feat(deploy): #347 S11 CI templates and cache hardening

.llm/runs/beta5-impl--supervisor/slices/347-deploy/context-pack.md

@@ -0,0 +1,36 @@
+# Context Pack
+
+Issue #347 S11 scope is CI/CD template generation plus Aspire deployment state/secret hardening. The branch is `feat/347-deploy-s11` at baseline `37e6818c4f7871d7d6f051c90e9734ec45fb4566`.
+
+Key facts:
+
+- Workflow templates do not exist in the CLI asset manifest yet.
+- Scaffold root generation in `packages/cli/src/kernel/application/scaffold/plan-init.ts` is the planned emission point.
+- Aspire CLI `deploy` supports `--clear-cache`; Aspire docs say cache files under `~/.aspire/deployments/{AppHostSha}/{environment}.json` may contain plaintext secrets and `--clear-cache` does not save prompted values.
+- Current shipped deploy targets in issue scope are Deno Deploy, compose/docker via Aspire, and bare-metal compile/service.
+
+Planned implementation:
+
+1. Add three `.github/workflows/*.yml` templates as CLI assets and emit them during init. Done:
+   default Aspire-backed init emits Compose/GHCR, Deno Deploy, and bare-metal workflows;
+   `--no-aspire` omits the Aspire-dependent Compose/GHCR workflow.
+2. Adjust Aspire compose/docker deploy behavior so generated CI can use `--clear-cache`,
+   `--non-interactive`, and explicit `--environment`. Done: router flags are generic and
+   the Aspire adapter forwards supported args.
+3. Update generated README/site docs with CI workflow usage and dev -> staging -> prod promotion.
+   Done, including the plaintext `~/.aspire/deployments` warning and CI non-persistence guidance.
+4. Run focused tests, scoped wrappers, `deno task arch:check`, full `deno task check`, and full
+   `deno task test`. Done. `deno task e2e:cli` was not run in this implementation slice; supervisor
+   merge-readiness owns `deno task e2e:cli run scaffold.runtime --cleanup --format pretty`.
+
+Plan-Gate status: first PLAN-EVAL returned `FAIL_PLAN`; plan gate set updated; second PLAN-EVAL returned `PASS`. Implementation may proceed.
+
+Final validation:
+
+- Focused deploy/scaffold/generator tests: 30 passed.
+- `rtk proxy deno task --cwd packages/cli test`: 311 passed, 0 failed.
+- `run-deno-doc-lint --root packages/cli`: 0 errors.
+- `rtk proxy deno task publish:dry-run`: passed.
+- `rtk proxy deno task check`: 2102 selected files, 18 batches, 0 occurrences.
+- `rtk proxy deno task test`: 1527 passed, 0 failed, 12 ignored.
+- `rtk proxy deno task arch:check`: exit 0; existing warnings only.

.llm/runs/beta5-impl--supervisor/slices/347-deploy/drift.md

@@ -0,0 +1,3 @@
+# Drift
+
+No drift recorded yet.

.llm/runs/beta5-impl--supervisor/slices/347-deploy/notes.md

@@ -0,0 +1,9 @@
+# Notes
+
+- If a planned item conflicts with the actual checkout, stop that item and record the conflict here.
+- No file-level collision with sibling slices #346 or #348 observed during initial research.
+- PR label note: requested `type:feature` does not exist in `.github/labels.yml` or GitHub; draft PR #490 uses existing taxonomy label `type:feat`.
+- `deno task e2e:cli` intentionally not run by this implementation slice; supervisor owns the
+  `scaffold.runtime --cleanup --format pretty` merge-readiness smoke per handoff.
+- `rtk proxy deno task arch:check` exited 0 but emitted existing WARN/INFO items in unrelated
+  package/plugin doctrine readiness checks; no S11 item stopped on those warnings.

.llm/runs/beta5-impl--supervisor/slices/347-deploy/plan-eval.md

@@ -0,0 +1,40 @@
+# PLAN-EVAL - beta5-impl--supervisor / 347-deploy
+
+- Plan evaluator session: Codex second PLAN-EVAL, 2026-07-06
+- Run: `beta5-impl--supervisor`
+- Surface / archetype: Issue #347 S11, Archetype 7 Deployment Target Adapter composed with Archetype 6 CLI/tooling and Archetype 2 Aspire integration concerns
+- Scope overlays: Docs overlay; Aspire cache/deploy behavior
+- Prior PLAN-EVAL: first pass returned `FAIL_PLAN`; this pass evaluates the corrected artifacts only.
+
+## Checklist results
+
+| Plan-Gate item | Result | Evidence / location |
+| --- | --- | --- |
+| Research present and current | PASS | `research.md` exists and has `## Re-Baseline Findings` R1-R10 against current tree/docs/CLI behavior. Spot-check: asset manifest, root scaffold asset loader, and root scaffold planning paths match R3-R5 and plan D1-D2. |
+| Decisions locked | PASS | `plan.md` `## Locked Decisions` D1-D6 locks asset location, scaffold write point, workflow set, Aspire cache behavior, promotion model, and deploy-router thinness. |
+| Open-decision sweep | PASS | `plan.md` marks the new CI-generation command, encrypted Aspire cache, and live cloud deployment validation safe to defer. Evaluator sweep found no additional rework-forcing open decision. |
+| Commit slices (< 30, gate + files each) | PASS | `plan.md` lists four ordered slices S11-A through S11-D; each names what it proves, files touched, and gates. |
+| Risk register | PASS | `plan.md` lists YAML drift, generated barrel churn, Aspire non-interactive prompting, and docs overclaiming risks with mitigations. |
+| Gate set selected | PASS | `plan.md` now selects static gates, universal fitness evidence, A6 F-CLI manual/PENDING_SCRIPT evidence backed by `deno task arch:check`, A7 F-DEPLOY reviewed evidence, consumer scaffold-output validation, and conditional public-surface doc-lint/publish dry-run. The required `scaffold.runtime` e2e gate is assigned to supervisor merge-readiness while preserving the explicit instruction not to run `deno task e2e:cli` in this implementation slice. |
+| Deferred scope explicit | PASS | `plan.md` and `worklog.md` defer the new CI command, encrypted cache/state provider, live deployments, and sibling #346/#348 scope. |
+| jsr-audit surface scan (pkg/plugin) | PASS | `research.md` states the slice changes CLI internals/scaffold output, not exports or `mod.ts`; `plan.md` requires doc-lint/publish dry-run if implementation unexpectedly changes exports or public symbols. |
+
+## Open-decision sweep (evaluator-run)
+
+None beyond the plan's listed deferrals. The corrected e2e placement is not an open decision: the user explicitly forbade `deno task e2e:cli` in the implementation slice, and the plan assigns the required scaffold runtime gate to the supervisor merge-readiness pass.
+
+## Verdict
+
+`PASS`
+
+Implementation may proceed.
+
+### If FAIL_PLAN - required fixes
+
+N/A.
+
+## Notes
+
+- No implementation gates were run.
+- No product code was edited.
+- This verdict replaces the first `FAIL_PLAN` after confirming its required fixes were addressed.

.llm/runs/beta5-impl--supervisor/slices/347-deploy/plan.md

@@ -0,0 +1,77 @@
+# Plan
+
+## Archetype
+
+- **Selected:** Archetype 7 — Deployment Target Adapter.
+- **Composed surfaces:** Archetype 6 CLI/tooling (`packages/cli` scaffold generation and deploy adapter), with Archetype 2 integration concerns for the Aspire target adapter.
+- **Scope overlays:** Docs overlay for generated README/site docs; Aspire skill applies to `aspire deploy` cache behavior.
+- **Current doctrine verdict:** `@netscript/cli` is still a restructure package in doctrine file 10; new work must not deepen existing AP-1/AP-21 debt.
+
+## Locked Decisions
+
+| ID | Decision | Rationale |
+| --- | --- | --- |
+| D1 | Add workflow templates as checked-in CLI template assets under `packages/cli/src/kernel/assets/workspace/github/workflows/`. | Keeps generation in the existing asset registry instead of embedding long YAML strings in application code. |
+| D2 | Extend `loadRootScaffoldTemplateAssets()` and `scaffoldRoot()` to write `.github/workflows/deploy-*.yml`. | Root scaffold planning already owns root files and directories; workflows are generated project root files. |
+| D3 | Generate three workflows: compose/GHCR, Deno Deploy push, and bare-metal compile artifact. | Matches the issue's shipped-target template list exactly. |
+| D4 | Do not cache `~/.aspire/deployments` in generated CI; use `aspire deploy --clear-cache --non-interactive --environment <env>` where Aspire deployment is needed. | Aspire docs state cache files can contain plaintext secrets and `--clear-cache` does not save prompted values. |
+| D5 | Document environment promotion as explicit environment names and protected GitHub environments: development -> staging -> production. | Aspire already keys deployment state by `--environment`; GitHub environments provide approval/secret boundaries. |
+| D6 | Keep target-specific business logic out of the deploy router. | S11 templates and adapter options belong in assets/adapters, not `deploy-group.ts`. |
+
+## Open-Decision Sweep
+
+| Decision | Status | Why Safe |
+| --- | --- | --- |
+| Whether to add a new `netscript generate ci` command | Safe to defer | Acceptance does not require a command; init-time scaffold templates satisfy generated templates without expanding CLI surface. |
+| Whether to encrypt Aspire deployment cache | Safe to defer | Aspire's documented safe CI path for this slice is not persisting the cache. Encryption would require a separate state-store contract beyond S11. |
+| Whether live cloud deployment is validated | Safe to defer | Credentials are unavailable in this slice; unit tests assert argv and generated templates. Supervisor owns expensive/runtime E2E. |
+
+## Commit Slices
+
+| Slice | Proves | Files | Gates |
+| --- | --- | --- | --- |
+| S11-A | Workflow templates are registered and emitted by scaffold root generation. | `packages/cli/src/kernel/assets/manifest.ts`, new `packages/cli/src/kernel/assets/workspace/github/workflows/*.yml.template`, `packages/cli/src/kernel/assets/embedded.generated.ts`, `packages/cli/src/kernel/adapters/templates/scaffold-template-assets.ts`, `packages/cli/src/kernel/application/scaffold/plan-init.ts`, focused scaffold/template tests. | Focused Deno tests; scoped check/lint/fmt for `packages/cli/src/kernel/{assets,adapters/templates,application/scaffold,templates/workspace}`; consumer check that scaffold root output contains all three workflow files. |
+| S11-B | Aspire deploy CI path avoids plaintext cache persistence and records environment promotion behavior. | `packages/cli/src/kernel/adapters/aspire/aspire-compose-deploy-target.ts`, `packages/cli/src/kernel/adapters/aspire/aspire-compose-deploy-target_test.ts`, docs. | Focused adapter test; scoped check/lint/fmt on adapter root; F-DEPLOY-2 reviewed evidence that router remains thin and cache policy stays in adapter/template docs. |
+| S11-C | Generated and site docs describe workflow usage, cache hardening, and dev -> staging -> prod promotion. | `packages/cli/src/kernel/templates/workspace/generate-readme.ts`, `packages/cli/src/kernel/templates/workspace/generators_test.ts`, `docs/site/how-to/deploy.md` or focused deployment doc. | Focused generator tests; docs validation when available; reviewed evidence that docs do not overclaim live cloud deployment. |
+| S11-D | Final validation and PR trail. | Run artifacts under this slice dir. | Touched-root wrappers, focused tests, full `deno task check`, full `deno task test`, `deno task arch:check` for universal/F-CLI/F-DEPLOY reviewed evidence, consumer scaffold/import validation. Supervisor merge-readiness triggers `deno task e2e:cli run scaffold.runtime --cleanup --format pretty`; this implementation slice does not run it per briefing. |
+
+## Risk Register
+
+| Risk | Mitigation |
+| --- | --- |
+| YAML templates drift from generated project commands. | Keep workflows conservative and reference existing CLI commands; test emitted files include required trigger, secret, and command lines. |
+| Generated asset barrel churn is broad. | Use `deno task gen:assets-barrel` and inspect diff; do not hand-edit generated barrel. |
+| Aspire `--clear-cache` still prompts on missing values in CI. | Generated workflow supplies required values through GitHub environment secrets and uses `--non-interactive`; docs warn not to cache plaintext state. |
+| Docs claim more target maturity than code supports. | State exact current target behavior: Deno Deploy command, Aspire compose/docker adapter, bare-metal compile workflow. |
+
+## Gate Set
+
+- Static gates:
+  - scoped check/lint/fmt wrappers on touched TypeScript roots with `--ext ts,tsx`;
+  - focused Deno tests for template generation, scaffold emission, generated README text, and Aspire adapter argv;
+  - full `deno task check`;
+  - full `deno task test`.
+- Universal fitness evidence:
+  - `deno task arch:check` as the mechanical doctrine gate backing F-1, F-3, F-5, F-10, F-11, F-12, F-15, F-16, F-17, F-18, and related CLI package checks;
+  - manual reviewed evidence for F-2/F-4/F-8/F-9/F-14/F-19 where scripts do not directly cover this slice or the gate is not touched.
+- Archetype 6 evidence:
+  - F-CLI-1 through F-CLI-31 recorded as `PENDING_SCRIPT` with manual/structural evidence, backed by `deno task arch:check`;
+  - explicit F-CLI-21/F-CLI-22/F-CLI-24 evidence for workflow templates under `kernel/assets/**` and manifest/embedded asset consistency;
+  - explicit F-CLI-27/F-DEPLOY-2 evidence that no target-specific business logic is added to the deploy command router.
+- Archetype 7 evidence:
+  - F-DEPLOY-1 reviewed evidence that first-party target registrations still advertise the supported uniform-operation subset;
+  - F-DEPLOY-2 reviewed evidence that CI/cache/secrets conventions live in assets/adapters/docs, not in router logic.
+- Consumer validation:
+  - generated scaffold root emits `.github/workflows/deploy-compose-ghcr.yml`, `.github/workflows/deploy-deno-deploy.yml`, and `.github/workflows/deploy-bare-metal.yml`;
+  - generated workflow command lines reference existing public CLI/deploy commands and avoid caching `~/.aspire/deployments`.
+- Release/merge-readiness gate:
+  - because this slice changes scaffold output, the supervisor merge-readiness pass must trigger the one-pass `deno task e2e:cli run scaffold.runtime --cleanup --format pretty`;
+  - this implementation slice must not run `deno task e2e:cli` during implementation, per briefing.
+- Public surface doc-lint/publish dry-run only if implementation changes package exports or public symbols.
+
+## Deferred Scope
+
+- New `netscript generate ci` command.
+- Encrypted Aspire deployment-state cache or custom state-store provider.
+- Live GHCR, Deno Deploy, Azure, or remote host deployment.
+- Sibling issue #346/#348 scope.

.llm/runs/beta5-impl--supervisor/slices/347-deploy/research.md

@@ -0,0 +1,35 @@
+# Research
+
+## Issue Scope
+
+Issue #347 requires exactly:
+
+- generated GitHub Actions workflow templates per shipped deploy target;
+- Aspire deployment-state caching no longer persists plaintext secrets in CI, with documented handling;
+- a documented promotion path between Aspire environments `dev -> staging -> prod`.
+
+Dependencies #342 and #343 are closed, so the slice is unblocked. Parent epic is #327.
+
+## Re-Baseline Findings
+
+| ID | Finding | Evidence |
+| --- | --- | --- |
+| R1 | The current deploy surface already has the canonical 7-op target contract. | `deno doc packages/cli/src/kernel/domain/deploy/deploy-target-port.ts` shows `plan`, `emit`, `up`, `down`, `status`, `logs`, `rollback`, `secrets`, plus legacy aliases. |
+| R2 | Shipped deploy targets in scope are `deno-deploy`, `compose`, and bare-metal compile/OS-service. | `packages/config/src/domain/schemas/deploy-schema.ts` documents `deno-deploy`, `docker`/`compose`, `linux`, and `windows`; issue scope names compose -> GHCR, Deno Deploy push, and bare-metal compile. |
+| R3 | Workflow templates are absent from the CLI asset manifest today. | `packages/cli/src/kernel/assets/manifest.ts` has workspace, app, Aspire, database, service, plugin, and Windows env templates, but no `.github/workflows/*` keys. |
+| R4 | Root scaffold planning is the correct write point for generated workflows. | `packages/cli/src/kernel/application/scaffold/plan-init.ts` writes root-level `.gitignore`, `README.md`, `deno.json`, `netscript.config.ts`, and uses `loadRootScaffoldTemplateAssets()`. |
+| R5 | Embedded template content is generated and must not be hand-edited. | `packages/cli/src/kernel/assets/embedded.generated.ts` says to run `deno task gen:assets-barrel`; `.llm/tools/generate-cli-assets-barrel.ts` reads `TEMPLATE_MANIFEST`. |
+| R6 | The Aspire compose adapter delegates `plan`/`emit` to `aspire publish --output-path` and docker `up` to `aspire deploy`. | `packages/cli/src/kernel/adapters/aspire/aspire-compose-deploy-target.ts`. |
+| R7 | Aspire CLI `deploy` supports `--clear-cache`, and help states it clears deployment cache and does not save deployment state. | `aspire deploy --help` output on 2026-07-06. |
+| R8 | Aspire docs confirm deployment cache files contain plaintext secrets and live at `~/.aspire/deployments/{AppHostSha}/{environment}.json`; `--clear-cache` performs a deployment without persisting new values. | `aspire docs get deployment-state-caching` on 2026-07-06. |
+| R9 | Existing deploy secrets convention already centralizes env-file rendering and restricted permissions. | `packages/cli/src/kernel/domain/deploy/secrets-convention.ts` and `packages/cli/src/kernel/adapters/secrets/env-file-secrets-store.ts`. |
+| R10 | Current docs under `docs/site/how-to/deploy.md` still describe Docker/Compose/Linux as config-schema only, which conflicts with the now-landed target adapters. | `docs/site/how-to/deploy.md` lines found by `rtk rg` mention no runnable `netscript deploy docker|compose|linux` verb. |
+
+## Open Questions
+
+- OQ1: Whether a separate CLI command should generate workflows on demand or workflows should be emitted by `netscript init`. Plan locks to init-time generated templates because the acceptance says "Generated GH Actions workflow templates" and the existing scaffold asset system is the established generation path.
+- OQ2: Whether to preserve Aspire deployment cache in CI with encryption. Plan locks to no plaintext cache persistence for generated CI by using `aspire deploy --clear-cache --non-interactive --environment <env>` and no `actions/cache` over `~/.aspire/deployments`.
+
+## JSR / Public Surface Scan
+
+This slice changes `packages/cli` internals and scaffold output, not package exports or `mod.ts`. No new public TypeScript export is planned. Publish-surface risk is limited to generated asset registration and generated docs text; `deno task publish:dry-run` is not required by the issue unless implementation unexpectedly changes export maps or public symbols.

.llm/runs/beta5-impl--supervisor/slices/347-deploy/supervisor.md

@@ -0,0 +1,17 @@
+# Slice 347 Deploy S11
+
+- **Run:** `beta5-impl--supervisor`
+- **Slice:** `347-deploy`
+- **Issue:** #347 `[Deploy-S11] CI/CD template generation + state/secret hardening`
+- **Worktree:** `/home/codex/repos/netscript-347-deploy`
+- **Branch:** `feat/347-deploy-s11`
+- **Baseline:** `37e6818c4f7871d7d6f051c90e9734ec45fb4566`
+- **Generator session:** WSL Codex implementation slice
+- **Evaluator separation:** PLAN-EVAL and IMPL-EVAL must be separate sessions.
+- **PR policy:** Draft PR to `main`, push only with `git push origin HEAD:refs/heads/feat/347-deploy-s11`.
+
+## Lane Notes
+
+- This slice is a Tier-D implementation lane under the supervisor run.
+- The slice writes artifacts only under this directory.
+- Sibling slices #346 and #348 are out of scope.