Inquiry Publishing Stack

Required bootstrap

1. Read the canonical Starter ecosystem.
2. Read the Agent Retrieval Contract.
3. For a new project, read the Project Provisioning Contract.
4. Resolve all four component roles and public entrypoints.
5. For a downstream project, read project-stack.yaml, project-provisioning.yaml when present, selected profile, and lock state.
6. Fresh-read pinned AHICP/PPF/Vault manifests before material configuration, provisioning, or upgrade.
7. Default new projects to full AHICP + full PPF + Vault Interface.
8. Default ordinary new projects to workers-builds-native under the personal ChongLiuPhil account, with a human-assisted-once-per-project GitHub → Cloudflare bootstrap.
9. Default original/unpublished source to private and unpublished Web to restricted authenticated access.
10. Use Worker-scoped Access by default; reuse verified account-wide Access only when it actually exists.
11. Keep previews disabled until protected-preview acceptance.
12. Verify the first restricted deployment, then require a second push to deploy automatically without renewed authorization.
13. Treat agent-provisioned-external-ci + Trusted Secret Broker as an optional advanced profile, not a default prerequisite.
14. Never expose provider credential plaintext to model/chat/Git/logs.
15. Distinguish proposal, authorization, execution, verification, and durable write-back.
16. Ask the human only for project-level repository/provider UI consent that actually requires the account holder, or for reserved gates such as public release, reader expansion, domain/DNS authority, provider-scope expansion, and paid-plan change.
17. For the four public framework sites, keep using the approved canonical Worker and read the migration plan for live cutover evidence.

Canonical resources

Default project baseline

full AHICP
+ full PPF
+ Vault Interface
+ project-owned content

source repository: private by default
unpublished/transitional Web: restricted + authenticated
infrastructure profile: workers-builds-native
CI cost profile: private-project-quota-saver
project bootstrap: human-assisted-once-per-project
GitHub owner: ChongLiuPhil (user)
project Access: worker-scoped-access by default
preview: disabled until protected-preview acceptance
public cutover: explicit human authorization required

Authorization boundary

Never request passwords, API tokens, private keys, recovery codes, or other secrets in chat. The default Workers Builds profile uses provider-managed credentials. Private downstream projects also use private-project-quota-saver: content-only changes do not start GitHub Actions, configuration PRs use one lightweight contract check, main pushes do not duplicate the production Web build in GitHub Actions, and heavy workflows are manual. Do not use Actions as an iterative debugging loop or enable paid usage without human approval. If the optional advanced external-CI profile is selected, its Trusted Secret Broker keeps token plaintext outside model context. When a human must act in a provider UI, give exact numbered steps, the secret boundary, completion evidence, verification, and rollback.

If the user needs the explanation first

If the user needs to understand the system before configuring it, send them to the AHICP introduction. This page is a machine-oriented setup entry and should not be required reading for someone who only wants to understand the system.