chore: untrack plan-4-kickoff-prompt.md (user's local prompt notes, not repo content)

docs/superpowers/plan-4-kickoff-prompt.md

@@ -1,108 +0,0 @@
-Continue VolcanicCore development. Plans 1, 2, and 3 are shipped and pushed to
-origin. Head is `7854cb0` on `main`; the last plan-close commit is
-`docs: close out Plan 3 — React SPA live`. Backend is 74/74 (`dotnet test`),
-frontend is 20/20 (`pnpm --dir frontend test`), and the Playwright happy-path
-smoke passes (`pnpm --dir frontend test:e2e`).
-
-Read the following in order before writing anything:
-- `CLAUDE.md` — current status, invariants (esp. the SPA-bundles-into-wwwroot
-  and MapFallbackToFile-goes-last rules), and the working style that shipped
-  Plans 1, 2, and 3 cleanly (superpowers:brainstorming for design if the shape
-  isn't obvious, superpowers:writing-plans for the plan doc,
-  superpowers:subagent-driven-development for execution — auto mode, no
-  per-task confirmation).
-- `docs/superpowers/specs/2026-08-28-volcaniccore-workflow-engine-design.md` —
-  §8 (Deployment) and §1 (Architecture) especially. The design already commits
-  to single-container Coolify, `/data` volume, single ASP.NET Core 9 process.
-- `docs/superpowers/plans/2026-08-29-plan-2-workflow-engine.md` and
-  `docs/superpowers/plans/2026-08-30-plan-3-react-spa.md` — for cadence and
-  file-structure conventions.
-- `docs/superpowers/followups.md` — cross-plan items. Two Plan-4 items are
-  already listed (forwarded-headers/secure-cookie behind Traefik + boot-time
-  re-seed on legacy plaintext `admin.password_hash_source`). Plan 4 MUST clear
-  both.
-
-Read these skills before authoring:
-- `preparing-dotnet-react-app-for-coolify` — Dockerfile pattern, docker-compose
-  conventions, `expose: [8080]`, `SERVICE_FQDN_APP`, named volume, static-file
-  serving env-var overrides.
-- `deploying-to-coolify-via-api` — v4 REST API for creating/updating apps,
-  `deploy.json` for non-secret config, project/server discovery, HTTP-probe
-  verification.
-
-Author **Plan 4 — Container + Coolify deploy** using superpowers:writing-plans,
-then execute it with superpowers:subagent-driven-development (same cadence as
-Plans 1, 2, 3 — auto mode, no per-task confirmation, TDD per task where it
-applies, two-stage reviews for substantive tasks and combined lightweight
-reviews for mechanical ones, conventional-commits messages).
-
-Plan 4 must cover, at minimum:
-
-- **Multi-stage Dockerfile** in the repo root: pnpm-installs + Vite build the
-  SPA into a scratch stage's `/build/wwwroot`, `dotnet publish` the API in a
-  separate stage using `sdk:9.0`, final runtime image based on the .NET 9
-  runtime (or aspnet:9.0 — distroless if it plays nicely with IronPython's
-  P/Invoke; if not, `mcr.microsoft.com/dotnet/aspnet:9.0` is fine — call it out
-  in the plan). Copy the SPA build output into `/app/wwwroot`. `EXPOSE 8080`.
-  `ENTRYPOINT ["dotnet", "VolcanicCore.Api.dll"]`.
-- **docker-compose.yml** at repo root, Coolify-flavored per the skill: single
-  service, `expose: [8080]`, named volume mounted at `/data`, env passed
-  through (`ADMIN_PASSWORD`, `ENCRYPTION_KEY`, retention/timeout knobs,
-  `DATA_DIRECTORY=/data`), `SERVICE_FQDN_APP` for the domain, Traefik labels
-  only when the domain is set.
-- **`Program.cs` — `UseForwardedHeaders` wired before `UseAuthentication`.**
-  Configure `ForwardedHeaders.XForwardedProto | XForwardedFor`,
-  `KnownNetworks` + `KnownProxies` cleared so the Coolify/Traefik reverse
-  proxy is trusted inside the container network. Cookie config stays
-  `SameSite=Lax` but `Secure` starts flipping to `Always` behind TLS. Add
-  xUnit tests that prove the middleware sees `X-Forwarded-Proto: https` and
-  reports `Request.Scheme == "https"`.
-- **Boot-time re-seed on legacy plaintext `admin.password_hash_source`.**
-  Wrap the `repo.Get(PasswordSourceKey)` call in `AdminBootstrap.Seed` in a
-  `try/catch (CryptographicException)` — treat "can't decrypt" as "row is in
-  the pre-Plan-2 plaintext format, treat as unset" so the boot re-seeds
-  cleanly. Add a test that seeds a plaintext row directly into `admin_config`
-  and asserts `AdminBootstrap.Seed` fixes it up on next boot.
-- **`deploy.json`** at repo root (or under a `deploy/` dir) capturing project
-  UUID, server UUID, planned domain, non-secret app env vars — populated once
-  from Coolify project/server discovery (Task in the plan asks the user for
-  the domain).
-- **Coolify deploy — CREATE the app via v4 API** if it doesn't exist yet, PATCH
-  its git config + env vars, then trigger a deploy fire-and-forget per the
-  global CLAUDE.md rule. Verify the deployment id came back; DO NOT poll the
-  build. Instead, the plan's Playwright smoke can be reused later against
-  the live URL as a follow-up sanity — do NOT block on it in this plan.
-- **CI story for the Playwright smoke.** If GitHub Actions / Gitea Actions
-  aren't wired yet, add a lightweight workflow (or note in followups.md that
-  it lands in a Plan-5 CI task). Either way, make sure the Playwright browser
-  install step is documented.
-- **README-ish** — the plan's close-out task should extend `CLAUDE.md` with the
-  live URL, the current deploy invocation, and any new invariants the Docker
-  build introduces.
-
-After Plan 4 executes cleanly, the app is live at its Coolify FQDN and the
-close-out commit is on `main`. This is the end of the initial-launch scope.
-
-Working invariants that MUST NOT be relearned from scratch:
-- Working branch: `main`. No feature branches.
-- Every commit needs `-c user.email="claude@volcanic" -c user.name="Claude"`.
-- All the Plan-1/2/3 invariants in CLAUDE.md: cookie auth is in the .NET 9
-  shared framework (do NOT add `Microsoft.AspNetCore.Authentication.Cookies`
-  as a PackageReference); test parallelism stays off; env-var loop honors
-  pre-set config; `WebhookRegistry` / `WebhookRouter` live in `.Core`;
-  `TriggerActivationSink` is fire-and-forget; SPA bundles into
-  `src/VolcanicCore.Api/wwwroot/`; `MapFallbackToFile` stays the LAST `Map*`
-  call; `vite.config.ts` needs `/// <reference types="vitest" />` on line 1.
-- Global CLAUDE.md: deploys are fire-and-forget via the Coolify v4 API — do
-  NOT poll the build, do NOT block on the FQDN. The API returns a deployment
-  id; that's the success signal.
-
-Env vars available in the session: `COOLIFY_URL`, `COOLIFY_KEY`, `GIT_URL`,
-`GIT_USER`, `GIT_KEY`. Use the `deploying-to-coolify-via-api` skill for the
-splice-credentials-into-git-URL and stderr-redaction patterns.
-
-Start by pulling latest, reading CLAUDE.md + followups + the two skills above,
-confirming `dotnet test` is 74/74 and `pnpm --dir frontend test` is 20/20
-before authoring Plan 4. Ask the user for the intended Coolify domain
-(e.g. `volcaniccore.tes.gd`) BEFORE the plan gets to the `deploy.json`
-creation task — that's a decision only they can make.