrate with US1 but should be independently testable
-- **User Story 3 (P3)**: Can start after Foundational (Phase 2) - May integrate with US1/US2 but should be independently testable
-
-### Within Each User Story
-
-- Tests (if included) MUST be written and FAIL before implementation
-- Models before services
-- Services before endpoints
-- Core implementation before integration
-- Story complete before moving to next priority
-
-### Parallel Opportunities
-
-- All Setup tasks marked [P] can run in parallel
-- All Foundational tasks marked [P] can run in parallel (within Phase 2)
-- Once Foundational phase completes, all user stories can start in parallel (if team capacity allows)
-- All tests for a user story marked [P] can run in parallel
-- Models within a story marked [P] can run in parallel
-- Different user stories can be worked on in parallel by different team members
-
----
-
-## Parallel Example: User Story 1
-
-```bash
-# Launch all tests for User Story 1 together (if tests requested):
-Task: "Contract test for [endpoint] in tests/contract/test_[name].py"
-Task: "Integration test for [user journey] in tests/integration/test_[name].py"
-
-# Launch all models for User Story 1 together:
-Task: "Create [Entity1] model in src/models/[entity1].py"
-Task: "Create [Entity2] model in src/models/[entity2].py"
-```
-
----
-
-## Implementation Strategy
-
-### MVP First (User Story 1 Only)
-
-1. Complete Phase 1: Setup
-2. Complete Phase 2: Foundational (CRITICAL - blocks all stories)
-3. Complete Phase 3: User Story 1
-4. **STOP and VALIDATE**: Test User Story 1 independently
-5. Deploy/demo if ready
-
-### Incremental Delivery
-
-1. Complete Setup + Foundational → Foundation ready
-2. Add User Story 1 → Test independently → Deploy/Demo (MVP!)
-3. Add User Story 2 → Test independently → Deploy/Demo
-4. Add User Story 3 → Test independently → Deploy/Demo
-5. Each story adds value without breaking previous stories
-
-### Parallel Team Strategy
-
-With multiple developers:
-
-1. Team completes Setup + Foundational together
-2. Once Foundational is done:
-   - Developer A: User Story 1
-   - Developer B: User Story 2
-   - Developer C: User Story 3
-3. Stories complete and integrate independently
-
----
-
-## Notes
-
-- [P] tasks = different files, no dependencies
-- [Story] label maps task to specific user story for traceability
-- Each user story should be independently completable and testable
-- Verify tests fail before implementing
-- Commit after each task or logical group
-- Stop at any checkpoint to validate story independently
-- Avoid: vague tasks, same file conflicts, cross-story dependencies that break independence
diff --git a/.specify/workflows/speckit/workflow.yml b/.specify/workflows/speckit/workflow.yml
deleted file mode 100644
index f69efea..0000000
--- a/.specify/workflows/speckit/workflow.yml
+++ /dev/null
@@ -1,77 +0,0 @@
-schema_version: "1.0"
-workflow:
-  id: "speckit"
-  name: "Full SDD Cycle"
-  version: "1.0.0"
-  author: "GitHub"
-  description: "Runs specify → plan → tasks → implement with review gates"
-
-requires:
-  # 0.8.5 is the first release with engine-side resolution of the
-  # ``integration: "auto"`` default. Older versions would treat "auto"
-  # as a literal integration key and fail at dispatch.
-  speckit_version: ">=0.8.5"
-  integrations:
-    # The four commands below (specify, plan, tasks, implement) are core
-    # spec-kit commands provided by every integration. The list here is an
-    # advisory, non-exhaustive compatibility hint following the documented
-    # ``any: [...]`` schema -- it is NOT a closed set. The workflow runs
-    # against any integration the project was initialized with, including
-    # ones not listed below, as long as that integration provides the four
-    # core commands referenced in ``steps``.
-    any:
-      - "claude"
-      - "copilot"
-      - "gemini"
-      - "opencode"
-
-inputs:
-  spec:
-    type: string
-    required: true
-    prompt: "Describe what you want to build"
-  integration:
-    type: string
-    default: "auto"
-    prompt: "Integration to use (e.g. claude, copilot, gemini; 'auto' uses the project's initialized integration)"
-  scope:
-    type: string
-    default: "full"
-    enum: ["full", "backend-only", "frontend-only"]
-
-steps:
-  - id: specify
-    command: speckit.specify
-    integration: "{{ inputs.integration }}"
-    input:
-      args: "{{ inputs.spec }}"
-
-  - id: review-spec
-    type: gate
-    message: "Review the generated spec before planning."
-    options: [approve, reject]
-    on_reject: abort
-
-  - id: plan
-    command: speckit.plan
-    integration: "{{ inputs.integration }}"
-    input:
-      args: "{{ inputs.spec }}"
-
-  - id: review-plan
-    type: gate
-    message: "Review the plan before generating tasks."
-    options: [approve, reject]
-    on_reject: abort
-
-  - id: tasks
-    command: speckit.tasks
-    integration: "{{ inputs.integration }}"
-    input:
-      args: "{{ inputs.spec }}"
-
-  - id: implement
-    command: speckit.implement
-    integration: "{{ inputs.integration }}"
-    input:
-      args: "{{ inputs.spec }}"
diff --git a/.specify/workflows/workflow-registry.json b/.specify/workflows/workflow-registry.json
deleted file mode 100644
index 1c25ebe..0000000
--- a/.specify/workflows/workflow-registry.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "schema_version": "1.0",
-  "workflows": {
-    "speckit": {
-      "name": "Full SDD Cycle",
-      "version": "1.0.0",
-      "description": "Runs specify \u2192 plan \u2192 tasks \u2192 implement with review gates",
-      "source": "bundled",
-      "installed_at": "2026-06-20T12:54:56.328042+00:00",
-      "updated_at": "2026-06-20T12:54:56.328055+00:00"
-    }
-  }
-}
\ No newline at end of file
diff --git a/02-cluster/local/env/02-cluster-local-example.tfvars b/02-cluster/local/env/02-cluster-local-example.tfvars
new file mode 100644
index 0000000..e47d8ea
--- /dev/null
+++ b/02-cluster/local/env/02-cluster-local-example.tfvars
@@ -0,0 +1,13 @@
+# This repo follow GitOps convention & standard. 
+# Which means even `local` environment do get it's own official environment file.
+# Treat this file as an example file for any local environment. But only push what should be pushed.
+# For secrets, please at least use a .gitingored file extension (such as *.auto.tfvars files, which are apply by default, with lower precedence)
+
+
+# infisical_client_id     = ""
+# infisical_client_secret = ""
+
+ # By default, terraform should default this variable into the most production-ish reference you have, as default value within `variables.tf`, and keep that variable commented in git.
+ # This is an expected behavior, as CI tests regarding local environment will exploit this behavior to keep things DRY.
+ # This is only true for any "local" env files
+# gitops_revision = "main"
diff --git a/02-cluster/local/env/02-cluster-local.tfvars b/02-cluster/local/env/02-cluster-local.tfvars
deleted file mode 100644
index bd4c3c1..0000000
--- a/02-cluster/local/env/02-cluster-local.tfvars
+++ /dev/null
@@ -1,8 +0,0 @@
-# This repo follow GitOps convention & standard. 
-# Which means even `local` environment do get it's own official environment file.
-# Treat this file as an example file for any local environment
-
-
-# infisical_client_id     = ""
-# infisical_client_secret = ""
-gitops_revision = "main"
diff --git a/02-cluster/local/main.tf b/02-cluster/local/main.tf
index 3d0ce8f..5ae0992 100644
--- a/02-cluster/local/main.tf
+++ b/02-cluster/local/main.tf
@@ -1,9 +1,51 @@
 data "infisical_secrets" "this" {
+  count        = var.argocd_admin_password_hash == "" ? 1 : 0
   env_slug     = "local"
   workspace_id = "7ecb6ed4-058a-46cd-ac9f-7e792469cf0f" // project ID
   folder_path  = "/"
 }
 
+locals {
+  argocd_password_hash = var.argocd_admin_password_hash != "" ? var.argocd_admin_password_hash : data.infisical_secrets.this[0].secrets["ArgoCD_admin_encrypted"].value
+}
+
+resource "kubernetes_namespace" "openbao" {
+  metadata {
+    name = "openbao"
+  }
+}
+
+resource "kubernetes_secret" "scaleway_s3_credentials" {
+  metadata {
+    name      = "scaleway-s3-credentials"
+    namespace = kubernetes_namespace.openbao.metadata[0].name
+  }
+
+  data = {
+    bucket     = "backup-dev-id"
+    AWS_ACCESS_KEY_ID = "SCW8FGA70P4HY3A120KV"
+    AWS_SECRET_ACCESS_KEY = var.scaleway_s3_secret_key
+  }
+}
+
+# AWS credentials OpenBao reads at startup for KMS auto-unseal (seal "awskms").
+# Sourced here — outside OpenBao — by necessity: OpenBao can't supply the very
+# creds it needs to unseal itself (chicken-and-egg). Values come from the
+# 03-backup/scaleway kms.tf outputs, fed via the gitignored *.auto.tfvars.
+# Key names (access_key/secret_key) mirror scaleway-s3-credentials so the
+# OpenBao chart's extraSecretEnvironmentVars mapping stays uniform.
+resource "kubernetes_secret" "openbao_unseal_aws" {
+  metadata {
+    name      = "openbao-unseal-aws"
+    namespace = kubernetes_namespace.openbao.metadata[0].name
+  }
+
+  data = {
+    AWS_ACCESS_KEY_ID = var.openbao_unseal_aws_access_key_id
+    AWS_SECRET_ACCESS_KEY = var.openbao_unseal_aws_secret_access_key
+  }
+}
+
 resource "helm_release" "argocd" {
   name             = "argocd"
   namespace        = "argocd"
@@ -17,7 +59,7 @@ resource "helm_release" "argocd" {
     name = "configs.secret.argocdServerAdminPassword"
     # ArgoCD require a `bcrypt()` hashed password here. But `bcrypt` generate a new hash at each execution
     # So instead, we store the hash directly, so terraform is not confused anymore by fake changes
-    value = data.infisical_secrets.this.secrets["ArgoCD_admin_encrypted"].value
+    value = local.argocd_password_hash
   }]
 
   values = [<<EOF
diff --git a/02-cluster/local/variables.tf b/02-cluster/local/variables.tf
index 87f0bc3..6536812 100644
--- a/02-cluster/local/variables.tf
+++ b/02-cluster/local/variables.tf
@@ -10,3 +10,30 @@ variable "gitops_revision" {
   type    = string
   default = "main"
 }
+
+variable "argocd_admin_password_hash" {
+  description = "Pre-computed bcrypt hash of the ArgoCD admin password. When set, Infisical is not consulted."
+  type        = string
+  # default     = ""
+}
+
+variable "scaleway_s3_secret_key" {
+  description = "Scaleway S3 secret key for OpenBao backup bucket"
+  type        = string
+  sensitive   = true
+  # default     = ""
+}
+
+variable "openbao_unseal_aws_access_key_id" {
+  description = "AWS access key id OpenBao uses for KMS auto-unseal. From 03-backup/scaleway output `openbao_unseal_access_key_id`."
+  type        = string
+  sensitive   = true
+  # default     = ""
+}
+
+variable "openbao_unseal_aws_secret_access_key" {
+  description = "AWS secret access key OpenBao uses for KMS auto-unseal. From 03-backup/scaleway output `openbao_unseal_secret_access_key`."
+  type        = string
+  sensitive   = true
+  # default     = ""
+}
diff --git a/03-backup/scaleway/iam.tf b/03-backup/scaleway/iam.tf
index c7c8bfa..d61d183 100644
--- a/03-backup/scaleway/iam.tf
+++ b/03-backup/scaleway/iam.tf
@@ -1,6 +1,6 @@
 resource "scaleway_iam_application" "kubernetes" {
   name        = "backup-k8s-${terraform.workspace}"
-  description = "Kubernetes workload identity for ${terraform.workspace} — grants pods object read/write on the backup bucket via Infisical → ESO → Secret (no administrative rights, managed by terraform: 03-backup/scaleway/)."
+  description = "Kubernetes workload identity for ${terraform.workspace} — grants pods object read/write on the backup bucket."
 }
 
 resource "scaleway_iam_policy" "kubernetes" {
@@ -10,7 +10,7 @@ resource "scaleway_iam_policy" "kubernetes" {
 
   rule {
     project_ids          = [var.project_id]
-    permission_set_names = ["ObjectStorageObjectsRead", "ObjectStorageObjectsWrite"]
+    permission_set_names = ["ObjectStorageObjectsRead", "ObjectStorageObjectsWrite", "ObjectStorageBucketsRead"]
   }
 }
 
diff --git a/03-backup/scaleway/infisical.tf b/03-backup/scaleway/infisical.tf
deleted file mode 100644
index e55d3d7..0000000
--- a/03-backup/scaleway/infisical.tf
+++ /dev/null
@@ -1,23 +0,0 @@
-resource "infisical_secret_folder" "backup" {
-  project_id       = var.infisical_workspace_id
-  environment_slug = var.infisical_env_slug
-  folder_path      = "/"
-  name             = trimprefix(var.infisical_folder_path, "/")
-  description      = "Backup workload credentials (managed by terraform: 03-backup/scaleway/)."
-}
-
-resource "infisical_secret" "access_key" {
-  name         = "BACKUP_ACCESS_KEY"
-  value        = scaleway_iam_api_key.kubernetes.access_key
-  env_slug     = var.infisical_env_slug
-  workspace_id = var.infisical_workspace_id
-  folder_path  = infisical_secret_folder.backup.path
-}
-
-resource "infisical_secret" "secret_key" {
-  name         = "BACKUP_SECRET_KEY"
-  value        = scaleway_iam_api_key.kubernetes.secret_key
-  env_slug     = var.infisical_env_slug
-  workspace_id = var.infisical_workspace_id
-  folder_path  = infisical_secret_folder.backup.path
-}
diff --git a/03-backup/scaleway/kms.tf b/03-backup/scaleway/kms.tf
new file mode 100644
index 0000000..a9f2de1
--- /dev/null
+++ b/03-backup/scaleway/kms.tf
@@ -0,0 +1,115 @@
+# =============================================================================
+# OpenBao auto-unseal — native AWS KMS.
+#
+# OpenBao runs on Scaleway Kapsule, which is NOT AWS: there is no instance
+# profile / IRSA to lean on, so the `seal "awskms"` stanza must authenticate
+# with a STATIC AWS access key. This root therefore provisions:
+#
+#   1. A symmetric KMS key (the unseal key — encrypts OpenBao's root key).
+#   2. A dedicated, single-purpose IAM user whose ONLY capability is to
+#      Encrypt/Decrypt/DescribeKey against this one key (granted via the key
+#      policy, not an IAM policy — the user holds no IAM permissions at all).
+#   3. A static access key for that user, surfaced as outputs.
+#
+# The access key id + secret feed OpenBao's pod env (AWS_ACCESS_KEY_ID /
+# AWS_SECRET_ACCESS_KEY) alongside the KMS key id, e.g.:
+#
+#   seal "awskms" {
+#     region     = "<aws_region>"
+#     kms_key_id = "<kms_key_id output>"
+#   }
+#
+# APPLY PATH — admin/local only. See version.tf: the backup CI role is S3-only
+# and the CI permissions boundary denies IAM users + access keys. Apply this
+# locally with SSO admin credentials (`aws sso login`).
+# =============================================================================
+
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
+locals {
+  unseal_name = "openbao-unseal-${terraform.workspace}"
+}
+
+# -----------------------------------------------------------------------------
+# The IAM user OpenBao authenticates as. It carries NO IAM policy — its only
+# capability comes from the KMS key policy below (least privilege: it cannot
+# touch any other key or AWS resource even if the access key leaks).
+# -----------------------------------------------------------------------------
+resource "aws_iam_user" "openbao_unseal" {
+  name = local.unseal_name
+  path = "/openbao/"
+
+  tags = {
+    Terraform   = "true"
+    Environment = "dev"
+    Purpose     = "openbao-auto-unseal"
+  }
+}
+
+# Scaleway-side keys carry an expiry (see iam.tf); AWS access keys do not expire
+# on their own. Rotation is a manual operator action: taint this key, re-apply,
+# then update the OpenBao Secret. Kept static because OpenBao must read it at
+# every pod start (including unattended restarts), with no human in the loop.
+resource "aws_iam_access_key" "openbao_unseal" {
+  user = aws_iam_user.openbao_unseal.name
+}
+
+# -----------------------------------------------------------------------------
+# The unseal key. Symmetric, auto-rotated (transparent — the key id is stable,
+# so OpenBao keeps unsealing across rotations). prevent_destroy because losing
+# this key permanently bricks OpenBao: it must outlive ephemeral cluster resets.
+# -----------------------------------------------------------------------------
+resource "aws_kms_key" "openbao_unseal" {
+  description             = "OpenBao auto-unseal key (${terraform.workspace}). Wraps OpenBao's root key; destroying it permanently bricks the OpenBao store."
+  deletion_window_in_days = 30
+  enable_key_rotation     = true
+  policy                  = data.aws_iam_policy_document.openbao_unseal_key.json
+
+  tags = {
+    Terraform   = "true"
+    Environment = "dev"
+    Purpose     = "openbao-auto-unseal"
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "aws_kms_alias" "openbao_unseal" {
+  name          = "alias/${local.unseal_name}"
+  target_key_id = aws_kms_key.openbao_unseal.key_id
+}
+
+# Key policy = the single source of access for this key:
+#   - account root keeps full administrative control (so the key is never
+#     orphaned and can always be managed via IAM / the console).
+#   - the OpenBao user gets exactly the three crypto actions auto-unseal needs.
+data "aws_iam_policy_document" "openbao_unseal_key" {
+  statement {
+    sid    = "EnableRootAccountAdmin"
+    effect = "Allow"
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"]
+    }
+    actions   = ["kms:*"]
+    resources = ["*"]
+  }
+
+  statement {
+    sid    = "AllowOpenBaoAutoUnseal"
+    effect = "Allow"
+    principals {
+      type        = "AWS"
+      identifiers = [aws_iam_user.openbao_unseal.arn]
+    }
+    actions = [
+      "kms:Encrypt",
+      "kms:Decrypt",
+      "kms:DescribeKey",
+    ]
+    resources = ["*"]
+  }
+}
diff --git a/03-backup/scaleway/outputs.tf b/03-backup/scaleway/outputs.tf
index 9b94874..4026fae 100644
--- a/03-backup/scaleway/outputs.tf
+++ b/03-backup/scaleway/outputs.tf
@@ -17,3 +17,37 @@ output "workload_access_key" {
   description = "Public access key for the scoped Kubernetes backup workload identity. The secret key is in Infisical only."
   value       = scaleway_iam_api_key.kubernetes.access_key
 }
+
+output "workload_secret_key" {
+  sensitive   = true
+  description = "Public access key for the scoped Kubernetes backup workload identity. The secret key is in Infisical only."
+  value       = scaleway_iam_api_key.kubernetes.secret_key
+}
+
+# ── OpenBao auto-unseal (AWS KMS, kms.tf) ────────────────────────────────────
+
+output "openbao_unseal_kms_key_id" {
+  description = "KMS key id for OpenBao's `seal \"awskms\"` stanza (kms_key_id)."
+  value       = aws_kms_key.openbao_unseal.key_id
+}
+
+output "openbao_unseal_kms_key_arn" {
+  description = "KMS key ARN of the OpenBao auto-unseal key."
+  value       = aws_kms_key.openbao_unseal.arn
+}
+
+output "openbao_unseal_aws_region" {
+  description = "AWS region the unseal key lives in (OpenBao seal `region`)."
+  value       = var.aws_region
+}
+
+output "openbao_unseal_access_key_id" {
+  description = "AWS access key id OpenBao uses to reach the unseal key (AWS_ACCESS_KEY_ID)."
+  value       = aws_iam_access_key.openbao_unseal.id
+}
+
+output "openbao_unseal_secret_access_key" {
+  description = "AWS secret access key OpenBao uses to reach the unseal key (AWS_SECRET_ACCESS_KEY). Feed into the OpenBao Secret."
+  sensitive   = true
+  value       = aws_iam_access_key.openbao_unseal.secret
+}
diff --git a/03-backup/scaleway/variables.tf b/03-backup/scaleway/variables.tf
index a45b15f..e816d53 100644
--- a/03-backup/scaleway/variables.tf
+++ b/03-backup/scaleway/variables.tf
@@ -9,6 +9,12 @@ variable "region" {
   default     = "fr-par"
 }
 
+variable "aws_region" {
+  description = "AWS region for the OpenBao auto-unseal KMS key (kms.tf). Defaults to the state bucket region to keep all AWS resources colocated."
+  type        = string
+  default     = "eu-west-3"
+}
+
 # ── Lifecycle ────────────────────────────────────────────────────────────────
 
 variable "versioning_enabled" {
diff --git a/03-backup/scaleway/version.tf b/03-backup/scaleway/version.tf
index bff9de7..25b2a39 100644
--- a/03-backup/scaleway/version.tf
+++ b/03-backup/scaleway/version.tf
@@ -13,6 +13,10 @@ terraform {
       source  = "scaleway/scaleway"
       version = "~> 2.0"
     }
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
     infisical = {
       source  = "infisical/infisical"
       version = "~> 0.16"
@@ -26,10 +30,23 @@ terraform {
 
 provider "scaleway" {}
 
-provider "infisical" {
-  auth = {
-    # Uncomment `universal` and comment `oidc` when running terraform locally.
-    # universal = {}
-    oidc = {}
-  }
+# AWS provider — used ONLY by kms.tf (OpenBao auto-unseal key + scoped IAM user).
+# Credentials are resolved by the AWS SDK chain, NOT hardcoded:
+#   - local: `aws sso login` -> the provider defaults to your SSO admin session
+#
+# IMPORTANT — apply path: these AWS resources (kms:CreateKey, iam:CreateUser,
+# iam:CreateAccessKey) CANNOT be applied by the backup CI workflow, which assumes
+# the S3-only `tf-state-access` role (and the CI permissions boundary explicitly
+# denies IAM users / access keys). kms.tf is therefore an ADMIN-APPLIED, run-it-
+# locally concern. A push that changes kms.tf will fail the backup CI apply.
+provider "aws" {
+  region = var.aws_region
 }
+
+# provider "infisical" {
+#   auth = {
+#     # Uncomment `universal` and comment `oidc` when running terraform locally.
+#     # universal = {}
+#     oidc = {}
+#   }
+# }
diff --git a/mise.toml b/mise.toml
index bc2853d..d7b8deb 100644
--- a/mise.toml
+++ b/mise.toml
@@ -39,7 +39,7 @@ if [ "$ws" = "default" ]; then
   echo "error: terraform workspace is 'default' — select a real workspace first (terraform workspace select <env>)" >&2
   exit 1
 fi
-terraform apply -auto-approve -var-file="env/${ws}.tfvars"
+terraform apply -auto-approve -var-file="env/${ws}.tfvars" $(test -f default.auto.tfvars && echo "-var-file=default.auto.tfvars")
 """
 
 [tasks.dev]
diff --git a/modules/README.md b/modules/README.md
deleted file mode 100644
index 9ce6302..0000000
--- a/modules/README.md
+++ /dev/null
@@ -1,12 +0,0 @@
-# modules/
-
-Reusable Terraform modules shared across the roots in this repo.
-
-Empty for now — the roots currently consume community modules
-(`terraform-aws-modules/*`) directly. When a pattern is duplicated across roots
-(e.g. an IAM identity used by more than one root), factor it out into a module
-here and reference it with a relative `source = "../../modules/<name>"`.
-
-Roots (the deployable configs) live under the numeric domain folders
-`00-remote_state/`, `01-iam/`, and `02-cluster/`; this folder holds only
-non-deployable, reusable building blocks.