From b45577512616da069f099210b855140ccd52cc3e Mon Sep 17 00:00:00 2001
From: Adrian Martin Garcia <adrianmg231189@gmail.com>
Date: Sun, 12 Apr 2026 23:20:37 +0200
Subject: [PATCH 1/5] feat: add Docker image, tests, docs and CLI snapshot for
 v1.5.1

---
 .dockerignore                                 |   4 +
 .github/copilot-instructions.md               |  77 ++++
 .github/prompts/opsx-apply.prompt.md          | 149 ++++++
 .github/prompts/opsx-archive.prompt.md        | 154 +++++++
 .github/prompts/opsx-explore.prompt.md        | 170 +++++++
 .github/prompts/opsx-propose.prompt.md        | 103 +++++
 .github/skills/openspec-apply-change/SKILL.md | 156 +++++++
 .../skills/openspec-archive-change/SKILL.md   | 114 +++++
 .github/skills/openspec-explore/SKILL.md      | 288 ++++++++++++
 .github/skills/openspec-propose/SKILL.md      | 110 +++++
 .github/updatecli/powerpipe.yaml              |  23 +
 .github/workflows/copilot-setup-steps.yml     |  30 ++
 .github/workflows/docker-build.yml            | 282 ++++++++++++
 .gitignore                                    |  16 +
 .hadolint.yaml                                |   9 +
 CONTRIBUTING.md                               |  97 ++++
 Dockerfile                                    |  50 ++
 LICENSE                                       |  21 +
 README.md                                     | 117 ++++-
 cli-snapshot.json                             | 432 ++++++++++++++++++
 docs/configuration.md                         | 120 +++++
 docs/examples.md                              | 176 +++++++
 docs/getting-started.md                       | 109 +++++
 docs/kubernetes.md                            | 173 +++++++
 docs/troubleshooting.md                       | 165 +++++++
 examples/docker-compose.yml                   |  40 ++
 examples/powerpipe.ppvars                     |  15 +
 package.json                                  |  21 +
 .../compare_snapshots.cpython-314.pyc         | Bin 0 -> 10154 bytes
 scripts/compare_snapshots.py                  | 166 +++++++
 scripts/extract-cli-snapshot.sh               | 124 +++++
 scripts/extract-env-vars.sh                   |  28 ++
 structure-tests.yaml                          |  87 ++++
 .../conftest.cpython-314-pytest-9.0.2.pyc     | Bin 0 -> 627 bytes
 .../conftest.cpython-314-pytest-9.0.3.pyc     | Bin 0 -> 627 bytes
 ...are_snapshots.cpython-314-pytest-9.0.2.pyc | Bin 0 -> 40162 bytes
 ...are_snapshots.cpython-314-pytest-9.0.3.pyc | Bin 0 -> 40162 bytes
 tests/conftest.py                             |   5 +
 tests/requirements.txt                        |   2 +
 tests/test_compare_snapshots.py               | 317 +++++++++++++
 trivy.yaml                                    |   9 +
 41 files changed, 3958 insertions(+), 1 deletion(-)
 create mode 100644 .dockerignore
 create mode 100644 .github/copilot-instructions.md
 create mode 100644 .github/prompts/opsx-apply.prompt.md
 create mode 100644 .github/prompts/opsx-archive.prompt.md
 create mode 100644 .github/prompts/opsx-explore.prompt.md
 create mode 100644 .github/prompts/opsx-propose.prompt.md
 create mode 100644 .github/skills/openspec-apply-change/SKILL.md
 create mode 100644 .github/skills/openspec-archive-change/SKILL.md
 create mode 100644 .github/skills/openspec-explore/SKILL.md
 create mode 100644 .github/skills/openspec-propose/SKILL.md
 create mode 100644 .github/updatecli/powerpipe.yaml
 create mode 100644 .github/workflows/copilot-setup-steps.yml
 create mode 100644 .github/workflows/docker-build.yml
 create mode 100644 .gitignore
 create mode 100644 .hadolint.yaml
 create mode 100644 CONTRIBUTING.md
 create mode 100644 Dockerfile
 create mode 100644 LICENSE
 create mode 100644 cli-snapshot.json
 create mode 100644 docs/configuration.md
 create mode 100644 docs/examples.md
 create mode 100644 docs/getting-started.md
 create mode 100644 docs/kubernetes.md
 create mode 100644 docs/troubleshooting.md
 create mode 100644 examples/docker-compose.yml
 create mode 100644 examples/powerpipe.ppvars
 create mode 100644 package.json
 create mode 100644 scripts/__pycache__/compare_snapshots.cpython-314.pyc
 create mode 100644 scripts/compare_snapshots.py
 create mode 100755 scripts/extract-cli-snapshot.sh
 create mode 100755 scripts/extract-env-vars.sh
 create mode 100644 structure-tests.yaml
 create mode 100644 tests/__pycache__/conftest.cpython-314-pytest-9.0.2.pyc
 create mode 100644 tests/__pycache__/conftest.cpython-314-pytest-9.0.3.pyc
 create mode 100644 tests/__pycache__/test_compare_snapshots.cpython-314-pytest-9.0.2.pyc
 create mode 100644 tests/__pycache__/test_compare_snapshots.cpython-314-pytest-9.0.3.pyc
 create mode 100644 tests/conftest.py
 create mode 100644 tests/requirements.txt
 create mode 100644 tests/test_compare_snapshots.py
 create mode 100644 trivy.yaml

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..050fa4c
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,4 @@
+.git
+.github
+*.md
+LICENSE
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
new file mode 100644
index 0000000..3c681be
--- /dev/null
+++ b/.github/copilot-instructions.md
@@ -0,0 +1,77 @@
+# Copilot Instructions — devops-ia/powerpipe
+
+## Project Overview
+
+This repo maintains a community Docker image for [Powerpipe](https://powerpipe.io). Turbot stopped publishing official Docker images, so we build from their pre-compiled binaries.
+
+The image is a thin wrapper: it downloads the Powerpipe binary, sets up the runtime environment (UID 9193, dirs, env vars), and provides a default CMD.
+
+## Architecture
+
+```
+Dockerfile          → builds the image (ARG POWERPIPE_VERSION controls version)
+README.md           → documents flags, env vars, quickstart, Kubernetes notes
+cli-snapshot.json   → machine-readable snapshot of CLI behavior (auto-generated)
+scripts/            → extraction and comparison tools (do not modify)
+package.json        → semantic-release config (do not modify)
+```
+
+## When Upstream Releases a New Version
+
+1. Review the behavioral diff in the PR comment
+2. Update `README.md`:
+   - Add new CLI flags to the flag tables
+   - Remove deprecated/removed flags
+   - Add new environment variables to the env var table
+   - Remove dropped environment variables
+   - Update the version in example commands if relevant
+3. Update `Dockerfile`:
+   - Add/remove ENV vars if defaults changed
+   - Update HEALTHCHECK if the service behavior changed
+4. Do NOT update `ARG POWERPIPE_VERSION` (updatecli handles this)
+5. Do NOT modify `cli-snapshot.json` (CI regenerates it)
+
+## Files You SHOULD Modify
+
+- `README.md` — flag tables, env var tables, examples
+- `Dockerfile` — ENV defaults, HEALTHCHECK, EXPOSE
+
+## Files You MUST NOT Modify
+
+- `.github/workflows/` — CI/CD pipelines
+- `package.json` — semantic-release config
+- `cli-snapshot.json` — auto-generated by CI
+- `scripts/` — extraction tools
+- `LICENSE`
+
+## How to Build and Test
+
+```bash
+# Build
+docker build -t powerpipe:test .
+
+# Smoke test
+docker run --rm powerpipe:test powerpipe --version
+
+# Server test
+docker run --rm -d --name pp-test -p 9033:9033 powerpipe:test powerpipe server
+sleep 5
+curl -sf http://localhost:9033/ && echo "OK"
+docker stop pp-test
+```
+
+## Documentation Format
+
+Flag tables use this format:
+```markdown
+| Flag | Description | Default |
+|------|-------------|---------|
+| `--listen` | Listen address (local/network) | `network` |
+```
+
+Env var tables use this format:
+```markdown
+| Variable | Image default | Description |
+|----------|--------------|-------------|
+| `POWERPIPE_LISTEN` | `network` | Interface to listen on |
+```
diff --git a/.github/prompts/opsx-apply.prompt.md b/.github/prompts/opsx-apply.prompt.md
new file mode 100644
index 0000000..494e10e
--- /dev/null
+++ b/.github/prompts/opsx-apply.prompt.md
@@ -0,0 +1,149 @@
+---
+description: Implement tasks from an OpenSpec change (Experimental)
+---
+
+Implement tasks from an OpenSpec change.
+
+**Input**: Optionally specify a change name (e.g., `/opsx:apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - Context file paths (varies by schema)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx:continue`
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read the files listed in `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! You can archive this change with `/opsx:archive`.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.github/prompts/opsx-archive.prompt.md b/.github/prompts/opsx-archive.prompt.md
new file mode 100644
index 0000000..1163776
--- /dev/null
+++ b/.github/prompts/opsx-archive.prompt.md
@@ -0,0 +1,154 @@
+---
+description: Archive a completed change in the experimental workflow
+---
+
+Archive a completed change in the experimental workflow.
+
+**Input**: Optionally specify a change name after `/opsx:archive` (e.g., `/opsx:archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Check for delta specs at `openspec/changes/<name>/specs/`. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create the archive directory if it doesn't exist:
+   ```bash
+   mkdir -p openspec/changes/archive
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move the change directory to archive
+
+   ```bash
+   mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Spec sync status (synced / sync skipped / no delta specs)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success (No Delta Specs)**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** No delta specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success With Warnings**
+
+```
+## Archive Complete (with warnings)
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** Sync skipped (user chose to skip)
+
+**Warnings:**
+- Archived with 2 incomplete artifacts
+- Archived with 3 incomplete tasks
+- Delta spec sync was skipped (user chose to skip)
+
+Review the archive if this was not intentional.
+```
+
+**Output On Error (Archive Exists)**
+
+```
+## Archive Failed
+
+**Change:** <change-name>
+**Target:** openspec/changes/archive/YYYY-MM-DD-<name>/
+
+Target archive directory already exists.
+
+**Options:**
+1. Rename the existing archive
+2. Delete the existing archive if it's a duplicate
+3. Wait until a different date to archive
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use the Skill tool to invoke `openspec-sync-specs` (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.github/prompts/opsx-explore.prompt.md b/.github/prompts/opsx-explore.prompt.md
new file mode 100644
index 0000000..b21a226
--- /dev/null
+++ b/.github/prompts/opsx-explore.prompt.md
@@ -0,0 +1,170 @@
+---
+description: Enter explore mode - think through ideas, investigate problems, clarify requirements
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Input**: The argument after `/opsx:explore` is whatever the user wants to think about. Could be:
+- A vague idea: "real-time collaboration"
+- A specific problem: "the auth system is getting unwieldy"
+- A change name: "add-dark-mode" (to explore in context of that change)
+- A comparison: "postgres vs sqlite for this"
+- Nothing (just enter explore mode)
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│   ┌────────┐         ┌────────┐        │
+│   │ State  │────────▶│ State  │        │
+│   │   A    │         │   B    │        │
+│   └────────┘         └────────┘        │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+If the user mentioned a specific change name, read its artifacts for context.
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Read existing artifacts for context**
+   - `openspec/changes/<name>/proposal.md`
+   - `openspec/changes/<name>/design.md`
+   - `openspec/changes/<name>/tasks.md`
+   - etc.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+   | Insight Type | Where to Capture |
+   |--------------|------------------|
+   | New requirement discovered | `specs/<capability>/spec.md` |
+   | Requirement changed | `specs/<capability>/spec.md` |
+   | Design decision made | `design.md` |
+   | Scope changed | `proposal.md` |
+   | New work identified | `tasks.md` |
+   | Assumption invalidated | Relevant artifact |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When things crystallize, you might offer a summary - but it's optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.github/prompts/opsx-propose.prompt.md b/.github/prompts/opsx-propose.prompt.md
new file mode 100644
index 0000000..cf30b2a
--- /dev/null
+++ b/.github/prompts/opsx-propose.prompt.md
@@ -0,0 +1,103 @@
+---
+description: Propose a new change - create it and generate all artifacts in one step
+---
+
+Propose a new change - create the change and generate all artifacts in one step.
+
+I'll create a change with artifacts:
+- proposal.md (what & why)
+- design.md (how)
+- tasks.md (implementation steps)
+
+When ready to implement, run /opsx:apply
+
+---
+
+**Input**: The argument after `/opsx:propose` is the change name (kebab-case), OR a description of what the user wants to build.
+
+**Steps**
+
+1. **If no input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change at `openspec/changes/<name>/` with `.openspec.yaml`.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `outputPath`: Where to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` to start implementing."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.github/skills/openspec-apply-change/SKILL.md b/.github/skills/openspec-apply-change/SKILL.md
new file mode 100644
index 0000000..d474dc1
--- /dev/null
+++ b/.github/skills/openspec-apply-change/SKILL.md
@@ -0,0 +1,156 @@
+---
+name: openspec-apply-change
+description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.2.0"
+---
+
+Implement tasks from an OpenSpec change.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - Context file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read the files listed in `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! Ready to archive this change.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.github/skills/openspec-archive-change/SKILL.md b/.github/skills/openspec-archive-change/SKILL.md
new file mode 100644
index 0000000..9b1f851
--- /dev/null
+++ b/.github/skills/openspec-archive-change/SKILL.md
@@ -0,0 +1,114 @@
+---
+name: openspec-archive-change
+description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.2.0"
+---
+
+Archive a completed change in the experimental workflow.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Check for delta specs at `openspec/changes/<name>/specs/`. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create the archive directory if it doesn't exist:
+   ```bash
+   mkdir -p openspec/changes/archive
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move the change directory to archive
+
+   ```bash
+   mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Whether specs were synced (if applicable)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
+
+All artifacts complete. All tasks complete.
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use openspec-sync-specs approach (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.github/skills/openspec-explore/SKILL.md b/.github/skills/openspec-explore/SKILL.md
new file mode 100644
index 0000000..ffa10ca
--- /dev/null
+++ b/.github/skills/openspec-explore/SKILL.md
@@ -0,0 +1,288 @@
+---
+name: openspec-explore
+description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.2.0"
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│   ┌────────┐         ┌────────┐        │
+│   │ State  │────────▶│ State  │        │
+│   │   A    │         │   B    │        │
+│   └────────┘         └────────┘        │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Read existing artifacts for context**
+   - `openspec/changes/<name>/proposal.md`
+   - `openspec/changes/<name>/design.md`
+   - `openspec/changes/<name>/tasks.md`
+   - etc.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+   | Insight Type | Where to Capture |
+   |--------------|------------------|
+   | New requirement discovered | `specs/<capability>/spec.md` |
+   | Requirement changed | `specs/<capability>/spec.md` |
+   | Design decision made | `design.md` |
+   | Scope changed | `proposal.md` |
+   | New work identified | `tasks.md` |
+   | Assumption invalidated | Relevant artifact |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Handling Different Entry Points
+
+**User brings a vague idea:**
+```
+User: I'm thinking about adding real-time collaboration
+
+You: Real-time collab is a big space. Let me think about this...
+
+      COLLABORATION SPECTRUM
+      ════════════════════════════════════════════
+
+      Awareness          Coordination         Sync
+          │                   │                 │
+          ▼                   ▼                 ▼
+      ┌────────┐         ┌────────┐        ┌────────┐
+      │Presence│         │Cursors │        │  CRDT  │
+      │  "3    │         │ Multi  │        │Conflict│
+      │online" │         │ select │        │  free  │
+      └────────┘         └────────┘        └────────┘
+          │                   │                 │
+       trivial            moderate           complex
+
+      Where's your head at?
+```
+
+**User brings a specific problem:**
+```
+User: The auth system is a mess
+
+You: [reads codebase]
+
+     ┌─────────────────────────────────────────────┐
+     │              CURRENT AUTH FLOW              │
+     └─────────────────────────────────────────────┘
+                        │
+          ┌─────────────┼─────────────┐
+          ▼             ▼             ▼
+     ┌─────────┐  ┌─────────┐  ┌─────────┐
+     │ Google  │  │  GitHub │  │  Email  │
+     │  OAuth  │  │  OAuth  │  │  Magic  │
+     └────┬────┘  └────┬────┘  └────┬────┘
+          │             │             │
+          └─────────────┼─────────────┘
+                        ▼
+                  ┌───────────┐
+                  │  Session  │
+                  └─────┬─────┘
+                        │
+                        ▼
+                  ┌───────────┐
+                  │   Perms   │
+                  └───────────┘
+
+     I see three tangles. Which one's burning?
+```
+
+**User is stuck mid-implementation:**
+```
+User: /opsx:explore add-auth-system
+      The OAuth integration is more complex than expected
+
+You: [reads change artifacts]
+
+     You're on task 4: "Implement OAuth flow"
+
+     Let me trace what's involved...
+
+     [draws diagram, explores options, suggests paths]
+
+     Want to update the design to reflect this?
+     Or add a spike task to investigate?
+```
+
+**User wants to compare options:**
+```
+User: Should we use Postgres or SQLite?
+
+You: Generic answer is boring. What's the context?
+
+User: A CLI tool that tracks local dev environments
+
+You: That changes everything.
+
+     ┌─────────────────────────────────────────────────┐
+     │         CLI TOOL DATA STORAGE                  │
+     └─────────────────────────────────────────────────┘
+
+     Key constraints:
+     • No daemon running
+     • Must work offline
+     • Single user
+
+                  SQLite          Postgres
+     Deployment   embedded ✓      needs server ✗
+     Offline      yes ✓           no ✗
+     Single file  yes ✓           no ✗
+
+     SQLite. Not even close.
+
+     Unless... is there a sync component?
+```
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When it feels like things are crystallizing, you might summarize:
+
+```
+## What We Figured Out
+
+**The problem**: [crystallized understanding]
+
+**The approach**: [if one emerged]
+
+**Open questions**: [if any remain]
+
+**Next steps** (if ready):
+- Create a change proposal
+- Keep exploring: just keep talking
+```
+
+But this summary is optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.github/skills/openspec-propose/SKILL.md b/.github/skills/openspec-propose/SKILL.md
new file mode 100644
index 0000000..d27bc53
--- /dev/null
+++ b/.github/skills/openspec-propose/SKILL.md
@@ -0,0 +1,110 @@
+---
+name: openspec-propose
+description: Propose a new change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.2.0"
+---
+
+Propose a new change - create the change and generate all artifacts in one step.
+
+I'll create a change with artifacts:
+- proposal.md (what & why)
+- design.md (how)
+- tasks.md (implementation steps)
+
+When ready to implement, run /opsx:apply
+
+---
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change at `openspec/changes/<name>/` with `.openspec.yaml`.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `outputPath`: Where to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` or ask me to implement to start working on the tasks."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.github/updatecli/powerpipe.yaml b/.github/updatecli/powerpipe.yaml
new file mode 100644
index 0000000..ae6faa6
--- /dev/null
+++ b/.github/updatecli/powerpipe.yaml
@@ -0,0 +1,23 @@
+---
+name: Bump Powerpipe version
+
+sources:
+  powerpipe:
+    kind: githubRelease
+    spec:
+      owner: turbot
+      repository: powerpipe
+      token: '{{ requiredEnv "GITHUB_TOKEN" }}'
+      versionFilter:
+        kind: semver
+        pattern: ">=1.0.0"
+
+targets:
+  dockerfile:
+    name: "Update Powerpipe version in Dockerfile"
+    kind: file
+    sourceid: powerpipe
+    spec:
+      file: Dockerfile
+      matchpattern: 'ARG POWERPIPE_VERSION=.*'
+      replacepattern: 'ARG POWERPIPE_VERSION={{ source "powerpipe" }}'
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
new file mode 100644
index 0000000..98fcb43
--- /dev/null
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -0,0 +1,30 @@
+---
+name: Copilot Setup Steps
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+  pull_request:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+
+jobs:
+  copilot-setup-steps:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install tools
+        run: |
+          sudo apt-get update -qq && sudo apt-get install -y -qq jq > /dev/null
+          echo "jq $(jq --version), docker $(docker --version)"
+
+      - name: Build Docker image
+        run: docker build -t powerpipe:local .
+
+      - name: Validate
+        run: docker run --rm powerpipe:local powerpipe --version
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
new file mode 100644
index 0000000..221f222
--- /dev/null
+++ b/.github/workflows/docker-build.yml
@@ -0,0 +1,282 @@
+name: Build and Push Docker Image
+
+env:
+  DOCKERHUB_USER: devopsiaci
+  DOCKERHUB_REPO: powerpipe
+  GHCR_REGISTRY: ghcr.io
+  GHCR_REPO: ${{ github.repository }}
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Lint Dockerfile
+        uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
+        with:
+          dockerfile: Dockerfile
+          config: .hadolint.yaml
+
+      - name: Unit tests
+        run: |
+          pip install -r tests/requirements.txt
+          python3 -m pytest tests/ \
+            --cov=compare_snapshots \
+            --cov-report=term-missing \
+            --cov-fail-under=90
+
+      - name: Build test image
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+        with:
+          context: .
+          load: true
+          tags: powerpipe:test
+
+      - name: Smoke test
+        run: |
+          docker run --rm powerpipe:test powerpipe --version
+
+      - name: Container structure tests
+        run: |
+          docker run --rm \
+            -v "$PWD/structure-tests.yaml:/structure-tests.yaml:ro" \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            gcr.io/gcp-runtimes/container-structure-test:latest \
+            test --image powerpipe:test --config /structure-tests.yaml
+
+      - name: Security scan (Trivy)
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        with:
+          image-ref: powerpipe:test
+          format: sarif
+          output: trivy-results.sarif
+          exit-code: "1"
+          severity: CRITICAL
+          ignore-unfixed: true
+
+      - name: Upload Trivy SARIF results
+        if: always()
+        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        with:
+          sarif_file: trivy-results.sarif
+
+  behavior-check:
+    name: Behavior Check
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Detect version change
+        id: version
+        run: |
+          git fetch origin ${{ github.base_ref }} --depth=1
+          OLD_VERSION=$(git show origin/${{ github.base_ref }}:Dockerfile 2>/dev/null | grep -oP 'ARG POWERPIPE_VERSION=\K.*' || echo "")
+          NEW_VERSION=$(grep -oP 'ARG POWERPIPE_VERSION=\K.*' Dockerfile)
+          echo "old=$OLD_VERSION" >> "$GITHUB_OUTPUT"
+          echo "new=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+          if [ "$OLD_VERSION" != "$NEW_VERSION" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "Version change detected: $OLD_VERSION → $NEW_VERSION"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "No version change"
+          fi
+
+      - name: Build test image
+        if: steps.version.outputs.changed == 'true'
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+        with:
+          context: .
+          load: true
+          tags: powerpipe:test
+
+      - name: Extract CLI snapshot
+        if: steps.version.outputs.changed == 'true'
+        run: |
+          docker run --rm --network none \
+            -v "$PWD/scripts:/scripts:ro" \
+            powerpipe:test bash /scripts/extract-cli-snapshot.sh > /tmp/cli-snapshot-new.json
+
+      - name: Extract env vars from upstream source
+        if: steps.version.outputs.changed == 'true'
+        run: |
+          ENV_VARS=$(bash scripts/extract-env-vars.sh "${{ steps.version.outputs.new }}")
+          jq --argjson env_vars "$ENV_VARS" '. + {env_vars: $env_vars}' /tmp/cli-snapshot-new.json > /tmp/cli-snapshot-full.json
+
+      - name: Compare snapshots
+        id: diff
+        if: steps.version.outputs.changed == 'true'
+        run: |
+          python3 scripts/compare_snapshots.py \
+            cli-snapshot.json /tmp/cli-snapshot-full.json \
+            --output-md /tmp/behavior-diff.md \
+            --output-json /tmp/behavior-diff.json \
+            && echo "has_changes=false" >> "$GITHUB_OUTPUT" \
+            || echo "has_changes=true" >> "$GITHUB_OUTPUT"
+
+      - name: Comment on PR
+        if: steps.version.outputs.changed == 'true'
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const fs = require('fs');
+            const md = fs.readFileSync('/tmp/behavior-diff.md', 'utf8');
+            const marker = '<!-- behavior-check -->';
+
+            // Find and update existing comment, or create new one
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find(c => c.body.includes(marker));
+
+            const body = `${marker}\n${md}`;
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+
+  release:
+    name: Release
+    needs: [test]
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      attestations: write
+      artifact-metadata: write
+      contents: write
+      id-token: write
+      issues: write
+      packages: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Semantic Release
+        id: semantic
+        uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
+        with:
+          tag_format: 'v${version}'
+          extra_plugins: |
+            @semantic-release/changelog
+            @semantic-release/git
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set Docker metadata
+        id: meta
+        if: steps.semantic.outputs.new_release_published == 'true'
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        with:
+          images: |
+            ${{ env.DOCKERHUB_USER }}/${{ env.DOCKERHUB_REPO }}
+            ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_REPO }}
+          labels: |
+            org.opencontainers.image.maintainer='amartingarcia,ialejandro'
+            org.opencontainers.image.title='Powerpipe'
+            org.opencontainers.image.description='Powerpipe — Dashboards for DevOps'
+            org.opencontainers.image.vendor='devops-ia'
+          tags: |
+            type=raw,value=${{ steps.semantic.outputs.new_release_git_tag }}
+
+      - name: Set up QEMU
+        if: steps.semantic.outputs.new_release_published == 'true'
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+
+      - name: Set up Docker Buildx
+        if: steps.semantic.outputs.new_release_published == 'true'
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      - name: Cache Docker layers
+        if: steps.semantic.outputs.new_release_published == 'true'
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
+
+      - name: "[DOCKERHUB] Log in"
+        if: steps.semantic.outputs.new_release_published == 'true'
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: "[GHCR] Log in"
+        if: steps.semantic.outputs.new_release_published == 'true'
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        with:
+          registry: ${{ env.GHCR_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Docker image
+        id: push
+        if: steps.semantic.outputs.new_release_published == 'true'
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+        with:
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+          context: .
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          sbom: true
+          tags: ${{ steps.meta.outputs.tags }}
+
+      - name: "[DOCKERHUB] Update registry description"
+        if: steps.semantic.outputs.new_release_published == 'true'
+        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+          repository: ${{ env.DOCKERHUB_USER }}/${{ env.DOCKERHUB_REPO }}
+
+      - name: "[GHCR] Generate artifact attestation"
+        if: steps.semantic.outputs.new_release_published == 'true'
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-name: ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_REPO }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
+
+      - name: Move Docker cache
+        if: steps.semantic.outputs.new_release_published == 'true'
+        run: |
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..74e8ffe
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,16 @@
+# OS
+.DS_Store
+Thumbs.db
+
+# IDE
+.vscode/
+.idea/
+.coverage
+
+__pycache__/
+
+# OpenSpec — local workflow tooling, not part of the image
+openspec/
+OPENSPEC-GUIDE.md
+.github/prompts/
+.github/skills/
diff --git a/.hadolint.yaml b/.hadolint.yaml
new file mode 100644
index 0000000..b6b5fc4
--- /dev/null
+++ b/.hadolint.yaml
@@ -0,0 +1,9 @@
+# Hadolint configuration
+# https://github.com/hadolint/hadolint
+
+ignore:
+  # DL3008: Pin versions in apt-get install — acceptable for base system tools
+  # in CI-built images where reproducibility is handled by pinning the base image tag
+  - DL3008
+  # DL3009: Delete apt-get lists — handled explicitly in our RUN layer
+  - DL3009
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..4496e21
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,97 @@
+# Contributing
+
+Thank you for your interest in contributing! This repo builds and publishes a community Docker image for [Powerpipe](https://powerpipe.io).
+
+## Prerequisites
+
+- Docker 20.10+
+- `bash`, `jq`, `python3`, `pip`
+- A running Steampipe instance (see [devops-ia/steampipe](https://github.com/devops-ia/steampipe))
+
+## Build the image locally
+
+```bash
+# Build with the default Powerpipe version from the Dockerfile
+docker build -t powerpipe:dev .
+
+# Build with a specific version
+docker build --build-arg POWERPIPE_VERSION=1.5.1 -t powerpipe:dev .
+```
+
+## Run the test suite
+
+### Unit tests (no Docker needed)
+
+```bash
+pip install -r tests/requirements.txt
+python3 -m pytest tests/ --cov=compare_snapshots --cov-report=term-missing
+```
+
+### Lint the Dockerfile
+
+```bash
+docker run --rm -i hadolint/hadolint < Dockerfile
+```
+
+### Container structure tests (requires built image)
+
+```bash
+docker run --rm \
+  -v "$PWD/structure-tests.yaml:/structure-tests.yaml:ro" \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  gcr.io/gcp-runtimes/container-structure-test:latest \
+  test --image powerpipe:dev --config /structure-tests.yaml
+```
+
+### Security scan
+
+```bash
+docker run --rm \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  aquasec/trivy image --severity CRITICAL --ignore-unfixed powerpipe:dev
+```
+
+## How releases work
+
+Releases are **fully automated** — do not bump versions manually.
+
+1. [updatecli](https://www.updatecli.io/) detects new Powerpipe releases and opens a PR updating `ARG POWERPIPE_VERSION` in the `Dockerfile`.
+2. The PR CI runs all tests.
+3. On merge to `main`, [semantic-release](https://semantic-release.gitbook.io/) reads conventional commits, bumps the version, and publishes to GHCR and Docker Hub automatically.
+
+## Commit message format
+
+This repo uses [Conventional Commits](https://www.conventionalcommits.org/):
+
+```
+feat: add support for multi-arch builds
+fix: correct workspace directory permissions
+chore: bump powerpipe to 1.6.0
+docs: add mod installation example
+```
+
+| Type | When to use |
+|------|------------|
+| `feat` | New feature or capability |
+| `fix` | Bug fix |
+| `chore` | Maintenance (version bumps, CI tweaks) |
+| `docs` | Documentation only |
+| `refactor` | Code restructure without behaviour change |
+
+## Reporting bugs
+
+Please [open an issue](https://github.com/devops-ia/powerpipe/issues/new) with:
+
+- Powerpipe image version
+- Docker version (`docker --version`)
+- Steps to reproduce
+- Expected vs actual behaviour
+- Relevant logs (`docker logs powerpipe`)
+
+## Pull requests
+
+1. Fork the repo and create a branch: `git checkout -b feat/my-improvement`
+2. Make your changes
+3. Run the tests (see above)
+4. Commit using Conventional Commits format
+5. Open a PR against `main`
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..464684f
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,50 @@
+FROM debian:bookworm-slim
+
+ARG POWERPIPE_VERSION=1.5.1
+ARG TARGETARCH
+
+LABEL maintainer="amartingarcia, ialejandro"
+LABEL org.opencontainers.image.title="Powerpipe"
+LABEL org.opencontainers.image.description="Powerpipe — Dashboards for DevOps"
+LABEL org.opencontainers.image.source="https://github.com/devops-ia/powerpipe"
+LABEL org.opencontainers.image.vendor="devops-ia"
+LABEL org.opencontainers.image.url="https://powerpipe.io"
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+# hadolint ignore=DL3008,DL3005
+# git is required for 'powerpipe mod install' from GitHub repos
+RUN apt-get update && \
+    apt-get upgrade -y --no-install-recommends && \
+    apt-get install -y --no-install-recommends ca-certificates curl git jq && \
+    rm -rf /var/lib/apt/lists/*
+
+# Powerpipe uses DOTS as separator in release asset names
+RUN curl -fsSL "https://github.com/turbot/powerpipe/releases/download/v${POWERPIPE_VERSION}/powerpipe.linux.${TARGETARCH}.tar.gz" \
+    | tar -xz -C /usr/local/bin && \
+    chmod +x /usr/local/bin/powerpipe
+
+# UID 9193, GID 0 (OpenShift compatible, consistent with Steampipe)
+RUN useradd -u 9193 -g 0 -d /home/powerpipe -m -s /bin/bash powerpipe
+
+RUN mkdir -p /home/powerpipe/.powerpipe \
+             /workspace && \
+    chown -R 9193:0 /home/powerpipe /workspace && \
+    chmod -R g=u /home/powerpipe /workspace
+
+ENV POWERPIPE_UPDATE_CHECK=false \
+    POWERPIPE_TELEMETRY=none \
+    POWERPIPE_INSTALL_DIR=/home/powerpipe/.powerpipe \
+    POWERPIPE_LISTEN=network \
+    POWERPIPE_LOG_LEVEL=warn \
+    POWERPIPE_MOD_LOCATION=/workspace
+
+USER 9193
+WORKDIR /workspace
+
+EXPOSE 9033
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD curl -sf http://localhost:9033/ || exit 1
+
+CMD ["powerpipe", "server"]
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..b6eddf8
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DevOps Solutions
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
index 17c1eb2..67e9597 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,116 @@
-# powerpipe
\ No newline at end of file
+# powerpipe
+
+[![CI](https://github.com/devops-ia/powerpipe/actions/workflows/docker-build.yml/badge.svg)](https://github.com/devops-ia/powerpipe/actions/workflows/docker-build.yml)
+[![GitHub release](https://img.shields.io/github/v/release/devops-ia/powerpipe)](https://github.com/devops-ia/powerpipe/releases)
+[![Docker Hub](https://img.shields.io/docker/v/devopsiaci/powerpipe?label=Docker%20Hub&logo=docker)](https://hub.docker.com/r/devopsiaci/powerpipe)
+[![Docker Pulls](https://img.shields.io/docker/pulls/devopsiaci/powerpipe?logo=docker)](https://hub.docker.com/r/devopsiaci/powerpipe)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+Community Docker image for [Powerpipe](https://powerpipe.io) — dashboards for DevOps. Visualize cloud configurations and assess security posture against compliance benchmarks.
+
+> **Why this image?** Turbot stopped publishing official Docker images after Powerpipe v0.1.1. This project provides multi-arch container images built from official pre-compiled binaries.
+
+## Quick start
+
+```bash
+# Run Powerpipe server (HTTP dashboard on port 9033)
+docker run -d --name powerpipe \
+  -p 9033:9033 \
+  -e POWERPIPE_DATABASE="postgres://steampipe:password@steampipe-host:9193/steampipe" \
+  ghcr.io/devops-ia/powerpipe:1.5.1
+
+# Install a mod
+docker exec powerpipe powerpipe mod install github.com/turbot/steampipe-mod-aws-compliance
+
+# Access dashboards
+open http://localhost:9033
+```
+
+## Image details
+
+| Property | Value |
+|----------|-------|
+| Base image | `debian:bookworm-slim` |
+| Architectures | `linux/amd64`, `linux/arm64` |
+| User | `powerpipe` (UID 9193, GID 0) |
+| Port | 9033 (HTTP) |
+| Default CMD | `powerpipe server` |
+
+## Registries
+
+```bash
+# GitHub Container Registry
+docker pull ghcr.io/devops-ia/powerpipe:1.5.1
+
+# Docker Hub
+docker pull devopsiaci/powerpipe:1.5.1
+```
+
+## `server` flags
+
+| Flag | Description | Default |
+|------|-------------|---------|
+| `--listen` | Accept connections from `local` or `network` | `local` |
+| `--port` | HTTP server port | `9033` |
+| `--dashboard-timeout` | Dashboard execution timeout (seconds) | `0` (no timeout) |
+| `--watch` | Watch mod files for changes | `true` |
+| `--var` | Set a variable value (`key=value`) | — |
+| `--var-file` | Path to `.ppvar` file | — |
+
+## Environment variables
+
+Container-optimized defaults are pre-configured. Override as needed:
+
+| Variable | Image default | Description |
+|----------|--------------|-------------|
+| `POWERPIPE_UPDATE_CHECK` | `false` | Disable update checking |
+| `POWERPIPE_TELEMETRY` | `none` | Disable telemetry |
+| `POWERPIPE_LISTEN` | `network` | Listen on all interfaces |
+| `POWERPIPE_PORT` | `9033` | HTTP server port |
+| `POWERPIPE_LOG_LEVEL` | `warn` | Logging level |
+| `POWERPIPE_MOD_LOCATION` | `/workspace` | Mod working directory |
+| `POWERPIPE_DATABASE` | — | Database connection string (deprecated — use config) |
+| `POWERPIPE_DASHBOARD_TIMEOUT` | `0` | Dashboard timeout (seconds) |
+| `POWERPIPE_BENCHMARK_TIMEOUT` | `0` | Benchmark timeout (seconds) |
+| `POWERPIPE_MEMORY_MAX_MB` | `1024` | Process memory soft limit (MB) |
+| `POWERPIPE_MAX_PARALLEL` | `10` | Maximum parallel executions |
+| `POWERPIPE_INSTALL_DIR` | `/home/powerpipe/.powerpipe` | Installation directory |
+
+Full reference: [Powerpipe Environment Variables](https://powerpipe.io/docs/reference/env-vars)
+
+## Kubernetes / Helm
+
+This image is designed to work with the [helm-steampipe](https://github.com/devops-ia/helm-steampipe) Helm chart (Powerpipe component):
+
+- **UID 9193 / GID 0** — compatible with OpenShift restricted SCC
+- **`/workspace`** — mod working directory, mountable as volume
+- **`git` included** — required for `powerpipe mod install` from GitHub
+- **Shell available** (`/bin/bash`, `/bin/sh`) for init container scripts
+
+## Documentation
+
+| Topic | Description |
+|-------|-------------|
+| [Getting Started](docs/getting-started.md) | Docker, Docker Compose, mod install, first dashboard |
+| [Configuration](docs/configuration.md) | Environment variables, database connection, mod workspace |
+| [Kubernetes](docs/kubernetes.md) | Helm chart, workspace PVC, Secrets, health checks |
+| [Examples](docs/examples.md) | AWS benchmarks, multi-account, CI/CD integration |
+| [Troubleshooting](docs/troubleshooting.md) | Connection errors, mod not found, OOM, debug mode |
+
+## Versioning
+
+Image versions track upstream Powerpipe releases 1:1:
+
+| Image tag | Powerpipe version |
+|-----------|-------------------|
+| `1.5.1` | [v1.5.1](https://github.com/turbot/powerpipe/releases/tag/v1.5.1) |
+
+New versions are detected automatically via [updatecli](https://www.updatecli.io/) and published after merge.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+MIT — see [LICENSE](LICENSE).
\ No newline at end of file
diff --git a/cli-snapshot.json b/cli-snapshot.json
new file mode 100644
index 0000000..0794650
--- /dev/null
+++ b/cli-snapshot.json
@@ -0,0 +1,432 @@
+{
+  "version": "1.5.1",
+  "snapshot_date": "2026-04-12",
+  "help_text_hash": "2e295bc0a121c9d2e776369776bf5d8155b14e973de0ac2babf21c776190947b",
+  "subcommands": [
+    "benchmark",
+    "control",
+    "dashboard",
+    "detection",
+    "login",
+    "mod",
+    "query",
+    "server",
+    "variable"
+  ],
+  "benchmark_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--workspace"
+  ],
+  "benchmark_help_hash": "7d1bffd17e00444989e05678ccb4d4b485cb09c52461f73ff965d14e960a7e40",
+  "benchmark_list_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "benchmark_list_help_hash": "edc5f872263bae1b7b87b2569b11e79e3f09aa1477e6810baea1caf4f6000490",
+  "benchmark_run_flags": [
+    "--benchmark-timeout",
+    "--config-path",
+    "--database",
+    "--dry-run",
+    "--export",
+    "--header",
+    "--help",
+    "--input",
+    "--install-dir",
+    "--max-parallel",
+    "--mod-install",
+    "--mod-location",
+    "--output",
+    "--pipes-host",
+    "--pipes-token",
+    "--progress",
+    "--pull",
+    "--query-timeout",
+    "--search-path",
+    "--search-path-prefix",
+    "--separator",
+    "--share",
+    "--snapshot",
+    "--snapshot-location",
+    "--snapshot-tag",
+    "--snapshot-title",
+    "--tag",
+    "--timing",
+    "--var",
+    "--var-file",
+    "--where",
+    "--workspace"
+  ],
+  "benchmark_run_help_hash": "7823e1436895172ab13110b79d3c7c415ca844a36d595a46b37cbb25da211b88",
+  "benchmark_show_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "benchmark_show_help_hash": "e65c3d042ad00df03b1f4484a495caa737b5d26882151e9ac4f3f5cf40bc434a",
+  "control_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--workspace"
+  ],
+  "control_help_hash": "cf5a0b44764f9261326f61414df0124bbed8f651a467ed8ef912df05fc257afb",
+  "control_list_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "control_list_help_hash": "d4a129ba470749a2628818ab53f09940deeb2a1236fd9dea7e81b50f0f4ee3b1",
+  "control_run_flags": [
+    "--arg",
+    "--benchmark-timeout",
+    "--config-path",
+    "--database",
+    "--export",
+    "--header",
+    "--help",
+    "--input",
+    "--install-dir",
+    "--mod-install",
+    "--mod-location",
+    "--output",
+    "--pipes-host",
+    "--pipes-token",
+    "--progress",
+    "--pull",
+    "--query-timeout",
+    "--search-path",
+    "--search-path-prefix",
+    "--separator",
+    "--share",
+    "--snapshot",
+    "--snapshot-location",
+    "--snapshot-tag",
+    "--snapshot-title",
+    "--timing",
+    "--var",
+    "--var-file",
+    "--workspace"
+  ],
+  "control_run_help_hash": "133cf7c1984a761b3c2e140466634357133dfb9c2939367d1df0e946f8dd3ad5",
+  "control_show_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "control_show_help_hash": "a22fc5f238a793087981d8f8d8dd4bdacc74bca135a6e7e47e29440ef358f8de",
+  "dashboard_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--workspace"
+  ],
+  "dashboard_help_hash": "520056444ae7693bf3bdaade32b4c304eee7d1ef5b711662f168db200d223e9d",
+  "dashboard_list_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "dashboard_list_help_hash": "e87e6d72ff0043314126f80465e16bb41061245b67b5cc52940b0ba9b5dda344",
+  "dashboard_run_flags": [
+    "--arg",
+    "--config-path",
+    "--dashboard-timeout",
+    "--database",
+    "--export",
+    "--help",
+    "--input",
+    "--install-dir",
+    "--max-parallel",
+    "--mod-install",
+    "--mod-location",
+    "--output",
+    "--pipes-host",
+    "--pipes-token",
+    "--progress",
+    "--pull",
+    "--query-timeout",
+    "--search-path",
+    "--search-path-prefix",
+    "--share",
+    "--snapshot",
+    "--snapshot-location",
+    "--snapshot-tag",
+    "--snapshot-title",
+    "--var",
+    "--var-file",
+    "--workspace"
+  ],
+  "dashboard_run_help_hash": "ef2538fe0c145f9e616f5fbd6ceac8f785f8c0e4d3046220e03405ee5f79216f",
+  "dashboard_show_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "dashboard_show_help_hash": "504aa398325af276e5cb8433210b43b909cf4ba55f5439ba97476b8029aa992b",
+  "detection_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--workspace"
+  ],
+  "detection_help_hash": "96b6609afb40ab333920ade93d2b5197abeb84cf958d759dd92e962173fce3cb",
+  "detection_list_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "detection_list_help_hash": "87d5e18958b1d59c90826cef1c7842d89cc3fd1ec0a104cff6966008051dcc77",
+  "detection_run_flags": [
+    "--arg",
+    "--config-path",
+    "--database",
+    "--detection-timeout",
+    "--export",
+    "--header",
+    "--help",
+    "--input",
+    "--install-dir",
+    "--max-parallel",
+    "--mod-install",
+    "--mod-location",
+    "--output",
+    "--pipes-host",
+    "--pipes-token",
+    "--progress",
+    "--pull",
+    "--query-timeout",
+    "--separator",
+    "--share",
+    "--snapshot",
+    "--snapshot-location",
+    "--snapshot-tag",
+    "--snapshot-title",
+    "--var",
+    "--var-file",
+    "--workspace"
+  ],
+  "detection_run_help_hash": "2863a121c24c661e4057216a8c456ef634f6470b0c4cc23558c14ad40a12d43a",
+  "detection_show_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "detection_show_help_hash": "e0bcee903727d493247a5c3bd4b8adbd733274da2b2cb7c9bc6b188121740507",
+  "login_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--pipes-host",
+    "--pipes-token",
+    "--workspace"
+  ],
+  "login_help_hash": "d69728be5bb065632eb6d7a0a1dfbc5f39c5cad21bac7eca1a0c741ff4a71eb7",
+  "mod_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--workspace"
+  ],
+  "mod_help_hash": "e712f02f345d4060e8fcaf0b1efbd49fa495c0fb33b1bd56eab6a1bd5e9ba2cb",
+  "mod_init_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--workspace"
+  ],
+  "mod_init_help_hash": "7a0f09cdc6987c73152bf98e4995e9007db82dfdb2964cc6c9b1a72d23e6052d",
+  "mod_install_flags": [
+    "--config-path",
+    "--database",
+    "--dry-run",
+    "--force",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--prune",
+    "--pull",
+    "--workspace"
+  ],
+  "mod_install_help_hash": "41a75b930c069a6f769badc336b42a31d066bf0834b841111523aa5e38184c11",
+  "mod_list_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "mod_list_help_hash": "10569928b5b3c5bd5a508587332467319011aee5d7ef64ea565f30ce20c448be",
+  "mod_show_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "mod_show_help_hash": "c60274576c3faa3deabb2a05cc19f2175515858af92b3eb3d212fc5a081d81ba",
+  "mod_uninstall_flags": [
+    "--config-path",
+    "--dry-run",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--prune",
+    "--workspace"
+  ],
+  "mod_uninstall_help_hash": "40f3d562fc49fbf5f04677944128b243fb783d15a2a7ad4feff90bc900231846",
+  "mod_update_flags": [
+    "--config-path",
+    "--dry-run",
+    "--force",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--prune",
+    "--pull",
+    "--workspace"
+  ],
+  "mod_update_help_hash": "436669e53dac4315838c30de11983b7e9d4cae3b6fd9f455c2558554807a9098",
+  "query_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--workspace"
+  ],
+  "query_help_hash": "e653c652937b7007ce96386d7941990c570542ff17e08c7156b7aa2e81468ad9",
+  "query_list_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "query_list_help_hash": "84526f030bff6459ffe96d905f23d9383617adc223688588fdb832bf37819987",
+  "query_run_flags": [
+    "--arg",
+    "--config-path",
+    "--database",
+    "--export",
+    "--header",
+    "--help",
+    "--input",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--pipes-host",
+    "--pipes-token",
+    "--progress",
+    "--query-timeout",
+    "--search-path",
+    "--search-path-prefix",
+    "--separator",
+    "--share",
+    "--snapshot",
+    "--snapshot-location",
+    "--snapshot-tag",
+    "--snapshot-title",
+    "--timing",
+    "--var",
+    "--var-file",
+    "--workspace"
+  ],
+  "query_run_help_hash": "bbd9c24c0c424e9e761799ad56b0d4b068cd8f7526466826ae26a6cd36ad2ef9",
+  "query_show_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "query_show_help_hash": "2b1ee40626caab45a7934f17f767b9cbab0c76f66df1be984ceed49e7f5f5768",
+  "server_flags": [
+    "--config-path",
+    "--dashboard-timeout",
+    "--database",
+    "--help",
+    "--install-dir",
+    "--listen",
+    "--mod-location",
+    "--pipes-host",
+    "--pipes-token",
+    "--port",
+    "--var",
+    "--var-file",
+    "--watch",
+    "--workspace"
+  ],
+  "server_help_hash": "ec0c5317809e8e82400018e5c617ec8514aa69a0b733ca464e7ab8c638cabc9a",
+  "variable_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--workspace"
+  ],
+  "variable_help_hash": "49817cbe3301801eaa3a961406a7f6c54f2cab94f711f85a554c535a8c35f40f",
+  "variable_list_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "variable_list_help_hash": "efa0feec252e4439d11f968817a797a27d1b0c1266d7e5c93c055e106b1f6f68",
+  "variable_show_flags": [
+    "--config-path",
+    "--help",
+    "--install-dir",
+    "--mod-location",
+    "--output",
+    "--workspace"
+  ],
+  "variable_show_help_hash": "9322b4fe4b4fcf46489da890c29ec8132ae3df9aebf24d4de2ca9c0b505150f9",
+  "env_vars": [
+    "POWERPIPE_BENCHMARK_TIMEOUT",
+    "POWERPIPE_CONFIG_DUMP",
+    "POWERPIPE_DASHBOARD_TIMEOUT",
+    "POWERPIPE_DISPLAY_WIDTH",
+    "POWERPIPE_LISTEN",
+    "POWERPIPE_PORT"
+  ]
+}
diff --git a/docs/configuration.md b/docs/configuration.md
new file mode 100644
index 0000000..9af853a
--- /dev/null
+++ b/docs/configuration.md
@@ -0,0 +1,120 @@
+# Configuration
+
+## Database connection
+
+Powerpipe requires a PostgreSQL-compatible database (Steampipe). Set this with `POWERPIPE_DATABASE`:
+
+```bash
+docker run -d \
+  -e POWERPIPE_DATABASE="postgresql://steampipe:mypassword@steampipe:9193/steampipe" \
+  ghcr.io/devops-ia/powerpipe:1.5.1
+```
+
+The connection string format: `postgresql://<user>:<password>@<host>:<port>/<dbname>`
+
+## Environment variables
+
+All variables can be set via `-e` flags or a `.env` file in Docker Compose.
+
+### Server settings
+
+| Variable | Default (image) | Description |
+|----------|----------------|-------------|
+| `POWERPIPE_DATABASE` | — | **Required.** Steampipe connection string |
+| `POWERPIPE_LISTEN` | `network` | `local` or `network` (bind to all interfaces) |
+| `POWERPIPE_PORT` | `9033` | HTTP port for the dashboard server |
+| `POWERPIPE_BASE_URL` | — | Public URL used in share links (e.g. `https://my.domain`) |
+
+### Execution settings
+
+| Variable | Default (image) | Description |
+|----------|----------------|-------------|
+| `POWERPIPE_MAX_PARALLEL` | `10` | Max concurrent queries |
+| `POWERPIPE_MEMORY_MAX_MB` | `1024` | Memory limit in MB |
+| `POWERPIPE_BENCHMARK_TIMEOUT` | `0` | Benchmark timeout (0 = unlimited) |
+| `POWERPIPE_DASHBOARD_TIMEOUT` | `0` | Dashboard timeout (0 = unlimited) |
+
+### Mod and workspace
+
+| Variable | Default (image) | Description |
+|----------|----------------|-------------|
+| `POWERPIPE_MOD_LOCATION` | `/workspace` | Directory containing `mod.pp` files |
+| `POWERPIPE_WORKSPACE_PROFILES_LOCATION` | — | Custom workspace profiles directory |
+
+### Operational
+
+| Variable | Default (image) | Description |
+|----------|----------------|-------------|
+| `POWERPIPE_UPDATE_CHECK` | `false` | Disable update check |
+| `POWERPIPE_TELEMETRY` | `none` | Disable telemetry |
+| `POWERPIPE_LOG_LEVEL` | `warn` | Log verbosity: `error`, `warn`, `info`, `debug`, `trace` |
+| `POWERPIPE_INSTALL_DIR` | `/home/powerpipe/.powerpipe` | Powerpipe install directory |
+
+## Mounting a mod workspace
+
+Mods are installed into the workspace volume. Mount your mod directory:
+
+```bash
+docker run -d \
+  -v "$PWD/workspace:/workspace" \
+  -e POWERPIPE_MOD_LOCATION=/workspace \
+  -e POWERPIPE_DATABASE="postgresql://steampipe:pass@steampipe:9193/steampipe" \
+  ghcr.io/devops-ia/powerpipe:1.5.1
+```
+
+Inside the container, install mods:
+
+```bash
+docker exec powerpipe powerpipe mod install github.com/turbot/steampipe-mod-aws-compliance
+```
+
+## Variable files (`.ppvars`)
+
+For mods that accept input variables, create a `.ppvars` file:
+
+```hcl
+# workspace/steampipe.ppvars
+benchmark_tags = {
+  environment = "production"
+  team        = "platform"
+}
+```
+
+Mount it alongside your workspace:
+
+```bash
+docker run -d \
+  -v "$PWD/workspace:/workspace" \
+  -v "$PWD/steampipe.ppvars:/workspace/steampipe.ppvars:ro" \
+  ghcr.io/devops-ia/powerpipe:1.5.1
+```
+
+## Using secrets for the database password
+
+In production, avoid passing plaintext passwords via environment variables. Use Docker secrets or Kubernetes Secrets:
+
+```yaml
+# docker-compose.yml (Docker Swarm)
+services:
+  powerpipe:
+    image: ghcr.io/devops-ia/powerpipe:1.5.1
+    environment:
+      POWERPIPE_DATABASE: "postgresql://steampipe:{{ secret('db_password') }}@steampipe:9193/steampipe"
+    secrets:
+      - db_password
+secrets:
+  db_password:
+    external: true
+```
+
+## Debug mode
+
+Enable verbose logging:
+
+```bash
+docker run --rm \
+  -e POWERPIPE_LOG_LEVEL=debug \
+  -e POWERPIPE_DATABASE="..." \
+  ghcr.io/devops-ia/powerpipe:1.5.1 \
+  powerpipe server
+```
diff --git a/docs/examples.md b/docs/examples.md
new file mode 100644
index 0000000..0e85749
--- /dev/null
+++ b/docs/examples.md
@@ -0,0 +1,176 @@
+# Examples
+
+## Running a benchmark
+
+With a mod installed, run a compliance benchmark:
+
+```bash
+# Install the AWS Compliance mod
+docker exec powerpipe powerpipe mod install github.com/turbot/steampipe-mod-aws-compliance
+
+# List available benchmarks
+docker exec powerpipe powerpipe benchmark list
+
+# Run the CIS AWS Foundations benchmark
+docker exec powerpipe powerpipe benchmark run aws_compliance.benchmark.cis_aws_foundations_benchmark_v300
+
+# Export results as JSON
+docker exec powerpipe \
+  powerpipe benchmark run aws_compliance.benchmark.cis_aws_foundations_benchmark_v300 \
+  --export /workspace/results.json
+```
+
+## Docker Compose — Full stack
+
+The complete stack for Powerpipe + Steampipe + AWS:
+
+```yaml
+# docker-compose.yml
+services:
+  steampipe:
+    image: ghcr.io/devops-ia/steampipe:2.4.1
+    command: ["steampipe", "service", "start", "--foreground", "--database-listen", "network"]
+    environment:
+      STEAMPIPE_DATABASE_PASSWORD: steampipe
+    volumes:
+      - steampipe-data:/home/steampipe/.steampipe
+      - ./aws.spc:/home/steampipe/.steampipe/config/aws.spc:ro
+    healthcheck:
+      test: ["CMD", "pg_isready", "-h", "localhost", "-p", "9193"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  powerpipe:
+    image: ghcr.io/devops-ia/powerpipe:1.5.1
+    ports:
+      - "9033:9033"
+    environment:
+      POWERPIPE_DATABASE: "postgresql://steampipe:steampipe@steampipe:9193/steampipe"
+    volumes:
+      - workspace:/workspace
+    depends_on:
+      steampipe:
+        condition: service_healthy
+
+volumes:
+  steampipe-data:
+  workspace:
+```
+
+```bash
+# Install AWS plugin in Steampipe
+docker compose exec steampipe steampipe plugin install aws
+
+# Install AWS compliance mod in Powerpipe
+docker compose exec powerpipe powerpipe mod install github.com/turbot/steampipe-mod-aws-compliance
+
+# Open dashboards
+open http://localhost:9033
+```
+
+## AWS credentials
+
+Mount AWS credentials read-only:
+
+```yaml
+# In your docker-compose.yml steampipe service:
+volumes:
+  - "$HOME/.aws:/home/steampipe/.aws:ro"
+```
+
+Or set environment variables:
+
+```yaml
+environment:
+  AWS_ACCESS_KEY_ID: "${AWS_ACCESS_KEY_ID}"
+  AWS_SECRET_ACCESS_KEY: "${AWS_SECRET_ACCESS_KEY}"
+  AWS_DEFAULT_REGION: us-east-1
+```
+
+## Running benchmarks via CLI (non-interactive)
+
+Run benchmarks from the command line without starting the server:
+
+```bash
+# One-shot benchmark (no server needed)
+docker run --rm \
+  -v "$HOME/.aws:/home/powerpipe/.aws:ro" \
+  -v "$PWD/workspace:/workspace" \
+  -e POWERPIPE_DATABASE="postgresql://steampipe:pass@host.docker.internal:9193/steampipe" \
+  ghcr.io/devops-ia/powerpipe:1.5.1 \
+  powerpipe benchmark run aws_compliance.benchmark.cis_aws_foundations_benchmark_v300 \
+  --output brief
+```
+
+## Multiple AWS accounts
+
+Configure Steampipe with an aggregator connection, then query across all accounts from Powerpipe:
+
+**`aws.spc`:**
+```hcl
+connection "aws_prod" {
+  plugin  = "aws"
+  profile = "production"
+  regions = ["us-east-1", "eu-west-1"]
+}
+
+connection "aws_dev" {
+  plugin  = "aws"
+  profile = "development"
+  regions = ["us-east-1"]
+}
+
+connection "aws_all" {
+  plugin      = "aws"
+  type        = "aggregator"
+  connections = ["aws_prod", "aws_dev"]
+}
+```
+
+Run compliance benchmarks against all accounts:
+
+```bash
+docker exec powerpipe \
+  powerpipe benchmark run aws_compliance.benchmark.cis_aws_foundations_benchmark_v300 \
+  --search-path-prefix aws_all
+```
+
+## Kubernetes compliance
+
+Install and run the Kubernetes compliance mod:
+
+```bash
+# Requires the kubernetes plugin in Steampipe
+docker exec steampipe steampipe plugin install kubernetes
+
+# Install the mod
+docker exec powerpipe powerpipe mod install github.com/turbot/steampipe-mod-kubernetes-compliance
+
+# Run NSA/CISA Kubernetes hardening benchmark
+docker exec powerpipe \
+  powerpipe benchmark run kubernetes_compliance.benchmark.nsa_cisa_v10
+```
+
+## CI/CD integration
+
+Export benchmark results for CI pipelines:
+
+```bash
+#!/bin/bash
+# Run benchmark and fail if any controls are in alarm state
+docker run --rm \
+  -v "$HOME/.aws:/home/powerpipe/.aws:ro" \
+  -v "$PWD/workspace:/workspace" \
+  -e POWERPIPE_DATABASE="${STEAMPIPE_CONNECTION_STRING}" \
+  ghcr.io/devops-ia/powerpipe:1.5.1 \
+  powerpipe benchmark run aws_compliance.benchmark.cis_aws_foundations_benchmark_v300 \
+  --export /workspace/results.json \
+  --output brief
+
+# Check exit code — non-zero means controls failed
+if [ $? -ne 0 ]; then
+  echo "Compliance benchmark failed — review results.json"
+  exit 1
+fi
+```
diff --git a/docs/getting-started.md b/docs/getting-started.md
new file mode 100644
index 0000000..7771096
--- /dev/null
+++ b/docs/getting-started.md
@@ -0,0 +1,109 @@
+# Getting Started
+
+## Prerequisites
+
+You'll need Docker installed. Powerpipe connects to [Steampipe](https://steampipe.io) as its data source — the simplest way to run both is Docker Compose.
+
+## Quick start with Docker Compose
+
+The fastest way to get dashboards running:
+
+```bash
+# Clone the examples
+curl -O https://raw.githubusercontent.com/devops-ia/powerpipe/main/examples/docker-compose.yml
+
+# Start Steampipe + Powerpipe
+docker compose up -d
+
+# Open dashboards
+open http://localhost:9033
+```
+
+## Manual Docker run
+
+### 1. Start Steampipe first
+
+Powerpipe needs a running Steampipe PostgreSQL endpoint:
+
+```bash
+docker run -d --name steampipe \
+  -p 9193:9193 \
+  -e STEAMPIPE_DATABASE_PASSWORD=mypassword \
+  ghcr.io/devops-ia/steampipe:2.4.1 \
+  steampipe service start --foreground --database-listen network
+```
+
+### 2. Install a plugin
+
+```bash
+docker exec steampipe steampipe plugin install aws
+```
+
+### 3. Start Powerpipe
+
+```bash
+docker run -d --name powerpipe \
+  -p 9033:9033 \
+  -e POWERPIPE_DATABASE="postgresql://steampipe:mypassword@steampipe:9193/steampipe" \
+  --link steampipe \
+  ghcr.io/devops-ia/powerpipe:1.5.1 \
+  powerpipe server --listen network
+```
+
+### 4. Install a mod
+
+```bash
+# Install the AWS Compliance mod
+docker exec powerpipe powerpipe mod install github.com/turbot/steampipe-mod-aws-compliance
+```
+
+### 5. Open the dashboard
+
+Navigate to [http://localhost:9033](http://localhost:9033) in your browser.
+
+## Docker Compose (recommended)
+
+Using the example compose file from this repo:
+
+```yaml
+services:
+  steampipe:
+    image: ghcr.io/devops-ia/steampipe:2.4.1
+    command: ["steampipe", "service", "start", "--foreground", "--database-listen", "network"]
+    environment:
+      STEAMPIPE_DATABASE_PASSWORD: steampipe
+    volumes:
+      - steampipe-data:/home/steampipe/.steampipe
+      - ./aws.spc:/home/steampipe/.steampipe/config/aws.spc:ro
+    healthcheck:
+      test: ["CMD", "pg_isready", "-h", "localhost", "-p", "9193"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  powerpipe:
+    image: ghcr.io/devops-ia/powerpipe:1.5.1
+    command: ["powerpipe", "server", "--listen", "network"]
+    ports:
+      - "9033:9033"
+    environment:
+      POWERPIPE_DATABASE: "postgresql://steampipe:steampipe@steampipe:9193/steampipe"
+    volumes:
+      - ./workspace:/workspace
+    depends_on:
+      steampipe:
+        condition: service_healthy
+
+volumes:
+  steampipe-data:
+```
+
+```bash
+docker compose up -d
+```
+
+## Next steps
+
+- [Configuration](configuration.md) — database connection, env vars, mod workspace
+- [Examples](examples.md) — running benchmarks, AWS compliance, mod patterns
+- [Kubernetes](kubernetes.md) — deploy with Helm
diff --git a/docs/kubernetes.md b/docs/kubernetes.md
new file mode 100644
index 0000000..2c6ac57
--- /dev/null
+++ b/docs/kubernetes.md
@@ -0,0 +1,173 @@
+# Kubernetes
+
+The recommended way to run Powerpipe on Kubernetes is via the [helm-steampipe](https://github.com/devops-ia/helm-steampipe) chart, which manages both Steampipe and Powerpipe as a single release.
+
+## Quick install with Helm
+
+```bash
+helm repo add devops-ia https://devops-ia.github.io/helm-charts
+helm repo update
+
+helm install steampipe devops-ia/steampipe \
+  --set powerpipe.enabled=true \
+  --set bbdd.enabled=true \
+  --set bbdd.listen=network
+```
+
+Powerpipe will be available on port 9033 of the Powerpipe Service.
+
+## Custom values
+
+Create a `values.yaml` to configure both components:
+
+```yaml
+# Steampipe (required by Powerpipe)
+bbdd:
+  enabled: true
+  listen: network
+
+# Powerpipe
+powerpipe:
+  enabled: true
+  image:
+    repository: ghcr.io/devops-ia/powerpipe
+    tag: "1.5.1"
+  env:
+    - name: POWERPIPE_MAX_PARALLEL
+      value: "10"
+    - name: POWERPIPE_LOG_LEVEL
+      value: "warn"
+  resources:
+    requests:
+      memory: "512Mi"
+      cpu: "250m"
+    limits:
+      memory: "2Gi"
+      cpu: "1"
+  ingress:
+    enabled: true
+    className: nginx
+    hosts:
+      - host: powerpipe.example.com
+        paths:
+          - path: /
+            pathType: Prefix
+```
+
+```bash
+helm install steampipe devops-ia/steampipe -f values.yaml
+```
+
+## Mounting a mod workspace
+
+Use a PersistentVolumeClaim to persist installed mods:
+
+```yaml
+powerpipe:
+  enabled: true
+  extraVolumes:
+    - name: workspace
+      persistentVolumeClaim:
+        claimName: powerpipe-workspace
+  extraVolumeMounts:
+    - name: workspace
+      mountPath: /workspace
+  env:
+    - name: POWERPIPE_MOD_LOCATION
+      value: /workspace
+```
+
+Install a mod in the PVC on first run using an init container:
+
+```yaml
+powerpipe:
+  initContainers:
+    - name: install-mods
+      image: ghcr.io/devops-ia/powerpipe:1.5.1
+      command:
+        - sh
+        - -c
+        - |
+          powerpipe mod install github.com/turbot/steampipe-mod-aws-compliance
+      env:
+        - name: POWERPIPE_MOD_LOCATION
+          value: /workspace
+      volumeMounts:
+        - name: workspace
+          mountPath: /workspace
+```
+
+## Database connection with Kubernetes Secrets
+
+Store the Steampipe database password in a Secret:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: steampipe-db-password
+type: Opaque
+stringData:
+  password: "mysecretpassword"
+```
+
+Reference it in the Powerpipe deployment:
+
+```yaml
+powerpipe:
+  enabled: true
+  extraEnvVarsSecret: steampipe-db-password
+  env:
+    - name: STEAMPIPE_DATABASE_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: steampipe-db-password
+          key: password
+```
+
+## OpenShift
+
+The image is OpenShift compatible (UID 9193, GID 0):
+
+```yaml
+# No securityContext overrides needed — runs with the default SCC
+powerpipe:
+  enabled: true
+  securityContext:
+    runAsUser: 9193
+    runAsGroup: 0
+    fsGroup: 0
+```
+
+## Health checks
+
+Powerpipe exposes an HTTP endpoint. The chart configures these automatically:
+
+```yaml
+livenessProbe:
+  httpGet:
+    path: /
+    port: 9033
+  initialDelaySeconds: 30
+  periodSeconds: 30
+
+readinessProbe:
+  httpGet:
+    path: /
+    port: 9033
+  initialDelaySeconds: 10
+  periodSeconds: 10
+```
+
+## Verifying the deployment
+
+```bash
+# Check pods are running
+kubectl get pods -l app.kubernetes.io/name=steampipe
+
+# Port-forward to access Powerpipe locally
+kubectl port-forward svc/steampipe-powerpipe 9033:9033
+
+# Open browser
+open http://localhost:9033
+```
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
new file mode 100644
index 0000000..c454e55
--- /dev/null
+++ b/docs/troubleshooting.md
@@ -0,0 +1,165 @@
+# Troubleshooting
+
+## Powerpipe exits immediately
+
+**Symptom:** Container exits right after starting with no error message.
+
+**Cause:** Missing `POWERPIPE_DATABASE` or unreachable Steampipe endpoint.
+
+**Fix:**
+
+```bash
+# Check logs
+docker logs powerpipe
+
+# Verify Steampipe is reachable from Powerpipe container
+docker exec powerpipe bash -c "pg_isready -h steampipe -p 9193"
+
+# Ensure Steampipe is listening on network (not just localhost)
+# Steampipe must be started with --database-listen network
+docker logs steampipe | grep "Listen"
+```
+
+---
+
+## Cannot connect to database
+
+**Symptom:** `Error: connection refused` or `FATAL: password authentication failed`
+
+**Fix:**
+
+```bash
+# Verify the connection string
+docker run --rm \
+  -e POWERPIPE_DATABASE="postgresql://steampipe:yourpassword@steampipe:9193/steampipe" \
+  ghcr.io/devops-ia/powerpipe:1.5.1 \
+  powerpipe query "select 1"
+
+# Check Steampipe password
+docker exec steampipe steampipe service status --show-password
+```
+
+---
+
+## Port 9033 already in use
+
+**Symptom:** `address already in use: 9033`
+
+**Fix:**
+
+```bash
+# Find the conflicting process
+lsof -i :9033
+
+# Use a different host port (container still uses 9033 internally)
+docker run -d -p 19033:9033 ghcr.io/devops-ia/powerpipe:1.5.1
+```
+
+---
+
+## Mod not found
+
+**Symptom:** `Error: no mods found in /workspace` or benchmark commands fail with `not found`.
+
+**Cause:** Mod not installed, or `POWERPIPE_MOD_LOCATION` not set correctly.
+
+**Fix:**
+
+```bash
+# Verify mod location
+docker exec powerpipe ls /workspace
+
+# Install the mod
+docker exec powerpipe powerpipe mod install github.com/turbot/steampipe-mod-aws-compliance
+
+# Verify mod was installed
+docker exec powerpipe powerpipe mod list
+```
+
+If using a mounted volume, ensure the mount is writable:
+
+```bash
+docker run -d \
+  -v "$PWD/workspace:/workspace" \  # writable, no :ro
+  -e POWERPIPE_MOD_LOCATION=/workspace \
+  ghcr.io/devops-ia/powerpipe:1.5.1
+```
+
+---
+
+## Permission denied on /workspace
+
+**Symptom:** `mkdir: cannot create directory '/workspace': Permission denied` or mod install fails.
+
+**Cause:** The workspace volume is owned by root and Powerpipe runs as UID 9193.
+
+**Fix:**
+
+```bash
+# Set correct ownership before mounting
+mkdir -p workspace
+chown -R 9193:0 workspace
+chmod -R g=u workspace
+```
+
+Or in Docker Compose:
+
+```yaml
+services:
+  powerpipe:
+    user: "9193:0"
+    volumes:
+      - workspace:/workspace
+```
+
+---
+
+## Out of memory / OOM killed
+
+**Symptom:** Container killed by OOM. `dmesg | grep -i oom` shows the process.
+
+**Fix:**
+
+```bash
+docker run -d \
+  -e POWERPIPE_MEMORY_MAX_MB=2048 \
+  -e POWERPIPE_MAX_PARALLEL=5 \
+  --memory=3g \
+  ghcr.io/devops-ia/powerpipe:1.5.1
+```
+
+Rule of thumb: set `--memory` to `POWERPIPE_MEMORY_MAX_MB` × 1.5 to allow headroom.
+
+---
+
+## Dashboard timeout
+
+**Symptom:** Dashboard loads but queries never complete, showing spinners indefinitely.
+
+**Fix:**
+
+```bash
+# Increase timeouts (0 = unlimited)
+docker run -d \
+  -e POWERPIPE_DASHBOARD_TIMEOUT=300 \
+  -e POWERPIPE_BENCHMARK_TIMEOUT=600 \
+  ghcr.io/devops-ia/powerpipe:1.5.1
+```
+
+Also check Steampipe query timeout:
+
+```bash
+docker exec steampipe bash -c "echo 'SHOW steampipe_query_timeout' | psql -h localhost -p 9193 -U steampipe -d steampipe"
+```
+
+---
+
+## Enabling debug logs
+
+```bash
+docker run --rm \
+  -e POWERPIPE_LOG_LEVEL=debug \
+  -e POWERPIPE_DATABASE="..." \
+  ghcr.io/devops-ia/powerpipe:1.5.1 \
+  powerpipe server 2>&1 | tee powerpipe-debug.log
+```
diff --git a/examples/docker-compose.yml b/examples/docker-compose.yml
new file mode 100644
index 0000000..7545402
--- /dev/null
+++ b/examples/docker-compose.yml
@@ -0,0 +1,40 @@
+services:
+  steampipe:
+    image: ghcr.io/devops-ia/steampipe:2.4.1
+    command: ["steampipe", "service", "start", "--foreground", "--database-listen", "network"]
+    environment:
+      STEAMPIPE_DATABASE_PASSWORD: steampipe
+      STEAMPIPE_LOG_LEVEL: warn
+    volumes:
+      - steampipe-data:/home/steampipe/.steampipe
+      # Mount plugin config (see examples/aws.spc)
+      # - ./aws.spc:/home/steampipe/.steampipe/config/aws.spc:ro
+    ports:
+      - "9193:9193"
+    healthcheck:
+      test: ["CMD", "pg_isready", "-h", "localhost", "-p", "9193"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    restart: unless-stopped
+
+  powerpipe:
+    image: ghcr.io/devops-ia/powerpipe:1.5.1
+    command: ["powerpipe", "server", "--listen", "network"]
+    ports:
+      - "9033:9033"
+    environment:
+      POWERPIPE_DATABASE: "postgresql://steampipe:steampipe@steampipe:9193/steampipe"
+      POWERPIPE_LOG_LEVEL: warn
+      POWERPIPE_MOD_LOCATION: /workspace
+    volumes:
+      - workspace:/workspace
+    depends_on:
+      steampipe:
+        condition: service_healthy
+    restart: unless-stopped
+
+volumes:
+  steampipe-data:
+  workspace:
diff --git a/examples/powerpipe.ppvars b/examples/powerpipe.ppvars
new file mode 100644
index 0000000..de024a2
--- /dev/null
+++ b/examples/powerpipe.ppvars
@@ -0,0 +1,15 @@
+# Example Powerpipe variable file (.ppvars)
+# Place this file in your mod workspace directory to set input variables.
+# Reference: https://powerpipe.io/docs/reference/config-files/variables
+
+# Tags to filter benchmark results (optional)
+# benchmark_tags = {
+#   environment = "production"
+#   team        = "platform"
+# }
+
+# Limit benchmarks to specific AWS regions (optional, defaults to all)
+# regions = ["us-east-1", "eu-west-1"]
+
+# Control the number of parallel control evaluations
+# max_parallel = 5
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..966c755
--- /dev/null
+++ b/package.json
@@ -0,0 +1,21 @@
+{
+  "name": "powerpipe",
+  "private": true,
+  "release": {
+    "branches": ["main"],
+    "tagFormat": "v${version}",
+    "plugins": [
+      "@semantic-release/commit-analyzer",
+      "@semantic-release/release-notes-generator",
+      "@semantic-release/changelog",
+      [
+        "@semantic-release/git",
+        {
+          "assets": ["CHANGELOG.md"],
+          "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+        }
+      ],
+      "@semantic-release/github"
+    ]
+  }
+}
diff --git a/scripts/__pycache__/compare_snapshots.cpython-314.pyc b/scripts/__pycache__/compare_snapshots.cpython-314.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..a20d30199b9f358b56b8f6add405d8a106dc53f0
GIT binary patch
literal 10154
zcmcgyZ)_V!cAw=g$rb;J`tLvbvoa;wR4mfAWXqNvCyp#yvMpO#+f;I=m|lx3i7`bo
zyGzSvos<_`FLEx0l|u^C7v0$bd^j0MTLaC96gadga39i7rAo@u?Wt&x-k1ASxpI&e
z?T5Y@a+fqsS?Lw+fSjG3c{}sw&71dr^LAfw*ewW>_w$v|i**S73%=2kAzxTufI<@S
zNI@47PYqEDMXm<LK(4ex!__dv3>p<<3*zYp#4`;j>{Lv=kvHuzC}!TQusjR(6{Nm`
zw?NrS$`;-RWjiTbc?Xm$N!i9bp<G4EcD}j+DULTP`I>{TAru6j8_^q%R@9Sc5k{q4
z<nOMHU!@T0k50z~N#vB7DA#{_h?65iOrDA=GABfW+@u&0B|#B6fs@5)A)<uFxnO8w
z!eg;qkcCOH&%!~9U00@}k#0^NmqIZ`_KxTJ?9%)4#IAGEaM1In9F1@haVA&zepgpC
zuEgR>*K{z~>vZr9u24&;$!NIrhQ)H0P|LYNySS6*&YmI9aY~evl^}G+?TSjA-YtI2
zO*ri0h6U+LFgg?A<oNWoAYI4L=!7u-u4qgNMI%DkZLtho3n|=qG$`hW+QWUF{D_N0
zxy#~|a5WT_gfKTgB}67gne@Jwv_IR(1w}<1SHvKp+DE8FNs3CAGj2*{Mg(PQ9F_p#
zKTan2)9_zE0$CFI(M7|-AHpg^T_bvxnxc4W3|exDHx!lWF--@Nmv*5C%<u8NN`uf<
z8U(JIBvFY=5w}5Q!Xa5vnP6yK0VYfnQE6IGWX!@2^|<$fEK0KX*l>6EzJtA9NsL8h
zZw#uiWW2HHj3~uIG0|JH(t+ZYR&9ZR5Q#(;(3?O&vO~`e@RwU5OQLU)iQ4lRXCED3
z!<Tu5Ts~z;<vI|daeXpy!@wT|z^uOmg(Mo&gazX1$(Lh>qFPF?rN^)^NgCa^n{40Q
zole0NQMk%d7<tOi@CLupYj7bqo$wa#7da}y;&ND^@@_6CVNM7J#UMy-I(k(MdQ>C1
zSIzkfSO8iU71fk`)@_pTqDyATR5Pqr05_Up#c)A#;<hTtWK7l3fj66E!?YH>F9Kv_
zsU9kbgkOY068+9mHRt;ARPw~CUa(cq^)A)4Wo+%qfmKKC+~`tWN5-);d1A#@Gj}01
zbZ;hY^`;rG<iLHKufl@EUQq4YvIc^%mZ~u@CCE=}tP$vm#`?(6n`*4Suw!^xN!q<l
zD}i+dAwQrc+^foJgG(&jLM>iEsRB3AvLd-D$qMD1;u4t<O(R(wZfJ%KtDBKBJ;vF5
z+Zw*y@A;Je#UWBdW=l38kdl<24zvCW+!pH^Pc?wPjp+K6r-zGXSe<%F(=N~#L*f`u
z_8ljL!`v0|y3EZ?MP-q@Dum-Am{>5pWDU7p@|94Gn-&!TL@ju+pb5R(^9+OCFzUJj
z*$&hKOrA$R4?;5_S*f~c8yE@}p(ii(oq4V&VH%C-R1-pes;~}+U^C@gI&sT2lms7j
zY7ascs2O~k3+<;v)C1~_n^r9$ITVo<Au=xJR>TrGcWP)PaBAT7a}Q|M;Mt>6S5)e%
zj0FZ-o735fBiNl>i%Cb-=71nc!u0?aiRVZ-Ixd9eqaMAz10Iw2LH2u?;2NT<O~0w{
zxEY)kR;_h&!hG$rwfPB+Dl99mwogwkx(<AcZ{DXe^&S5q<L&Y8wu96s>_O@;EC;Cv
z2B`+BRAWdHr{xEf)QCIBmZKxbmbHi%sSE1c;J@yI4EB<>>M<UErM~%g<ikj|zGIz+
z+jT_SOu(1XRL~*KF8v>D328epBf)y1=V|?JXn$7gYjaxPc3=L5`~OYr+e@`xnGzJD
z?L@IBLSi^5Z=l&9!8CNuKKh4i_6S~xk~D_RC`sBTE!h)&MVkNe)0!`}!h>!`+5r~{
z8yA%oBSCp4q)dUw8$5PyFmUdI&o}g%g!Shs&6jpz@+M+FH&S`n!$>{=S$UPOS++Li
zRDOr+mz|$<emb_iqpw))E8)?1w;f}tPqskzHx|ew*vCjBYEh)_mI52nejvc@5+40o
zRmRf7JNOU5Bk))*VLT!+PzK$_Cj5CSjE$*|6B?-M#|W~IK!xEl4{!l4_s^5c9J6`D
zMh3#30hndhSE07pb{Bm7n6459?4T(^St=b%XjHqgqs}L-t{8n3^`cWgcdP={cN>f5
zDc-=-;EV8lOA^oUM$OpU5O4BRn^Wzhd9xSstOt3S7~?lMkuQKy%s7U<D@o<Y@*6!!
z8>{>{#S|K4%rqM0&BZR?Z^XvlZ{jP8YxQkeja?PATFSP<dV?eT9)cqhpfn2ibV|r=
zTR#mm5%Ekm;$K_8jkwp^56(R07#W@|=4Axq+mhrrj^OQBlEyHaBT4Id1UsgZ#M^kg
zCM}H)-0)<6Rt%sDN8;oO?OgWMsSM61%8V#R$YD-{PcpZQoZ>>`ySbUDbVcR>^26co
zIzH~XJ*pK<av*=2@u`kH_RH5u7+0#)OL4q&xUYZo6Hc{^0~VZ&N+D5JZP=V^4;Rqt
zd6f#N6z8@O&nv+iBH~zyy;12&K(-jOswN>80~@N^a^P5wPfUcaNf_T?yc`P)<D%PK
z1dttoqKcfgYRC741&kx`8ApzX6_tiNl?uvuZ{;v^9)Oth2UBSfT8OPV0ERJ%o|sU5
z<9z>p>q38q+mmVB`&s|5tY7qJ4i08|hL#$KGIb}DXI5*s&3Dfy7F-|yab~;sGuLNt
zeo^yR(ab*I(so~__C#`c&4eoI=i)2umejesqjyH{z5bBSH1(t#_dmSwdH3J;{&nvc
zhrS%o9Olz~=hEBGuduaqmsi;OlwqyHSZhl9)*Z;%JWH?I>gVL!Gat^R<a@7V8g?$!
z{AI&~hKDr|FK66`GPb^1YNf4x_Qn$1m^!z}wys!hv!l2AKIltTr4HR~{CVR_+pbyP
z+>04o>*EUOaNUNSO|$fh)p4u$X7610kB_9f@Als5z1RKmkw?~@D{wS8x@6n2Y;!N#
z+zYPd&c4OYzF!^5bPg_ejx2VLq+dOs_P?I#{N5wm_a7UfuQe9gs*}V2dvBo|Z=Nok
zWU;pZCyUihHHL-DVi+G)Cnm@tz-=IocT+cV2A<a4h?Q!5j3Apow}vmDGUW1E4XJ$A
zjpThEvmPX>;XyHjAI{yyTV6L#u%W>?fk7_U8vFriHH<(%r3o8w8`@_mY;b>hI%ZP}
zV-ZCOCtv`#fB~d8=-cF{!AY3+(S;sP!C4HW{n8n4(i6LJPkcqWLz7>hIjpuN(Zhok
z5Wy&MaIBaNix6uX$HADLa6&3RO>=_GLF|UaaXbZclQ3FbE*F=my2166s0??58v?M;
z-GHjDe99MY#PM<Z2KV*PKH&J=86BuECFo1sjW{;i(Dd^^<Bs8Baf3=(K<i$H29<d;
z8j65!o`f6e6s|FbLlLlo3^`d~h=Z+7?od%BktqepF<lWZhehdCARwA~7Ya%AmCcbH
zSTS2?PrUc`58qBPsn_pT&R4Fm_FJ}_wz;b*F*Ta5YtOPB`Kol?t}N?*`lfbEYU}N@
zb7yCduh^<?oxXWGy?yt>`32uYS9<G#N4DO_G^%U+3aA=x56=zjRH>I1dKNk!(&?=|
zk8Jxf(T=aImA4MvJT!M9W8I!+wm-YO@$?85gaaXP|J_gexxfk8(L`$6PR3Y}Z0F|z
zLTnghP)Zo_Tjat!88Up5hs*tLa#vs#$VkF=pCCc3dJvAK{19|4-lCxP^gh}{#c&H#
z+@f#oezJKHZ!Fsiz5{RkvRm6!*iIWzm<tp<U3PouSkMK6F2Nf*hRx3wF4&df1ltt!
zl7s?Wu<5ZJN)itNWer`F!-iT<F{Xh3M*FoV081Hl34v?@d-dT1Q#m>Kiwx7L;k;Sd
zK%PMeTx}>%Ye8D&N5Y7ytQ1Q|)B1tccN81FjdUP*?KxakYQ42=Fn`{;DMi($6xEwj
z)ND#oyD3Fofnsxgbk`@E^5%LX4nZx=9&2%RPn-jt19QA~_oF{0ZxmiB1kH2iS?=Sc
zLqH^fS|I5l&W=D9$Ex-9{GV{0ooC90+VyC<r?WHBZ#h3D;#Ub=9<XwN133liWMNt)
z<4%NyNeIh|k*g4Hlc0oOXvp!)00QAn2E-qv!+2;MG?gIEfD-k@jSPz67^jHW;0-`7
z#Ghy=tqNiY-Nz*iySc<65BQO*Az<WESJxCgdx^`v)F3b$0Cx~vnipOrkar{C)VO#I
zM^j}_g0X;aii3*=ak;p!e|qm<KflEtBc2atCV~e_oPb$ExG>KN2>UvOncs?sAa0oN
z2EWI+#19-hK0M%=4qhUYymUM|enpffLSgX|H*m)9u_O+@JRXgO!cm1A35x=BDdm{P
z5-aoKLbwdkYur~~qHC{*yFgfeY8)(GGFV=|9C31T;=sNFc?lbuTjxR(u$B`7V0Ae^
zwP0d@w}%^u$Z?oiFghNe79%*cuCWF)SH?jUWQE7$5_ngIoL@}DH%r*BN-yB-706Vh
z5>oOW7b5J~S4(Gc=EIG)Jh~vhnRs)c#~wNtWXCb~yc4g?J8@0NrBQgExTFXHhhJ5C
zA2R9v150~+Y43?Iq_q8H+IA{A0M2yI4l&BCwfUa1aAtYu;q1=Cy5~NcWnaqQtl0P`
zw4uTRM+ax^t?M_hr|L45EorvptESd_yO)~0%T4<ioAy6y>Rn{F0*H6k+_rvbP4(Za
z$vE4Woi8jpU&uJSW{s=P)_d(4=Yd({KU<wQ_vgVts_v1k1r7nt2iI(fwauPcHgC_G
zw`+_vc(UvsjS)xtz2GlHpM)MV4=*n5IiBelNVoge5Osp`QE;*Qs3$ZHj9PF<!^`Gv
zS@X91vvZ?awn^)>&Rf)}&9BX_!humuy6$Y29nndTXW0S$W;n~9(Qi&?+2OK?1mv%$
zJW@yNtAI@);G;K;=qC%k3bjH6o2Pp7SUiS<`DGj_4z2J^Z~l2O?d7T9UF~<EGV|<r
zpaO?nLRH3X>u#Caj>hoo5RyhPgepm`XiN`CfV*^*G{dcC>_;#VE=k%r8V!WD{wJg1
zgMLZUdiqYI(PORJ<F6TBql;n3h)ZiJTs3Z;=z{5jIZk^~+~9*V8390(5HxZWg>FC+
zqm!2nr+`O%!iljlQ_SpVN7@VhX(hjrcND`uZ4NEPvd6KelGKX)>_r1#sp(Iw0#*Qr
zeoK-Dp@Ll)U_7;6WvI2$N3eM-N&X7niQ~6g(r8=Iuyt&!R_m`Q)B{Jw59CR7j(Q14
zUj0cO#KkO6@mZ!1ZH%&fS~lWy41;@;MsQ5MB!NVYd{yyU=$u0Mvk_g?fiis8V0Xb+
z7aAA2d#-rJYD+qY+c6x5BB|S8Lcy1Dp8$Pz$??|n3_hn9aoL!Epy<Nev=s*p*<?N!
z^^<Q4Y66~P%uCDwb^7gGDMW?PVY&&0sJNj8#p#$iW(py9b)rst?fldy8u0$!T7)b}
zq%6^dKP$kf0Ny5Z<KdA06$bg}0)KaaQ3`qET%g53>KWREwdezhMDwTw=iF!T9v%q;
zjf7n%#-Cjz8gk@MeWO9>%mX}smha;*C%EDafnoSlgb)M)B1!=jy0@sTAWg#ODYB?K
zj!BaQ6^!6pNwq;_0Ahi;I@Lmm@I4&I@%V5yj|xFq!ls<aMXiuTAsE2GF88**60>$(
z#GiQ#;BPY2Dj()1s`#SuNHAArj7gyg1QcZ)U4$=8;NuOI5#j3)5<w(@Lp9}qm}(5h
zr(?2e&7r>lVZt(lWkv>7EAkD~K>{P(R@Fq9h8{87MPW`#%t01xVkE5aswwxZT0z1I
zq-(=;P_{xFMl1Q0i##yXLMS4|q3K=t%l|--%BsC?+1~b#_O|ri!K{5K>04ne%S^)}
z(~vTz+xpW?LzX%I{5pGj_h~{mT%fB=drpwL!4+%OvbAy1+L*C6Cy%c&Mq}-&qx#mH
z@4q=;n+o2Yx-<20^YYfci(B_*wsvP6JrL)7e)AIxf^QSLQ*_4K2pyUb*LF8?Coz8`
zYd?19#)rz>TMKVJJiX|B`GerB@P6>ljihhUehgT9Z}<npb8T}sma5ybO#7;{_O|6G
zmehfT)~s`PatH!0%jO37rOgei0A<cE+nW~cO&PX%nRPF+?gjV5;8JJb5_|Y}tbI0=
zWw*f4tnIyb-g_tc&Z@mJbv|R?F>4@?-nw}6Vuo#8W_K>KI~NQK=l{GS%kG0<vXOmn
z@ZCXR;_c<?_H1?g?5mHMu7$mj{ri&_kiBZz#x2^o?2hiVwdV;kfT&peoH<3!$+Oe<
z$?Lr(wriEO-eTWp=c;a5-?#qfni0tU3qr(>S11|#tiRiT%rj_3zcyHhcA0)%ZG!wu
z>-M2``pb@<A&&lg&Io0d4Fs?{1OjfSY7PVdS;H4OZ@}Y{fU`-+RC5drMmTgiw^y)5
zl(4fUari>mKBw_GhDFquC>ZWO0>`aD;6d)~VNL_tBh%4fJS-lS{s_o1<dQE#wnkGF
z^_a0!%z87ToWDiZ-y+LDp)KE-;47fDYE-!;)snWmla`gr`lRg}6MU@kjgw^X+V7hl
nh~0kE2w|UpJ56zvXU#_;#x|SC(p!JSus`xa5R2JHLP7rxkOIM$

literal 0
HcmV?d00001

diff --git a/scripts/compare_snapshots.py b/scripts/compare_snapshots.py
new file mode 100644
index 0000000..cfdccbd
--- /dev/null
+++ b/scripts/compare_snapshots.py
@@ -0,0 +1,166 @@
+#!/usr/bin/env python3
+"""Compare two CLI snapshots and generate a semantic diff.
+
+Usage:
+    python3 scripts/compare-snapshots.py old.json new.json [--output-md diff.md] [--output-json diff.json]
+
+Outputs:
+    - JSON diff to stdout (or --output-json)
+    - Markdown summary to --output-md (optional)
+
+Exit codes:
+    0 — no behavioral changes
+    1 — behavioral changes detected
+    2 — error
+"""
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+
+def diff_lists(old: list, new: list) -> dict:
+    """Compare two sorted lists, return added/removed."""
+    old_set = set(old)
+    new_set = set(new)
+    added = sorted(new_set - old_set)
+    removed = sorted(old_set - new_set)
+    return {"added": added, "removed": removed}
+
+
+_SKIP_KEYS = {"version", "snapshot_date"}
+_HASH_SUFFIX = "_hash"
+
+
+def _array_keys(snapshot: dict) -> list[str]:
+    """Return all keys whose values are lists (skip metadata/hash keys)."""
+    return sorted(
+        k for k, v in snapshot.items()
+        if isinstance(v, list) and k not in _SKIP_KEYS
+    )
+
+
+def _hash_keys(snapshot: dict) -> list[str]:
+    """Return all keys that are hash fields."""
+    return sorted(
+        k for k, v in snapshot.items()
+        if isinstance(v, str) and k.endswith(_HASH_SUFFIX)
+    )
+
+
+def compare(old: dict, new: dict) -> dict:
+    """Generate semantic diff between two snapshots (generic, works for any CLI)."""
+    # Collect all array keys from both snapshots
+    all_array_keys = sorted(set(_array_keys(old)) | set(_array_keys(new)))
+    all_hash_keys = sorted(set(_hash_keys(old)) | set(_hash_keys(new)))
+
+    result: dict = {
+        "has_changes": False,
+        "version_change": f"{old.get('version', '?')} → {new.get('version', '?')}",
+        "categories": {},
+        "hash_changes": [],
+    }
+
+    for key in all_array_keys:
+        d = diff_lists(old.get(key, []), new.get(key, []))
+        result["categories"][key] = d
+        if d["added"] or d["removed"]:
+            result["has_changes"] = True
+
+    for key in all_hash_keys:
+        if old.get(key) != new.get(key):
+            result["hash_changes"].append(key.removesuffix(_HASH_SUFFIX).replace("_", " "))
+
+    return result
+
+
+def render_diff_table(label: str, diff: dict) -> str:
+    """Render a single section's added/removed as markdown."""
+    lines = []
+    if diff["added"] or diff["removed"]:
+        lines.append(f"\n### {label}")
+        lines.append("| Change | Item |")
+        lines.append("|--------|------|")
+        for item in diff["removed"]:
+            lines.append(f"| ❌ Removed | `{item}` |")
+        for item in diff["added"]:
+            lines.append(f"| ➕ Added | `{item}` |")
+    return "\n".join(lines)
+
+
+def render_markdown(diff: dict) -> str:
+    """Render full markdown summary."""
+    lines = [f"## 🔍 CLI Behavioral Changes: {diff['version_change']}\n"]
+
+    if not diff["has_changes"] and not diff["hash_changes"]:
+        lines.append("✅ **No behavioral changes detected.**")
+        lines.append(
+            "\nThe new version has the same CLI flags, env vars, and subcommands."
+        )
+        return "\n".join(lines)
+
+    for key, section_diff in diff["categories"].items():
+        label = key.replace("_", " ").title()
+        table = render_diff_table(label, section_diff)
+        if table:
+            lines.append(table)
+
+    if diff["hash_changes"]:
+        lines.append(f"\n### Help text changes")
+        lines.append(
+            f"Help text changed for: {', '.join(diff['hash_changes'])}. "
+            "Review `--help` output for wording/description updates."
+        )
+
+    if diff["has_changes"]:
+        lines.append("\n---")
+        lines.append("### ⚠️ Action needed")
+        lines.append(
+            "These changes may require updates to `README.md` and `Dockerfile` ENV.\n"
+        )
+        lines.append("@copilot Please review the behavioral changes above and:")
+        lines.append("1. Update `README.md` flag and env var tables")
+        lines.append("2. Update `Dockerfile` ENV section if defaults changed")
+        lines.append("3. Ensure documented behavior matches the current CLI")
+
+    return "\n".join(lines)
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Compare CLI snapshots")
+    parser.add_argument("old", help="Path to old cli-snapshot.json")
+    parser.add_argument("new", help="Path to new cli-snapshot.json")
+    parser.add_argument("--output-md", help="Write markdown summary to file")
+    parser.add_argument("--output-json", help="Write JSON diff to file")
+    args = parser.parse_args()
+
+    try:
+        old = json.loads(Path(args.old).read_text())
+        new = json.loads(Path(args.new).read_text())
+    except (json.JSONDecodeError, FileNotFoundError) as e:
+        print(f"ERROR: {e}", file=sys.stderr)
+        sys.exit(2)
+
+    diff = compare(old, new)
+
+    # Output JSON (flatten categories for backward compat)
+    output = {k: v for k, v in diff.items() if k != "categories"}
+    output.update(diff["categories"])
+    diff_json = json.dumps(output, indent=2)
+    if args.output_json:
+        Path(args.output_json).write_text(diff_json + "\n")
+    else:
+        print(diff_json)
+
+    # Output markdown
+    if args.output_md:
+        md = render_markdown(diff)
+        Path(args.output_md).write_text(md + "\n")
+
+    # Exit code: 1 if behavioral changes, 0 if none
+    sys.exit(1 if diff["has_changes"] else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/extract-cli-snapshot.sh b/scripts/extract-cli-snapshot.sh
new file mode 100755
index 0000000..2b042b4
--- /dev/null
+++ b/scripts/extract-cli-snapshot.sh
@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+# Extract a behavioral snapshot of a Cobra CLI.
+# Runs INSIDE the Docker container (mount this script as a volume).
+#
+# Usage:
+#   docker run --rm --network none \
+#     -v "$PWD/scripts:/scripts:ro" \
+#     powerpipe:test bash /scripts/extract-cli-snapshot.sh
+#
+# Override binary:  CLI_BIN=powerpipe bash /scripts/extract-cli-snapshot.sh
+# Override depth:   MAX_DEPTH=3 bash /scripts/extract-cli-snapshot.sh
+#
+# Outputs JSON to stdout. Env vars are NOT included (extracted separately
+# from upstream source code by extract-env-vars.sh).
+
+set -euo pipefail
+
+# Suppress color, update checks, and telemetry for deterministic output.
+export NO_COLOR=1
+export STEAMPIPE_UPDATE_CHECK=false STEAMPIPE_TELEMETRY=none
+export POWERPIPE_UPDATE_CHECK=false POWERPIPE_TELEMETRY=none
+export TERM=dumb
+
+readonly CLI="${CLI_BIN:-powerpipe}"
+readonly MAX_DEPTH="${MAX_DEPTH:-4}"
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+# Strip ANSI escape sequences from stdin.
+_strip_ansi() {
+  sed 's/\x1b\[[0-9;]*[mGKHF]//g'
+}
+
+# Emit clean --help text for a command.
+# Exits non-zero if the command itself fails (not just "no subcommands").
+_help() {
+  "$@" --help 2>&1 | _strip_ansi
+}
+
+# Parse subcommand names from help text on stdin.
+# Prints one name per line; empty output (exit 0) = no Available Commands section.
+_parse_subcommands() {
+  awk '
+    /^[[:space:]]*Available Commands:/ { in_section=1; next }
+    in_section && /^[^[:space:]]/ { exit }
+    in_section && /^[[:space:]]+[a-z]/ { print $1 }
+  ' | grep -xv 'help' || true
+}
+
+# ---------------------------------------------------------------------------
+# Recursive emitter
+# ---------------------------------------------------------------------------
+
+# Emit one JSON fragment per command visited (flags + help hash), then recurse.
+# Args: depth  key_prefix  [cmd_words...]
+_emit() {
+  local depth="$1"
+  local key_prefix="$2"
+  shift 2
+  # $@ = full command words, e.g.: powerpipe benchmark run
+
+  # Capture help text ONCE; derive flags, subcommands, and hash from it.
+  local help_text
+  if ! help_text=$(_help "$@"); then
+    return 0  # command failed — skip without poisoning the snapshot
+  fi
+
+  local flags
+  flags=$(printf '%s\n' "$help_text" \
+    | grep -oE -- '--[a-z][a-z0-9-]+' \
+    | sort -u \
+    | jq -R . | jq -s . \
+    || printf '[]')
+
+  local hash
+  hash=$(printf '%s' "$help_text" | sha256sum | awk '{print $1}')
+
+  jq -n \
+    --arg kf "${key_prefix}_flags" \
+    --argjson vf "$flags" \
+    --arg kh "${key_prefix}_help_hash" \
+    --arg vh "$hash" \
+    '{($kf): $vf, ($kh): $vh}'
+
+  [[ "$depth" -ge "$MAX_DEPTH" ]] && return 0
+
+  local subcmds
+  subcmds=$(printf '%s\n' "$help_text" | _parse_subcommands) || return 0
+
+  while IFS= read -r sub; do
+    [[ -z "$sub" ]] && continue
+    _emit $(( depth + 1 )) "${key_prefix}_${sub}" "$@" "$sub"
+  done <<< "$subcmds"
+}
+
+# ---------------------------------------------------------------------------
+# Main
+# ---------------------------------------------------------------------------
+
+VERSION=$("$CLI" --version 2>&1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || printf 'unknown')
+
+# Capture top-level help once.
+TOP_HELP=$(_help "$CLI")
+TOP_HASH=$(printf '%s' "$TOP_HELP" | sha256sum | awk '{print $1}')
+TOP_CMDS=$(printf '%s\n' "$TOP_HELP" | _parse_subcommands)
+SUBCMDS_JSON=$(printf '%s\n' "$TOP_CMDS" | jq -R . | jq -s .)
+
+# Stream all JSON fragments then merge into one object.
+{
+  jq -n \
+    --arg version   "$VERSION" \
+    --arg date      "$(date -u +%Y-%m-%d)" \
+    --arg help_hash "$TOP_HASH" \
+    --argjson subs  "$SUBCMDS_JSON" \
+    '{version: $version, snapshot_date: $date, help_text_hash: $help_hash, subcommands: $subs}'
+
+  while IFS= read -r cmd; do
+    [[ -z "$cmd" ]] && continue
+    _emit 1 "$cmd" "$CLI" "$cmd"
+  done <<< "$TOP_CMDS"
+
+} | jq -s 'reduce .[] as $item ({}; . + $item)'
diff --git a/scripts/extract-env-vars.sh b/scripts/extract-env-vars.sh
new file mode 100755
index 0000000..930de9b
--- /dev/null
+++ b/scripts/extract-env-vars.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Extract environment variable names from upstream Powerpipe source code.
+# Runs on the CI runner (not inside the container).
+#
+# Usage:
+#   bash scripts/extract-env-vars.sh 1.5.1
+#
+# Outputs a JSON array of env var names to stdout.
+
+set -euo pipefail
+
+VERSION="${1:?Usage: $0 <version>}"
+
+# Fetch env.go from the tagged release (powerpipe uses internal/ not pkg/)
+ENV_GO_URL="https://raw.githubusercontent.com/turbot/powerpipe/v${VERSION}/internal/constants/env.go"
+
+ENV_VARS=$(curl -sfL "$ENV_GO_URL" \
+  | grep -oE '"(POWERPIPE_[A-Z_]+|PIPES_[A-Z_]+)"' \
+  | tr -d '"' \
+  | sort -u \
+  | jq -R . | jq -s .)
+
+if [ "$ENV_VARS" = "[]" ] || [ -z "$ENV_VARS" ]; then
+  echo "ERROR: No env vars extracted from $ENV_GO_URL" >&2
+  exit 1
+fi
+
+echo "$ENV_VARS"
diff --git a/structure-tests.yaml b/structure-tests.yaml
new file mode 100644
index 0000000..89624a2
--- /dev/null
+++ b/structure-tests.yaml
@@ -0,0 +1,87 @@
+schemaVersion: "2.0.0"
+
+# Validate binary
+fileExistenceTests:
+  - name: "powerpipe binary exists"
+    path: "/usr/local/bin/powerpipe"
+    shouldExist: true
+    permissions: "-rwxr-xr-x"
+
+  - name: "powerpipe home dir exists"
+    path: "/home/powerpipe"
+    shouldExist: true
+
+  - name: "powerpipe install dir exists"
+    path: "/home/powerpipe/.powerpipe"
+    shouldExist: true
+
+  - name: "workspace dir exists"
+    path: "/workspace"
+    shouldExist: true
+
+# Validate image metadata
+metadataTest:
+  labels:
+    - key: "org.opencontainers.image.title"
+      value: "Powerpipe"
+    - key: "org.opencontainers.image.vendor"
+      value: "devops-ia"
+    - key: "org.opencontainers.image.source"
+      value: "https://github.com/devops-ia/powerpipe"
+  exposedPorts:
+    - "9033"
+  cmd:
+    - "powerpipe"
+    - "server"
+  workdir: "/workspace"
+  user: "9193"
+
+# Validate ENV vars and binary behavior
+commandTests:
+  - name: "POWERPIPE_UPDATE_CHECK is false"
+    command: "sh"
+    args: ["-c", "printenv POWERPIPE_UPDATE_CHECK"]
+    expectedOutput: ["false"]
+    exitCode: 0
+
+  - name: "POWERPIPE_TELEMETRY is none"
+    command: "sh"
+    args: ["-c", "printenv POWERPIPE_TELEMETRY"]
+    expectedOutput: ["none"]
+    exitCode: 0
+
+  - name: "POWERPIPE_INSTALL_DIR is set"
+    command: "sh"
+    args: ["-c", "printenv POWERPIPE_INSTALL_DIR"]
+    expectedOutput: ["/home/powerpipe/.powerpipe"]
+    exitCode: 0
+
+  - name: "POWERPIPE_LISTEN is network"
+    command: "sh"
+    args: ["-c", "printenv POWERPIPE_LISTEN"]
+    expectedOutput: ["network"]
+    exitCode: 0
+
+  - name: "POWERPIPE_MOD_LOCATION is workspace"
+    command: "sh"
+    args: ["-c", "printenv POWERPIPE_MOD_LOCATION"]
+    expectedOutput: ["/workspace"]
+    exitCode: 0
+
+  - name: "POWERPIPE_LOG_LEVEL is warn"
+    command: "sh"
+    args: ["-c", "printenv POWERPIPE_LOG_LEVEL"]
+    expectedOutput: ["warn"]
+    exitCode: 0
+
+  - name: "powerpipe --version returns version string"
+    command: "powerpipe"
+    args: ["--version"]
+    expectedOutput:
+      - "Powerpipe v[0-9]+\\.[0-9]+\\.[0-9]+"
+    exitCode: 0
+
+  - name: "powerpipe --help exits 0"
+    command: "powerpipe"
+    args: ["--help"]
+    exitCode: 0
diff --git a/tests/__pycache__/conftest.cpython-314-pytest-9.0.2.pyc b/tests/__pycache__/conftest.cpython-314-pytest-9.0.2.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..77454056c76bcc6978ba3a1586788080f8877ce8
GIT binary patch
literal 627
zcmZuu&ubGw6n>kH*-dN>sIV1;Z1EHfyU;CILHgq$qz5GgJf_1ondrcFXPB9#<WgE%
z=+&YJ{{;_%S1<k#MYK8~E&c^U|AD?S-R9!J&imf?-n{Rd*~fS08-Q!!%TM+R<IpDM
z@~^?=R|Nae2Mt@$cQzee`4`=8wWze9drQ|^(~74(tW-ArZe7<~Fz|Z!%VD$F3ud@P
zTQHbggh3s@`DJIy_8ykiS^OW@cRROd9p&le%9LxN<44f07HgP`iKa@2L!OV>>q4fQ
z@jU#q|2|AdBNeKlWJ0Sr)I3xZ6^T^83CCQ9Y)5dZRrIp$m}(DM<6ZZ*o5mw##D|0!
zf4g9rX1OwR>taG~vIk@;8>LE7X(b~`cO}!*)Nd%`m0SZ4TbCr2#zh;(vpzDmE$zFQ
zs?AIdWpEZYXlZ;x#w?>~p(avEbNvx6?d8qW_!V}kc;iKqEUi3=B^6x70x6!SSuFT2
zm4XQxTRj!qXR#;}6XQSI;iDp>tJ3~KtE^UW`|CQ6^9!Dz102C&<2Ni^fP3s8_{YtI
n=3D0^Inf`w@Al4u&S}s&3zE|y`OLltYv1mz|9}m77e`zHQ1qi<

literal 0
HcmV?d00001

diff --git a/tests/__pycache__/conftest.cpython-314-pytest-9.0.3.pyc b/tests/__pycache__/conftest.cpython-314-pytest-9.0.3.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..77454056c76bcc6978ba3a1586788080f8877ce8
GIT binary patch
literal 627
zcmZuu&ubGw6n>kH*-dN>sIV1;Z1EHfyU;CILHgq$qz5GgJf_1ondrcFXPB9#<WgE%
z=+&YJ{{;_%S1<k#MYK8~E&c^U|AD?S-R9!J&imf?-n{Rd*~fS08-Q!!%TM+R<IpDM
z@~^?=R|Nae2Mt@$cQzee`4`=8wWze9drQ|^(~74(tW-ArZe7<~Fz|Z!%VD$F3ud@P
zTQHbggh3s@`DJIy_8ykiS^OW@cRROd9p&le%9LxN<44f07HgP`iKa@2L!OV>>q4fQ
z@jU#q|2|AdBNeKlWJ0Sr)I3xZ6^T^83CCQ9Y)5dZRrIp$m}(DM<6ZZ*o5mw##D|0!
zf4g9rX1OwR>taG~vIk@;8>LE7X(b~`cO}!*)Nd%`m0SZ4TbCr2#zh;(vpzDmE$zFQ
zs?AIdWpEZYXlZ;x#w?>~p(avEbNvx6?d8qW_!V}kc;iKqEUi3=B^6x70x6!SSuFT2
zm4XQxTRj!qXR#;}6XQSI;iDp>tJ3~KtE^UW`|CQ6^9!Dz102C&<2Ni^fP3s8_{YtI
n=3D0^Inf`w@Al4u&S}s&3zE|y`OLltYv1mz|9}m77e`zHQ1qi<

literal 0
HcmV?d00001

diff --git a/tests/__pycache__/test_compare_snapshots.cpython-314-pytest-9.0.2.pyc b/tests/__pycache__/test_compare_snapshots.cpython-314-pytest-9.0.2.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..f7f78d51c483834ef31deb1ebd4b44dc05e0ab17
GIT binary patch
literal 40162
zcmeHw33MFCbzslka{z+@2;KmO7sw%Tkl-mE3Q3S6A@P7(&@j?MYz+rPVk8{H?g2@F
zmPPL-&!8i(<Qy+>tT=p<k|pg;mf6kQr?vbxO6;|r?C}N|41w*)yN<J7uai9}(i`qF
z?<M<xRd;pupa%npq!nq=82qlPuBz^-`StIr-c(r;5a2leucp)Iw+TWLGsfZ86L-5D
zf^bEUgsgB{kQ^P3tdpEwN8Llt2H~hD>usP{d|4m4B4$N6J3IVG1KEInEtm~LnX4mo
zv?5z^v@%<HG@K1L2rmRXqs9%*v*cbPz~hi38!1u8!_}!SQOC>Gsi_rK36gJ#Ac@<Y
zdf$sknIFmmtgM!l1)(g&$`+Hd3Mi{&WlKm|7|N<x*-}y#fwF2=wv3e3K-nTzwp?<o
z5n{DN?eHAW4y3cuY)Z|l(X)d}R81=BOjd184)$jfN=jA-5*f93Fsrs?hNC~c@~hFz
z;Kh`ZNoP{gv*}COAtj}@oQOFzcV{Bo8*^zsy`dK9NuNC{_obm@Ev%#ldQytqpHN=z
z8N4`P`JorVL%87o?m+<fLrV_HDY+zfiy%c#IwTLAtKsZ}a}AtD$t(F=oKgVtiy$AA
zLQ;iPDTSq~)&PDj&37TCsOiCh`<^W=+grA16~>p4dlK2yNT6+V+m7bVTi~Mw)uA)+
z#QlkZ9#speDFvF!XZsT8)cfA%=H66aMyolK8c6o`!=uZ}&;Y%t`TGZZ%zBxjzCKM%
z4P1~fBotMv#CCEvbtx<NCe&WdpUKFHGs!J&TeT|v7NiEd*poWDZTk-XPS)$^deb|1
zJr;9oe)cR{00+7+m4)xAx!`FuFYP+!Qi3p$_r>OB9Q@P(ev!<elD**`@i#a3D8tS0
zHAdia>Jk>S+Ji&c%uqJw(W*L6o;oabc61(=k99oLb@+s~*ep4I@{oM&Wcz`xj*};}
zO0&H4q|~L=nE9^5#||Gq+$BB7H-5JB(1EVQa{JN4?N8khlr{LP!@r;%X?+%+UTr;a
zeCyV>T{~NqRAx|Z%|OxMK%%de;an?0R03r?4Ap8`Rff6pg)K@W+@uQr)#CuJ2)Dh0
zzxs`x)8dk`mD6JF#FF-Daq+~`UDIOSM8k<`vF455Yhtc8HZ4})5xlj5+m(WU+1RFO
zarxL&P-pD&?NyPG_qGu6c$Kx#V-iRdI}n!%K37BHiqI;=g?0yGb*rNtr=3&r!Ue?5
z9W9&57{nap0afg!QCSC2Gp8B%J=)}fK{?r*7&w<wl^9lrf3+6C72yZLUAf9Nx!|sA
z&)xKmL&m*}J{nwQ2b*g9p{Qu8Rq0a=ryNc-oN_SLS{yLh=)?<{Q;kftMdXVp8=x;m
z1Yk_8Hkeq7A4`$C6Z}#_n5sY!Mu5MC7Jz9%zfF&VW2Mv}z-LtOJH<T8VoWbVuoS^E
z0GbF>ES)&hmx{S**URzJ3IO+m&CM4Fm6z2_BAHTFLJ4$Hk5?N2Xb}@RPaHla#}7zK
z6fdqufT&0T{+{$VSZ#+(ZSuu*wwL`1tx$Ut{Hsp_utBVo1hI~Ai1o(vR;+3&jaASk
zI}8lFdkBgWaH|)DEMOHd!^2tEVqp;QYl)C`OHP0u$pz4hY%J@OfKg@PhXm-CeAz%;
z$Oa`5@X)VSbOG5v1Z4UcQfUhk``|8s#Nyp7@Tx09w{d$yo?D!N5rLBqgP&v^afjq;
z!XH9EGET|a;yB+HckMbV2<H#2*UQfh3&KjFTjzg*(CIc>m}lUU!MJ;?LkgW*v(>px
zuOYd)Rycu*j#Wb3xlMmc$y2tj%c$GxY~p&$c!0V1;+|HArPSMv=u8f-XCk{8<@5|s
z;Wc_T&b=^?_Bb-mJr1QE#>sCTrxsyhlyL0$Q9|^*QK2~!n&XV-NNS!$Pfw~xb7h9N
zAlP=lGNA&y$VS&~$PDj@saUw<gyvIH{eu@$J-`7`dQ-L|*a6^%<Gyp>z8j8_YHYA2
zrbhSeBW<_E)Eiy}iM1BkpBYBxA}16rA}14leKIg1#gJzFvYI%X!V<0W0J%Bv-NTA9
zsAx4Z$W8r;tPK3LFENlnj(o$Xxz$wPS<TU-1)*n|KJaEfvz5=Z(G2ZrJD=I9;#_Qu
zl7kYaD*B)}C~`WR>Q}XT%S>)5zWxOCp#A}XE5Zk%#bd6qXWkfj>*w;Jt)q_VaMc@2
zzBrN-SC1vfp2gF%<Kfj)qW;N?t4Bv@u3#o7u^OwxCnm(z*yFM<ekLcb8dC@u53iaM
z^-o@0HToHvE11bitjp@~3Ai$o!<HmYlq?~yZE?;<oE9b>-~t@{q?<{a7D%`q2}k0j
zY=yy7_9GxuYsL(%CNof{NBSI%+RRZ)ji;bLbC&+{tJiC;C$9&rv$SDM%83BR!wplS
z{>h6CI7cy8Fq4y5jn&~36Ji6Kqie6Z#)fj@+OeVW@Y*R+|K!EBI7=~CFq4y5jn&~3
zaAlTRdcjtNKrL_fS^7Zu7a$@;@c#!9LJ}T8)cVwp6OnO4MUsHB6X)zM1dk!ujbIOe
z6Utsp?nCf%2=*hepWG|R<UTV9Y5);TWH26pus~!FEoL*z?W=ae9n^0C;F$8Y_Ukp*
zcIQJakCZY0EGE5TKj~+(X6Hkbhy7&A2P{+G#mVcOoDZW;4vW@MUc)G@HGtmm(6t61
zr!|NRqf|n-VxuJaK&cIK6aHb$^)Q+1rrAZSvzg!K<!1q_)PD(}%$$DMZ2ZxS+AkH&
z=N6$wu!z{gL&H!Xna84K9y{hSkDX=fmY&C8c7Evd*u%|Z@4_gRn8$3CBo7*=9tx+X
zigKzylO5JQ5q63)cl~*szrSb9-#3)8wtT3b<Heu6d3&j7-cscl6y;!%{myO0OmxAt
zI6ty&Dn#aRg=G$xx5}9oJnsX{VV@*E^f~P3=5U~Bq#O?*et&AmN%F%iuGAbO979H1
zT$y<dw!0Uw7PH;WO(d@+Y#Mx#Lw#8}t;#Amw!mVz#)erJSCVncziUi+d)wIhvE;R_
zW6$Tr^<&SEhu2Su`X?{0N6i~^1v5E`)mR-qF(IyhM4C78U7U!8G*OlZ68$Mz)&jB&
zZo#2GOowFo{7|A#zY><^vuQ=m_N50>AiK!Q2^{jL5p*Fqg#byRavFeEE6ZvY%$i9#
zk<BXUGea=g&}T%JlYL;<>`5oH$rRX2<r@yIf-8h(XprAejF!q4><__V_*c<s^nX4N
zV$vO_%d`4Uz~x!T0LiYthh?_~0K~LFnkJzYI}De^T~y~R9+7l8k4RPoFNk0A0*d;y
zMTjKr)ZKkzu${Wsl0Y`u!R(Fu;hwxR<Wz)-K+d>RvWh@1$#K3t?tW4@|Ll6bt2w$q
zzySg75AoDC&iyeDp++jN^tcVnR+0Myd`6Nd?k#eE_~zmM@EJWDXRtAPfq1&W{n3RZ
ze#5T?!SQW)(4Mf>#sQO@X_dFwr&Z2kk3Wub0Kq{7?FbGbK-{_^Dn~Hg2tf1F>8^BO
z3Hs<1w6ZD35TGwuMaN~M#k#(p(2{gdY5-6^(Z~F+DmwEy53IJ=4sodMy?pDJ@a8W9
z08JsXG`FlJA9-TbI~}flqrVVdn-iO_dngDuPl@^`FE;1UN{873m!8DhtQMbuE7UND
zJ`Uq3jm|7;B;$&^iqP2&=-d_e06L$YH#&O>Iv<`FIx`fV13G&QWGg~vA3<kd5ju<W
zKxfhD**NRy>;`mBAv!BB!>}qD05|+5-VyJ-qTr>Hn1?RKMl0$y64cY9SLD9LnN*)V
zIM6p-jCp%XV_w<D1900S#C!T@jd(ppLg^_E@g(7VyX4?SEJQoB*3BF7#5f|J|J0`s
z@q7zo1Zrg2$r%eMNbIyqV^+{`6I+%;;#dgZ8L;r30fX<5Nv>SL>0>i>8!S_o-UlU7
zjASCR=(h56c4jN2AnNY}Fu4Sotc!DETW-~s!typuEN>eRw@r!qCoi^*UZlB#nVcl`
zSS3C&A+}A2A8L<qGs<>srKp4RlA^#@3sMvbBbl!p1twXT|2~TxRo;-qj6+g+nTs*0
zBF5vz_{E1VN1=&?%28+{5w#Eo5E_D%JyM$v4P;TudBmrgBF`Fvyr2s39m*GbQv))S
zWVBtS5qS2N7xAVq0x*$S7j*^-;dME2)Aecs#>1PYME#Q&H|4_XXtuzmC$ToG#V6nj
zRTS31old~a$2%$s1ZNPS?x3g$@OhNaBKU_0dJv=#oCUzEENLu6fd48+lIbdo)6;TC
zB*5j_dN1JgG~E^e(EDR$ycs(H-N|tm<xh*Ea;2Q2!iR1_Iv|PJAgC@OqFo2H#oSMF
z3c}J1<z+$I(}!FTG7nYS1G{7&blqh?+4|v<GKgS?Jcx0E^OpyyS%cG-<g7B3(wgjl
zcB*<5*Zv&bxoGx1!^?Y3*WEc0LAYs3)IWK#i6|PFEpX{ctjKEd3Ai$gqJiOq7QJ~^
zc~7#q1g(LEA6XXk6In1|kp;^;{1|<oLr7t1B?LnXAGQ*LA%#>4!C20q(gZ&<#Dqh9
z`?*0S4e`N##JJKfu*-P)6$FGad>&GEVog2a4AjkShRVx5scb5V7PjrPp<>BqzleA1
z1z>Unf|JW~V#l>(g}N;_n+tXO-(OOw>wuD6UB`I1V@lLNd9eeHZkQ{W$w^X=RpJwH
zX#qENCR8M+_(-_xqsGl<M6+K)fFZLFj+9i^*0IZ6vSDK7jyYhZO}ne`barUDGAACt
z_L)L-+s)I3=%M#d6{5$XBo{qC9zH%L>Yu!LeDoEXE11biQjb;Q6L4t(Ek91QtYm0O
z7ABAYAluNOdC^KEq|aC&WMbv4w6bKgFP1>cB{}iPwWh*~)|<h?ioNeXS6FcbN^&cX
zjE9d*iTWom9vQtva|JUwN$Rmmd;%^lAmzu2lr0P?$wHY2X5chfjnYbeftrbtZRP1?
zahoq8I->Eqh;^^di6^gj7aDiJySvc%#QPTujVGZb*LZR~d~!<EKY1v@;Bw3sxb!5c
z$*S=QxU_(fA16YtvLfUIQ^`6aQ5xi~7`-&!Ovb6SRJSSB>eosjCHPUEx&E2LhQ04T
zU)XT;d&>$No`I6whG)jZ&rFH>Cl4j)Rl#h5OHY!TtQwzyOEZx&2oC{@w|EzQf~B;b
znQoPCrmV-Awvq9i7S5;Q-d(={R_}|<-SQ){c*+g;AxEceK%?Z3`@rfII2GsIEf8zn
zjb<O(4yCZ7V-;KQjF$Fu@T0>rE%Q#ee6Q$O#VzA9oFm4Q_P}yHOM7IsMTcGc<7DM8
zcVF9f<~YHkF!LGh>oTnjG`Mng+0w06w`KVkt~mC^#UeM7zdK@lC9Y>&$XIlMrP^<d
zka5;mUVsLd0jr*JfkZ0@mCr#_T+OsubM>WQU2kT%jRY!VYNut{(_?hm(_^^y+VObI
zG17`_n_xjx;If{G(lt(-W9kMhX^W|`z$?+mi8*^GW-vroP~Jpv0Kq}Lc?ef4of%5^
zWzz$y=It8<7pST&m0=C|P#=alXB7Ed-{2W=jAArFk?$2cJ%U}K?^R(o4}PK37UG5F
zOLp)X%hIP^^l9j#s4bgS#9QVui_*1F%LqB)?3N~X+dLb0vup8X=wC%(<!v>~###zB
zv7FfQnwqPL<-;2xdHrbu#=|XBqW;N?ExGVUmSu_8RF<5;K4|V1)UJuq^d#33($}A6
z4fq7KAXG<>^{BA5aE{{0zlPv-1iy>`$)hrc;A;qa5ZD?#Q7=~zT!DYJ4FEHEHlxAw
zNe99c1Rf=@lfW*=Jt%KQBWNpqMC`=g2#UR0jG%9oHiBk-VC)o0K%m!R>^w9K$d^t&
zl^Ry<BQ-{Ws#<6;7pVar#<n64BX}5yhjG3h20!sI1S}qg@?Hbe!|?YvQp2|}MnJb`
zk7f}U#;EKVVT@If+I@%x$X3Bd@q+FSP^4;~hYL3Ts&$0ubIbEHsbu;r1gO0X1i@qg
ze1Hx|F{mtAuJzk^Yo~)}2E=PsmlL;N4;5BzhjVV#_VMucDN+CA#qFb?rMZHcoFw&F
zB|b4BZlA_rpS?s#g>!Dh-tq9>DN+CAp#()!%oe!xB&o@&@rem>?{s)Mc!jTZ7wU<3
zxPFFr__FC8)|2QRt~XuCymxqZU+#=Zj`DOChIHN$aS+f;A~`;N5pni(c43T)q6T9D
ztp@kENhe`TqHIFR(#?0MRoRZFXu<PCDP@>egAD+@1B2OUdH@9F#V8HqCIGa=8s1TY
z;83L%+}yCCPNE-oKcb{2k;$ZB!vJ1sok3_ywYq@>=Jx@Z(k3A=Ko9oc+*@ec59eId
z{_*hsDN+CAp#<pxW(!<;lGJ3?_{4;`e>w~X>|NLQ7S`^9b8hXf@$jxGQUBz{U1+w(
zT)|9El6tHXpMXnL_eJf&IDC)*iA%iu9U^zZo;R@9O~y&jbVsKaC+>ffahY3*oLa-8
zXWbx^brpH~K>sB&nW_H{&uR0J5Yc}tEc$PGPam%*vTtUuVVhfg6nRrh>51ryBL}yr
z!Bz(^sV5R0G48gGkTpQFXk!r%U0+SC2uCeegt?7kB^kx=r*agn3phMd5Jw3DTjz^u
zRb-4JpT037)`)7Y5(ynH5};Ic#Mj)MP=^PSN*!QxY0^s_e0@--OEKj+GZM)fCc&Ew
zG}mAs?DH~^x>zPwf?5LTo+we>60ng7h0qpuZy{drVL3e@W8U2U&2U>E;7kKE3HDsN
z_&xY~>TV()PFJqaMH+LJ>qlMFl@duxxedGCeeC_0a=V`%uarhz5aK;nlaH*%z>9{Q
zxbu2bVa-lB=ho~T5AU23^-ms3aAOC|7P#~zsmZGGi3xEh295U>!fSGCw-v(MZ=NfJ
zAJ2);z5m$vUdkPO4pIQe!_Q5L`X>)1;m2vVz@;ZiO;(LhOo-2!k?9XNU_>`&_-&0D
z{|xaAm(wcWL{Qpr@w<2#!CUaJE(4$&F5I52cS0`DWA_4HPxEa70JTqG-6Z_81Aa+z
z+<hEQ7W>3|rR@_ClEwDd%KE`p5g?0@MXeg~OCp;d9yj(pWLyPq!1!ew;g=jw<m6}0
zGRzjnWgsm7{Gqsua7NQw0b+#3-fC|dHl*lw-ZISDE}4ax4h2Hc@0e8@mjre*zSU`K
z6UL2~@WAIg2V}zXRQ48HW({H1<0VDy?4OIZ1FNyCh!dAu#}XkA2Y~z5_7>X`n!j>b
z@{#ekO6YSN{{Ycqf~OY7|3StdEefHL`V)iEGpXLhh4i43=!??OX*FsDCXoO=w3=_#
zoc%o(%lUR{Ip2O_q~bs_3!8OC2U026N{jF+o6zsAF;&66vr4EAaQTLAN_Rso)09q4
z<4BN{w-LO9;1Ght0Al<qB{%Mss{Aot>p<`n0Dcd!ZG2{jjX`7y<$Y{-NVz|ys)=(c
zZR1QrM9m+dmFQz;)I}1j765=g0^#6Gn)2a8qwWtXR*rS$D^`y>r^Bsa^0*1s1dGKZ
z7j9)H50+*|j$7D*<-p#-<ybK!h$W;xCvLcQW<0!MO4L7jal`1VG*>W_?D8$F&vFx%
z94m&zq_~0VEI@79QJMyG(TN-lX7nb5+RC%K#n@a7H8&bytV!vb7Y#PGlSe~?8I7MO
z4QB0ZXmF{;S97PqCDwN+aiGBq<8R^3KjZO78XOoxkM|FM^R=i%_dcRQ(SHPml$3o7
zQ{M(~VhA<hAAa@Mq6cu#LaG$}8@&1*0G4%g#Ao<jykw<@%J;DBPXO3OsnQ@9gPx@a
zl6^xxDLIR~#Hw0LDH3R3AMdN?0hna)X)757Ys%_t&f;AX!H9x;CgLuMdXnvncnj;Z
z9Bh%u<ybK!$mWS)yN!+k5sXfW`X?_&N5M{uxq_Kwmv3QxmYcBTSTQ6f#po<V@ShV^
zh7&{|B@y(IU~KW!0ud}P2$d#+I0^kD;{N1dCfzrfEj|5;CY<u`OH8A+M2aY$7JBy}
zCcuJd*lc{~T<23!L!80t&}<V6!oTOVwISQg@RntdL)h1_#Eyrs7vciy!^p#i%l0}L
z<Kv$Y{!dXqauoL2hj$lT${O<jgU<o-Dg=HVoUFo12f%wd16v8e6wtPo!hb%bq^J>@
zak%cRBvXO-$(gb*36?}r7=&MzW`ga4^h;3M0*d0;=4OHTq+$Pp^b5Z^Z<+cyq+hbK
zd=`4M0iJQLjCV0%yv8DRuv+(~67aqhx|yiej7YWj8C56XZt6IIk^}}8c&{8=eHCQW
zmGqMrSK>Nx%oWTeyL=0)v)qIw$BH2VSIFw|N7DJExRTmy*T7dh0f8hh!nt@+@1J7X
ze?Wi(piCl|LePUCh2Sgzer4|;Vj+U}@B((u?8UJ=A-8808jYj4BT?*L!0oBKEdZcT
zf~}J9&kkleMmMy@a{T>rmSf94L?ZH);|b7S+^lawU{S??>cStFyx>U4xM8;;XA@r2
zkBkROT$U18{oV;}iVx26X=^2pJB%1r<J<r*HF#(}xjLCQ)O<42s*D@9bXOQx;>_;B
zm9Z$@7S}fY`!xvNOs?syGFqEwh&5(bUgKNsambD#=a5Tgk<S^}c(SwBY-OYjn|1?i
zUW<R`U4P!!x!9;>p3jeVE;VyTD&vQk?i=v{*~#ENL(V$)ePZigZq({rX{5|Eybz-z
z9)$Rp%2U6=S&bkjxf|D{lcO`LC%BU>FEsD8nyacO`DiZV345qD-fXva_I5yvVFSMI
za`l;7Bl*kLWzo}8plscM@%t9VaEI{aHSthU40lDh@ihgmXC&Q42aHUG(X(-e7;Xo|
zZ{tc_*d9>%2EJ4)3U7lkx;*E^-!=^|DXSA2$lqbdvE_SQbwb*4Bm5J*!-@MMcsyHP
zg4Z0~7r|9YQkpxVoV##;k=+Z9l&?T5&6T>8RDKgubQkNdV(PaLTtl!A0NAmQln4li
zKyVr(4hb_xyyZfoZzvUbr6oDo11IAR84xIbqgIQ|coZ#gQGr)a$S8bkZhU^t(=*hc
zQ8k~Mg3aQxisn*>;msT>q`dUi8n78xBCUc&Ch*KK#L@I0zLbWx{Xp?F54pSM#+!2%
z^tbTqyp7-;1nme8As`m?N;B466SMspIg`ltYQg@&0SE(xbh1}-CRGhb81}pCOKCX5
zB&GZiJNaz{Pa^mo1pfrVbp$s6s7O#C*j(Ql3|-AM;Cv<F)%euhUSRO<k91a*H*4z*
zB2M{qiE94|Z%{`pE`KIAPS>m$d#O;fVN~Q&V%3zmVq9GD=Aqwu@;9E$t>2qpxo=W@
ze7Z#W55yY1e*3k>xsCh3z2^PiZ#7Ro-IaUxh5XZ}b1`{ReDQ;dn%7_W!V7Qio~me^
ztZ2NxW;#^)`jM+gUhBB$5-QjKAYA?W@YP|kZoU55tDi+9SA>9KOBaMVqNR)fj6zVm
zUI0ccBL{Y`(P4T4-WY<Rkyr<k*CMPspMd)JJn$g!c)5zk`*+d9_{Xi0BN5McBf%r9
z{YeiL7>7M$^uPieD`WIRiIp*e_35FpGv7z*iMewPQUWa2Juk+{m>|a(nalE_Ge&S6
z&yz8Vwv6%1wu~`w+Hw9H@gQN0|BeyQxiZEOVT@mY<cyIqEaM61$QW6>IWk6**_CIE
zjM>eBF$N7>D`JclgfUhWF~-VyFvd!wXXC6hM%*(u0F3e9&WAB7AHW1x{tJLu*re}t
zEzupkbQi%-5&Ulie~n-c<U9=Zkett;=X8e)La6ySyXh2ti?-f|qT5ycOSr*9qUjy^
zl}}EJPkkC`y7GTvn3B9&!sz%2lrja!1+OEr(s4IXNWLBPgNMZ2vOq%}lG~yJdF)jn
ziK!LP#@Wep722uL%~T^?`e*JJX$He^Wvn*~-7OO+V=64htg%r@fOmC9^he@OvnV9q
zPNwLX4bETeTx8~qR7O1QJU<rq6T15~gR1EY2~%tAC^jf0;dlV(Zq=!)9NiTyqP(pl
zV>~$*9%SB$DKo|s5+e`ebjB0vbk}SbHR~HG5Z75dpu2vckLBt!?kNS!)@3wZ3YD$P
z=y?&{4dP2{<G~`j8|q$Td<U-QwMLnFhHn@$FvmFSbQj-<0ZNH-V?J~@7EyrX3MWRy
zGYP7Yj8tHNJP79Lp6KPvm+$+}4G!w6iu3X-$`7En^5+OpC7~pER+U8g3#b>XQGSHg
z|0@DiffS^h%3mS)?+E?}g8zx&e<8Sy;6nrl5FA7>yH-#^xrUWjX!xzD5<tGjoV5Tn
zMc6Qn<)#vV9i#rEGmJL6>G*Nb4>%Q|xYA!kx2oSp0Wie-v6HZ)*7Ty4W0wnyHjetI
zMUa?Rj)M`d3&iJH7{lrO({e8M;-r}PgbDj95%ztNCt{xO#DY)kwhH_BGXU`y?~aHZ
zlbD;Z4?8hhn1TojfyYt;dxP1rmXBm9``IZ3$e2t^86$UGnMu+_uGA!6ey)^}sTQAU
z-!hrhN4Kg0i=C(P5VuzzzGm99&YSkLx6#HTkyjIUGpk!Cvpxad=!e;wV?K;Yb=or@
zHdaN<$7~lh`Zv!&nprzwKJa$(?sD}_LB6tVT~m;ES#~MlS%-PQd9e=V>v6xW;#O|#
z!;fI>8Ai@?>{&Y)`|u}e>^XYVXkwF*LageH89DQ8h*X9Ukg14QNLBp)*_lcya{gb(
zgRsKo?~Jk3-$Y>I$wsqBBL!mKig*~ryp^Z^iWBpy%VH=~2&MU8v-L&HA*n`MG{at7
z#feAev)ki%l`$g5Sr?BgK{WassrLL&I&JK{nMgchQi@D<yfR*m^nx2XFy28_yLor}
zk*gykSC8#K;@B;g{{GIYCEWLq8u((K0aqi&s7p)B)~z<`7Kz9;(lTjzyrxJ*UNjFJ
zSY-5UoJ}0agh5P>WUA*NB)g71Nv-y=1}Y>gXuwteGk_64hHewH{fLhw`+H2$c%-7a
zd2lG38Ok=Jh&Tc-sMoXoJtGIWmss2E+fu?z4~AxVS9{=<4X~LDbq0vgC6Pc)kAUXI
zGI)|cctm}(+THlbd+?DLw;$_>9yDX;+vzJ$lt026-$w9N1g1lwAG3o9E(3r#_@l-W
z+BDrA9lQk8r2q-tr2tX(v<MP<5k$(jDB##8P6PT4Vv9L-;Kz7}|AwHvVxW2HKyb<c
zQ4rq2=Isa$Avg>`^YjfSdQ{EN?oHH)SnZt6OCAu^6)%F{#!jC^a148P_atB~atG$0
zLU0@lx%Yi<qn-uRses<aA}bVn77X74U1m&eQRrS#Wr{9DT~W10J5$umdbnwUI^sk@
zxs-PSJPt3zmNwvVh%6iHC`8u5!ZbtmDCcpovrbKiR=?AJU3~laA8fsO>0j)d4y}0e
znQKeG^1^gz*_&I(E_`LrZJ&E%;HQGyAN*-Rs9eO{5QU0Hs}th3SEyS0`m0x8g)rFB
zSM%X0oNsZ#ur#6-Lt<fHLp?wiVqT3L1jFKj0lWb5uDKZvA%GTEvc3Mw)mL(2{pc&d
z1h=XG$Izgj|K#D)1y(R&=5ApddSMch#qA1W{RiQi*GIlEGPYrAdDHmvru_1je7JSg
zJsqxj<9HzqL0%iL^-zF21?iu>xRFG6VYa}fC$ToG#V01jjnm=vIdR|Araj}E_CNw)
ze$zfk<e+@hzVYzBDY!~Ld83eK3na^~(!?!s-}N1=Y{JaJh1{k+^vWcr&3;*Rnz$D>
zT{lFV`___3XUvm}1v_{9^<{qcyRzTIx$`#&5OtLhf*#DK5S#_T$8Km?hyd*s{I2W)
z&zd_+4RCL1t>^LE0stDefen)I&knc=IcB^*N^<C78%|i>2TQI2dL%bMujC;M{=9nF
z2EK1p)GBaNqARl<e3xpv9{RNeaDc)}Ro8dm3bSvzXZWd5nYH?<KK=j>8$Xq4_cVhx
z4CZRLB+#zRs*o2c;~0d2#`>b8n}v1QSvb3qu#&^vvWF{U7Fw>1Da<WywDIl)dWi@A
zro~JieA-DRoyn@i-qi&!38_pbGT9*|rPJqFPz%8B*coLo3G1$?am(aph-vs<HuOQm
zd(*s`go1ITE@fzdSiiJD>QX8>M3yTMOPIbkjC!t-#Zb>RVK&6BwFtU2-5;7)e>_Ar
z!^J_J)ovMXLRX_Q6m7w>2IxV36Y3+6SjPFCO<%N?A6&bXU%7cw+)~6QjN%U>wZGc?
zEA>;6#_>qwRHS)4(tOijh&-0tD-|LVE_+^vPUR0Os$M^R^)xVt#b5ac|8&ju-mf=*
zv*z8Of3GeVIx@YY;kHMps=q6^ssixhH-BJe%(fq%nAm~tkjWGmI&pA|j#H7i)39OS
zi>x~JpO&wdaYHl?yjO@Azs)sV-zBoW+o);3{{y^Ua^`!5=DWjUUD2J;{8e;-6wRC)
zhTf(dzs)CPaZhGrz8&bmxMHkaeHH;bpB)ujt@a042@Nm7p1GGeb6{{!VdJDg{nj8P
z#u=n_G-lI%?vdOE$ke13X9d176?wl6Da#U15JQO!d%}o?Y14N=v<rMuQZSPTtYI%8
zw8Em!m4IAYz`Q<Z8#MnWFfw7uvl8Jk2z^os@=x&jQ8X;Qq6uW&th|}Nh{as6Ny9?T
z`Alrl_Ek5*-PEgak1N7-r1saBeQ8;4#pdrV&C@AaI~9(?LZh6x?%DwY#_^Ra`X?{0
zBjS@;LNB3Yq?b*I>x|qjuJ$DM$13p&xI*VN!$){DKm3=U)73B+pcWnw{phxx(;f&U
zz+F?1TJ}4c>zu}2Q~j2`JRZ%QW^-+xbDFiA<D6zpZw_;sF~g!c4SO%boPO9lpW>XR
zyPlFc{S&0&c5_-mF2zk`C5rh~0Dur2!A58&<6;A5pJoB5Y_LZ|<63G?o-K5q>C2y}
zvSl~Pto2&qY1A)3&-@I_#ZTuWGI`6&$2P@yrpKn(-x94*4<dHX@Uf%U-715Y^13r*
zgwR_Le0y@3UUP$hccMsAbl8<yWkAVmanC?#b0<a#6dm1+W!f!jGB@Ytf`}O_G8rpZ
zk9{YQ2qA>kkO(tga1T`%-5jzRANbEd9~TL^`LZ#Y&rx#2{Oxw;bmBkv6aV=o&Nzr(
z>iN4c%sVlYr1`ACRN2%vo=_Jd%y#y!57rLI4Y*gj%hflXO`)=N8KW;EHv!@k4-^^v
zg59f(Z^ZSy+9)&6@NJoM#K1t)C$5a4sgL=&L;Y!0O%I$Swmao-p%>-v5JZs1{5hn$
zlxj>8?=~SU#Ji2MhDn#`+o_Q(#j2G>Se-bwAt5NWm|cuu34*`GvZa_J&hFKiI)G&d
z5xj-qZ3OQiXh(1e!C?Tg5a-jzyJ$ZB;S~pVvjV~Fv=8UX%-AQoZkmV=ZSbN|S?`rP
z%3~JAmO8WTt8Rt+tLUVs%0%_@vD1a>O{2b2{_C>JLS)6S*MF(LSXnst^`>vS-tBm=
zk|_(-QBW4D1Eb#CqENN?<07@Q+BQ&zRMsF^j{pU-S!^3&yo><N2v*xh;LcK~rxEvG
zZoDT3JdL*n0MxdD4Pq-apDgzbCPBj#js3d`T4~E<8h_nF4bHHZ5zMe8d|UIgBF(3l
zQKbAa;vS-`=EJD!zVsOdZlcF%{0LLPNdyHYGQ|x*^PNp!LXDWR<QSH>BG`f;jo=p%
z{4Rn&L_o|q<om9{>{<lt0BGV~`r7ix6`aF(SM?@<+b)O0@gIc_c(Pv*{!#GHguwTO
zrGFt*{8%_RE*!jFDLBQ?*MF}5Lua+ad)Fm6t8QcJ_C{9ja6G1$LkbYaw*I}gI>)*X
z1pxPsI;tE^9|{2OwXAToekcIAcgRugX#P+DaIbBJqYew}pm4Y2@ec(6_YOK69F2Dc
I0OT9}KLTr!%K!iX

literal 0
HcmV?d00001

diff --git a/tests/__pycache__/test_compare_snapshots.cpython-314-pytest-9.0.3.pyc b/tests/__pycache__/test_compare_snapshots.cpython-314-pytest-9.0.3.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..f7f78d51c483834ef31deb1ebd4b44dc05e0ab17
GIT binary patch
literal 40162
zcmeHw33MFCbzslka{z+@2;KmO7sw%Tkl-mE3Q3S6A@P7(&@j?MYz+rPVk8{H?g2@F
zmPPL-&!8i(<Qy+>tT=p<k|pg;mf6kQr?vbxO6;|r?C}N|41w*)yN<J7uai9}(i`qF
z?<M<xRd;pupa%npq!nq=82qlPuBz^-`StIr-c(r;5a2leucp)Iw+TWLGsfZ86L-5D
zf^bEUgsgB{kQ^P3tdpEwN8Llt2H~hD>usP{d|4m4B4$N6J3IVG1KEInEtm~LnX4mo
zv?5z^v@%<HG@K1L2rmRXqs9%*v*cbPz~hi38!1u8!_}!SQOC>Gsi_rK36gJ#Ac@<Y
zdf$sknIFmmtgM!l1)(g&$`+Hd3Mi{&WlKm|7|N<x*-}y#fwF2=wv3e3K-nTzwp?<o
z5n{DN?eHAW4y3cuY)Z|l(X)d}R81=BOjd184)$jfN=jA-5*f93Fsrs?hNC~c@~hFz
z;Kh`ZNoP{gv*}COAtj}@oQOFzcV{Bo8*^zsy`dK9NuNC{_obm@Ev%#ldQytqpHN=z
z8N4`P`JorVL%87o?m+<fLrV_HDY+zfiy%c#IwTLAtKsZ}a}AtD$t(F=oKgVtiy$AA
zLQ;iPDTSq~)&PDj&37TCsOiCh`<^W=+grA16~>p4dlK2yNT6+V+m7bVTi~Mw)uA)+
z#QlkZ9#speDFvF!XZsT8)cfA%=H66aMyolK8c6o`!=uZ}&;Y%t`TGZZ%zBxjzCKM%
z4P1~fBotMv#CCEvbtx<NCe&WdpUKFHGs!J&TeT|v7NiEd*poWDZTk-XPS)$^deb|1
zJr;9oe)cR{00+7+m4)xAx!`FuFYP+!Qi3p$_r>OB9Q@P(ev!<elD**`@i#a3D8tS0
zHAdia>Jk>S+Ji&c%uqJw(W*L6o;oabc61(=k99oLb@+s~*ep4I@{oM&Wcz`xj*};}
zO0&H4q|~L=nE9^5#||Gq+$BB7H-5JB(1EVQa{JN4?N8khlr{LP!@r;%X?+%+UTr;a
zeCyV>T{~NqRAx|Z%|OxMK%%de;an?0R03r?4Ap8`Rff6pg)K@W+@uQr)#CuJ2)Dh0
zzxs`x)8dk`mD6JF#FF-Daq+~`UDIOSM8k<`vF455Yhtc8HZ4})5xlj5+m(WU+1RFO
zarxL&P-pD&?NyPG_qGu6c$Kx#V-iRdI}n!%K37BHiqI;=g?0yGb*rNtr=3&r!Ue?5
z9W9&57{nap0afg!QCSC2Gp8B%J=)}fK{?r*7&w<wl^9lrf3+6C72yZLUAf9Nx!|sA
z&)xKmL&m*}J{nwQ2b*g9p{Qu8Rq0a=ryNc-oN_SLS{yLh=)?<{Q;kftMdXVp8=x;m
z1Yk_8Hkeq7A4`$C6Z}#_n5sY!Mu5MC7Jz9%zfF&VW2Mv}z-LtOJH<T8VoWbVuoS^E
z0GbF>ES)&hmx{S**URzJ3IO+m&CM4Fm6z2_BAHTFLJ4$Hk5?N2Xb}@RPaHla#}7zK
z6fdqufT&0T{+{$VSZ#+(ZSuu*wwL`1tx$Ut{Hsp_utBVo1hI~Ai1o(vR;+3&jaASk
zI}8lFdkBgWaH|)DEMOHd!^2tEVqp;QYl)C`OHP0u$pz4hY%J@OfKg@PhXm-CeAz%;
z$Oa`5@X)VSbOG5v1Z4UcQfUhk``|8s#Nyp7@Tx09w{d$yo?D!N5rLBqgP&v^afjq;
z!XH9EGET|a;yB+HckMbV2<H#2*UQfh3&KjFTjzg*(CIc>m}lUU!MJ;?LkgW*v(>px
zuOYd)Rycu*j#Wb3xlMmc$y2tj%c$GxY~p&$c!0V1;+|HArPSMv=u8f-XCk{8<@5|s
z;Wc_T&b=^?_Bb-mJr1QE#>sCTrxsyhlyL0$Q9|^*QK2~!n&XV-NNS!$Pfw~xb7h9N
zAlP=lGNA&y$VS&~$PDj@saUw<gyvIH{eu@$J-`7`dQ-L|*a6^%<Gyp>z8j8_YHYA2
zrbhSeBW<_E)Eiy}iM1BkpBYBxA}16rA}14leKIg1#gJzFvYI%X!V<0W0J%Bv-NTA9
zsAx4Z$W8r;tPK3LFENlnj(o$Xxz$wPS<TU-1)*n|KJaEfvz5=Z(G2ZrJD=I9;#_Qu
zl7kYaD*B)}C~`WR>Q}XT%S>)5zWxOCp#A}XE5Zk%#bd6qXWkfj>*w;Jt)q_VaMc@2
zzBrN-SC1vfp2gF%<Kfj)qW;N?t4Bv@u3#o7u^OwxCnm(z*yFM<ekLcb8dC@u53iaM
z^-o@0HToHvE11bitjp@~3Ai$o!<HmYlq?~yZE?;<oE9b>-~t@{q?<{a7D%`q2}k0j
zY=yy7_9GxuYsL(%CNof{NBSI%+RRZ)ji;bLbC&+{tJiC;C$9&rv$SDM%83BR!wplS
z{>h6CI7cy8Fq4y5jn&~36Ji6Kqie6Z#)fj@+OeVW@Y*R+|K!EBI7=~CFq4y5jn&~3
zaAlTRdcjtNKrL_fS^7Zu7a$@;@c#!9LJ}T8)cVwp6OnO4MUsHB6X)zM1dk!ujbIOe
z6Utsp?nCf%2=*hepWG|R<UTV9Y5);TWH26pus~!FEoL*z?W=ae9n^0C;F$8Y_Ukp*
zcIQJakCZY0EGE5TKj~+(X6Hkbhy7&A2P{+G#mVcOoDZW;4vW@MUc)G@HGtmm(6t61
zr!|NRqf|n-VxuJaK&cIK6aHb$^)Q+1rrAZSvzg!K<!1q_)PD(}%$$DMZ2ZxS+AkH&
z=N6$wu!z{gL&H!Xna84K9y{hSkDX=fmY&C8c7Evd*u%|Z@4_gRn8$3CBo7*=9tx+X
zigKzylO5JQ5q63)cl~*szrSb9-#3)8wtT3b<Heu6d3&j7-cscl6y;!%{myO0OmxAt
zI6ty&Dn#aRg=G$xx5}9oJnsX{VV@*E^f~P3=5U~Bq#O?*et&AmN%F%iuGAbO979H1
zT$y<dw!0Uw7PH;WO(d@+Y#Mx#Lw#8}t;#Amw!mVz#)erJSCVncziUi+d)wIhvE;R_
zW6$Tr^<&SEhu2Su`X?{0N6i~^1v5E`)mR-qF(IyhM4C78U7U!8G*OlZ68$Mz)&jB&
zZo#2GOowFo{7|A#zY><^vuQ=m_N50>AiK!Q2^{jL5p*Fqg#byRavFeEE6ZvY%$i9#
zk<BXUGea=g&}T%JlYL;<>`5oH$rRX2<r@yIf-8h(XprAejF!q4><__V_*c<s^nX4N
zV$vO_%d`4Uz~x!T0LiYthh?_~0K~LFnkJzYI}De^T~y~R9+7l8k4RPoFNk0A0*d;y
zMTjKr)ZKkzu${Wsl0Y`u!R(Fu;hwxR<Wz)-K+d>RvWh@1$#K3t?tW4@|Ll6bt2w$q
zzySg75AoDC&iyeDp++jN^tcVnR+0Myd`6Nd?k#eE_~zmM@EJWDXRtAPfq1&W{n3RZ
ze#5T?!SQW)(4Mf>#sQO@X_dFwr&Z2kk3Wub0Kq{7?FbGbK-{_^Dn~Hg2tf1F>8^BO
z3Hs<1w6ZD35TGwuMaN~M#k#(p(2{gdY5-6^(Z~F+DmwEy53IJ=4sodMy?pDJ@a8W9
z08JsXG`FlJA9-TbI~}flqrVVdn-iO_dngDuPl@^`FE;1UN{873m!8DhtQMbuE7UND
zJ`Uq3jm|7;B;$&^iqP2&=-d_e06L$YH#&O>Iv<`FIx`fV13G&QWGg~vA3<kd5ju<W
zKxfhD**NRy>;`mBAv!BB!>}qD05|+5-VyJ-qTr>Hn1?RKMl0$y64cY9SLD9LnN*)V
zIM6p-jCp%XV_w<D1900S#C!T@jd(ppLg^_E@g(7VyX4?SEJQoB*3BF7#5f|J|J0`s
z@q7zo1Zrg2$r%eMNbIyqV^+{`6I+%;;#dgZ8L;r30fX<5Nv>SL>0>i>8!S_o-UlU7
zjASCR=(h56c4jN2AnNY}Fu4Sotc!DETW-~s!typuEN>eRw@r!qCoi^*UZlB#nVcl`
zSS3C&A+}A2A8L<qGs<>srKp4RlA^#@3sMvbBbl!p1twXT|2~TxRo;-qj6+g+nTs*0
zBF5vz_{E1VN1=&?%28+{5w#Eo5E_D%JyM$v4P;TudBmrgBF`Fvyr2s39m*GbQv))S
zWVBtS5qS2N7xAVq0x*$S7j*^-;dME2)Aecs#>1PYME#Q&H|4_XXtuzmC$ToG#V6nj
zRTS31old~a$2%$s1ZNPS?x3g$@OhNaBKU_0dJv=#oCUzEENLu6fd48+lIbdo)6;TC
zB*5j_dN1JgG~E^e(EDR$ycs(H-N|tm<xh*Ea;2Q2!iR1_Iv|PJAgC@OqFo2H#oSMF
z3c}J1<z+$I(}!FTG7nYS1G{7&blqh?+4|v<GKgS?Jcx0E^OpyyS%cG-<g7B3(wgjl
zcB*<5*Zv&bxoGx1!^?Y3*WEc0LAYs3)IWK#i6|PFEpX{ctjKEd3Ai$gqJiOq7QJ~^
zc~7#q1g(LEA6XXk6In1|kp;^;{1|<oLr7t1B?LnXAGQ*LA%#>4!C20q(gZ&<#Dqh9
z`?*0S4e`N##JJKfu*-P)6$FGad>&GEVog2a4AjkShRVx5scb5V7PjrPp<>BqzleA1
z1z>Unf|JW~V#l>(g}N;_n+tXO-(OOw>wuD6UB`I1V@lLNd9eeHZkQ{W$w^X=RpJwH
zX#qENCR8M+_(-_xqsGl<M6+K)fFZLFj+9i^*0IZ6vSDK7jyYhZO}ne`barUDGAACt
z_L)L-+s)I3=%M#d6{5$XBo{qC9zH%L>Yu!LeDoEXE11biQjb;Q6L4t(Ek91QtYm0O
z7ABAYAluNOdC^KEq|aC&WMbv4w6bKgFP1>cB{}iPwWh*~)|<h?ioNeXS6FcbN^&cX
zjE9d*iTWom9vQtva|JUwN$Rmmd;%^lAmzu2lr0P?$wHY2X5chfjnYbeftrbtZRP1?
zahoq8I->Eqh;^^di6^gj7aDiJySvc%#QPTujVGZb*LZR~d~!<EKY1v@;Bw3sxb!5c
z$*S=QxU_(fA16YtvLfUIQ^`6aQ5xi~7`-&!Ovb6SRJSSB>eosjCHPUEx&E2LhQ04T
zU)XT;d&>$No`I6whG)jZ&rFH>Cl4j)Rl#h5OHY!TtQwzyOEZx&2oC{@w|EzQf~B;b
znQoPCrmV-Awvq9i7S5;Q-d(={R_}|<-SQ){c*+g;AxEceK%?Z3`@rfII2GsIEf8zn
zjb<O(4yCZ7V-;KQjF$Fu@T0>rE%Q#ee6Q$O#VzA9oFm4Q_P}yHOM7IsMTcGc<7DM8
zcVF9f<~YHkF!LGh>oTnjG`Mng+0w06w`KVkt~mC^#UeM7zdK@lC9Y>&$XIlMrP^<d
zka5;mUVsLd0jr*JfkZ0@mCr#_T+OsubM>WQU2kT%jRY!VYNut{(_?hm(_^^y+VObI
zG17`_n_xjx;If{G(lt(-W9kMhX^W|`z$?+mi8*^GW-vroP~Jpv0Kq}Lc?ef4of%5^
zWzz$y=It8<7pST&m0=C|P#=alXB7Ed-{2W=jAArFk?$2cJ%U}K?^R(o4}PK37UG5F
zOLp)X%hIP^^l9j#s4bgS#9QVui_*1F%LqB)?3N~X+dLb0vup8X=wC%(<!v>~###zB
zv7FfQnwqPL<-;2xdHrbu#=|XBqW;N?ExGVUmSu_8RF<5;K4|V1)UJuq^d#33($}A6
z4fq7KAXG<>^{BA5aE{{0zlPv-1iy>`$)hrc;A;qa5ZD?#Q7=~zT!DYJ4FEHEHlxAw
zNe99c1Rf=@lfW*=Jt%KQBWNpqMC`=g2#UR0jG%9oHiBk-VC)o0K%m!R>^w9K$d^t&
zl^Ry<BQ-{Ws#<6;7pVar#<n64BX}5yhjG3h20!sI1S}qg@?Hbe!|?YvQp2|}MnJb`
zk7f}U#;EKVVT@If+I@%x$X3Bd@q+FSP^4;~hYL3Ts&$0ubIbEHsbu;r1gO0X1i@qg
ze1Hx|F{mtAuJzk^Yo~)}2E=PsmlL;N4;5BzhjVV#_VMucDN+CA#qFb?rMZHcoFw&F
zB|b4BZlA_rpS?s#g>!Dh-tq9>DN+CAp#()!%oe!xB&o@&@rem>?{s)Mc!jTZ7wU<3
zxPFFr__FC8)|2QRt~XuCymxqZU+#=Zj`DOChIHN$aS+f;A~`;N5pni(c43T)q6T9D
ztp@kENhe`TqHIFR(#?0MRoRZFXu<PCDP@>egAD+@1B2OUdH@9F#V8HqCIGa=8s1TY
z;83L%+}yCCPNE-oKcb{2k;$ZB!vJ1sok3_ywYq@>=Jx@Z(k3A=Ko9oc+*@ec59eId
z{_*hsDN+CAp#<pxW(!<;lGJ3?_{4;`e>w~X>|NLQ7S`^9b8hXf@$jxGQUBz{U1+w(
zT)|9El6tHXpMXnL_eJf&IDC)*iA%iu9U^zZo;R@9O~y&jbVsKaC+>ffahY3*oLa-8
zXWbx^brpH~K>sB&nW_H{&uR0J5Yc}tEc$PGPam%*vTtUuVVhfg6nRrh>51ryBL}yr
z!Bz(^sV5R0G48gGkTpQFXk!r%U0+SC2uCeegt?7kB^kx=r*agn3phMd5Jw3DTjz^u
zRb-4JpT037)`)7Y5(ynH5};Ic#Mj)MP=^PSN*!QxY0^s_e0@--OEKj+GZM)fCc&Ew
zG}mAs?DH~^x>zPwf?5LTo+we>60ng7h0qpuZy{drVL3e@W8U2U&2U>E;7kKE3HDsN
z_&xY~>TV()PFJqaMH+LJ>qlMFl@duxxedGCeeC_0a=V`%uarhz5aK;nlaH*%z>9{Q
zxbu2bVa-lB=ho~T5AU23^-ms3aAOC|7P#~zsmZGGi3xEh295U>!fSGCw-v(MZ=NfJ
zAJ2);z5m$vUdkPO4pIQe!_Q5L`X>)1;m2vVz@;ZiO;(LhOo-2!k?9XNU_>`&_-&0D
z{|xaAm(wcWL{Qpr@w<2#!CUaJE(4$&F5I52cS0`DWA_4HPxEa70JTqG-6Z_81Aa+z
z+<hEQ7W>3|rR@_ClEwDd%KE`p5g?0@MXeg~OCp;d9yj(pWLyPq!1!ew;g=jw<m6}0
zGRzjnWgsm7{Gqsua7NQw0b+#3-fC|dHl*lw-ZISDE}4ax4h2Hc@0e8@mjre*zSU`K
z6UL2~@WAIg2V}zXRQ48HW({H1<0VDy?4OIZ1FNyCh!dAu#}XkA2Y~z5_7>X`n!j>b
z@{#ekO6YSN{{Ycqf~OY7|3StdEefHL`V)iEGpXLhh4i43=!??OX*FsDCXoO=w3=_#
zoc%o(%lUR{Ip2O_q~bs_3!8OC2U026N{jF+o6zsAF;&66vr4EAaQTLAN_Rso)09q4
z<4BN{w-LO9;1Ght0Al<qB{%Mss{Aot>p<`n0Dcd!ZG2{jjX`7y<$Y{-NVz|ys)=(c
zZR1QrM9m+dmFQz;)I}1j765=g0^#6Gn)2a8qwWtXR*rS$D^`y>r^Bsa^0*1s1dGKZ
z7j9)H50+*|j$7D*<-p#-<ybK!h$W;xCvLcQW<0!MO4L7jal`1VG*>W_?D8$F&vFx%
z94m&zq_~0VEI@79QJMyG(TN-lX7nb5+RC%K#n@a7H8&bytV!vb7Y#PGlSe~?8I7MO
z4QB0ZXmF{;S97PqCDwN+aiGBq<8R^3KjZO78XOoxkM|FM^R=i%_dcRQ(SHPml$3o7
zQ{M(~VhA<hAAa@Mq6cu#LaG$}8@&1*0G4%g#Ao<jykw<@%J;DBPXO3OsnQ@9gPx@a
zl6^xxDLIR~#Hw0LDH3R3AMdN?0hna)X)757Ys%_t&f;AX!H9x;CgLuMdXnvncnj;Z
z9Bh%u<ybK!$mWS)yN!+k5sXfW`X?_&N5M{uxq_Kwmv3QxmYcBTSTQ6f#po<V@ShV^
zh7&{|B@y(IU~KW!0ud}P2$d#+I0^kD;{N1dCfzrfEj|5;CY<u`OH8A+M2aY$7JBy}
zCcuJd*lc{~T<23!L!80t&}<V6!oTOVwISQg@RntdL)h1_#Eyrs7vciy!^p#i%l0}L
z<Kv$Y{!dXqauoL2hj$lT${O<jgU<o-Dg=HVoUFo12f%wd16v8e6wtPo!hb%bq^J>@
zak%cRBvXO-$(gb*36?}r7=&MzW`ga4^h;3M0*d0;=4OHTq+$Pp^b5Z^Z<+cyq+hbK
zd=`4M0iJQLjCV0%yv8DRuv+(~67aqhx|yiej7YWj8C56XZt6IIk^}}8c&{8=eHCQW
zmGqMrSK>Nx%oWTeyL=0)v)qIw$BH2VSIFw|N7DJExRTmy*T7dh0f8hh!nt@+@1J7X
ze?Wi(piCl|LePUCh2Sgzer4|;Vj+U}@B((u?8UJ=A-8808jYj4BT?*L!0oBKEdZcT
zf~}J9&kkleMmMy@a{T>rmSf94L?ZH);|b7S+^lawU{S??>cStFyx>U4xM8;;XA@r2
zkBkROT$U18{oV;}iVx26X=^2pJB%1r<J<r*HF#(}xjLCQ)O<42s*D@9bXOQx;>_;B
zm9Z$@7S}fY`!xvNOs?syGFqEwh&5(bUgKNsambD#=a5Tgk<S^}c(SwBY-OYjn|1?i
zUW<R`U4P!!x!9;>p3jeVE;VyTD&vQk?i=v{*~#ENL(V$)ePZigZq({rX{5|Eybz-z
z9)$Rp%2U6=S&bkjxf|D{lcO`LC%BU>FEsD8nyacO`DiZV345qD-fXva_I5yvVFSMI
za`l;7Bl*kLWzo}8plscM@%t9VaEI{aHSthU40lDh@ihgmXC&Q42aHUG(X(-e7;Xo|
zZ{tc_*d9>%2EJ4)3U7lkx;*E^-!=^|DXSA2$lqbdvE_SQbwb*4Bm5J*!-@MMcsyHP
zg4Z0~7r|9YQkpxVoV##;k=+Z9l&?T5&6T>8RDKgubQkNdV(PaLTtl!A0NAmQln4li
zKyVr(4hb_xyyZfoZzvUbr6oDo11IAR84xIbqgIQ|coZ#gQGr)a$S8bkZhU^t(=*hc
zQ8k~Mg3aQxisn*>;msT>q`dUi8n78xBCUc&Ch*KK#L@I0zLbWx{Xp?F54pSM#+!2%
z^tbTqyp7-;1nme8As`m?N;B466SMspIg`ltYQg@&0SE(xbh1}-CRGhb81}pCOKCX5
zB&GZiJNaz{Pa^mo1pfrVbp$s6s7O#C*j(Ql3|-AM;Cv<F)%euhUSRO<k91a*H*4z*
zB2M{qiE94|Z%{`pE`KIAPS>m$d#O;fVN~Q&V%3zmVq9GD=Aqwu@;9E$t>2qpxo=W@
ze7Z#W55yY1e*3k>xsCh3z2^PiZ#7Ro-IaUxh5XZ}b1`{ReDQ;dn%7_W!V7Qio~me^
ztZ2NxW;#^)`jM+gUhBB$5-QjKAYA?W@YP|kZoU55tDi+9SA>9KOBaMVqNR)fj6zVm
zUI0ccBL{Y`(P4T4-WY<Rkyr<k*CMPspMd)JJn$g!c)5zk`*+d9_{Xi0BN5McBf%r9
z{YeiL7>7M$^uPieD`WIRiIp*e_35FpGv7z*iMewPQUWa2Juk+{m>|a(nalE_Ge&S6
z&yz8Vwv6%1wu~`w+Hw9H@gQN0|BeyQxiZEOVT@mY<cyIqEaM61$QW6>IWk6**_CIE
zjM>eBF$N7>D`JclgfUhWF~-VyFvd!wXXC6hM%*(u0F3e9&WAB7AHW1x{tJLu*re}t
zEzupkbQi%-5&Ulie~n-c<U9=Zkett;=X8e)La6ySyXh2ti?-f|qT5ycOSr*9qUjy^
zl}}EJPkkC`y7GTvn3B9&!sz%2lrja!1+OEr(s4IXNWLBPgNMZ2vOq%}lG~yJdF)jn
ziK!LP#@Wep722uL%~T^?`e*JJX$He^Wvn*~-7OO+V=64htg%r@fOmC9^he@OvnV9q
zPNwLX4bETeTx8~qR7O1QJU<rq6T15~gR1EY2~%tAC^jf0;dlV(Zq=!)9NiTyqP(pl
zV>~$*9%SB$DKo|s5+e`ebjB0vbk}SbHR~HG5Z75dpu2vckLBt!?kNS!)@3wZ3YD$P
z=y?&{4dP2{<G~`j8|q$Td<U-QwMLnFhHn@$FvmFSbQj-<0ZNH-V?J~@7EyrX3MWRy
zGYP7Yj8tHNJP79Lp6KPvm+$+}4G!w6iu3X-$`7En^5+OpC7~pER+U8g3#b>XQGSHg
z|0@DiffS^h%3mS)?+E?}g8zx&e<8Sy;6nrl5FA7>yH-#^xrUWjX!xzD5<tGjoV5Tn
zMc6Qn<)#vV9i#rEGmJL6>G*Nb4>%Q|xYA!kx2oSp0Wie-v6HZ)*7Ty4W0wnyHjetI
zMUa?Rj)M`d3&iJH7{lrO({e8M;-r}PgbDj95%ztNCt{xO#DY)kwhH_BGXU`y?~aHZ
zlbD;Z4?8hhn1TojfyYt;dxP1rmXBm9``IZ3$e2t^86$UGnMu+_uGA!6ey)^}sTQAU
z-!hrhN4Kg0i=C(P5VuzzzGm99&YSkLx6#HTkyjIUGpk!Cvpxad=!e;wV?K;Yb=or@
zHdaN<$7~lh`Zv!&nprzwKJa$(?sD}_LB6tVT~m;ES#~MlS%-PQd9e=V>v6xW;#O|#
z!;fI>8Ai@?>{&Y)`|u}e>^XYVXkwF*LageH89DQ8h*X9Ukg14QNLBp)*_lcya{gb(
zgRsKo?~Jk3-$Y>I$wsqBBL!mKig*~ryp^Z^iWBpy%VH=~2&MU8v-L&HA*n`MG{at7
z#feAev)ki%l`$g5Sr?BgK{WassrLL&I&JK{nMgchQi@D<yfR*m^nx2XFy28_yLor}
zk*gykSC8#K;@B;g{{GIYCEWLq8u((K0aqi&s7p)B)~z<`7Kz9;(lTjzyrxJ*UNjFJ
zSY-5UoJ}0agh5P>WUA*NB)g71Nv-y=1}Y>gXuwteGk_64hHewH{fLhw`+H2$c%-7a
zd2lG38Ok=Jh&Tc-sMoXoJtGIWmss2E+fu?z4~AxVS9{=<4X~LDbq0vgC6Pc)kAUXI
zGI)|cctm}(+THlbd+?DLw;$_>9yDX;+vzJ$lt026-$w9N1g1lwAG3o9E(3r#_@l-W
z+BDrA9lQk8r2q-tr2tX(v<MP<5k$(jDB##8P6PT4Vv9L-;Kz7}|AwHvVxW2HKyb<c
zQ4rq2=Isa$Avg>`^YjfSdQ{EN?oHH)SnZt6OCAu^6)%F{#!jC^a148P_atB~atG$0
zLU0@lx%Yi<qn-uRses<aA}bVn77X74U1m&eQRrS#Wr{9DT~W10J5$umdbnwUI^sk@
zxs-PSJPt3zmNwvVh%6iHC`8u5!ZbtmDCcpovrbKiR=?AJU3~laA8fsO>0j)d4y}0e
znQKeG^1^gz*_&I(E_`LrZJ&E%;HQGyAN*-Rs9eO{5QU0Hs}th3SEyS0`m0x8g)rFB
zSM%X0oNsZ#ur#6-Lt<fHLp?wiVqT3L1jFKj0lWb5uDKZvA%GTEvc3Mw)mL(2{pc&d
z1h=XG$Izgj|K#D)1y(R&=5ApddSMch#qA1W{RiQi*GIlEGPYrAdDHmvru_1je7JSg
zJsqxj<9HzqL0%iL^-zF21?iu>xRFG6VYa}fC$ToG#V01jjnm=vIdR|Araj}E_CNw)
ze$zfk<e+@hzVYzBDY!~Ld83eK3na^~(!?!s-}N1=Y{JaJh1{k+^vWcr&3;*Rnz$D>
zT{lFV`___3XUvm}1v_{9^<{qcyRzTIx$`#&5OtLhf*#DK5S#_T$8Km?hyd*s{I2W)
z&zd_+4RCL1t>^LE0stDefen)I&knc=IcB^*N^<C78%|i>2TQI2dL%bMujC;M{=9nF
z2EK1p)GBaNqARl<e3xpv9{RNeaDc)}Ro8dm3bSvzXZWd5nYH?<KK=j>8$Xq4_cVhx
z4CZRLB+#zRs*o2c;~0d2#`>b8n}v1QSvb3qu#&^vvWF{U7Fw>1Da<WywDIl)dWi@A
zro~JieA-DRoyn@i-qi&!38_pbGT9*|rPJqFPz%8B*coLo3G1$?am(aph-vs<HuOQm
zd(*s`go1ITE@fzdSiiJD>QX8>M3yTMOPIbkjC!t-#Zb>RVK&6BwFtU2-5;7)e>_Ar
z!^J_J)ovMXLRX_Q6m7w>2IxV36Y3+6SjPFCO<%N?A6&bXU%7cw+)~6QjN%U>wZGc?
zEA>;6#_>qwRHS)4(tOijh&-0tD-|LVE_+^vPUR0Os$M^R^)xVt#b5ac|8&ju-mf=*
zv*z8Of3GeVIx@YY;kHMps=q6^ssixhH-BJe%(fq%nAm~tkjWGmI&pA|j#H7i)39OS
zi>x~JpO&wdaYHl?yjO@Azs)sV-zBoW+o);3{{y^Ua^`!5=DWjUUD2J;{8e;-6wRC)
zhTf(dzs)CPaZhGrz8&bmxMHkaeHH;bpB)ujt@a042@Nm7p1GGeb6{{!VdJDg{nj8P
z#u=n_G-lI%?vdOE$ke13X9d176?wl6Da#U15JQO!d%}o?Y14N=v<rMuQZSPTtYI%8
zw8Em!m4IAYz`Q<Z8#MnWFfw7uvl8Jk2z^os@=x&jQ8X;Qq6uW&th|}Nh{as6Ny9?T
z`Alrl_Ek5*-PEgak1N7-r1saBeQ8;4#pdrV&C@AaI~9(?LZh6x?%DwY#_^Ra`X?{0
zBjS@;LNB3Yq?b*I>x|qjuJ$DM$13p&xI*VN!$){DKm3=U)73B+pcWnw{phxx(;f&U
zz+F?1TJ}4c>zu}2Q~j2`JRZ%QW^-+xbDFiA<D6zpZw_;sF~g!c4SO%boPO9lpW>XR
zyPlFc{S&0&c5_-mF2zk`C5rh~0Dur2!A58&<6;A5pJoB5Y_LZ|<63G?o-K5q>C2y}
zvSl~Pto2&qY1A)3&-@I_#ZTuWGI`6&$2P@yrpKn(-x94*4<dHX@Uf%U-715Y^13r*
zgwR_Le0y@3UUP$hccMsAbl8<yWkAVmanC?#b0<a#6dm1+W!f!jGB@Ytf`}O_G8rpZ
zk9{YQ2qA>kkO(tga1T`%-5jzRANbEd9~TL^`LZ#Y&rx#2{Oxw;bmBkv6aV=o&Nzr(
z>iN4c%sVlYr1`ACRN2%vo=_Jd%y#y!57rLI4Y*gj%hflXO`)=N8KW;EHv!@k4-^^v
zg59f(Z^ZSy+9)&6@NJoM#K1t)C$5a4sgL=&L;Y!0O%I$Swmao-p%>-v5JZs1{5hn$
zlxj>8?=~SU#Ji2MhDn#`+o_Q(#j2G>Se-bwAt5NWm|cuu34*`GvZa_J&hFKiI)G&d
z5xj-qZ3OQiXh(1e!C?Tg5a-jzyJ$ZB;S~pVvjV~Fv=8UX%-AQoZkmV=ZSbN|S?`rP
z%3~JAmO8WTt8Rt+tLUVs%0%_@vD1a>O{2b2{_C>JLS)6S*MF(LSXnst^`>vS-tBm=
zk|_(-QBW4D1Eb#CqENN?<07@Q+BQ&zRMsF^j{pU-S!^3&yo><N2v*xh;LcK~rxEvG
zZoDT3JdL*n0MxdD4Pq-apDgzbCPBj#js3d`T4~E<8h_nF4bHHZ5zMe8d|UIgBF(3l
zQKbAa;vS-`=EJD!zVsOdZlcF%{0LLPNdyHYGQ|x*^PNp!LXDWR<QSH>BG`f;jo=p%
z{4Rn&L_o|q<om9{>{<lt0BGV~`r7ix6`aF(SM?@<+b)O0@gIc_c(Pv*{!#GHguwTO
zrGFt*{8%_RE*!jFDLBQ?*MF}5Lua+ad)Fm6t8QcJ_C{9ja6G1$LkbYaw*I}gI>)*X
z1pxPsI;tE^9|{2OwXAToekcIAcgRugX#P+DaIbBJqYew}pm4Y2@ec(6_YOK69F2Dc
I0OT9}KLTr!%K!iX

literal 0
HcmV?d00001

diff --git a/tests/conftest.py b/tests/conftest.py
new file mode 100644
index 0000000..e78bfcf
--- /dev/null
+++ b/tests/conftest.py
@@ -0,0 +1,5 @@
+"""pytest configuration — adds scripts/ to sys.path for imports."""
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent / "scripts"))
diff --git a/tests/requirements.txt b/tests/requirements.txt
new file mode 100644
index 0000000..661d893
--- /dev/null
+++ b/tests/requirements.txt
@@ -0,0 +1,2 @@
+pytest>=8.0
+pytest-cov>=5.0
diff --git a/tests/test_compare_snapshots.py b/tests/test_compare_snapshots.py
new file mode 100644
index 0000000..5575b6d
--- /dev/null
+++ b/tests/test_compare_snapshots.py
@@ -0,0 +1,317 @@
+"""Unit tests for scripts/compare_snapshots.py — powerpipe fixtures."""
+
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+from compare_snapshots import compare, diff_lists, render_markdown
+
+
+# ---------------------------------------------------------------------------
+# Fixtures — powerpipe-specific
+# ---------------------------------------------------------------------------
+
+@pytest.fixture
+def powerpipe_snapshot_v1():
+    return {
+        "version": "1.5.1",
+        "snapshot_date": "2026-01-01",
+        "subcommands": ["benchmark", "completion", "mod", "server"],
+        "server_flags": ["--help", "--listen", "--port"],
+        "benchmark_run_flags": ["--dry-run", "--export", "--help", "--output"],
+        "mod_flags": ["--help", "--pull"],
+        "env_vars": [
+            "POWERPIPE_LISTEN",
+            "POWERPIPE_MOD_LOCATION",
+            "POWERPIPE_PORT",
+            "POWERPIPE_TELEMETRY",
+            "POWERPIPE_UPDATE_CHECK",
+        ],
+        "help_text_hash": "pp_abc123",
+        "server_help_hash": "pp_def456",
+        "benchmark_help_hash": "pp_ghi789",
+    }
+
+
+@pytest.fixture
+def powerpipe_snapshot_v2_no_changes(powerpipe_snapshot_v1):
+    return {**powerpipe_snapshot_v1, "version": "1.6.0"}
+
+
+@pytest.fixture
+def powerpipe_snapshot_v2_with_changes():
+    return {
+        "version": "1.6.0",
+        "snapshot_date": "2026-02-01",
+        "subcommands": ["benchmark", "completion", "mod", "server", "variable"],
+        "server_flags": ["--help", "--listen", "--port", "--workspace"],
+        "benchmark_run_flags": ["--dry-run", "--export", "--help", "--output"],
+        "mod_flags": ["--help"],
+        "env_vars": [
+            "POWERPIPE_LISTEN",
+            "POWERPIPE_MOD_LOCATION",
+            "POWERPIPE_NEW_VAR",
+            "POWERPIPE_PORT",
+            "POWERPIPE_UPDATE_CHECK",
+        ],
+        "help_text_hash": "pp_changed",
+        "server_help_hash": "pp_def456",
+        "benchmark_help_hash": "pp_ghi789",
+    }
+
+
+# ---------------------------------------------------------------------------
+# diff_lists
+# ---------------------------------------------------------------------------
+
+class TestDiffLists:
+    def test_added_items(self):
+        d = diff_lists(["a", "b"], ["a", "b", "c"])
+        assert d["added"] == ["c"]
+        assert d["removed"] == []
+
+    def test_removed_items(self):
+        d = diff_lists(["a", "b", "c"], ["a", "b"])
+        assert d["added"] == []
+        assert d["removed"] == ["c"]
+
+    def test_both_added_and_removed(self):
+        d = diff_lists(["a", "b"], ["b", "c"])
+        assert d["added"] == ["c"]
+        assert d["removed"] == ["a"]
+
+    def test_no_changes(self):
+        d = diff_lists(["a", "b"], ["a", "b"])
+        assert d["added"] == []
+        assert d["removed"] == []
+
+    def test_empty_lists(self):
+        d = diff_lists([], [])
+        assert d["added"] == []
+        assert d["removed"] == []
+
+    def test_result_is_sorted(self):
+        d = diff_lists(["z", "a"], ["z", "b", "c"])
+        assert d["added"] == ["b", "c"]
+        assert d["removed"] == ["a"]
+
+
+# ---------------------------------------------------------------------------
+# compare — no changes
+# ---------------------------------------------------------------------------
+
+class TestCompareNoChanges:
+    def test_identical_snapshots_has_no_changes(self, powerpipe_snapshot_v1):
+        result = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v1)
+        assert result["has_changes"] is False
+
+    def test_version_label_only_has_no_changes(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_no_changes):
+        result = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v2_no_changes)
+        assert result["has_changes"] is False
+
+    def test_version_change_is_reported(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_no_changes):
+        result = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v2_no_changes)
+        assert "1.5.1" in result["version_change"]
+        assert "1.6.0" in result["version_change"]
+
+    def test_no_hash_changes_when_identical(self, powerpipe_snapshot_v1):
+        result = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v1)
+        assert result["hash_changes"] == []
+
+
+# ---------------------------------------------------------------------------
+# compare — with behavioral changes
+# ---------------------------------------------------------------------------
+
+class TestCompareWithChanges:
+    def test_has_changes_true(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes):
+        result = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes)
+        assert result["has_changes"] is True
+
+    def test_added_subcommand_detected(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes):
+        result = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes)
+        assert "variable" in result["categories"]["subcommands"]["added"]
+
+    def test_added_server_flag_detected(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes):
+        result = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes)
+        assert "--workspace" in result["categories"]["server_flags"]["added"]
+
+    def test_removed_mod_flag_detected(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes):
+        result = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes)
+        assert "--pull" in result["categories"]["mod_flags"]["removed"]
+
+    def test_added_env_var_detected(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes):
+        result = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes)
+        assert "POWERPIPE_NEW_VAR" in result["categories"]["env_vars"]["added"]
+
+    def test_removed_env_var_detected(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes):
+        result = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes)
+        assert "POWERPIPE_TELEMETRY" in result["categories"]["env_vars"]["removed"]
+
+    def test_hash_change_detected(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes):
+        result = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes)
+        assert len(result["hash_changes"]) > 0
+
+
+# ---------------------------------------------------------------------------
+# compare — dynamic key detection
+# ---------------------------------------------------------------------------
+
+class TestCompareDynamicKeys:
+    def test_powerpipe_specific_keys_detected(self, powerpipe_snapshot_v1):
+        result = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v1)
+        assert "server_flags" in result["categories"]
+        assert "benchmark_run_flags" in result["categories"]
+        assert "mod_flags" in result["categories"]
+
+    def test_no_steampipe_keys_appear(self, powerpipe_snapshot_v1):
+        result = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v1)
+        assert "service_start_flags" not in result["categories"]
+        assert "query_flags" not in result["categories"]
+
+    def test_new_category_in_new_snapshot_detected(self, powerpipe_snapshot_v1):
+        old = {**powerpipe_snapshot_v1}
+        new = {**powerpipe_snapshot_v1, "pipeline_flags": ["--async", "--output"]}
+        result = compare(old, new)
+        assert "pipeline_flags" in result["categories"]
+        assert result["categories"]["pipeline_flags"]["added"] == ["--async", "--output"]
+        assert result["has_changes"] is True
+
+
+# ---------------------------------------------------------------------------
+# render_markdown
+# ---------------------------------------------------------------------------
+
+class TestRenderMarkdown:
+    def test_no_changes_message(self, powerpipe_snapshot_v1):
+        diff = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v1)
+        md = render_markdown(diff)
+        assert "No behavioral changes detected" in md
+        assert "Action needed" not in md
+
+    def test_changes_include_tables(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes):
+        diff = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes)
+        md = render_markdown(diff)
+        assert "❌ Removed" in md
+        assert "➕ Added" in md
+
+    def test_changes_include_copilot_mention(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes):
+        diff = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes)
+        md = render_markdown(diff)
+        assert "@copilot" in md
+
+    def test_hash_change_section_present(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes):
+        diff = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes)
+        md = render_markdown(diff)
+        assert "Help text changes" in md
+
+    def test_version_in_header(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes):
+        diff = compare(powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes)
+        md = render_markdown(diff)
+        assert "1.5.1" in md
+        assert "1.6.0" in md
+
+
+# ---------------------------------------------------------------------------
+# TestMain — in-process calls for coverage
+# ---------------------------------------------------------------------------
+
+class TestMain:
+    def test_main_no_changes_exits_0(self, powerpipe_snapshot_v1, tmp_path, monkeypatch):
+        import compare_snapshots as cs
+        old_file = tmp_path / "old.json"
+        new_file = tmp_path / "new.json"
+        old_file.write_text(json.dumps(powerpipe_snapshot_v1))
+        new_file.write_text(json.dumps(powerpipe_snapshot_v1))
+
+        monkeypatch.setattr(sys, "argv", ["compare_snapshots.py", str(old_file), str(new_file)])
+        with pytest.raises(SystemExit) as exc:
+            cs.main()
+        assert exc.value.code == 0
+
+    def test_main_with_changes_exits_1(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes, tmp_path, monkeypatch):
+        import compare_snapshots as cs
+        old_file = tmp_path / "old.json"
+        new_file = tmp_path / "new.json"
+        old_file.write_text(json.dumps(powerpipe_snapshot_v1))
+        new_file.write_text(json.dumps(powerpipe_snapshot_v2_with_changes))
+
+        monkeypatch.setattr(sys, "argv", ["compare_snapshots.py", str(old_file), str(new_file)])
+        with pytest.raises(SystemExit) as exc:
+            cs.main()
+        assert exc.value.code == 1
+
+    def test_main_bad_json_exits_2(self, tmp_path, monkeypatch):
+        import compare_snapshots as cs
+        bad_file = tmp_path / "bad.json"
+        bad_file.write_text("not valid {{{")
+        good_file = tmp_path / "good.json"
+        good_file.write_text("{}")
+
+        monkeypatch.setattr(sys, "argv", ["compare_snapshots.py", str(bad_file), str(good_file)])
+        with pytest.raises(SystemExit) as exc:
+            cs.main()
+        assert exc.value.code == 2
+
+    def test_main_writes_output_files(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes, tmp_path, monkeypatch):
+        import compare_snapshots as cs
+        old_file = tmp_path / "old.json"
+        new_file = tmp_path / "new.json"
+        out_json = tmp_path / "diff.json"
+        out_md = tmp_path / "diff.md"
+        old_file.write_text(json.dumps(powerpipe_snapshot_v1))
+        new_file.write_text(json.dumps(powerpipe_snapshot_v2_with_changes))
+
+        monkeypatch.setattr(sys, "argv", [
+            "compare_snapshots.py", str(old_file), str(new_file),
+            "--output-json", str(out_json),
+            "--output-md", str(out_md),
+        ])
+        with pytest.raises(SystemExit):
+            cs.main()
+
+        assert out_json.exists()
+        assert out_md.exists()
+        data = json.loads(out_json.read_text())
+        assert data["has_changes"] is True
+        assert "CLI Behavioral Changes" in out_md.read_text()
+
+
+# ---------------------------------------------------------------------------
+# CLI invocation via subprocess (exit codes)
+# ---------------------------------------------------------------------------
+
+class TestExitCodes:
+    def _run(self, old_data, new_data, tmp_path):
+        import subprocess
+        old_file = tmp_path / "old.json"
+        new_file = tmp_path / "new.json"
+        old_file.write_text(json.dumps(old_data))
+        new_file.write_text(json.dumps(new_data))
+        script = Path(__file__).parent.parent / "scripts" / "compare_snapshots.py"
+        return subprocess.run(
+            [sys.executable, str(script), str(old_file), str(new_file)],
+            capture_output=True,
+        )
+
+    def test_exit_0_when_no_changes(self, powerpipe_snapshot_v1, tmp_path):
+        result = self._run(powerpipe_snapshot_v1, powerpipe_snapshot_v1, tmp_path)
+        assert result.returncode == 0
+
+    def test_exit_1_when_changes(self, powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes, tmp_path):
+        result = self._run(powerpipe_snapshot_v1, powerpipe_snapshot_v2_with_changes, tmp_path)
+        assert result.returncode == 1
+
+    def test_exit_2_on_missing_file(self, tmp_path):
+        import subprocess
+        missing = tmp_path / "missing.json"
+        good_file = tmp_path / "good.json"
+        good_file.write_text("{}")
+        script = Path(__file__).parent.parent / "scripts" / "compare_snapshots.py"
+        result = subprocess.run(
+            [sys.executable, str(script), str(missing), str(good_file)],
+            capture_output=True,
+        )
+        assert result.returncode == 2
diff --git a/trivy.yaml b/trivy.yaml
new file mode 100644
index 0000000..28bcece
--- /dev/null
+++ b/trivy.yaml
@@ -0,0 +1,9 @@
+# Trivy configuration
+# https://trivy.dev/docs/references/configuration/config-file/
+
+scan:
+  # Skip the powerpipe binary from vulnerability scanning.
+  # CVEs in the Go binary are upstream Turbot's responsibility;
+  # we cannot patch a pre-compiled third-party binary.
+  skip-files:
+    - usr/local/bin/powerpipe

From b0e748f504885ba92803f29b59dfb640b8b94196 Mon Sep 17 00:00:00 2001
From: Adrian Martin Garcia <adrianmg231189@gmail.com>
Date: Sun, 12 Apr 2026 23:21:27 +0200
Subject: [PATCH 2/5] feat: add Docker image, tests, docs and CLI snapshot for
 v1.5.1

- Dockerfile: debian bookworm-slim, UID 9193, apt hardening (SHELL pipefail, upgrade, jq)
- structure-tests.yaml: 13 tests covering binary, env vars, filesystem layout
- cli-snapshot.json: full v1.5.1 snapshot (9 subcommands + env vars)
- trivy.yaml: skip pre-compiled binary from CVE scanning
- docs/: getting-started, configuration, kubernetes, examples, troubleshooting
- tests/: 32 unit tests for compare_snapshots.py (99% coverage)
- README.md: accurate flag tables, env vars, image details

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/prompts/opsx-apply.prompt.md          | 149 ---------
 .github/prompts/opsx-archive.prompt.md        | 154 ----------
 .github/prompts/opsx-explore.prompt.md        | 170 -----------
 .github/prompts/opsx-propose.prompt.md        | 103 -------
 .github/skills/openspec-apply-change/SKILL.md | 156 ----------
 .../skills/openspec-archive-change/SKILL.md   | 114 -------
 .github/skills/openspec-explore/SKILL.md      | 288 ------------------
 .github/skills/openspec-propose/SKILL.md      | 110 -------
 .../compare_snapshots.cpython-314.pyc         | Bin 10154 -> 0 bytes
 .../conftest.cpython-314-pytest-9.0.2.pyc     | Bin 627 -> 0 bytes
 .../conftest.cpython-314-pytest-9.0.3.pyc     | Bin 627 -> 0 bytes
 ...are_snapshots.cpython-314-pytest-9.0.2.pyc | Bin 40162 -> 0 bytes
 ...are_snapshots.cpython-314-pytest-9.0.3.pyc | Bin 40162 -> 0 bytes
 13 files changed, 1244 deletions(-)
 delete mode 100644 .github/prompts/opsx-apply.prompt.md
 delete mode 100644 .github/prompts/opsx-archive.prompt.md
 delete mode 100644 .github/prompts/opsx-explore.prompt.md
 delete mode 100644 .github/prompts/opsx-propose.prompt.md
 delete mode 100644 .github/skills/openspec-apply-change/SKILL.md
 delete mode 100644 .github/skills/openspec-archive-change/SKILL.md
 delete mode 100644 .github/skills/openspec-explore/SKILL.md
 delete mode 100644 .github/skills/openspec-propose/SKILL.md
 delete mode 100644 scripts/__pycache__/compare_snapshots.cpython-314.pyc
 delete mode 100644 tests/__pycache__/conftest.cpython-314-pytest-9.0.2.pyc
 delete mode 100644 tests/__pycache__/conftest.cpython-314-pytest-9.0.3.pyc
 delete mode 100644 tests/__pycache__/test_compare_snapshots.cpython-314-pytest-9.0.2.pyc
 delete mode 100644 tests/__pycache__/test_compare_snapshots.cpython-314-pytest-9.0.3.pyc

diff --git a/.github/prompts/opsx-apply.prompt.md b/.github/prompts/opsx-apply.prompt.md
deleted file mode 100644
index 494e10e..0000000
--- a/.github/prompts/opsx-apply.prompt.md
+++ /dev/null
@@ -1,149 +0,0 @@
----
-description: Implement tasks from an OpenSpec change (Experimental)
----
-
-Implement tasks from an OpenSpec change.
-
-**Input**: Optionally specify a change name (e.g., `/opsx:apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **Select the change**
-
-   If a name is provided, use it. Otherwise:
-   - Infer from conversation context if the user mentioned a change
-   - Auto-select if only one active change exists
-   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
-
-   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
-
-2. **Check status to understand the schema**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Parse the JSON to understand:
-   - `schemaName`: The workflow being used (e.g., "spec-driven")
-   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
-
-3. **Get apply instructions**
-
-   ```bash
-   openspec instructions apply --change "<name>" --json
-   ```
-
-   This returns:
-   - Context file paths (varies by schema)
-   - Progress (total, complete, remaining)
-   - Task list with status
-   - Dynamic instruction based on current state
-
-   **Handle states:**
-   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx:continue`
-   - If `state: "all_done"`: congratulate, suggest archive
-   - Otherwise: proceed to implementation
-
-4. **Read context files**
-
-   Read the files listed in `contextFiles` from the apply instructions output.
-   The files depend on the schema being used:
-   - **spec-driven**: proposal, specs, design, tasks
-   - Other schemas: follow the contextFiles from CLI output
-
-5. **Show current progress**
-
-   Display:
-   - Schema being used
-   - Progress: "N/M tasks complete"
-   - Remaining tasks overview
-   - Dynamic instruction from CLI
-
-6. **Implement tasks (loop until done or blocked)**
-
-   For each pending task:
-   - Show which task is being worked on
-   - Make the code changes required
-   - Keep changes minimal and focused
-   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
-   - Continue to next task
-
-   **Pause if:**
-   - Task is unclear → ask for clarification
-   - Implementation reveals a design issue → suggest updating artifacts
-   - Error or blocker encountered → report and wait for guidance
-   - User interrupts
-
-7. **On completion or pause, show status**
-
-   Display:
-   - Tasks completed this session
-   - Overall progress: "N/M tasks complete"
-   - If all done: suggest archive
-   - If paused: explain why and wait for guidance
-
-**Output During Implementation**
-
-```
-## Implementing: <change-name> (schema: <schema-name>)
-
-Working on task 3/7: <task description>
-[...implementation happening...]
-✓ Task complete
-
-Working on task 4/7: <task description>
-[...implementation happening...]
-✓ Task complete
-```
-
-**Output On Completion**
-
-```
-## Implementation Complete
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Progress:** 7/7 tasks complete ✓
-
-### Completed This Session
-- [x] Task 1
-- [x] Task 2
-...
-
-All tasks complete! You can archive this change with `/opsx:archive`.
-```
-
-**Output On Pause (Issue Encountered)**
-
-```
-## Implementation Paused
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Progress:** 4/7 tasks complete
-
-### Issue Encountered
-<description of the issue>
-
-**Options:**
-1. <option 1>
-2. <option 2>
-3. Other approach
-
-What would you like to do?
-```
-
-**Guardrails**
-- Keep going through tasks until done or blocked
-- Always read context files before starting (from the apply instructions output)
-- If task is ambiguous, pause and ask before implementing
-- If implementation reveals issues, pause and suggest artifact updates
-- Keep code changes minimal and scoped to each task
-- Update task checkbox immediately after completing each task
-- Pause on errors, blockers, or unclear requirements - don't guess
-- Use contextFiles from CLI output, don't assume specific file names
-
-**Fluid Workflow Integration**
-
-This skill supports the "actions on a change" model:
-
-- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
-- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.github/prompts/opsx-archive.prompt.md b/.github/prompts/opsx-archive.prompt.md
deleted file mode 100644
index 1163776..0000000
--- a/.github/prompts/opsx-archive.prompt.md
+++ /dev/null
@@ -1,154 +0,0 @@
----
-description: Archive a completed change in the experimental workflow
----
-
-Archive a completed change in the experimental workflow.
-
-**Input**: Optionally specify a change name after `/opsx:archive` (e.g., `/opsx:archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **If no change name provided, prompt for selection**
-
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
-
-   Show only active changes (not already archived).
-   Include the schema used for each change if available.
-
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
-
-2. **Check artifact completion status**
-
-   Run `openspec status --change "<name>" --json` to check artifact completion.
-
-   Parse the JSON to understand:
-   - `schemaName`: The workflow being used
-   - `artifacts`: List of artifacts with their status (`done` or other)
-
-   **If any artifacts are not `done`:**
-   - Display warning listing incomplete artifacts
-   - Prompt user for confirmation to continue
-   - Proceed if user confirms
-
-3. **Check task completion status**
-
-   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
-
-   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
-
-   **If incomplete tasks found:**
-   - Display warning showing count of incomplete tasks
-   - Prompt user for confirmation to continue
-   - Proceed if user confirms
-
-   **If no tasks file exists:** Proceed without task-related warning.
-
-4. **Assess delta spec sync state**
-
-   Check for delta specs at `openspec/changes/<name>/specs/`. If none exist, proceed without sync prompt.
-
-   **If delta specs exist:**
-   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
-   - Determine what changes would be applied (adds, modifications, removals, renames)
-   - Show a combined summary before prompting
-
-   **Prompt options:**
-   - If changes needed: "Sync now (recommended)", "Archive without syncing"
-   - If already synced: "Archive now", "Sync anyway", "Cancel"
-
-   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
-
-5. **Perform the archive**
-
-   Create the archive directory if it doesn't exist:
-   ```bash
-   mkdir -p openspec/changes/archive
-   ```
-
-   Generate target name using current date: `YYYY-MM-DD-<change-name>`
-
-   **Check if target already exists:**
-   - If yes: Fail with error, suggest renaming existing archive or using different date
-   - If no: Move the change directory to archive
-
-   ```bash
-   mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
-   ```
-
-6. **Display summary**
-
-   Show archive completion summary including:
-   - Change name
-   - Schema that was used
-   - Archive location
-   - Spec sync status (synced / sync skipped / no delta specs)
-   - Note about any warnings (incomplete artifacts/tasks)
-
-**Output On Success**
-
-```
-## Archive Complete
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
-**Specs:** ✓ Synced to main specs
-
-All artifacts complete. All tasks complete.
-```
-
-**Output On Success (No Delta Specs)**
-
-```
-## Archive Complete
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
-**Specs:** No delta specs
-
-All artifacts complete. All tasks complete.
-```
-
-**Output On Success With Warnings**
-
-```
-## Archive Complete (with warnings)
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
-**Specs:** Sync skipped (user chose to skip)
-
-**Warnings:**
-- Archived with 2 incomplete artifacts
-- Archived with 3 incomplete tasks
-- Delta spec sync was skipped (user chose to skip)
-
-Review the archive if this was not intentional.
-```
-
-**Output On Error (Archive Exists)**
-
-```
-## Archive Failed
-
-**Change:** <change-name>
-**Target:** openspec/changes/archive/YYYY-MM-DD-<name>/
-
-Target archive directory already exists.
-
-**Options:**
-1. Rename the existing archive
-2. Delete the existing archive if it's a duplicate
-3. Wait until a different date to archive
-```
-
-**Guardrails**
-- Always prompt for change selection if not provided
-- Use artifact graph (openspec status --json) for completion checking
-- Don't block archive on warnings - just inform and confirm
-- Preserve .openspec.yaml when moving to archive (it moves with the directory)
-- Show clear summary of what happened
-- If sync is requested, use the Skill tool to invoke `openspec-sync-specs` (agent-driven)
-- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.github/prompts/opsx-explore.prompt.md b/.github/prompts/opsx-explore.prompt.md
deleted file mode 100644
index b21a226..0000000
--- a/.github/prompts/opsx-explore.prompt.md
+++ /dev/null
@@ -1,170 +0,0 @@
----
-description: Enter explore mode - think through ideas, investigate problems, clarify requirements
----
-
-Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
-
-**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
-
-**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
-
-**Input**: The argument after `/opsx:explore` is whatever the user wants to think about. Could be:
-- A vague idea: "real-time collaboration"
-- A specific problem: "the auth system is getting unwieldy"
-- A change name: "add-dark-mode" (to explore in context of that change)
-- A comparison: "postgres vs sqlite for this"
-- Nothing (just enter explore mode)
-
----
-
-## The Stance
-
-- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
-- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
-- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
-- **Adaptive** - Follow interesting threads, pivot when new information emerges
-- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
-- **Grounded** - Explore the actual codebase when relevant, don't just theorize
-
----
-
-## What You Might Do
-
-Depending on what the user brings, you might:
-
-**Explore the problem space**
-- Ask clarifying questions that emerge from what they said
-- Challenge assumptions
-- Reframe the problem
-- Find analogies
-
-**Investigate the codebase**
-- Map existing architecture relevant to the discussion
-- Find integration points
-- Identify patterns already in use
-- Surface hidden complexity
-
-**Compare options**
-- Brainstorm multiple approaches
-- Build comparison tables
-- Sketch tradeoffs
-- Recommend a path (if asked)
-
-**Visualize**
-```
-┌─────────────────────────────────────────┐
-│     Use ASCII diagrams liberally        │
-├─────────────────────────────────────────┤
-│                                         │
-│   ┌────────┐         ┌────────┐        │
-│   │ State  │────────▶│ State  │        │
-│   │   A    │         │   B    │        │
-│   └────────┘         └────────┘        │
-│                                         │
-│   System diagrams, state machines,      │
-│   data flows, architecture sketches,    │
-│   dependency graphs, comparison tables  │
-│                                         │
-└─────────────────────────────────────────┘
-```
-
-**Surface risks and unknowns**
-- Identify what could go wrong
-- Find gaps in understanding
-- Suggest spikes or investigations
-
----
-
-## OpenSpec Awareness
-
-You have full context of the OpenSpec system. Use it naturally, don't force it.
-
-### Check for context
-
-At the start, quickly check what exists:
-```bash
-openspec list --json
-```
-
-This tells you:
-- If there are active changes
-- Their names, schemas, and status
-- What the user might be working on
-
-If the user mentioned a specific change name, read its artifacts for context.
-
-### When no change exists
-
-Think freely. When insights crystallize, you might offer:
-
-- "This feels solid enough to start a change. Want me to create a proposal?"
-- Or keep exploring - no pressure to formalize
-
-### When a change exists
-
-If the user mentions a change or you detect one is relevant:
-
-1. **Read existing artifacts for context**
-   - `openspec/changes/<name>/proposal.md`
-   - `openspec/changes/<name>/design.md`
-   - `openspec/changes/<name>/tasks.md`
-   - etc.
-
-2. **Reference them naturally in conversation**
-   - "Your design mentions using Redis, but we just realized SQLite fits better..."
-   - "The proposal scopes this to premium users, but we're now thinking everyone..."
-
-3. **Offer to capture when decisions are made**
-
-   | Insight Type | Where to Capture |
-   |--------------|------------------|
-   | New requirement discovered | `specs/<capability>/spec.md` |
-   | Requirement changed | `specs/<capability>/spec.md` |
-   | Design decision made | `design.md` |
-   | Scope changed | `proposal.md` |
-   | New work identified | `tasks.md` |
-   | Assumption invalidated | Relevant artifact |
-
-   Example offers:
-   - "That's a design decision. Capture it in design.md?"
-   - "This is a new requirement. Add it to specs?"
-   - "This changes scope. Update the proposal?"
-
-4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
-
----
-
-## What You Don't Have To Do
-
-- Follow a script
-- Ask the same questions every time
-- Produce a specific artifact
-- Reach a conclusion
-- Stay on topic if a tangent is valuable
-- Be brief (this is thinking time)
-
----
-
-## Ending Discovery
-
-There's no required ending. Discovery might:
-
-- **Flow into a proposal**: "Ready to start? I can create a change proposal."
-- **Result in artifact updates**: "Updated design.md with these decisions"
-- **Just provide clarity**: User has what they need, moves on
-- **Continue later**: "We can pick this up anytime"
-
-When things crystallize, you might offer a summary - but it's optional. Sometimes the thinking IS the value.
-
----
-
-## Guardrails
-
-- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
-- **Don't fake understanding** - If something is unclear, dig deeper
-- **Don't rush** - Discovery is thinking time, not task time
-- **Don't force structure** - Let patterns emerge naturally
-- **Don't auto-capture** - Offer to save insights, don't just do it
-- **Do visualize** - A good diagram is worth many paragraphs
-- **Do explore the codebase** - Ground discussions in reality
-- **Do question assumptions** - Including the user's and your own
diff --git a/.github/prompts/opsx-propose.prompt.md b/.github/prompts/opsx-propose.prompt.md
deleted file mode 100644
index cf30b2a..0000000
--- a/.github/prompts/opsx-propose.prompt.md
+++ /dev/null
@@ -1,103 +0,0 @@
----
-description: Propose a new change - create it and generate all artifacts in one step
----
-
-Propose a new change - create the change and generate all artifacts in one step.
-
-I'll create a change with artifacts:
-- proposal.md (what & why)
-- design.md (how)
-- tasks.md (implementation steps)
-
-When ready to implement, run /opsx:apply
-
----
-
-**Input**: The argument after `/opsx:propose` is the change name (kebab-case), OR a description of what the user wants to build.
-
-**Steps**
-
-1. **If no input provided, ask what they want to build**
-
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
-   > "What change do you want to work on? Describe what you want to build or fix."
-
-   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
-
-   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
-
-2. **Create the change directory**
-   ```bash
-   openspec new change "<name>"
-   ```
-   This creates a scaffolded change at `openspec/changes/<name>/` with `.openspec.yaml`.
-
-3. **Get the artifact build order**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Parse the JSON to get:
-   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
-   - `artifacts`: list of all artifacts with their status and dependencies
-
-4. **Create artifacts in sequence until apply-ready**
-
-   Use the **TodoWrite tool** to track progress through the artifacts.
-
-   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
-
-   a. **For each artifact that is `ready` (dependencies satisfied)**:
-      - Get instructions:
-        ```bash
-        openspec instructions <artifact-id> --change "<name>" --json
-        ```
-      - The instructions JSON includes:
-        - `context`: Project background (constraints for you - do NOT include in output)
-        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
-        - `template`: The structure to use for your output file
-        - `instruction`: Schema-specific guidance for this artifact type
-        - `outputPath`: Where to write the artifact
-        - `dependencies`: Completed artifacts to read for context
-      - Read any completed dependency files for context
-      - Create the artifact file using `template` as the structure
-      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
-      - Show brief progress: "Created <artifact-id>"
-
-   b. **Continue until all `applyRequires` artifacts are complete**
-      - After creating each artifact, re-run `openspec status --change "<name>" --json`
-      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
-      - Stop when all `applyRequires` artifacts are done
-
-   c. **If an artifact requires user input** (unclear context):
-      - Use **AskUserQuestion tool** to clarify
-      - Then continue with creation
-
-5. **Show final status**
-   ```bash
-   openspec status --change "<name>"
-   ```
-
-**Output**
-
-After completing all artifacts, summarize:
-- Change name and location
-- List of artifacts created with brief descriptions
-- What's ready: "All artifacts created! Ready for implementation."
-- Prompt: "Run `/opsx:apply` to start implementing."
-
-**Artifact Creation Guidelines**
-
-- Follow the `instruction` field from `openspec instructions` for each artifact type
-- The schema defines what each artifact should contain - follow it
-- Read dependency artifacts for context before creating new ones
-- Use `template` as the structure for your output file - fill in its sections
-- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
-  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
-  - These guide what you write, but should never appear in the output
-
-**Guardrails**
-- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
-- Always read dependency artifacts before creating a new one
-- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
-- If a change with that name already exists, ask if user wants to continue it or create a new one
-- Verify each artifact file exists after writing before proceeding to next
diff --git a/.github/skills/openspec-apply-change/SKILL.md b/.github/skills/openspec-apply-change/SKILL.md
deleted file mode 100644
index d474dc1..0000000
--- a/.github/skills/openspec-apply-change/SKILL.md
+++ /dev/null
@@ -1,156 +0,0 @@
----
-name: openspec-apply-change
-description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.2.0"
----
-
-Implement tasks from an OpenSpec change.
-
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **Select the change**
-
-   If a name is provided, use it. Otherwise:
-   - Infer from conversation context if the user mentioned a change
-   - Auto-select if only one active change exists
-   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
-
-   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
-
-2. **Check status to understand the schema**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Parse the JSON to understand:
-   - `schemaName`: The workflow being used (e.g., "spec-driven")
-   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
-
-3. **Get apply instructions**
-
-   ```bash
-   openspec instructions apply --change "<name>" --json
-   ```
-
-   This returns:
-   - Context file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
-   - Progress (total, complete, remaining)
-   - Task list with status
-   - Dynamic instruction based on current state
-
-   **Handle states:**
-   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
-   - If `state: "all_done"`: congratulate, suggest archive
-   - Otherwise: proceed to implementation
-
-4. **Read context files**
-
-   Read the files listed in `contextFiles` from the apply instructions output.
-   The files depend on the schema being used:
-   - **spec-driven**: proposal, specs, design, tasks
-   - Other schemas: follow the contextFiles from CLI output
-
-5. **Show current progress**
-
-   Display:
-   - Schema being used
-   - Progress: "N/M tasks complete"
-   - Remaining tasks overview
-   - Dynamic instruction from CLI
-
-6. **Implement tasks (loop until done or blocked)**
-
-   For each pending task:
-   - Show which task is being worked on
-   - Make the code changes required
-   - Keep changes minimal and focused
-   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
-   - Continue to next task
-
-   **Pause if:**
-   - Task is unclear → ask for clarification
-   - Implementation reveals a design issue → suggest updating artifacts
-   - Error or blocker encountered → report and wait for guidance
-   - User interrupts
-
-7. **On completion or pause, show status**
-
-   Display:
-   - Tasks completed this session
-   - Overall progress: "N/M tasks complete"
-   - If all done: suggest archive
-   - If paused: explain why and wait for guidance
-
-**Output During Implementation**
-
-```
-## Implementing: <change-name> (schema: <schema-name>)
-
-Working on task 3/7: <task description>
-[...implementation happening...]
-✓ Task complete
-
-Working on task 4/7: <task description>
-[...implementation happening...]
-✓ Task complete
-```
-
-**Output On Completion**
-
-```
-## Implementation Complete
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Progress:** 7/7 tasks complete ✓
-
-### Completed This Session
-- [x] Task 1
-- [x] Task 2
-...
-
-All tasks complete! Ready to archive this change.
-```
-
-**Output On Pause (Issue Encountered)**
-
-```
-## Implementation Paused
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Progress:** 4/7 tasks complete
-
-### Issue Encountered
-<description of the issue>
-
-**Options:**
-1. <option 1>
-2. <option 2>
-3. Other approach
-
-What would you like to do?
-```
-
-**Guardrails**
-- Keep going through tasks until done or blocked
-- Always read context files before starting (from the apply instructions output)
-- If task is ambiguous, pause and ask before implementing
-- If implementation reveals issues, pause and suggest artifact updates
-- Keep code changes minimal and scoped to each task
-- Update task checkbox immediately after completing each task
-- Pause on errors, blockers, or unclear requirements - don't guess
-- Use contextFiles from CLI output, don't assume specific file names
-
-**Fluid Workflow Integration**
-
-This skill supports the "actions on a change" model:
-
-- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
-- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.github/skills/openspec-archive-change/SKILL.md b/.github/skills/openspec-archive-change/SKILL.md
deleted file mode 100644
index 9b1f851..0000000
--- a/.github/skills/openspec-archive-change/SKILL.md
+++ /dev/null
@@ -1,114 +0,0 @@
----
-name: openspec-archive-change
-description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.2.0"
----
-
-Archive a completed change in the experimental workflow.
-
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **If no change name provided, prompt for selection**
-
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
-
-   Show only active changes (not already archived).
-   Include the schema used for each change if available.
-
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
-
-2. **Check artifact completion status**
-
-   Run `openspec status --change "<name>" --json` to check artifact completion.
-
-   Parse the JSON to understand:
-   - `schemaName`: The workflow being used
-   - `artifacts`: List of artifacts with their status (`done` or other)
-
-   **If any artifacts are not `done`:**
-   - Display warning listing incomplete artifacts
-   - Use **AskUserQuestion tool** to confirm user wants to proceed
-   - Proceed if user confirms
-
-3. **Check task completion status**
-
-   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
-
-   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
-
-   **If incomplete tasks found:**
-   - Display warning showing count of incomplete tasks
-   - Use **AskUserQuestion tool** to confirm user wants to proceed
-   - Proceed if user confirms
-
-   **If no tasks file exists:** Proceed without task-related warning.
-
-4. **Assess delta spec sync state**
-
-   Check for delta specs at `openspec/changes/<name>/specs/`. If none exist, proceed without sync prompt.
-
-   **If delta specs exist:**
-   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
-   - Determine what changes would be applied (adds, modifications, removals, renames)
-   - Show a combined summary before prompting
-
-   **Prompt options:**
-   - If changes needed: "Sync now (recommended)", "Archive without syncing"
-   - If already synced: "Archive now", "Sync anyway", "Cancel"
-
-   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
-
-5. **Perform the archive**
-
-   Create the archive directory if it doesn't exist:
-   ```bash
-   mkdir -p openspec/changes/archive
-   ```
-
-   Generate target name using current date: `YYYY-MM-DD-<change-name>`
-
-   **Check if target already exists:**
-   - If yes: Fail with error, suggest renaming existing archive or using different date
-   - If no: Move the change directory to archive
-
-   ```bash
-   mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
-   ```
-
-6. **Display summary**
-
-   Show archive completion summary including:
-   - Change name
-   - Schema that was used
-   - Archive location
-   - Whether specs were synced (if applicable)
-   - Note about any warnings (incomplete artifacts/tasks)
-
-**Output On Success**
-
-```
-## Archive Complete
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
-**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
-
-All artifacts complete. All tasks complete.
-```
-
-**Guardrails**
-- Always prompt for change selection if not provided
-- Use artifact graph (openspec status --json) for completion checking
-- Don't block archive on warnings - just inform and confirm
-- Preserve .openspec.yaml when moving to archive (it moves with the directory)
-- Show clear summary of what happened
-- If sync is requested, use openspec-sync-specs approach (agent-driven)
-- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.github/skills/openspec-explore/SKILL.md b/.github/skills/openspec-explore/SKILL.md
deleted file mode 100644
index ffa10ca..0000000
--- a/.github/skills/openspec-explore/SKILL.md
+++ /dev/null
@@ -1,288 +0,0 @@
----
-name: openspec-explore
-description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.2.0"
----
-
-Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
-
-**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
-
-**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
-
----
-
-## The Stance
-
-- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
-- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
-- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
-- **Adaptive** - Follow interesting threads, pivot when new information emerges
-- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
-- **Grounded** - Explore the actual codebase when relevant, don't just theorize
-
----
-
-## What You Might Do
-
-Depending on what the user brings, you might:
-
-**Explore the problem space**
-- Ask clarifying questions that emerge from what they said
-- Challenge assumptions
-- Reframe the problem
-- Find analogies
-
-**Investigate the codebase**
-- Map existing architecture relevant to the discussion
-- Find integration points
-- Identify patterns already in use
-- Surface hidden complexity
-
-**Compare options**
-- Brainstorm multiple approaches
-- Build comparison tables
-- Sketch tradeoffs
-- Recommend a path (if asked)
-
-**Visualize**
-```
-┌─────────────────────────────────────────┐
-│     Use ASCII diagrams liberally        │
-├─────────────────────────────────────────┤
-│                                         │
-│   ┌────────┐         ┌────────┐        │
-│   │ State  │────────▶│ State  │        │
-│   │   A    │         │   B    │        │
-│   └────────┘         └────────┘        │
-│                                         │
-│   System diagrams, state machines,      │
-│   data flows, architecture sketches,    │
-│   dependency graphs, comparison tables  │
-│                                         │
-└─────────────────────────────────────────┘
-```
-
-**Surface risks and unknowns**
-- Identify what could go wrong
-- Find gaps in understanding
-- Suggest spikes or investigations
-
----
-
-## OpenSpec Awareness
-
-You have full context of the OpenSpec system. Use it naturally, don't force it.
-
-### Check for context
-
-At the start, quickly check what exists:
-```bash
-openspec list --json
-```
-
-This tells you:
-- If there are active changes
-- Their names, schemas, and status
-- What the user might be working on
-
-### When no change exists
-
-Think freely. When insights crystallize, you might offer:
-
-- "This feels solid enough to start a change. Want me to create a proposal?"
-- Or keep exploring - no pressure to formalize
-
-### When a change exists
-
-If the user mentions a change or you detect one is relevant:
-
-1. **Read existing artifacts for context**
-   - `openspec/changes/<name>/proposal.md`
-   - `openspec/changes/<name>/design.md`
-   - `openspec/changes/<name>/tasks.md`
-   - etc.
-
-2. **Reference them naturally in conversation**
-   - "Your design mentions using Redis, but we just realized SQLite fits better..."
-   - "The proposal scopes this to premium users, but we're now thinking everyone..."
-
-3. **Offer to capture when decisions are made**
-
-   | Insight Type | Where to Capture |
-   |--------------|------------------|
-   | New requirement discovered | `specs/<capability>/spec.md` |
-   | Requirement changed | `specs/<capability>/spec.md` |
-   | Design decision made | `design.md` |
-   | Scope changed | `proposal.md` |
-   | New work identified | `tasks.md` |
-   | Assumption invalidated | Relevant artifact |
-
-   Example offers:
-   - "That's a design decision. Capture it in design.md?"
-   - "This is a new requirement. Add it to specs?"
-   - "This changes scope. Update the proposal?"
-
-4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
-
----
-
-## What You Don't Have To Do
-
-- Follow a script
-- Ask the same questions every time
-- Produce a specific artifact
-- Reach a conclusion
-- Stay on topic if a tangent is valuable
-- Be brief (this is thinking time)
-
----
-
-## Handling Different Entry Points
-
-**User brings a vague idea:**
-```
-User: I'm thinking about adding real-time collaboration
-
-You: Real-time collab is a big space. Let me think about this...
-
-      COLLABORATION SPECTRUM
-      ════════════════════════════════════════════
-
-      Awareness          Coordination         Sync
-          │                   │                 │
-          ▼                   ▼                 ▼
-      ┌────────┐         ┌────────┐        ┌────────┐
-      │Presence│         │Cursors │        │  CRDT  │
-      │  "3    │         │ Multi  │        │Conflict│
-      │online" │         │ select │        │  free  │
-      └────────┘         └────────┘        └────────┘
-          │                   │                 │
-       trivial            moderate           complex
-
-      Where's your head at?
-```
-
-**User brings a specific problem:**
-```
-User: The auth system is a mess
-
-You: [reads codebase]
-
-     ┌─────────────────────────────────────────────┐
-     │              CURRENT AUTH FLOW              │
-     └─────────────────────────────────────────────┘
-                        │
-          ┌─────────────┼─────────────┐
-          ▼             ▼             ▼
-     ┌─────────┐  ┌─────────┐  ┌─────────┐
-     │ Google  │  │  GitHub │  │  Email  │
-     │  OAuth  │  │  OAuth  │  │  Magic  │
-     └────┬────┘  └────┬────┘  └────┬────┘
-          │             │             │
-          └─────────────┼─────────────┘
-                        ▼
-                  ┌───────────┐
-                  │  Session  │
-                  └─────┬─────┘
-                        │
-                        ▼
-                  ┌───────────┐
-                  │   Perms   │
-                  └───────────┘
-
-     I see three tangles. Which one's burning?
-```
-
-**User is stuck mid-implementation:**
-```
-User: /opsx:explore add-auth-system
-      The OAuth integration is more complex than expected
-
-You: [reads change artifacts]
-
-     You're on task 4: "Implement OAuth flow"
-
-     Let me trace what's involved...
-
-     [draws diagram, explores options, suggests paths]
-
-     Want to update the design to reflect this?
-     Or add a spike task to investigate?
-```
-
-**User wants to compare options:**
-```
-User: Should we use Postgres or SQLite?
-
-You: Generic answer is boring. What's the context?
-
-User: A CLI tool that tracks local dev environments
-
-You: That changes everything.
-
-     ┌─────────────────────────────────────────────────┐
-     │         CLI TOOL DATA STORAGE                  │
-     └─────────────────────────────────────────────────┘
-
-     Key constraints:
-     • No daemon running
-     • Must work offline
-     • Single user
-
-                  SQLite          Postgres
-     Deployment   embedded ✓      needs server ✗
-     Offline      yes ✓           no ✗
-     Single file  yes ✓           no ✗
-
-     SQLite. Not even close.
-
-     Unless... is there a sync component?
-```
-
----
-
-## Ending Discovery
-
-There's no required ending. Discovery might:
-
-- **Flow into a proposal**: "Ready to start? I can create a change proposal."
-- **Result in artifact updates**: "Updated design.md with these decisions"
-- **Just provide clarity**: User has what they need, moves on
-- **Continue later**: "We can pick this up anytime"
-
-When it feels like things are crystallizing, you might summarize:
-
-```
-## What We Figured Out
-
-**The problem**: [crystallized understanding]
-
-**The approach**: [if one emerged]
-
-**Open questions**: [if any remain]
-
-**Next steps** (if ready):
-- Create a change proposal
-- Keep exploring: just keep talking
-```
-
-But this summary is optional. Sometimes the thinking IS the value.
-
----
-
-## Guardrails
-
-- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
-- **Don't fake understanding** - If something is unclear, dig deeper
-- **Don't rush** - Discovery is thinking time, not task time
-- **Don't force structure** - Let patterns emerge naturally
-- **Don't auto-capture** - Offer to save insights, don't just do it
-- **Do visualize** - A good diagram is worth many paragraphs
-- **Do explore the codebase** - Ground discussions in reality
-- **Do question assumptions** - Including the user's and your own
diff --git a/.github/skills/openspec-propose/SKILL.md b/.github/skills/openspec-propose/SKILL.md
deleted file mode 100644
index d27bc53..0000000
--- a/.github/skills/openspec-propose/SKILL.md
+++ /dev/null
@@ -1,110 +0,0 @@
----
-name: openspec-propose
-description: Propose a new change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation.
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.2.0"
----
-
-Propose a new change - create the change and generate all artifacts in one step.
-
-I'll create a change with artifacts:
-- proposal.md (what & why)
-- design.md (how)
-- tasks.md (implementation steps)
-
-When ready to implement, run /opsx:apply
-
----
-
-**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
-
-**Steps**
-
-1. **If no clear input provided, ask what they want to build**
-
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
-   > "What change do you want to work on? Describe what you want to build or fix."
-
-   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
-
-   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
-
-2. **Create the change directory**
-   ```bash
-   openspec new change "<name>"
-   ```
-   This creates a scaffolded change at `openspec/changes/<name>/` with `.openspec.yaml`.
-
-3. **Get the artifact build order**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Parse the JSON to get:
-   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
-   - `artifacts`: list of all artifacts with their status and dependencies
-
-4. **Create artifacts in sequence until apply-ready**
-
-   Use the **TodoWrite tool** to track progress through the artifacts.
-
-   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
-
-   a. **For each artifact that is `ready` (dependencies satisfied)**:
-      - Get instructions:
-        ```bash
-        openspec instructions <artifact-id> --change "<name>" --json
-        ```
-      - The instructions JSON includes:
-        - `context`: Project background (constraints for you - do NOT include in output)
-        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
-        - `template`: The structure to use for your output file
-        - `instruction`: Schema-specific guidance for this artifact type
-        - `outputPath`: Where to write the artifact
-        - `dependencies`: Completed artifacts to read for context
-      - Read any completed dependency files for context
-      - Create the artifact file using `template` as the structure
-      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
-      - Show brief progress: "Created <artifact-id>"
-
-   b. **Continue until all `applyRequires` artifacts are complete**
-      - After creating each artifact, re-run `openspec status --change "<name>" --json`
-      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
-      - Stop when all `applyRequires` artifacts are done
-
-   c. **If an artifact requires user input** (unclear context):
-      - Use **AskUserQuestion tool** to clarify
-      - Then continue with creation
-
-5. **Show final status**
-   ```bash
-   openspec status --change "<name>"
-   ```
-
-**Output**
-
-After completing all artifacts, summarize:
-- Change name and location
-- List of artifacts created with brief descriptions
-- What's ready: "All artifacts created! Ready for implementation."
-- Prompt: "Run `/opsx:apply` or ask me to implement to start working on the tasks."
-
-**Artifact Creation Guidelines**
-
-- Follow the `instruction` field from `openspec instructions` for each artifact type
-- The schema defines what each artifact should contain - follow it
-- Read dependency artifacts for context before creating new ones
-- Use `template` as the structure for your output file - fill in its sections
-- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
-  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
-  - These guide what you write, but should never appear in the output
-
-**Guardrails**
-- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
-- Always read dependency artifacts before creating a new one
-- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
-- If a change with that name already exists, ask if user wants to continue it or create a new one
-- Verify each artifact file exists after writing before proceeding to next
diff --git a/scripts/__pycache__/compare_snapshots.cpython-314.pyc b/scripts/__pycache__/compare_snapshots.cpython-314.pyc
deleted file mode 100644
index a20d30199b9f358b56b8f6add405d8a106dc53f0..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 10154
zcmcgyZ)_V!cAw=g$rb;J`tLvbvoa;wR4mfAWXqNvCyp#yvMpO#+f;I=m|lx3i7`bo
zyGzSvos<_`FLEx0l|u^C7v0$bd^j0MTLaC96gadga39i7rAo@u?Wt&x-k1ASxpI&e
z?T5Y@a+fqsS?Lw+fSjG3c{}sw&71dr^LAfw*ewW>_w$v|i**S73%=2kAzxTufI<@S
zNI@47PYqEDMXm<LK(4ex!__dv3>p<<3*zYp#4`;j>{Lv=kvHuzC}!TQusjR(6{Nm`
zw?NrS$`;-RWjiTbc?Xm$N!i9bp<G4EcD}j+DULTP`I>{TAru6j8_^q%R@9Sc5k{q4
z<nOMHU!@T0k50z~N#vB7DA#{_h?65iOrDA=GABfW+@u&0B|#B6fs@5)A)<uFxnO8w
z!eg;qkcCOH&%!~9U00@}k#0^NmqIZ`_KxTJ?9%)4#IAGEaM1In9F1@haVA&zepgpC
zuEgR>*K{z~>vZr9u24&;$!NIrhQ)H0P|LYNySS6*&YmI9aY~evl^}G+?TSjA-YtI2
zO*ri0h6U+LFgg?A<oNWoAYI4L=!7u-u4qgNMI%DkZLtho3n|=qG$`hW+QWUF{D_N0
zxy#~|a5WT_gfKTgB}67gne@Jwv_IR(1w}<1SHvKp+DE8FNs3CAGj2*{Mg(PQ9F_p#
zKTan2)9_zE0$CFI(M7|-AHpg^T_bvxnxc4W3|exDHx!lWF--@Nmv*5C%<u8NN`uf<
z8U(JIBvFY=5w}5Q!Xa5vnP6yK0VYfnQE6IGWX!@2^|<$fEK0KX*l>6EzJtA9NsL8h
zZw#uiWW2HHj3~uIG0|JH(t+ZYR&9ZR5Q#(;(3?O&vO~`e@RwU5OQLU)iQ4lRXCED3
z!<Tu5Ts~z;<vI|daeXpy!@wT|z^uOmg(Mo&gazX1$(Lh>qFPF?rN^)^NgCa^n{40Q
zole0NQMk%d7<tOi@CLupYj7bqo$wa#7da}y;&ND^@@_6CVNM7J#UMy-I(k(MdQ>C1
zSIzkfSO8iU71fk`)@_pTqDyATR5Pqr05_Up#c)A#;<hTtWK7l3fj66E!?YH>F9Kv_
zsU9kbgkOY068+9mHRt;ARPw~CUa(cq^)A)4Wo+%qfmKKC+~`tWN5-);d1A#@Gj}01
zbZ;hY^`;rG<iLHKufl@EUQq4YvIc^%mZ~u@CCE=}tP$vm#`?(6n`*4Suw!^xN!q<l
zD}i+dAwQrc+^foJgG(&jLM>iEsRB3AvLd-D$qMD1;u4t<O(R(wZfJ%KtDBKBJ;vF5
z+Zw*y@A;Je#UWBdW=l38kdl<24zvCW+!pH^Pc?wPjp+K6r-zGXSe<%F(=N~#L*f`u
z_8ljL!`v0|y3EZ?MP-q@Dum-Am{>5pWDU7p@|94Gn-&!TL@ju+pb5R(^9+OCFzUJj
z*$&hKOrA$R4?;5_S*f~c8yE@}p(ii(oq4V&VH%C-R1-pes;~}+U^C@gI&sT2lms7j
zY7ascs2O~k3+<;v)C1~_n^r9$ITVo<Au=xJR>TrGcWP)PaBAT7a}Q|M;Mt>6S5)e%
zj0FZ-o735fBiNl>i%Cb-=71nc!u0?aiRVZ-Ixd9eqaMAz10Iw2LH2u?;2NT<O~0w{
zxEY)kR;_h&!hG$rwfPB+Dl99mwogwkx(<AcZ{DXe^&S5q<L&Y8wu96s>_O@;EC;Cv
z2B`+BRAWdHr{xEf)QCIBmZKxbmbHi%sSE1c;J@yI4EB<>>M<UErM~%g<ikj|zGIz+
z+jT_SOu(1XRL~*KF8v>D328epBf)y1=V|?JXn$7gYjaxPc3=L5`~OYr+e@`xnGzJD
z?L@IBLSi^5Z=l&9!8CNuKKh4i_6S~xk~D_RC`sBTE!h)&MVkNe)0!`}!h>!`+5r~{
z8yA%oBSCp4q)dUw8$5PyFmUdI&o}g%g!Shs&6jpz@+M+FH&S`n!$>{=S$UPOS++Li
zRDOr+mz|$<emb_iqpw))E8)?1w;f}tPqskzHx|ew*vCjBYEh)_mI52nejvc@5+40o
zRmRf7JNOU5Bk))*VLT!+PzK$_Cj5CSjE$*|6B?-M#|W~IK!xEl4{!l4_s^5c9J6`D
zMh3#30hndhSE07pb{Bm7n6459?4T(^St=b%XjHqgqs}L-t{8n3^`cWgcdP={cN>f5
zDc-=-;EV8lOA^oUM$OpU5O4BRn^Wzhd9xSstOt3S7~?lMkuQKy%s7U<D@o<Y@*6!!
z8>{>{#S|K4%rqM0&BZR?Z^XvlZ{jP8YxQkeja?PATFSP<dV?eT9)cqhpfn2ibV|r=
zTR#mm5%Ekm;$K_8jkwp^56(R07#W@|=4Axq+mhrrj^OQBlEyHaBT4Id1UsgZ#M^kg
zCM}H)-0)<6Rt%sDN8;oO?OgWMsSM61%8V#R$YD-{PcpZQoZ>>`ySbUDbVcR>^26co
zIzH~XJ*pK<av*=2@u`kH_RH5u7+0#)OL4q&xUYZo6Hc{^0~VZ&N+D5JZP=V^4;Rqt
zd6f#N6z8@O&nv+iBH~zyy;12&K(-jOswN>80~@N^a^P5wPfUcaNf_T?yc`P)<D%PK
z1dttoqKcfgYRC741&kx`8ApzX6_tiNl?uvuZ{;v^9)Oth2UBSfT8OPV0ERJ%o|sU5
z<9z>p>q38q+mmVB`&s|5tY7qJ4i08|hL#$KGIb}DXI5*s&3Dfy7F-|yab~;sGuLNt
zeo^yR(ab*I(so~__C#`c&4eoI=i)2umejesqjyH{z5bBSH1(t#_dmSwdH3J;{&nvc
zhrS%o9Olz~=hEBGuduaqmsi;OlwqyHSZhl9)*Z;%JWH?I>gVL!Gat^R<a@7V8g?$!
z{AI&~hKDr|FK66`GPb^1YNf4x_Qn$1m^!z}wys!hv!l2AKIltTr4HR~{CVR_+pbyP
z+>04o>*EUOaNUNSO|$fh)p4u$X7610kB_9f@Als5z1RKmkw?~@D{wS8x@6n2Y;!N#
z+zYPd&c4OYzF!^5bPg_ejx2VLq+dOs_P?I#{N5wm_a7UfuQe9gs*}V2dvBo|Z=Nok
zWU;pZCyUihHHL-DVi+G)Cnm@tz-=IocT+cV2A<a4h?Q!5j3Apow}vmDGUW1E4XJ$A
zjpThEvmPX>;XyHjAI{yyTV6L#u%W>?fk7_U8vFriHH<(%r3o8w8`@_mY;b>hI%ZP}
zV-ZCOCtv`#fB~d8=-cF{!AY3+(S;sP!C4HW{n8n4(i6LJPkcqWLz7>hIjpuN(Zhok
z5Wy&MaIBaNix6uX$HADLa6&3RO>=_GLF|UaaXbZclQ3FbE*F=my2166s0??58v?M;
z-GHjDe99MY#PM<Z2KV*PKH&J=86BuECFo1sjW{;i(Dd^^<Bs8Baf3=(K<i$H29<d;
z8j65!o`f6e6s|FbLlLlo3^`d~h=Z+7?od%BktqepF<lWZhehdCARwA~7Ya%AmCcbH
zSTS2?PrUc`58qBPsn_pT&R4Fm_FJ}_wz;b*F*Ta5YtOPB`Kol?t}N?*`lfbEYU}N@
zb7yCduh^<?oxXWGy?yt>`32uYS9<G#N4DO_G^%U+3aA=x56=zjRH>I1dKNk!(&?=|
zk8Jxf(T=aImA4MvJT!M9W8I!+wm-YO@$?85gaaXP|J_gexxfk8(L`$6PR3Y}Z0F|z
zLTnghP)Zo_Tjat!88Up5hs*tLa#vs#$VkF=pCCc3dJvAK{19|4-lCxP^gh}{#c&H#
z+@f#oezJKHZ!Fsiz5{RkvRm6!*iIWzm<tp<U3PouSkMK6F2Nf*hRx3wF4&df1ltt!
zl7s?Wu<5ZJN)itNWer`F!-iT<F{Xh3M*FoV081Hl34v?@d-dT1Q#m>Kiwx7L;k;Sd
zK%PMeTx}>%Ye8D&N5Y7ytQ1Q|)B1tccN81FjdUP*?KxakYQ42=Fn`{;DMi($6xEwj
z)ND#oyD3Fofnsxgbk`@E^5%LX4nZx=9&2%RPn-jt19QA~_oF{0ZxmiB1kH2iS?=Sc
zLqH^fS|I5l&W=D9$Ex-9{GV{0ooC90+VyC<r?WHBZ#h3D;#Ub=9<XwN133liWMNt)
z<4%NyNeIh|k*g4Hlc0oOXvp!)00QAn2E-qv!+2;MG?gIEfD-k@jSPz67^jHW;0-`7
z#Ghy=tqNiY-Nz*iySc<65BQO*Az<WESJxCgdx^`v)F3b$0Cx~vnipOrkar{C)VO#I
zM^j}_g0X;aii3*=ak;p!e|qm<KflEtBc2atCV~e_oPb$ExG>KN2>UvOncs?sAa0oN
z2EWI+#19-hK0M%=4qhUYymUM|enpffLSgX|H*m)9u_O+@JRXgO!cm1A35x=BDdm{P
z5-aoKLbwdkYur~~qHC{*yFgfeY8)(GGFV=|9C31T;=sNFc?lbuTjxR(u$B`7V0Ae^
zwP0d@w}%^u$Z?oiFghNe79%*cuCWF)SH?jUWQE7$5_ngIoL@}DH%r*BN-yB-706Vh
z5>oOW7b5J~S4(Gc=EIG)Jh~vhnRs)c#~wNtWXCb~yc4g?J8@0NrBQgExTFXHhhJ5C
zA2R9v150~+Y43?Iq_q8H+IA{A0M2yI4l&BCwfUa1aAtYu;q1=Cy5~NcWnaqQtl0P`
zw4uTRM+ax^t?M_hr|L45EorvptESd_yO)~0%T4<ioAy6y>Rn{F0*H6k+_rvbP4(Za
z$vE4Woi8jpU&uJSW{s=P)_d(4=Yd({KU<wQ_vgVts_v1k1r7nt2iI(fwauPcHgC_G
zw`+_vc(UvsjS)xtz2GlHpM)MV4=*n5IiBelNVoge5Osp`QE;*Qs3$ZHj9PF<!^`Gv
zS@X91vvZ?awn^)>&Rf)}&9BX_!humuy6$Y29nndTXW0S$W;n~9(Qi&?+2OK?1mv%$
zJW@yNtAI@);G;K;=qC%k3bjH6o2Pp7SUiS<`DGj_4z2J^Z~l2O?d7T9UF~<EGV|<r
zpaO?nLRH3X>u#Caj>hoo5RyhPgepm`XiN`CfV*^*G{dcC>_;#VE=k%r8V!WD{wJg1
zgMLZUdiqYI(PORJ<F6TBql;n3h)ZiJTs3Z;=z{5jIZk^~+~9*V8390(5HxZWg>FC+
zqm!2nr+`O%!iljlQ_SpVN7@VhX(hjrcND`uZ4NEPvd6KelGKX)>_r1#sp(Iw0#*Qr
zeoK-Dp@Ll)U_7;6WvI2$N3eM-N&X7niQ~6g(r8=Iuyt&!R_m`Q)B{Jw59CR7j(Q14
zUj0cO#KkO6@mZ!1ZH%&fS~lWy41;@;MsQ5MB!NVYd{yyU=$u0Mvk_g?fiis8V0Xb+
z7aAA2d#-rJYD+qY+c6x5BB|S8Lcy1Dp8$Pz$??|n3_hn9aoL!Epy<Nev=s*p*<?N!
z^^<Q4Y66~P%uCDwb^7gGDMW?PVY&&0sJNj8#p#$iW(py9b)rst?fldy8u0$!T7)b}
zq%6^dKP$kf0Ny5Z<KdA06$bg}0)KaaQ3`qET%g53>KWREwdezhMDwTw=iF!T9v%q;
zjf7n%#-Cjz8gk@MeWO9>%mX}smha;*C%EDafnoSlgb)M)B1!=jy0@sTAWg#ODYB?K
zj!BaQ6^!6pNwq;_0Ahi;I@Lmm@I4&I@%V5yj|xFq!ls<aMXiuTAsE2GF88**60>$(
z#GiQ#;BPY2Dj()1s`#SuNHAArj7gyg1QcZ)U4$=8;NuOI5#j3)5<w(@Lp9}qm}(5h
zr(?2e&7r>lVZt(lWkv>7EAkD~K>{P(R@Fq9h8{87MPW`#%t01xVkE5aswwxZT0z1I
zq-(=;P_{xFMl1Q0i##yXLMS4|q3K=t%l|--%BsC?+1~b#_O|ri!K{5K>04ne%S^)}
z(~vTz+xpW?LzX%I{5pGj_h~{mT%fB=drpwL!4+%OvbAy1+L*C6Cy%c&Mq}-&qx#mH
z@4q=;n+o2Yx-<20^YYfci(B_*wsvP6JrL)7e)AIxf^QSLQ*_4K2pyUb*LF8?Coz8`
zYd?19#)rz>TMKVJJiX|B`GerB@P6>ljihhUehgT9Z}<npb8T}sma5ybO#7;{_O|6G
zmehfT)~s`PatH!0%jO37rOgei0A<cE+nW~cO&PX%nRPF+?gjV5;8JJb5_|Y}tbI0=
zWw*f4tnIyb-g_tc&Z@mJbv|R?F>4@?-nw}6Vuo#8W_K>KI~NQK=l{GS%kG0<vXOmn
z@ZCXR;_c<?_H1?g?5mHMu7$mj{ri&_kiBZz#x2^o?2hiVwdV;kfT&peoH<3!$+Oe<
z$?Lr(wriEO-eTWp=c;a5-?#qfni0tU3qr(>S11|#tiRiT%rj_3zcyHhcA0)%ZG!wu
z>-M2``pb@<A&&lg&Io0d4Fs?{1OjfSY7PVdS;H4OZ@}Y{fU`-+RC5drMmTgiw^y)5
zl(4fUari>mKBw_GhDFquC>ZWO0>`aD;6d)~VNL_tBh%4fJS-lS{s_o1<dQE#wnkGF
z^_a0!%z87ToWDiZ-y+LDp)KE-;47fDYE-!;)snWmla`gr`lRg}6MU@kjgw^X+V7hl
nh~0kE2w|UpJ56zvXU#_;#x|SC(p!JSus`xa5R2JHLP7rxkOIM$

diff --git a/tests/__pycache__/conftest.cpython-314-pytest-9.0.2.pyc b/tests/__pycache__/conftest.cpython-314-pytest-9.0.2.pyc
deleted file mode 100644
index 77454056c76bcc6978ba3a1586788080f8877ce8..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 627
zcmZuu&ubGw6n>kH*-dN>sIV1;Z1EHfyU;CILHgq$qz5GgJf_1ondrcFXPB9#<WgE%
z=+&YJ{{;_%S1<k#MYK8~E&c^U|AD?S-R9!J&imf?-n{Rd*~fS08-Q!!%TM+R<IpDM
z@~^?=R|Nae2Mt@$cQzee`4`=8wWze9drQ|^(~74(tW-ArZe7<~Fz|Z!%VD$F3ud@P
zTQHbggh3s@`DJIy_8ykiS^OW@cRROd9p&le%9LxN<44f07HgP`iKa@2L!OV>>q4fQ
z@jU#q|2|AdBNeKlWJ0Sr)I3xZ6^T^83CCQ9Y)5dZRrIp$m}(DM<6ZZ*o5mw##D|0!
zf4g9rX1OwR>taG~vIk@;8>LE7X(b~`cO}!*)Nd%`m0SZ4TbCr2#zh;(vpzDmE$zFQ
zs?AIdWpEZYXlZ;x#w?>~p(avEbNvx6?d8qW_!V}kc;iKqEUi3=B^6x70x6!SSuFT2
zm4XQxTRj!qXR#;}6XQSI;iDp>tJ3~KtE^UW`|CQ6^9!Dz102C&<2Ni^fP3s8_{YtI
n=3D0^Inf`w@Al4u&S}s&3zE|y`OLltYv1mz|9}m77e`zHQ1qi<

diff --git a/tests/__pycache__/conftest.cpython-314-pytest-9.0.3.pyc b/tests/__pycache__/conftest.cpython-314-pytest-9.0.3.pyc
deleted file mode 100644
index 77454056c76bcc6978ba3a1586788080f8877ce8..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 627
zcmZuu&ubGw6n>kH*-dN>sIV1;Z1EHfyU;CILHgq$qz5GgJf_1ondrcFXPB9#<WgE%
z=+&YJ{{;_%S1<k#MYK8~E&c^U|AD?S-R9!J&imf?-n{Rd*~fS08-Q!!%TM+R<IpDM
z@~^?=R|Nae2Mt@$cQzee`4`=8wWze9drQ|^(~74(tW-ArZe7<~Fz|Z!%VD$F3ud@P
zTQHbggh3s@`DJIy_8ykiS^OW@cRROd9p&le%9LxN<44f07HgP`iKa@2L!OV>>q4fQ
z@jU#q|2|AdBNeKlWJ0Sr)I3xZ6^T^83CCQ9Y)5dZRrIp$m}(DM<6ZZ*o5mw##D|0!
zf4g9rX1OwR>taG~vIk@;8>LE7X(b~`cO}!*)Nd%`m0SZ4TbCr2#zh;(vpzDmE$zFQ
zs?AIdWpEZYXlZ;x#w?>~p(avEbNvx6?d8qW_!V}kc;iKqEUi3=B^6x70x6!SSuFT2
zm4XQxTRj!qXR#;}6XQSI;iDp>tJ3~KtE^UW`|CQ6^9!Dz102C&<2Ni^fP3s8_{YtI
n=3D0^Inf`w@Al4u&S}s&3zE|y`OLltYv1mz|9}m77e`zHQ1qi<

diff --git a/tests/__pycache__/test_compare_snapshots.cpython-314-pytest-9.0.2.pyc b/tests/__pycache__/test_compare_snapshots.cpython-314-pytest-9.0.2.pyc
deleted file mode 100644
index f7f78d51c483834ef31deb1ebd4b44dc05e0ab17..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 40162
zcmeHw33MFCbzslka{z+@2;KmO7sw%Tkl-mE3Q3S6A@P7(&@j?MYz+rPVk8{H?g2@F
zmPPL-&!8i(<Qy+>tT=p<k|pg;mf6kQr?vbxO6;|r?C}N|41w*)yN<J7uai9}(i`qF
z?<M<xRd;pupa%npq!nq=82qlPuBz^-`StIr-c(r;5a2leucp)Iw+TWLGsfZ86L-5D
zf^bEUgsgB{kQ^P3tdpEwN8Llt2H~hD>usP{d|4m4B4$N6J3IVG1KEInEtm~LnX4mo
zv?5z^v@%<HG@K1L2rmRXqs9%*v*cbPz~hi38!1u8!_}!SQOC>Gsi_rK36gJ#Ac@<Y
zdf$sknIFmmtgM!l1)(g&$`+Hd3Mi{&WlKm|7|N<x*-}y#fwF2=wv3e3K-nTzwp?<o
z5n{DN?eHAW4y3cuY)Z|l(X)d}R81=BOjd184)$jfN=jA-5*f93Fsrs?hNC~c@~hFz
z;Kh`ZNoP{gv*}COAtj}@oQOFzcV{Bo8*^zsy`dK9NuNC{_obm@Ev%#ldQytqpHN=z
z8N4`P`JorVL%87o?m+<fLrV_HDY+zfiy%c#IwTLAtKsZ}a}AtD$t(F=oKgVtiy$AA
zLQ;iPDTSq~)&PDj&37TCsOiCh`<^W=+grA16~>p4dlK2yNT6+V+m7bVTi~Mw)uA)+
z#QlkZ9#speDFvF!XZsT8)cfA%=H66aMyolK8c6o`!=uZ}&;Y%t`TGZZ%zBxjzCKM%
z4P1~fBotMv#CCEvbtx<NCe&WdpUKFHGs!J&TeT|v7NiEd*poWDZTk-XPS)$^deb|1
zJr;9oe)cR{00+7+m4)xAx!`FuFYP+!Qi3p$_r>OB9Q@P(ev!<elD**`@i#a3D8tS0
zHAdia>Jk>S+Ji&c%uqJw(W*L6o;oabc61(=k99oLb@+s~*ep4I@{oM&Wcz`xj*};}
zO0&H4q|~L=nE9^5#||Gq+$BB7H-5JB(1EVQa{JN4?N8khlr{LP!@r;%X?+%+UTr;a
zeCyV>T{~NqRAx|Z%|OxMK%%de;an?0R03r?4Ap8`Rff6pg)K@W+@uQr)#CuJ2)Dh0
zzxs`x)8dk`mD6JF#FF-Daq+~`UDIOSM8k<`vF455Yhtc8HZ4})5xlj5+m(WU+1RFO
zarxL&P-pD&?NyPG_qGu6c$Kx#V-iRdI}n!%K37BHiqI;=g?0yGb*rNtr=3&r!Ue?5
z9W9&57{nap0afg!QCSC2Gp8B%J=)}fK{?r*7&w<wl^9lrf3+6C72yZLUAf9Nx!|sA
z&)xKmL&m*}J{nwQ2b*g9p{Qu8Rq0a=ryNc-oN_SLS{yLh=)?<{Q;kftMdXVp8=x;m
z1Yk_8Hkeq7A4`$C6Z}#_n5sY!Mu5MC7Jz9%zfF&VW2Mv}z-LtOJH<T8VoWbVuoS^E
z0GbF>ES)&hmx{S**URzJ3IO+m&CM4Fm6z2_BAHTFLJ4$Hk5?N2Xb}@RPaHla#}7zK
z6fdqufT&0T{+{$VSZ#+(ZSuu*wwL`1tx$Ut{Hsp_utBVo1hI~Ai1o(vR;+3&jaASk
zI}8lFdkBgWaH|)DEMOHd!^2tEVqp;QYl)C`OHP0u$pz4hY%J@OfKg@PhXm-CeAz%;
z$Oa`5@X)VSbOG5v1Z4UcQfUhk``|8s#Nyp7@Tx09w{d$yo?D!N5rLBqgP&v^afjq;
z!XH9EGET|a;yB+HckMbV2<H#2*UQfh3&KjFTjzg*(CIc>m}lUU!MJ;?LkgW*v(>px
zuOYd)Rycu*j#Wb3xlMmc$y2tj%c$GxY~p&$c!0V1;+|HArPSMv=u8f-XCk{8<@5|s
z;Wc_T&b=^?_Bb-mJr1QE#>sCTrxsyhlyL0$Q9|^*QK2~!n&XV-NNS!$Pfw~xb7h9N
zAlP=lGNA&y$VS&~$PDj@saUw<gyvIH{eu@$J-`7`dQ-L|*a6^%<Gyp>z8j8_YHYA2
zrbhSeBW<_E)Eiy}iM1BkpBYBxA}16rA}14leKIg1#gJzFvYI%X!V<0W0J%Bv-NTA9
zsAx4Z$W8r;tPK3LFENlnj(o$Xxz$wPS<TU-1)*n|KJaEfvz5=Z(G2ZrJD=I9;#_Qu
zl7kYaD*B)}C~`WR>Q}XT%S>)5zWxOCp#A}XE5Zk%#bd6qXWkfj>*w;Jt)q_VaMc@2
zzBrN-SC1vfp2gF%<Kfj)qW;N?t4Bv@u3#o7u^OwxCnm(z*yFM<ekLcb8dC@u53iaM
z^-o@0HToHvE11bitjp@~3Ai$o!<HmYlq?~yZE?;<oE9b>-~t@{q?<{a7D%`q2}k0j
zY=yy7_9GxuYsL(%CNof{NBSI%+RRZ)ji;bLbC&+{tJiC;C$9&rv$SDM%83BR!wplS
z{>h6CI7cy8Fq4y5jn&~36Ji6Kqie6Z#)fj@+OeVW@Y*R+|K!EBI7=~CFq4y5jn&~3
zaAlTRdcjtNKrL_fS^7Zu7a$@;@c#!9LJ}T8)cVwp6OnO4MUsHB6X)zM1dk!ujbIOe
z6Utsp?nCf%2=*hepWG|R<UTV9Y5);TWH26pus~!FEoL*z?W=ae9n^0C;F$8Y_Ukp*
zcIQJakCZY0EGE5TKj~+(X6Hkbhy7&A2P{+G#mVcOoDZW;4vW@MUc)G@HGtmm(6t61
zr!|NRqf|n-VxuJaK&cIK6aHb$^)Q+1rrAZSvzg!K<!1q_)PD(}%$$DMZ2ZxS+AkH&
z=N6$wu!z{gL&H!Xna84K9y{hSkDX=fmY&C8c7Evd*u%|Z@4_gRn8$3CBo7*=9tx+X
zigKzylO5JQ5q63)cl~*szrSb9-#3)8wtT3b<Heu6d3&j7-cscl6y;!%{myO0OmxAt
zI6ty&Dn#aRg=G$xx5}9oJnsX{VV@*E^f~P3=5U~Bq#O?*et&AmN%F%iuGAbO979H1
zT$y<dw!0Uw7PH;WO(d@+Y#Mx#Lw#8}t;#Amw!mVz#)erJSCVncziUi+d)wIhvE;R_
zW6$Tr^<&SEhu2Su`X?{0N6i~^1v5E`)mR-qF(IyhM4C78U7U!8G*OlZ68$Mz)&jB&
zZo#2GOowFo{7|A#zY><^vuQ=m_N50>AiK!Q2^{jL5p*Fqg#byRavFeEE6ZvY%$i9#
zk<BXUGea=g&}T%JlYL;<>`5oH$rRX2<r@yIf-8h(XprAejF!q4><__V_*c<s^nX4N
zV$vO_%d`4Uz~x!T0LiYthh?_~0K~LFnkJzYI}De^T~y~R9+7l8k4RPoFNk0A0*d;y
zMTjKr)ZKkzu${Wsl0Y`u!R(Fu;hwxR<Wz)-K+d>RvWh@1$#K3t?tW4@|Ll6bt2w$q
zzySg75AoDC&iyeDp++jN^tcVnR+0Myd`6Nd?k#eE_~zmM@EJWDXRtAPfq1&W{n3RZ
ze#5T?!SQW)(4Mf>#sQO@X_dFwr&Z2kk3Wub0Kq{7?FbGbK-{_^Dn~Hg2tf1F>8^BO
z3Hs<1w6ZD35TGwuMaN~M#k#(p(2{gdY5-6^(Z~F+DmwEy53IJ=4sodMy?pDJ@a8W9
z08JsXG`FlJA9-TbI~}flqrVVdn-iO_dngDuPl@^`FE;1UN{873m!8DhtQMbuE7UND
zJ`Uq3jm|7;B;$&^iqP2&=-d_e06L$YH#&O>Iv<`FIx`fV13G&QWGg~vA3<kd5ju<W
zKxfhD**NRy>;`mBAv!BB!>}qD05|+5-VyJ-qTr>Hn1?RKMl0$y64cY9SLD9LnN*)V
zIM6p-jCp%XV_w<D1900S#C!T@jd(ppLg^_E@g(7VyX4?SEJQoB*3BF7#5f|J|J0`s
z@q7zo1Zrg2$r%eMNbIyqV^+{`6I+%;;#dgZ8L;r30fX<5Nv>SL>0>i>8!S_o-UlU7
zjASCR=(h56c4jN2AnNY}Fu4Sotc!DETW-~s!typuEN>eRw@r!qCoi^*UZlB#nVcl`
zSS3C&A+}A2A8L<qGs<>srKp4RlA^#@3sMvbBbl!p1twXT|2~TxRo;-qj6+g+nTs*0
zBF5vz_{E1VN1=&?%28+{5w#Eo5E_D%JyM$v4P;TudBmrgBF`Fvyr2s39m*GbQv))S
zWVBtS5qS2N7xAVq0x*$S7j*^-;dME2)Aecs#>1PYME#Q&H|4_XXtuzmC$ToG#V6nj
zRTS31old~a$2%$s1ZNPS?x3g$@OhNaBKU_0dJv=#oCUzEENLu6fd48+lIbdo)6;TC
zB*5j_dN1JgG~E^e(EDR$ycs(H-N|tm<xh*Ea;2Q2!iR1_Iv|PJAgC@OqFo2H#oSMF
z3c}J1<z+$I(}!FTG7nYS1G{7&blqh?+4|v<GKgS?Jcx0E^OpyyS%cG-<g7B3(wgjl
zcB*<5*Zv&bxoGx1!^?Y3*WEc0LAYs3)IWK#i6|PFEpX{ctjKEd3Ai$gqJiOq7QJ~^
zc~7#q1g(LEA6XXk6In1|kp;^;{1|<oLr7t1B?LnXAGQ*LA%#>4!C20q(gZ&<#Dqh9
z`?*0S4e`N##JJKfu*-P)6$FGad>&GEVog2a4AjkShRVx5scb5V7PjrPp<>BqzleA1
z1z>Unf|JW~V#l>(g}N;_n+tXO-(OOw>wuD6UB`I1V@lLNd9eeHZkQ{W$w^X=RpJwH
zX#qENCR8M+_(-_xqsGl<M6+K)fFZLFj+9i^*0IZ6vSDK7jyYhZO}ne`barUDGAACt
z_L)L-+s)I3=%M#d6{5$XBo{qC9zH%L>Yu!LeDoEXE11biQjb;Q6L4t(Ek91QtYm0O
z7ABAYAluNOdC^KEq|aC&WMbv4w6bKgFP1>cB{}iPwWh*~)|<h?ioNeXS6FcbN^&cX
zjE9d*iTWom9vQtva|JUwN$Rmmd;%^lAmzu2lr0P?$wHY2X5chfjnYbeftrbtZRP1?
zahoq8I->Eqh;^^di6^gj7aDiJySvc%#QPTujVGZb*LZR~d~!<EKY1v@;Bw3sxb!5c
z$*S=QxU_(fA16YtvLfUIQ^`6aQ5xi~7`-&!Ovb6SRJSSB>eosjCHPUEx&E2LhQ04T
zU)XT;d&>$No`I6whG)jZ&rFH>Cl4j)Rl#h5OHY!TtQwzyOEZx&2oC{@w|EzQf~B;b
znQoPCrmV-Awvq9i7S5;Q-d(={R_}|<-SQ){c*+g;AxEceK%?Z3`@rfII2GsIEf8zn
zjb<O(4yCZ7V-;KQjF$Fu@T0>rE%Q#ee6Q$O#VzA9oFm4Q_P}yHOM7IsMTcGc<7DM8
zcVF9f<~YHkF!LGh>oTnjG`Mng+0w06w`KVkt~mC^#UeM7zdK@lC9Y>&$XIlMrP^<d
zka5;mUVsLd0jr*JfkZ0@mCr#_T+OsubM>WQU2kT%jRY!VYNut{(_?hm(_^^y+VObI
zG17`_n_xjx;If{G(lt(-W9kMhX^W|`z$?+mi8*^GW-vroP~Jpv0Kq}Lc?ef4of%5^
zWzz$y=It8<7pST&m0=C|P#=alXB7Ed-{2W=jAArFk?$2cJ%U}K?^R(o4}PK37UG5F
zOLp)X%hIP^^l9j#s4bgS#9QVui_*1F%LqB)?3N~X+dLb0vup8X=wC%(<!v>~###zB
zv7FfQnwqPL<-;2xdHrbu#=|XBqW;N?ExGVUmSu_8RF<5;K4|V1)UJuq^d#33($}A6
z4fq7KAXG<>^{BA5aE{{0zlPv-1iy>`$)hrc;A;qa5ZD?#Q7=~zT!DYJ4FEHEHlxAw
zNe99c1Rf=@lfW*=Jt%KQBWNpqMC`=g2#UR0jG%9oHiBk-VC)o0K%m!R>^w9K$d^t&
zl^Ry<BQ-{Ws#<6;7pVar#<n64BX}5yhjG3h20!sI1S}qg@?Hbe!|?YvQp2|}MnJb`
zk7f}U#;EKVVT@If+I@%x$X3Bd@q+FSP^4;~hYL3Ts&$0ubIbEHsbu;r1gO0X1i@qg
ze1Hx|F{mtAuJzk^Yo~)}2E=PsmlL;N4;5BzhjVV#_VMucDN+CA#qFb?rMZHcoFw&F
zB|b4BZlA_rpS?s#g>!Dh-tq9>DN+CAp#()!%oe!xB&o@&@rem>?{s)Mc!jTZ7wU<3
zxPFFr__FC8)|2QRt~XuCymxqZU+#=Zj`DOChIHN$aS+f;A~`;N5pni(c43T)q6T9D
ztp@kENhe`TqHIFR(#?0MRoRZFXu<PCDP@>egAD+@1B2OUdH@9F#V8HqCIGa=8s1TY
z;83L%+}yCCPNE-oKcb{2k;$ZB!vJ1sok3_ywYq@>=Jx@Z(k3A=Ko9oc+*@ec59eId
z{_*hsDN+CAp#<pxW(!<;lGJ3?_{4;`e>w~X>|NLQ7S`^9b8hXf@$jxGQUBz{U1+w(
zT)|9El6tHXpMXnL_eJf&IDC)*iA%iu9U^zZo;R@9O~y&jbVsKaC+>ffahY3*oLa-8
zXWbx^brpH~K>sB&nW_H{&uR0J5Yc}tEc$PGPam%*vTtUuVVhfg6nRrh>51ryBL}yr
z!Bz(^sV5R0G48gGkTpQFXk!r%U0+SC2uCeegt?7kB^kx=r*agn3phMd5Jw3DTjz^u
zRb-4JpT037)`)7Y5(ynH5};Ic#Mj)MP=^PSN*!QxY0^s_e0@--OEKj+GZM)fCc&Ew
zG}mAs?DH~^x>zPwf?5LTo+we>60ng7h0qpuZy{drVL3e@W8U2U&2U>E;7kKE3HDsN
z_&xY~>TV()PFJqaMH+LJ>qlMFl@duxxedGCeeC_0a=V`%uarhz5aK;nlaH*%z>9{Q
zxbu2bVa-lB=ho~T5AU23^-ms3aAOC|7P#~zsmZGGi3xEh295U>!fSGCw-v(MZ=NfJ
zAJ2);z5m$vUdkPO4pIQe!_Q5L`X>)1;m2vVz@;ZiO;(LhOo-2!k?9XNU_>`&_-&0D
z{|xaAm(wcWL{Qpr@w<2#!CUaJE(4$&F5I52cS0`DWA_4HPxEa70JTqG-6Z_81Aa+z
z+<hEQ7W>3|rR@_ClEwDd%KE`p5g?0@MXeg~OCp;d9yj(pWLyPq!1!ew;g=jw<m6}0
zGRzjnWgsm7{Gqsua7NQw0b+#3-fC|dHl*lw-ZISDE}4ax4h2Hc@0e8@mjre*zSU`K
z6UL2~@WAIg2V}zXRQ48HW({H1<0VDy?4OIZ1FNyCh!dAu#}XkA2Y~z5_7>X`n!j>b
z@{#ekO6YSN{{Ycqf~OY7|3StdEefHL`V)iEGpXLhh4i43=!??OX*FsDCXoO=w3=_#
zoc%o(%lUR{Ip2O_q~bs_3!8OC2U026N{jF+o6zsAF;&66vr4EAaQTLAN_Rso)09q4
z<4BN{w-LO9;1Ght0Al<qB{%Mss{Aot>p<`n0Dcd!ZG2{jjX`7y<$Y{-NVz|ys)=(c
zZR1QrM9m+dmFQz;)I}1j765=g0^#6Gn)2a8qwWtXR*rS$D^`y>r^Bsa^0*1s1dGKZ
z7j9)H50+*|j$7D*<-p#-<ybK!h$W;xCvLcQW<0!MO4L7jal`1VG*>W_?D8$F&vFx%
z94m&zq_~0VEI@79QJMyG(TN-lX7nb5+RC%K#n@a7H8&bytV!vb7Y#PGlSe~?8I7MO
z4QB0ZXmF{;S97PqCDwN+aiGBq<8R^3KjZO78XOoxkM|FM^R=i%_dcRQ(SHPml$3o7
zQ{M(~VhA<hAAa@Mq6cu#LaG$}8@&1*0G4%g#Ao<jykw<@%J;DBPXO3OsnQ@9gPx@a
zl6^xxDLIR~#Hw0LDH3R3AMdN?0hna)X)757Ys%_t&f;AX!H9x;CgLuMdXnvncnj;Z
z9Bh%u<ybK!$mWS)yN!+k5sXfW`X?_&N5M{uxq_Kwmv3QxmYcBTSTQ6f#po<V@ShV^
zh7&{|B@y(IU~KW!0ud}P2$d#+I0^kD;{N1dCfzrfEj|5;CY<u`OH8A+M2aY$7JBy}
zCcuJd*lc{~T<23!L!80t&}<V6!oTOVwISQg@RntdL)h1_#Eyrs7vciy!^p#i%l0}L
z<Kv$Y{!dXqauoL2hj$lT${O<jgU<o-Dg=HVoUFo12f%wd16v8e6wtPo!hb%bq^J>@
zak%cRBvXO-$(gb*36?}r7=&MzW`ga4^h;3M0*d0;=4OHTq+$Pp^b5Z^Z<+cyq+hbK
zd=`4M0iJQLjCV0%yv8DRuv+(~67aqhx|yiej7YWj8C56XZt6IIk^}}8c&{8=eHCQW
zmGqMrSK>Nx%oWTeyL=0)v)qIw$BH2VSIFw|N7DJExRTmy*T7dh0f8hh!nt@+@1J7X
ze?Wi(piCl|LePUCh2Sgzer4|;Vj+U}@B((u?8UJ=A-8808jYj4BT?*L!0oBKEdZcT
zf~}J9&kkleMmMy@a{T>rmSf94L?ZH);|b7S+^lawU{S??>cStFyx>U4xM8;;XA@r2
zkBkROT$U18{oV;}iVx26X=^2pJB%1r<J<r*HF#(}xjLCQ)O<42s*D@9bXOQx;>_;B
zm9Z$@7S}fY`!xvNOs?syGFqEwh&5(bUgKNsambD#=a5Tgk<S^}c(SwBY-OYjn|1?i
zUW<R`U4P!!x!9;>p3jeVE;VyTD&vQk?i=v{*~#ENL(V$)ePZigZq({rX{5|Eybz-z
z9)$Rp%2U6=S&bkjxf|D{lcO`LC%BU>FEsD8nyacO`DiZV345qD-fXva_I5yvVFSMI
za`l;7Bl*kLWzo}8plscM@%t9VaEI{aHSthU40lDh@ihgmXC&Q42aHUG(X(-e7;Xo|
zZ{tc_*d9>%2EJ4)3U7lkx;*E^-!=^|DXSA2$lqbdvE_SQbwb*4Bm5J*!-@MMcsyHP
zg4Z0~7r|9YQkpxVoV##;k=+Z9l&?T5&6T>8RDKgubQkNdV(PaLTtl!A0NAmQln4li
zKyVr(4hb_xyyZfoZzvUbr6oDo11IAR84xIbqgIQ|coZ#gQGr)a$S8bkZhU^t(=*hc
zQ8k~Mg3aQxisn*>;msT>q`dUi8n78xBCUc&Ch*KK#L@I0zLbWx{Xp?F54pSM#+!2%
z^tbTqyp7-;1nme8As`m?N;B466SMspIg`ltYQg@&0SE(xbh1}-CRGhb81}pCOKCX5
zB&GZiJNaz{Pa^mo1pfrVbp$s6s7O#C*j(Ql3|-AM;Cv<F)%euhUSRO<k91a*H*4z*
zB2M{qiE94|Z%{`pE`KIAPS>m$d#O;fVN~Q&V%3zmVq9GD=Aqwu@;9E$t>2qpxo=W@
ze7Z#W55yY1e*3k>xsCh3z2^PiZ#7Ro-IaUxh5XZ}b1`{ReDQ;dn%7_W!V7Qio~me^
ztZ2NxW;#^)`jM+gUhBB$5-QjKAYA?W@YP|kZoU55tDi+9SA>9KOBaMVqNR)fj6zVm
zUI0ccBL{Y`(P4T4-WY<Rkyr<k*CMPspMd)JJn$g!c)5zk`*+d9_{Xi0BN5McBf%r9
z{YeiL7>7M$^uPieD`WIRiIp*e_35FpGv7z*iMewPQUWa2Juk+{m>|a(nalE_Ge&S6
z&yz8Vwv6%1wu~`w+Hw9H@gQN0|BeyQxiZEOVT@mY<cyIqEaM61$QW6>IWk6**_CIE
zjM>eBF$N7>D`JclgfUhWF~-VyFvd!wXXC6hM%*(u0F3e9&WAB7AHW1x{tJLu*re}t
zEzupkbQi%-5&Ulie~n-c<U9=Zkett;=X8e)La6ySyXh2ti?-f|qT5ycOSr*9qUjy^
zl}}EJPkkC`y7GTvn3B9&!sz%2lrja!1+OEr(s4IXNWLBPgNMZ2vOq%}lG~yJdF)jn
ziK!LP#@Wep722uL%~T^?`e*JJX$He^Wvn*~-7OO+V=64htg%r@fOmC9^he@OvnV9q
zPNwLX4bETeTx8~qR7O1QJU<rq6T15~gR1EY2~%tAC^jf0;dlV(Zq=!)9NiTyqP(pl
zV>~$*9%SB$DKo|s5+e`ebjB0vbk}SbHR~HG5Z75dpu2vckLBt!?kNS!)@3wZ3YD$P
z=y?&{4dP2{<G~`j8|q$Td<U-QwMLnFhHn@$FvmFSbQj-<0ZNH-V?J~@7EyrX3MWRy
zGYP7Yj8tHNJP79Lp6KPvm+$+}4G!w6iu3X-$`7En^5+OpC7~pER+U8g3#b>XQGSHg
z|0@DiffS^h%3mS)?+E?}g8zx&e<8Sy;6nrl5FA7>yH-#^xrUWjX!xzD5<tGjoV5Tn
zMc6Qn<)#vV9i#rEGmJL6>G*Nb4>%Q|xYA!kx2oSp0Wie-v6HZ)*7Ty4W0wnyHjetI
zMUa?Rj)M`d3&iJH7{lrO({e8M;-r}PgbDj95%ztNCt{xO#DY)kwhH_BGXU`y?~aHZ
zlbD;Z4?8hhn1TojfyYt;dxP1rmXBm9``IZ3$e2t^86$UGnMu+_uGA!6ey)^}sTQAU
z-!hrhN4Kg0i=C(P5VuzzzGm99&YSkLx6#HTkyjIUGpk!Cvpxad=!e;wV?K;Yb=or@
zHdaN<$7~lh`Zv!&nprzwKJa$(?sD}_LB6tVT~m;ES#~MlS%-PQd9e=V>v6xW;#O|#
z!;fI>8Ai@?>{&Y)`|u}e>^XYVXkwF*LageH89DQ8h*X9Ukg14QNLBp)*_lcya{gb(
zgRsKo?~Jk3-$Y>I$wsqBBL!mKig*~ryp^Z^iWBpy%VH=~2&MU8v-L&HA*n`MG{at7
z#feAev)ki%l`$g5Sr?BgK{WassrLL&I&JK{nMgchQi@D<yfR*m^nx2XFy28_yLor}
zk*gykSC8#K;@B;g{{GIYCEWLq8u((K0aqi&s7p)B)~z<`7Kz9;(lTjzyrxJ*UNjFJ
zSY-5UoJ}0agh5P>WUA*NB)g71Nv-y=1}Y>gXuwteGk_64hHewH{fLhw`+H2$c%-7a
zd2lG38Ok=Jh&Tc-sMoXoJtGIWmss2E+fu?z4~AxVS9{=<4X~LDbq0vgC6Pc)kAUXI
zGI)|cctm}(+THlbd+?DLw;$_>9yDX;+vzJ$lt026-$w9N1g1lwAG3o9E(3r#_@l-W
z+BDrA9lQk8r2q-tr2tX(v<MP<5k$(jDB##8P6PT4Vv9L-;Kz7}|AwHvVxW2HKyb<c
zQ4rq2=Isa$Avg>`^YjfSdQ{EN?oHH)SnZt6OCAu^6)%F{#!jC^a148P_atB~atG$0
zLU0@lx%Yi<qn-uRses<aA}bVn77X74U1m&eQRrS#Wr{9DT~W10J5$umdbnwUI^sk@
zxs-PSJPt3zmNwvVh%6iHC`8u5!ZbtmDCcpovrbKiR=?AJU3~laA8fsO>0j)d4y}0e
znQKeG^1^gz*_&I(E_`LrZJ&E%;HQGyAN*-Rs9eO{5QU0Hs}th3SEyS0`m0x8g)rFB
zSM%X0oNsZ#ur#6-Lt<fHLp?wiVqT3L1jFKj0lWb5uDKZvA%GTEvc3Mw)mL(2{pc&d
z1h=XG$Izgj|K#D)1y(R&=5ApddSMch#qA1W{RiQi*GIlEGPYrAdDHmvru_1je7JSg
zJsqxj<9HzqL0%iL^-zF21?iu>xRFG6VYa}fC$ToG#V01jjnm=vIdR|Araj}E_CNw)
ze$zfk<e+@hzVYzBDY!~Ld83eK3na^~(!?!s-}N1=Y{JaJh1{k+^vWcr&3;*Rnz$D>
zT{lFV`___3XUvm}1v_{9^<{qcyRzTIx$`#&5OtLhf*#DK5S#_T$8Km?hyd*s{I2W)
z&zd_+4RCL1t>^LE0stDefen)I&knc=IcB^*N^<C78%|i>2TQI2dL%bMujC;M{=9nF
z2EK1p)GBaNqARl<e3xpv9{RNeaDc)}Ro8dm3bSvzXZWd5nYH?<KK=j>8$Xq4_cVhx
z4CZRLB+#zRs*o2c;~0d2#`>b8n}v1QSvb3qu#&^vvWF{U7Fw>1Da<WywDIl)dWi@A
zro~JieA-DRoyn@i-qi&!38_pbGT9*|rPJqFPz%8B*coLo3G1$?am(aph-vs<HuOQm
zd(*s`go1ITE@fzdSiiJD>QX8>M3yTMOPIbkjC!t-#Zb>RVK&6BwFtU2-5;7)e>_Ar
z!^J_J)ovMXLRX_Q6m7w>2IxV36Y3+6SjPFCO<%N?A6&bXU%7cw+)~6QjN%U>wZGc?
zEA>;6#_>qwRHS)4(tOijh&-0tD-|LVE_+^vPUR0Os$M^R^)xVt#b5ac|8&ju-mf=*
zv*z8Of3GeVIx@YY;kHMps=q6^ssixhH-BJe%(fq%nAm~tkjWGmI&pA|j#H7i)39OS
zi>x~JpO&wdaYHl?yjO@Azs)sV-zBoW+o);3{{y^Ua^`!5=DWjUUD2J;{8e;-6wRC)
zhTf(dzs)CPaZhGrz8&bmxMHkaeHH;bpB)ujt@a042@Nm7p1GGeb6{{!VdJDg{nj8P
z#u=n_G-lI%?vdOE$ke13X9d176?wl6Da#U15JQO!d%}o?Y14N=v<rMuQZSPTtYI%8
zw8Em!m4IAYz`Q<Z8#MnWFfw7uvl8Jk2z^os@=x&jQ8X;Qq6uW&th|}Nh{as6Ny9?T
z`Alrl_Ek5*-PEgak1N7-r1saBeQ8;4#pdrV&C@AaI~9(?LZh6x?%DwY#_^Ra`X?{0
zBjS@;LNB3Yq?b*I>x|qjuJ$DM$13p&xI*VN!$){DKm3=U)73B+pcWnw{phxx(;f&U
zz+F?1TJ}4c>zu}2Q~j2`JRZ%QW^-+xbDFiA<D6zpZw_;sF~g!c4SO%boPO9lpW>XR
zyPlFc{S&0&c5_-mF2zk`C5rh~0Dur2!A58&<6;A5pJoB5Y_LZ|<63G?o-K5q>C2y}
zvSl~Pto2&qY1A)3&-@I_#ZTuWGI`6&$2P@yrpKn(-x94*4<dHX@Uf%U-715Y^13r*
zgwR_Le0y@3UUP$hccMsAbl8<yWkAVmanC?#b0<a#6dm1+W!f!jGB@Ytf`}O_G8rpZ
zk9{YQ2qA>kkO(tga1T`%-5jzRANbEd9~TL^`LZ#Y&rx#2{Oxw;bmBkv6aV=o&Nzr(
z>iN4c%sVlYr1`ACRN2%vo=_Jd%y#y!57rLI4Y*gj%hflXO`)=N8KW;EHv!@k4-^^v
zg59f(Z^ZSy+9)&6@NJoM#K1t)C$5a4sgL=&L;Y!0O%I$Swmao-p%>-v5JZs1{5hn$
zlxj>8?=~SU#Ji2MhDn#`+o_Q(#j2G>Se-bwAt5NWm|cuu34*`GvZa_J&hFKiI)G&d
z5xj-qZ3OQiXh(1e!C?Tg5a-jzyJ$ZB;S~pVvjV~Fv=8UX%-AQoZkmV=ZSbN|S?`rP
z%3~JAmO8WTt8Rt+tLUVs%0%_@vD1a>O{2b2{_C>JLS)6S*MF(LSXnst^`>vS-tBm=
zk|_(-QBW4D1Eb#CqENN?<07@Q+BQ&zRMsF^j{pU-S!^3&yo><N2v*xh;LcK~rxEvG
zZoDT3JdL*n0MxdD4Pq-apDgzbCPBj#js3d`T4~E<8h_nF4bHHZ5zMe8d|UIgBF(3l
zQKbAa;vS-`=EJD!zVsOdZlcF%{0LLPNdyHYGQ|x*^PNp!LXDWR<QSH>BG`f;jo=p%
z{4Rn&L_o|q<om9{>{<lt0BGV~`r7ix6`aF(SM?@<+b)O0@gIc_c(Pv*{!#GHguwTO
zrGFt*{8%_RE*!jFDLBQ?*MF}5Lua+ad)Fm6t8QcJ_C{9ja6G1$LkbYaw*I}gI>)*X
z1pxPsI;tE^9|{2OwXAToekcIAcgRugX#P+DaIbBJqYew}pm4Y2@ec(6_YOK69F2Dc
I0OT9}KLTr!%K!iX

diff --git a/tests/__pycache__/test_compare_snapshots.cpython-314-pytest-9.0.3.pyc b/tests/__pycache__/test_compare_snapshots.cpython-314-pytest-9.0.3.pyc
deleted file mode 100644
index f7f78d51c483834ef31deb1ebd4b44dc05e0ab17..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 40162
zcmeHw33MFCbzslka{z+@2;KmO7sw%Tkl-mE3Q3S6A@P7(&@j?MYz+rPVk8{H?g2@F
zmPPL-&!8i(<Qy+>tT=p<k|pg;mf6kQr?vbxO6;|r?C}N|41w*)yN<J7uai9}(i`qF
z?<M<xRd;pupa%npq!nq=82qlPuBz^-`StIr-c(r;5a2leucp)Iw+TWLGsfZ86L-5D
zf^bEUgsgB{kQ^P3tdpEwN8Llt2H~hD>usP{d|4m4B4$N6J3IVG1KEInEtm~LnX4mo
zv?5z^v@%<HG@K1L2rmRXqs9%*v*cbPz~hi38!1u8!_}!SQOC>Gsi_rK36gJ#Ac@<Y
zdf$sknIFmmtgM!l1)(g&$`+Hd3Mi{&WlKm|7|N<x*-}y#fwF2=wv3e3K-nTzwp?<o
z5n{DN?eHAW4y3cuY)Z|l(X)d}R81=BOjd184)$jfN=jA-5*f93Fsrs?hNC~c@~hFz
z;Kh`ZNoP{gv*}COAtj}@oQOFzcV{Bo8*^zsy`dK9NuNC{_obm@Ev%#ldQytqpHN=z
z8N4`P`JorVL%87o?m+<fLrV_HDY+zfiy%c#IwTLAtKsZ}a}AtD$t(F=oKgVtiy$AA
zLQ;iPDTSq~)&PDj&37TCsOiCh`<^W=+grA16~>p4dlK2yNT6+V+m7bVTi~Mw)uA)+
z#QlkZ9#speDFvF!XZsT8)cfA%=H66aMyolK8c6o`!=uZ}&;Y%t`TGZZ%zBxjzCKM%
z4P1~fBotMv#CCEvbtx<NCe&WdpUKFHGs!J&TeT|v7NiEd*poWDZTk-XPS)$^deb|1
zJr;9oe)cR{00+7+m4)xAx!`FuFYP+!Qi3p$_r>OB9Q@P(ev!<elD**`@i#a3D8tS0
zHAdia>Jk>S+Ji&c%uqJw(W*L6o;oabc61(=k99oLb@+s~*ep4I@{oM&Wcz`xj*};}
zO0&H4q|~L=nE9^5#||Gq+$BB7H-5JB(1EVQa{JN4?N8khlr{LP!@r;%X?+%+UTr;a
zeCyV>T{~NqRAx|Z%|OxMK%%de;an?0R03r?4Ap8`Rff6pg)K@W+@uQr)#CuJ2)Dh0
zzxs`x)8dk`mD6JF#FF-Daq+~`UDIOSM8k<`vF455Yhtc8HZ4})5xlj5+m(WU+1RFO
zarxL&P-pD&?NyPG_qGu6c$Kx#V-iRdI}n!%K37BHiqI;=g?0yGb*rNtr=3&r!Ue?5
z9W9&57{nap0afg!QCSC2Gp8B%J=)}fK{?r*7&w<wl^9lrf3+6C72yZLUAf9Nx!|sA
z&)xKmL&m*}J{nwQ2b*g9p{Qu8Rq0a=ryNc-oN_SLS{yLh=)?<{Q;kftMdXVp8=x;m
z1Yk_8Hkeq7A4`$C6Z}#_n5sY!Mu5MC7Jz9%zfF&VW2Mv}z-LtOJH<T8VoWbVuoS^E
z0GbF>ES)&hmx{S**URzJ3IO+m&CM4Fm6z2_BAHTFLJ4$Hk5?N2Xb}@RPaHla#}7zK
z6fdqufT&0T{+{$VSZ#+(ZSuu*wwL`1tx$Ut{Hsp_utBVo1hI~Ai1o(vR;+3&jaASk
zI}8lFdkBgWaH|)DEMOHd!^2tEVqp;QYl)C`OHP0u$pz4hY%J@OfKg@PhXm-CeAz%;
z$Oa`5@X)VSbOG5v1Z4UcQfUhk``|8s#Nyp7@Tx09w{d$yo?D!N5rLBqgP&v^afjq;
z!XH9EGET|a;yB+HckMbV2<H#2*UQfh3&KjFTjzg*(CIc>m}lUU!MJ;?LkgW*v(>px
zuOYd)Rycu*j#Wb3xlMmc$y2tj%c$GxY~p&$c!0V1;+|HArPSMv=u8f-XCk{8<@5|s
z;Wc_T&b=^?_Bb-mJr1QE#>sCTrxsyhlyL0$Q9|^*QK2~!n&XV-NNS!$Pfw~xb7h9N
zAlP=lGNA&y$VS&~$PDj@saUw<gyvIH{eu@$J-`7`dQ-L|*a6^%<Gyp>z8j8_YHYA2
zrbhSeBW<_E)Eiy}iM1BkpBYBxA}16rA}14leKIg1#gJzFvYI%X!V<0W0J%Bv-NTA9
zsAx4Z$W8r;tPK3LFENlnj(o$Xxz$wPS<TU-1)*n|KJaEfvz5=Z(G2ZrJD=I9;#_Qu
zl7kYaD*B)}C~`WR>Q}XT%S>)5zWxOCp#A}XE5Zk%#bd6qXWkfj>*w;Jt)q_VaMc@2
zzBrN-SC1vfp2gF%<Kfj)qW;N?t4Bv@u3#o7u^OwxCnm(z*yFM<ekLcb8dC@u53iaM
z^-o@0HToHvE11bitjp@~3Ai$o!<HmYlq?~yZE?;<oE9b>-~t@{q?<{a7D%`q2}k0j
zY=yy7_9GxuYsL(%CNof{NBSI%+RRZ)ji;bLbC&+{tJiC;C$9&rv$SDM%83BR!wplS
z{>h6CI7cy8Fq4y5jn&~36Ji6Kqie6Z#)fj@+OeVW@Y*R+|K!EBI7=~CFq4y5jn&~3
zaAlTRdcjtNKrL_fS^7Zu7a$@;@c#!9LJ}T8)cVwp6OnO4MUsHB6X)zM1dk!ujbIOe
z6Utsp?nCf%2=*hepWG|R<UTV9Y5);TWH26pus~!FEoL*z?W=ae9n^0C;F$8Y_Ukp*
zcIQJakCZY0EGE5TKj~+(X6Hkbhy7&A2P{+G#mVcOoDZW;4vW@MUc)G@HGtmm(6t61
zr!|NRqf|n-VxuJaK&cIK6aHb$^)Q+1rrAZSvzg!K<!1q_)PD(}%$$DMZ2ZxS+AkH&
z=N6$wu!z{gL&H!Xna84K9y{hSkDX=fmY&C8c7Evd*u%|Z@4_gRn8$3CBo7*=9tx+X
zigKzylO5JQ5q63)cl~*szrSb9-#3)8wtT3b<Heu6d3&j7-cscl6y;!%{myO0OmxAt
zI6ty&Dn#aRg=G$xx5}9oJnsX{VV@*E^f~P3=5U~Bq#O?*et&AmN%F%iuGAbO979H1
zT$y<dw!0Uw7PH;WO(d@+Y#Mx#Lw#8}t;#Amw!mVz#)erJSCVncziUi+d)wIhvE;R_
zW6$Tr^<&SEhu2Su`X?{0N6i~^1v5E`)mR-qF(IyhM4C78U7U!8G*OlZ68$Mz)&jB&
zZo#2GOowFo{7|A#zY><^vuQ=m_N50>AiK!Q2^{jL5p*Fqg#byRavFeEE6ZvY%$i9#
zk<BXUGea=g&}T%JlYL;<>`5oH$rRX2<r@yIf-8h(XprAejF!q4><__V_*c<s^nX4N
zV$vO_%d`4Uz~x!T0LiYthh?_~0K~LFnkJzYI}De^T~y~R9+7l8k4RPoFNk0A0*d;y
zMTjKr)ZKkzu${Wsl0Y`u!R(Fu;hwxR<Wz)-K+d>RvWh@1$#K3t?tW4@|Ll6bt2w$q
zzySg75AoDC&iyeDp++jN^tcVnR+0Myd`6Nd?k#eE_~zmM@EJWDXRtAPfq1&W{n3RZ
ze#5T?!SQW)(4Mf>#sQO@X_dFwr&Z2kk3Wub0Kq{7?FbGbK-{_^Dn~Hg2tf1F>8^BO
z3Hs<1w6ZD35TGwuMaN~M#k#(p(2{gdY5-6^(Z~F+DmwEy53IJ=4sodMy?pDJ@a8W9
z08JsXG`FlJA9-TbI~}flqrVVdn-iO_dngDuPl@^`FE;1UN{873m!8DhtQMbuE7UND
zJ`Uq3jm|7;B;$&^iqP2&=-d_e06L$YH#&O>Iv<`FIx`fV13G&QWGg~vA3<kd5ju<W
zKxfhD**NRy>;`mBAv!BB!>}qD05|+5-VyJ-qTr>Hn1?RKMl0$y64cY9SLD9LnN*)V
zIM6p-jCp%XV_w<D1900S#C!T@jd(ppLg^_E@g(7VyX4?SEJQoB*3BF7#5f|J|J0`s
z@q7zo1Zrg2$r%eMNbIyqV^+{`6I+%;;#dgZ8L;r30fX<5Nv>SL>0>i>8!S_o-UlU7
zjASCR=(h56c4jN2AnNY}Fu4Sotc!DETW-~s!typuEN>eRw@r!qCoi^*UZlB#nVcl`
zSS3C&A+}A2A8L<qGs<>srKp4RlA^#@3sMvbBbl!p1twXT|2~TxRo;-qj6+g+nTs*0
zBF5vz_{E1VN1=&?%28+{5w#Eo5E_D%JyM$v4P;TudBmrgBF`Fvyr2s39m*GbQv))S
zWVBtS5qS2N7xAVq0x*$S7j*^-;dME2)Aecs#>1PYME#Q&H|4_XXtuzmC$ToG#V6nj
zRTS31old~a$2%$s1ZNPS?x3g$@OhNaBKU_0dJv=#oCUzEENLu6fd48+lIbdo)6;TC
zB*5j_dN1JgG~E^e(EDR$ycs(H-N|tm<xh*Ea;2Q2!iR1_Iv|PJAgC@OqFo2H#oSMF
z3c}J1<z+$I(}!FTG7nYS1G{7&blqh?+4|v<GKgS?Jcx0E^OpyyS%cG-<g7B3(wgjl
zcB*<5*Zv&bxoGx1!^?Y3*WEc0LAYs3)IWK#i6|PFEpX{ctjKEd3Ai$gqJiOq7QJ~^
zc~7#q1g(LEA6XXk6In1|kp;^;{1|<oLr7t1B?LnXAGQ*LA%#>4!C20q(gZ&<#Dqh9
z`?*0S4e`N##JJKfu*-P)6$FGad>&GEVog2a4AjkShRVx5scb5V7PjrPp<>BqzleA1
z1z>Unf|JW~V#l>(g}N;_n+tXO-(OOw>wuD6UB`I1V@lLNd9eeHZkQ{W$w^X=RpJwH
zX#qENCR8M+_(-_xqsGl<M6+K)fFZLFj+9i^*0IZ6vSDK7jyYhZO}ne`barUDGAACt
z_L)L-+s)I3=%M#d6{5$XBo{qC9zH%L>Yu!LeDoEXE11biQjb;Q6L4t(Ek91QtYm0O
z7ABAYAluNOdC^KEq|aC&WMbv4w6bKgFP1>cB{}iPwWh*~)|<h?ioNeXS6FcbN^&cX
zjE9d*iTWom9vQtva|JUwN$Rmmd;%^lAmzu2lr0P?$wHY2X5chfjnYbeftrbtZRP1?
zahoq8I->Eqh;^^di6^gj7aDiJySvc%#QPTujVGZb*LZR~d~!<EKY1v@;Bw3sxb!5c
z$*S=QxU_(fA16YtvLfUIQ^`6aQ5xi~7`-&!Ovb6SRJSSB>eosjCHPUEx&E2LhQ04T
zU)XT;d&>$No`I6whG)jZ&rFH>Cl4j)Rl#h5OHY!TtQwzyOEZx&2oC{@w|EzQf~B;b
znQoPCrmV-Awvq9i7S5;Q-d(={R_}|<-SQ){c*+g;AxEceK%?Z3`@rfII2GsIEf8zn
zjb<O(4yCZ7V-;KQjF$Fu@T0>rE%Q#ee6Q$O#VzA9oFm4Q_P}yHOM7IsMTcGc<7DM8
zcVF9f<~YHkF!LGh>oTnjG`Mng+0w06w`KVkt~mC^#UeM7zdK@lC9Y>&$XIlMrP^<d
zka5;mUVsLd0jr*JfkZ0@mCr#_T+OsubM>WQU2kT%jRY!VYNut{(_?hm(_^^y+VObI
zG17`_n_xjx;If{G(lt(-W9kMhX^W|`z$?+mi8*^GW-vroP~Jpv0Kq}Lc?ef4of%5^
zWzz$y=It8<7pST&m0=C|P#=alXB7Ed-{2W=jAArFk?$2cJ%U}K?^R(o4}PK37UG5F
zOLp)X%hIP^^l9j#s4bgS#9QVui_*1F%LqB)?3N~X+dLb0vup8X=wC%(<!v>~###zB
zv7FfQnwqPL<-;2xdHrbu#=|XBqW;N?ExGVUmSu_8RF<5;K4|V1)UJuq^d#33($}A6
z4fq7KAXG<>^{BA5aE{{0zlPv-1iy>`$)hrc;A;qa5ZD?#Q7=~zT!DYJ4FEHEHlxAw
zNe99c1Rf=@lfW*=Jt%KQBWNpqMC`=g2#UR0jG%9oHiBk-VC)o0K%m!R>^w9K$d^t&
zl^Ry<BQ-{Ws#<6;7pVar#<n64BX}5yhjG3h20!sI1S}qg@?Hbe!|?YvQp2|}MnJb`
zk7f}U#;EKVVT@If+I@%x$X3Bd@q+FSP^4;~hYL3Ts&$0ubIbEHsbu;r1gO0X1i@qg
ze1Hx|F{mtAuJzk^Yo~)}2E=PsmlL;N4;5BzhjVV#_VMucDN+CA#qFb?rMZHcoFw&F
zB|b4BZlA_rpS?s#g>!Dh-tq9>DN+CAp#()!%oe!xB&o@&@rem>?{s)Mc!jTZ7wU<3
zxPFFr__FC8)|2QRt~XuCymxqZU+#=Zj`DOChIHN$aS+f;A~`;N5pni(c43T)q6T9D
ztp@kENhe`TqHIFR(#?0MRoRZFXu<PCDP@>egAD+@1B2OUdH@9F#V8HqCIGa=8s1TY
z;83L%+}yCCPNE-oKcb{2k;$ZB!vJ1sok3_ywYq@>=Jx@Z(k3A=Ko9oc+*@ec59eId
z{_*hsDN+CAp#<pxW(!<;lGJ3?_{4;`e>w~X>|NLQ7S`^9b8hXf@$jxGQUBz{U1+w(
zT)|9El6tHXpMXnL_eJf&IDC)*iA%iu9U^zZo;R@9O~y&jbVsKaC+>ffahY3*oLa-8
zXWbx^brpH~K>sB&nW_H{&uR0J5Yc}tEc$PGPam%*vTtUuVVhfg6nRrh>51ryBL}yr
z!Bz(^sV5R0G48gGkTpQFXk!r%U0+SC2uCeegt?7kB^kx=r*agn3phMd5Jw3DTjz^u
zRb-4JpT037)`)7Y5(ynH5};Ic#Mj)MP=^PSN*!QxY0^s_e0@--OEKj+GZM)fCc&Ew
zG}mAs?DH~^x>zPwf?5LTo+we>60ng7h0qpuZy{drVL3e@W8U2U&2U>E;7kKE3HDsN
z_&xY~>TV()PFJqaMH+LJ>qlMFl@duxxedGCeeC_0a=V`%uarhz5aK;nlaH*%z>9{Q
zxbu2bVa-lB=ho~T5AU23^-ms3aAOC|7P#~zsmZGGi3xEh295U>!fSGCw-v(MZ=NfJ
zAJ2);z5m$vUdkPO4pIQe!_Q5L`X>)1;m2vVz@;ZiO;(LhOo-2!k?9XNU_>`&_-&0D
z{|xaAm(wcWL{Qpr@w<2#!CUaJE(4$&F5I52cS0`DWA_4HPxEa70JTqG-6Z_81Aa+z
z+<hEQ7W>3|rR@_ClEwDd%KE`p5g?0@MXeg~OCp;d9yj(pWLyPq!1!ew;g=jw<m6}0
zGRzjnWgsm7{Gqsua7NQw0b+#3-fC|dHl*lw-ZISDE}4ax4h2Hc@0e8@mjre*zSU`K
z6UL2~@WAIg2V}zXRQ48HW({H1<0VDy?4OIZ1FNyCh!dAu#}XkA2Y~z5_7>X`n!j>b
z@{#ekO6YSN{{Ycqf~OY7|3StdEefHL`V)iEGpXLhh4i43=!??OX*FsDCXoO=w3=_#
zoc%o(%lUR{Ip2O_q~bs_3!8OC2U026N{jF+o6zsAF;&66vr4EAaQTLAN_Rso)09q4
z<4BN{w-LO9;1Ght0Al<qB{%Mss{Aot>p<`n0Dcd!ZG2{jjX`7y<$Y{-NVz|ys)=(c
zZR1QrM9m+dmFQz;)I}1j765=g0^#6Gn)2a8qwWtXR*rS$D^`y>r^Bsa^0*1s1dGKZ
z7j9)H50+*|j$7D*<-p#-<ybK!h$W;xCvLcQW<0!MO4L7jal`1VG*>W_?D8$F&vFx%
z94m&zq_~0VEI@79QJMyG(TN-lX7nb5+RC%K#n@a7H8&bytV!vb7Y#PGlSe~?8I7MO
z4QB0ZXmF{;S97PqCDwN+aiGBq<8R^3KjZO78XOoxkM|FM^R=i%_dcRQ(SHPml$3o7
zQ{M(~VhA<hAAa@Mq6cu#LaG$}8@&1*0G4%g#Ao<jykw<@%J;DBPXO3OsnQ@9gPx@a
zl6^xxDLIR~#Hw0LDH3R3AMdN?0hna)X)757Ys%_t&f;AX!H9x;CgLuMdXnvncnj;Z
z9Bh%u<ybK!$mWS)yN!+k5sXfW`X?_&N5M{uxq_Kwmv3QxmYcBTSTQ6f#po<V@ShV^
zh7&{|B@y(IU~KW!0ud}P2$d#+I0^kD;{N1dCfzrfEj|5;CY<u`OH8A+M2aY$7JBy}
zCcuJd*lc{~T<23!L!80t&}<V6!oTOVwISQg@RntdL)h1_#Eyrs7vciy!^p#i%l0}L
z<Kv$Y{!dXqauoL2hj$lT${O<jgU<o-Dg=HVoUFo12f%wd16v8e6wtPo!hb%bq^J>@
zak%cRBvXO-$(gb*36?}r7=&MzW`ga4^h;3M0*d0;=4OHTq+$Pp^b5Z^Z<+cyq+hbK
zd=`4M0iJQLjCV0%yv8DRuv+(~67aqhx|yiej7YWj8C56XZt6IIk^}}8c&{8=eHCQW
zmGqMrSK>Nx%oWTeyL=0)v)qIw$BH2VSIFw|N7DJExRTmy*T7dh0f8hh!nt@+@1J7X
ze?Wi(piCl|LePUCh2Sgzer4|;Vj+U}@B((u?8UJ=A-8808jYj4BT?*L!0oBKEdZcT
zf~}J9&kkleMmMy@a{T>rmSf94L?ZH);|b7S+^lawU{S??>cStFyx>U4xM8;;XA@r2
zkBkROT$U18{oV;}iVx26X=^2pJB%1r<J<r*HF#(}xjLCQ)O<42s*D@9bXOQx;>_;B
zm9Z$@7S}fY`!xvNOs?syGFqEwh&5(bUgKNsambD#=a5Tgk<S^}c(SwBY-OYjn|1?i
zUW<R`U4P!!x!9;>p3jeVE;VyTD&vQk?i=v{*~#ENL(V$)ePZigZq({rX{5|Eybz-z
z9)$Rp%2U6=S&bkjxf|D{lcO`LC%BU>FEsD8nyacO`DiZV345qD-fXva_I5yvVFSMI
za`l;7Bl*kLWzo}8plscM@%t9VaEI{aHSthU40lDh@ihgmXC&Q42aHUG(X(-e7;Xo|
zZ{tc_*d9>%2EJ4)3U7lkx;*E^-!=^|DXSA2$lqbdvE_SQbwb*4Bm5J*!-@MMcsyHP
zg4Z0~7r|9YQkpxVoV##;k=+Z9l&?T5&6T>8RDKgubQkNdV(PaLTtl!A0NAmQln4li
zKyVr(4hb_xyyZfoZzvUbr6oDo11IAR84xIbqgIQ|coZ#gQGr)a$S8bkZhU^t(=*hc
zQ8k~Mg3aQxisn*>;msT>q`dUi8n78xBCUc&Ch*KK#L@I0zLbWx{Xp?F54pSM#+!2%
z^tbTqyp7-;1nme8As`m?N;B466SMspIg`ltYQg@&0SE(xbh1}-CRGhb81}pCOKCX5
zB&GZiJNaz{Pa^mo1pfrVbp$s6s7O#C*j(Ql3|-AM;Cv<F)%euhUSRO<k91a*H*4z*
zB2M{qiE94|Z%{`pE`KIAPS>m$d#O;fVN~Q&V%3zmVq9GD=Aqwu@;9E$t>2qpxo=W@
ze7Z#W55yY1e*3k>xsCh3z2^PiZ#7Ro-IaUxh5XZ}b1`{ReDQ;dn%7_W!V7Qio~me^
ztZ2NxW;#^)`jM+gUhBB$5-QjKAYA?W@YP|kZoU55tDi+9SA>9KOBaMVqNR)fj6zVm
zUI0ccBL{Y`(P4T4-WY<Rkyr<k*CMPspMd)JJn$g!c)5zk`*+d9_{Xi0BN5McBf%r9
z{YeiL7>7M$^uPieD`WIRiIp*e_35FpGv7z*iMewPQUWa2Juk+{m>|a(nalE_Ge&S6
z&yz8Vwv6%1wu~`w+Hw9H@gQN0|BeyQxiZEOVT@mY<cyIqEaM61$QW6>IWk6**_CIE
zjM>eBF$N7>D`JclgfUhWF~-VyFvd!wXXC6hM%*(u0F3e9&WAB7AHW1x{tJLu*re}t
zEzupkbQi%-5&Ulie~n-c<U9=Zkett;=X8e)La6ySyXh2ti?-f|qT5ycOSr*9qUjy^
zl}}EJPkkC`y7GTvn3B9&!sz%2lrja!1+OEr(s4IXNWLBPgNMZ2vOq%}lG~yJdF)jn
ziK!LP#@Wep722uL%~T^?`e*JJX$He^Wvn*~-7OO+V=64htg%r@fOmC9^he@OvnV9q
zPNwLX4bETeTx8~qR7O1QJU<rq6T15~gR1EY2~%tAC^jf0;dlV(Zq=!)9NiTyqP(pl
zV>~$*9%SB$DKo|s5+e`ebjB0vbk}SbHR~HG5Z75dpu2vckLBt!?kNS!)@3wZ3YD$P
z=y?&{4dP2{<G~`j8|q$Td<U-QwMLnFhHn@$FvmFSbQj-<0ZNH-V?J~@7EyrX3MWRy
zGYP7Yj8tHNJP79Lp6KPvm+$+}4G!w6iu3X-$`7En^5+OpC7~pER+U8g3#b>XQGSHg
z|0@DiffS^h%3mS)?+E?}g8zx&e<8Sy;6nrl5FA7>yH-#^xrUWjX!xzD5<tGjoV5Tn
zMc6Qn<)#vV9i#rEGmJL6>G*Nb4>%Q|xYA!kx2oSp0Wie-v6HZ)*7Ty4W0wnyHjetI
zMUa?Rj)M`d3&iJH7{lrO({e8M;-r}PgbDj95%ztNCt{xO#DY)kwhH_BGXU`y?~aHZ
zlbD;Z4?8hhn1TojfyYt;dxP1rmXBm9``IZ3$e2t^86$UGnMu+_uGA!6ey)^}sTQAU
z-!hrhN4Kg0i=C(P5VuzzzGm99&YSkLx6#HTkyjIUGpk!Cvpxad=!e;wV?K;Yb=or@
zHdaN<$7~lh`Zv!&nprzwKJa$(?sD}_LB6tVT~m;ES#~MlS%-PQd9e=V>v6xW;#O|#
z!;fI>8Ai@?>{&Y)`|u}e>^XYVXkwF*LageH89DQ8h*X9Ukg14QNLBp)*_lcya{gb(
zgRsKo?~Jk3-$Y>I$wsqBBL!mKig*~ryp^Z^iWBpy%VH=~2&MU8v-L&HA*n`MG{at7
z#feAev)ki%l`$g5Sr?BgK{WassrLL&I&JK{nMgchQi@D<yfR*m^nx2XFy28_yLor}
zk*gykSC8#K;@B;g{{GIYCEWLq8u((K0aqi&s7p)B)~z<`7Kz9;(lTjzyrxJ*UNjFJ
zSY-5UoJ}0agh5P>WUA*NB)g71Nv-y=1}Y>gXuwteGk_64hHewH{fLhw`+H2$c%-7a
zd2lG38Ok=Jh&Tc-sMoXoJtGIWmss2E+fu?z4~AxVS9{=<4X~LDbq0vgC6Pc)kAUXI
zGI)|cctm}(+THlbd+?DLw;$_>9yDX;+vzJ$lt026-$w9N1g1lwAG3o9E(3r#_@l-W
z+BDrA9lQk8r2q-tr2tX(v<MP<5k$(jDB##8P6PT4Vv9L-;Kz7}|AwHvVxW2HKyb<c
zQ4rq2=Isa$Avg>`^YjfSdQ{EN?oHH)SnZt6OCAu^6)%F{#!jC^a148P_atB~atG$0
zLU0@lx%Yi<qn-uRses<aA}bVn77X74U1m&eQRrS#Wr{9DT~W10J5$umdbnwUI^sk@
zxs-PSJPt3zmNwvVh%6iHC`8u5!ZbtmDCcpovrbKiR=?AJU3~laA8fsO>0j)d4y}0e
znQKeG^1^gz*_&I(E_`LrZJ&E%;HQGyAN*-Rs9eO{5QU0Hs}th3SEyS0`m0x8g)rFB
zSM%X0oNsZ#ur#6-Lt<fHLp?wiVqT3L1jFKj0lWb5uDKZvA%GTEvc3Mw)mL(2{pc&d
z1h=XG$Izgj|K#D)1y(R&=5ApddSMch#qA1W{RiQi*GIlEGPYrAdDHmvru_1je7JSg
zJsqxj<9HzqL0%iL^-zF21?iu>xRFG6VYa}fC$ToG#V01jjnm=vIdR|Araj}E_CNw)
ze$zfk<e+@hzVYzBDY!~Ld83eK3na^~(!?!s-}N1=Y{JaJh1{k+^vWcr&3;*Rnz$D>
zT{lFV`___3XUvm}1v_{9^<{qcyRzTIx$`#&5OtLhf*#DK5S#_T$8Km?hyd*s{I2W)
z&zd_+4RCL1t>^LE0stDefen)I&knc=IcB^*N^<C78%|i>2TQI2dL%bMujC;M{=9nF
z2EK1p)GBaNqARl<e3xpv9{RNeaDc)}Ro8dm3bSvzXZWd5nYH?<KK=j>8$Xq4_cVhx
z4CZRLB+#zRs*o2c;~0d2#`>b8n}v1QSvb3qu#&^vvWF{U7Fw>1Da<WywDIl)dWi@A
zro~JieA-DRoyn@i-qi&!38_pbGT9*|rPJqFPz%8B*coLo3G1$?am(aph-vs<HuOQm
zd(*s`go1ITE@fzdSiiJD>QX8>M3yTMOPIbkjC!t-#Zb>RVK&6BwFtU2-5;7)e>_Ar
z!^J_J)ovMXLRX_Q6m7w>2IxV36Y3+6SjPFCO<%N?A6&bXU%7cw+)~6QjN%U>wZGc?
zEA>;6#_>qwRHS)4(tOijh&-0tD-|LVE_+^vPUR0Os$M^R^)xVt#b5ac|8&ju-mf=*
zv*z8Of3GeVIx@YY;kHMps=q6^ssixhH-BJe%(fq%nAm~tkjWGmI&pA|j#H7i)39OS
zi>x~JpO&wdaYHl?yjO@Azs)sV-zBoW+o);3{{y^Ua^`!5=DWjUUD2J;{8e;-6wRC)
zhTf(dzs)CPaZhGrz8&bmxMHkaeHH;bpB)ujt@a042@Nm7p1GGeb6{{!VdJDg{nj8P
z#u=n_G-lI%?vdOE$ke13X9d176?wl6Da#U15JQO!d%}o?Y14N=v<rMuQZSPTtYI%8
zw8Em!m4IAYz`Q<Z8#MnWFfw7uvl8Jk2z^os@=x&jQ8X;Qq6uW&th|}Nh{as6Ny9?T
z`Alrl_Ek5*-PEgak1N7-r1saBeQ8;4#pdrV&C@AaI~9(?LZh6x?%DwY#_^Ra`X?{0
zBjS@;LNB3Yq?b*I>x|qjuJ$DM$13p&xI*VN!$){DKm3=U)73B+pcWnw{phxx(;f&U
zz+F?1TJ}4c>zu}2Q~j2`JRZ%QW^-+xbDFiA<D6zpZw_;sF~g!c4SO%boPO9lpW>XR
zyPlFc{S&0&c5_-mF2zk`C5rh~0Dur2!A58&<6;A5pJoB5Y_LZ|<63G?o-K5q>C2y}
zvSl~Pto2&qY1A)3&-@I_#ZTuWGI`6&$2P@yrpKn(-x94*4<dHX@Uf%U-715Y^13r*
zgwR_Le0y@3UUP$hccMsAbl8<yWkAVmanC?#b0<a#6dm1+W!f!jGB@Ytf`}O_G8rpZ
zk9{YQ2qA>kkO(tga1T`%-5jzRANbEd9~TL^`LZ#Y&rx#2{Oxw;bmBkv6aV=o&Nzr(
z>iN4c%sVlYr1`ACRN2%vo=_Jd%y#y!57rLI4Y*gj%hflXO`)=N8KW;EHv!@k4-^^v
zg59f(Z^ZSy+9)&6@NJoM#K1t)C$5a4sgL=&L;Y!0O%I$Swmao-p%>-v5JZs1{5hn$
zlxj>8?=~SU#Ji2MhDn#`+o_Q(#j2G>Se-bwAt5NWm|cuu34*`GvZa_J&hFKiI)G&d
z5xj-qZ3OQiXh(1e!C?Tg5a-jzyJ$ZB;S~pVvjV~Fv=8UX%-AQoZkmV=ZSbN|S?`rP
z%3~JAmO8WTt8Rt+tLUVs%0%_@vD1a>O{2b2{_C>JLS)6S*MF(LSXnst^`>vS-tBm=
zk|_(-QBW4D1Eb#CqENN?<07@Q+BQ&zRMsF^j{pU-S!^3&yo><N2v*xh;LcK~rxEvG
zZoDT3JdL*n0MxdD4Pq-apDgzbCPBj#js3d`T4~E<8h_nF4bHHZ5zMe8d|UIgBF(3l
zQKbAa;vS-`=EJD!zVsOdZlcF%{0LLPNdyHYGQ|x*^PNp!LXDWR<QSH>BG`f;jo=p%
z{4Rn&L_o|q<om9{>{<lt0BGV~`r7ix6`aF(SM?@<+b)O0@gIc_c(Pv*{!#GHguwTO
zrGFt*{8%_RE*!jFDLBQ?*MF}5Lua+ad)Fm6t8QcJ_C{9ja6G1$LkbYaw*I}gI>)*X
z1pxPsI;tE^9|{2OwXAToekcIAcgRugX#P+DaIbBJqYew}pm4Y2@ec(6_YOK69F2Dc
I0OT9}KLTr!%K!iX


From c0ca7436c108d80baae0c96f403b3f8ff1b2461d Mon Sep 17 00:00:00 2001
From: Adrian Martin Garcia <adrianmg231189@gmail.com>
Date: Sun, 12 Apr 2026 23:26:28 +0200
Subject: [PATCH 3/5] fix: put hadolint ignore directive immediately before RUN

hadolint inline ignores only apply to the next Dockerfile instruction.
Having another comment between the directive and RUN caused it to be
skipped, triggering DL3008/DL3005 in CI despite the inline annotation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 464684f..22afa0a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,8 +12,8 @@ LABEL org.opencontainers.image.url="https://powerpipe.io"
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
-# hadolint ignore=DL3008,DL3005
 # git is required for 'powerpipe mod install' from GitHub repos
+# hadolint ignore=DL3008,DL3005
 RUN apt-get update && \
     apt-get upgrade -y --no-install-recommends && \
     apt-get install -y --no-install-recommends ca-certificates curl git jq && \

From 48a042522bc2f649f793c38fcaa8a53b6f4460a3 Mon Sep 17 00:00:00 2001
From: Adrian Martin Garcia <adrianmg231189@gmail.com>
Date: Sun, 12 Apr 2026 23:31:06 +0200
Subject: [PATCH 4/5] chore: version-based release tagging and Dependabot

- Replace semantic-release with Dockerfile-version-based tagging (mirrors steampipe)
- Fix updatecli: add scms block and actions.pr so it can open PRs automatically
- Add Dependabot for GitHub Actions (weekly) and pip tests/ (weekly)
- Remove package.json: no longer needed without semantic-release

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/dependabot.yml             | 15 +++++++
 .github/updatecli/powerpipe.yaml   | 23 ++++++++++
 .github/workflows/docker-build.yml | 67 ++++++++++++++++++++----------
 3 files changed, 84 insertions(+), 21 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..554bbfe
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: pip
+    directory: /tests
+    schedule:
+      interval: weekly
diff --git a/.github/updatecli/powerpipe.yaml b/.github/updatecli/powerpipe.yaml
index ae6faa6..7c93034 100644
--- a/.github/updatecli/powerpipe.yaml
+++ b/.github/updatecli/powerpipe.yaml
@@ -1,6 +1,19 @@
 ---
 name: Bump Powerpipe version
 
+scms:
+  github:
+    kind: github
+    spec:
+      user: '{{ requiredEnv "GITHUB_ACTOR" }}'
+      email: '{{ requiredEnv "GITHUB_ACTOR" }}@users.noreply.github.com'
+      owner: devops-ia
+      repository: powerpipe
+      token: '{{ requiredEnv "GITHUB_TOKEN" }}'
+      branch: main
+      commitmessage:
+        title: 'chore: bump powerpipe to {{ source "powerpipe" }}'
+
 sources:
   powerpipe:
     kind: githubRelease
@@ -16,8 +29,18 @@ targets:
   dockerfile:
     name: "Update Powerpipe version in Dockerfile"
     kind: file
+    scmid: github
     sourceid: powerpipe
     spec:
       file: Dockerfile
       matchpattern: 'ARG POWERPIPE_VERSION=.*'
       replacepattern: 'ARG POWERPIPE_VERSION={{ source "powerpipe" }}'
+
+actions:
+  pr:
+    kind: github/pullrequest
+    scmid: github
+    title: 'chore: bump powerpipe to {{ source "powerpipe" }}'
+    spec:
+      labels:
+        - dependencies
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 221f222..b65eee0 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -176,9 +176,7 @@ jobs:
       artifact-metadata: write
       contents: write
       id-token: write
-      issues: write
       packages: write
-      pull-requests: write
 
     steps:
       - name: Checkout
@@ -186,20 +184,45 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Semantic Release
-        id: semantic
-        uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
-        with:
-          tag_format: 'v${version}'
-          extra_plugins: |
-            @semantic-release/changelog
-            @semantic-release/git
+      - name: Get Powerpipe version
+        id: version
+        run: |
+          VERSION=$(grep -oP 'ARG POWERPIPE_VERSION=\K.*' Dockerfile)
+          TAG="v${VERSION}"
+          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
+          echo "tag=${TAG}" >> "${GITHUB_OUTPUT}"
+          if git rev-parse "${TAG}" >/dev/null 2>&1; then
+            echo "is_new=false" >> "${GITHUB_OUTPUT}"
+            echo "Tag ${TAG} already exists — skipping release"
+          else
+            echo "is_new=true" >> "${GITHUB_OUTPUT}"
+            echo "New version detected: ${TAG}"
+          fi
+
+      - name: Create release tag
+        if: steps.version.outputs.is_new == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a "${{ steps.version.outputs.tag }}" \
+            -m "Release ${{ steps.version.outputs.tag }}"
+          git push origin "${{ steps.version.outputs.tag }}"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create GitHub Release
+        if: steps.version.outputs.is_new == 'true'
+        run: |
+          gh release create "${{ steps.version.outputs.tag }}" \
+            --title "${{ steps.version.outputs.tag }}" \
+            --generate-notes \
+            --latest
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set Docker metadata
         id: meta
-        if: steps.semantic.outputs.new_release_published == 'true'
+        if: steps.version.outputs.is_new == 'true'
         uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: |
@@ -211,18 +234,18 @@ jobs:
             org.opencontainers.image.description='Powerpipe — Dashboards for DevOps'
             org.opencontainers.image.vendor='devops-ia'
           tags: |
-            type=raw,value=${{ steps.semantic.outputs.new_release_git_tag }}
+            type=raw,value=${{ steps.version.outputs.tag }}
 
       - name: Set up QEMU
-        if: steps.semantic.outputs.new_release_published == 'true'
+        if: steps.version.outputs.is_new == 'true'
         uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
       - name: Set up Docker Buildx
-        if: steps.semantic.outputs.new_release_published == 'true'
+        if: steps.version.outputs.is_new == 'true'
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Cache Docker layers
-        if: steps.semantic.outputs.new_release_published == 'true'
+        if: steps.version.outputs.is_new == 'true'
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: /tmp/.buildx-cache
@@ -231,14 +254,15 @@ jobs:
             ${{ runner.os }}-buildx-
 
       - name: "[DOCKERHUB] Log in"
-        if: steps.semantic.outputs.new_release_published == 'true'
+        if: steps.version.outputs.is_new == 'true'
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
       - name: "[GHCR] Log in"
-        if: steps.semantic.outputs.new_release_published == 'true'
+        if: steps.version.outputs.is_new == 'true'
+        continue-on-error: true
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ${{ env.GHCR_REGISTRY }}
@@ -247,7 +271,7 @@ jobs:
 
       - name: Build and push Docker image
         id: push
-        if: steps.semantic.outputs.new_release_published == 'true'
+        if: steps.version.outputs.is_new == 'true'
         uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
         with:
           cache-from: type=local,src=/tmp/.buildx-cache
@@ -260,7 +284,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
 
       - name: "[DOCKERHUB] Update registry description"
-        if: steps.semantic.outputs.new_release_published == 'true'
+        if: steps.version.outputs.is_new == 'true'
         uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -268,7 +292,8 @@ jobs:
           repository: ${{ env.DOCKERHUB_USER }}/${{ env.DOCKERHUB_REPO }}
 
       - name: "[GHCR] Generate artifact attestation"
-        if: steps.semantic.outputs.new_release_published == 'true'
+        if: steps.version.outputs.is_new == 'true'
+        continue-on-error: true
         uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
         with:
           subject-name: ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_REPO }}
@@ -276,7 +301,7 @@ jobs:
           push-to-registry: true
 
       - name: Move Docker cache
-        if: steps.semantic.outputs.new_release_published == 'true'
+        if: steps.version.outputs.is_new == 'true'
         run: |
           rm -rf /tmp/.buildx-cache
           mv /tmp/.buildx-cache-new /tmp/.buildx-cache

From b6955a5cb29290d031392d8cf47e4406e2b83c51 Mon Sep 17 00:00:00 2001
From: Adrian Martin Garcia <adrianmg231189@gmail.com>
Date: Sun, 12 Apr 2026 23:31:21 +0200
Subject: [PATCH 5/5] chore: remove package.json (semantic-release no longer
 used)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 package.json | 21 ---------------------
 1 file changed, 21 deletions(-)
 delete mode 100644 package.json

diff --git a/package.json b/package.json
deleted file mode 100644
index 966c755..0000000
--- a/package.json
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  "name": "powerpipe",
-  "private": true,
-  "release": {
-    "branches": ["main"],
-    "tagFormat": "v${version}",
-    "plugins": [
-      "@semantic-release/commit-analyzer",
-      "@semantic-release/release-notes-generator",
-      "@semantic-release/changelog",
-      [
-        "@semantic-release/git",
-        {
-          "assets": ["CHANGELOG.md"],
-          "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
-        }
-      ],
-      "@semantic-release/github"
-    ]
-  }
-}