Centralize agent instructions in SPEC (#4912)

* Centralize agent instructions in SPEC

Move the full coding-agent contract and repository guidance from `AGENTS.md` into `SPEC.md`, and reduce `AGENTS.md` to a simple pointer to the canonical instructions. Add lightweight `CLAUDE.md`, `GEMINI.md`, and `.github/copilot-instructions.md` files so different assistants consistently bootstrap through the same repo-specific guidance.

* Clarify auto-generated docs path scope in SPEC

Narrowed rule #3 to specify exact auto-generated subdirectories (tweaks/ and features/) rather than the entire code-reference/ directory, and clarified that other hand-written pages (e.g. architecture.mdx) may be edited directly.

* Remove archived docs from gitignore

Drop the old `docs-old` Hugo ignore rules from `.gitignore`, reflecting that the archived docs build artifacts no longer need special handling there.

* Add local env files to docs .gitignore

Add .env.local and .env.*.local patterns to prevent local environment files from being committed.

* Clarify test and git hygiene guidance

Update `SPEC.md` to run Pester in CI mode and tighten repository hygiene instructions around ignored files. The git guidance now points contributors to the actual `.gitignore` files and clarifies that `docs/public/` contains tracked static assets rather than generated output.

* Split agent workflow from project spec

Move repository working instructions into `AGENTS.md` and refocus `SPEC.md` on the stable WinUtil project contract. This separates agent-specific guidance from architecture, build, runtime, docs, testing, and release details so both documents have clearer ownership.

* docs: clarify Pester, ScriptAnalyzer, and source-of-truth rules

Expand AGENTS.md with context on why -SkipPublisherCheck is needed for Pester installation, why winutil.ps1 should be deleted before running ScriptAnalyzer, and clarify that the source-of-truth rule applies only to compiled-script behavior — repository metadata files are edited directly.

* Clarify Pester install command and -SkipPublisherCheck reason

Expands the explanation for why -SkipPublisherCheck is needed (catalog-signed vs Authenticode-signed), clarifies it does not skip download integrity, and adds -Repository PSGallery to pin the trusted source explicitly.

AGENTS.md

@@ -4,35 +4,22 @@ Drop-in operating instructions for coding agents. Read this file before every ta
 
 **Working code only. Finish the job. Plausibility is not correctness.**
 
-This repository follows the AGENTS.md convention: these instructions are for Codex, Claude Code, Cursor, Windsurf, Copilot, Aider, Devin, Amp, and other coding agents that read `AGENTS.md`.
+`SPEC.md` in the repository root is the project contract — read it for what WinUtil is and how it's architected. This file covers how to work on it.
 
 ## 0. Non-Negotiables
 
 These rules override everything else in this file when in conflict:
 
-1. **Do not edit `winutil.ps1` directly.** It is generated build output. Change source files and compile.
+1. **Do not edit `winutil.ps1` directly.** It is generated build output (see SPEC.md's Build Model). Change source files and compile.
 2. **Do not commit `winutil.ps1`.** It is ignored locally and generated by GitHub Actions for releases.
-3. **Never fabricate.** Do not invent file paths, function names, command output, test results, commit hashes, or API behavior. Read the file or run the command.
-4. **Disagree when the premise is wrong.** Say what is wrong before acting on it.
-5. **Stop when genuinely ambiguous.** If two interpretations would produce materially different diffs, ask before editing.
-6. **Touch only what the task requires.** No drive-by refactors, formatting sweeps, or unrelated cleanup.
-7. **Verify before saying done.** A plausible-looking diff is not proof.
+3. **Never touch `docs/src/content/docs/code-reference/tweaks/` or `docs/src/content/docs/code-reference/features/`.** Both are auto-generated (see SPEC.md's Docs Site). Edit the source JSON (`config/tweaks.json`, `config/feature.json`) or the relevant PowerShell function file instead. Other hand-written pages under `code-reference/` (e.g. `architecture.mdx`) are not touched by the generator and may be edited directly.
+4. **Never fabricate.** Do not invent file paths, function names, command output, test results, commit hashes, or API behavior. Read the file or run the command.
+5. **Disagree when the premise is wrong.** Say what is wrong before acting on it.
+6. **Stop when genuinely ambiguous.** If two interpretations would produce materially different diffs, ask before editing.
+7. **Touch only what the task requires.** No drive-by refactors, formatting sweeps, or unrelated cleanup.
+8. **Verify before saying done.** A plausible-looking diff is not proof.
 
-## 1. Project Context
-
-WinUtil is a Windows PowerShell utility with a WPF interface. The repository is maintained as modular source, but the distributed artifact is one compiled PowerShell script.
-
-### Stack
-
-- Language: Windows PowerShell / PowerShell.
-- UI: WPF via `xaml/inputXML.xaml`.
-- Configuration: JSON files under `config/`.
-- Tests: Pester tests under `pester/`.
-- Lint: PowerShell Script Analyzer with settings in `lint/PSScriptAnalyser.ps1`.
-- Docs: Hugo site under `docs/`.
-- Release artifact: generated root `winutil.ps1`.
-
-### Key Commands
+## 1. Key Commands
 
 - Compile:
   ```powershell
@@ -42,50 +29,38 @@ WinUtil is a Windows PowerShell utility with a WPF interface. The repository is
   ```powershell
   .\Compile.ps1 -Run
   ```
+- Install the supported Pester version (one-time). `-SkipPublisherCheck` is required because Windows ships an inbox Pester 3.4.0 that is catalog-signed, and PowerShell Gallery's Pester 5.8.0 is Authenticode-signed — `Install-Module` refuses the upgrade without it. This does not skip download integrity (still HTTPS + NuGet package hash verification); `-Repository PSGallery` pins the trusted source explicitly rather than relying on whatever repositories happen to be registered:
+  ```powershell
+  Install-Module -Name Pester -RequiredVersion 5.8.0 -Repository PSGallery -Scope CurrentUser -Force -SkipPublisherCheck
+  ```
 - Run tests:
   ```powershell
   Import-Module Pester -RequiredVersion 5.8.0 -Force
-  Invoke-Pester -Path 'pester/*.Tests.ps1' -Output Detailed
+  Invoke-Pester -Path 'pester/*.Tests.ps1' -Output Detailed -CI
   ```
-- Run Script Analyzer with project settings when available:
+- Run Script Analyzer with project settings when available. If a locally compiled `winutil.ps1` exists, delete it first — `lint/PSScriptAnalyser.ps1` only excludes rules, not files, so `-Recurse` would also lint the generated script and produce noise against line numbers that don't map to any source file:
   ```powershell
   Invoke-ScriptAnalyzer -Path . -Settings .\lint\PSScriptAnalyser.ps1 -Recurse
   ```
+- Docs site dev server (run from `docs/`):
+  ```powershell
+  npm install
+  npm run dev
+  ```
+- Docs site production build (run from `docs/`):
+  ```powershell
+  npm run build
+  ```
 
 Prefer the narrowest useful verification while iterating. Use the full relevant check before finishing.
 
 ## 2. Source Of Truth
 
-Make durable changes only in files consumed by `Compile.ps1` or in documentation/test files:
+For changes that affect the compiled WinUtil script, make them only in the source files described in SPEC.md's Repository Layout — never in `winutil.ps1` itself. If behavior changes require the compiled script to change, update the source files and run `.\Compile.ps1` only to verify generation.
 
-- `scripts/start.ps1` for startup/bootstrap code.
-- `functions/public/*.ps1` for UI-facing and user-facing workflows.
-- `functions/private/*.ps1` for internal helpers.
-- `config/*.json` for applications, tweaks, features, DNS, presets, navigation, themes, and related declarative data.
-- `xaml/inputXML.xaml` for the WPF UI layout.
-- `tools/autounattend.xml` for the embedded unattended Windows setup template.
-- `scripts/main.ps1` for the final entrypoint and GUI initialization logic appended during compile.
-- `pester/*.Tests.ps1` for automated checks.
-- `docs/` for Hugo documentation.
+This scoping applies to compiled-script behavior only. Repository metadata — `AGENTS.md`, `SPEC.md`, `CLAUDE.md`/`GEMINI.md`/`.github/copilot-instructions.md`, `.github/workflows/`, and the root `.gitignore` — is edited directly when a task requires it, per the other sections of this file.
 
-If behavior changes require the compiled script to change, update these source files and run `.\Compile.ps1` only to verify generation.
-
-## 3. Build Model
-
-`Compile.ps1` combines the repository sources into `winutil.ps1` in this order:
-
-1. Read `scripts/start.ps1` and replace `#{replaceme}` with the current `yy.MM.dd` build date.
-2. Append every file under `functions/` recursively.
-3. Convert each `config/*.json` file into embedded `$sync.configs` objects.
-4. Special-case `config/applications.json` so keys receive the `WPFInstall` prefix in compiled config.
-5. Embed `xaml/inputXML.xaml` into `$inputXML`.
-6. Embed `tools/autounattend.xml` into `$WinUtilAutounattendXml`.
-7. Append `scripts/main.ps1`.
-8. Write the result to root `winutil.ps1`.
-
-Because the final script is concatenated, do not rely on runtime module imports or source-relative dot-sourcing unless the compiled script will also contain the required code/data.
-
-## 4. Before Editing
+## 3. Before Editing
 
 - State the plan in one or two sentences before editing. For non-trivial work, include the verification you intend to run.
 - Read the files you will touch and the files that call them.
@@ -93,30 +68,29 @@ Because the final script is concatenated, do not rely on runtime module imports
 - Surface assumptions when they affect behavior, compatibility, or user data.
 - If two approaches have meaningful tradeoffs, name them before choosing. Trivial tasks can proceed directly.
 
-## 5. Coding Guidelines
+## 4. Coding Guidelines
 
 - Prefer the minimum code that solves the stated problem.
 - Keep PowerShell functions in one function file when practical, with the file name matching the primary function name.
-- Use approved PowerShell verb-noun names and follow the existing `WPF` / `WinUtil` naming conventions.
-- Keep UI event handler names aligned with XAML element names. A button named `WPFExampleButton` is typically handled by `Invoke-WPFExampleButton`.
-- Use `$sync` for shared state and UI references, consistent with the existing runspace model.
+- Use approved PowerShell verb-noun names and follow the existing `WPF` / `WinUtil` naming conventions; keep UI event handler names aligned with XAML element names per SPEC.md's UI And Event Contract.
+- Use `$sync` for shared state and UI references, consistent with SPEC.md's Runtime Model.
 - Update WPF controls through the UI dispatcher when running work in a background runspace.
-- Keep config-driven features in JSON when they fit the existing schema instead of hard-coding lists in PowerShell.
+- Keep config-driven features in JSON when they fit the existing schema instead of hard-coding lists in PowerShell; follow SPEC.md's Configuration Contract for required fields and key-renaming rules.
 - Preserve undo/original-state data for tweaks so users can reverse changes.
 - Do not add abstractions, configurability, hooks, or "future extensibility" unless the task needs them now.
 - Clean up orphans created by your own changes, such as unused variables or functions made obsolete by the edit.
 - Avoid broad formatting-only edits, especially in JSON config files, XAML, docs, and generated output.
 
-## 6. Runtime And Safety Rules
+## 5. Runtime And Safety Rules
 
-- WinUtil performs system-level Windows changes. Treat registry, services, AppX removal, package manager, Windows Update, ISO, and unattended setup changes as high-risk.
+- WinUtil performs system-level Windows changes; treat registry, services, AppX removal, package manager, Windows Update, ISO, and unattended setup changes as high-risk (see SPEC.md's Safety Requirements).
 - Prefer existing helper functions for WinGet, Chocolatey, registry, services, progress, and UI updates.
 - Keep tweaks reversible where the schema supports it by including original values or original states.
 - Never modify a user's original ISO in-place; follow existing copy/mount/export patterns.
 - Avoid storing credentials, secrets, or machine-specific paths in repo files.
 - Preserve logging and user feedback patterns for long-running or destructive operations.
 
-## 7. Surgical Changes
+## 6. Surgical Changes
 
 - Do not improve adjacent code, comments, formatting, imports, or docs unless required.
 - Do not refactor working code because you are already in the file.
@@ -124,7 +98,7 @@ Because the final script is concatenated, do not rely on runtime module imports
 - Keep diffs reviewable. Every changed line should trace to the user's request.
 - If a change starts spreading across unrelated areas, pause and reassess the plan.
 
-## 8. Verification
+## 7. Verification
 
 Define success in terms that can be checked, then check it.
 
@@ -136,26 +110,28 @@ Define success in terms that can be checked, then check it.
 - Read command output. Do not report tests as passing unless they actually passed.
 - If verification fails, fix the cause rather than weakening the test.
 
-If a check cannot be run, say exactly why and what residual risk remains.
+If a check cannot be run, say exactly why and what residual risk remains. See SPEC.md's Testing And CI for what GitHub Actions runs on every push.
 
-## 9. Generated Files And Git Hygiene
+## 8. Generated Files And Git Hygiene
 
 - Treat local `winutil.ps1` changes as disposable compile output.
-- Never stage or commit `winutil.ps1`, `docs/public/`, `docs/resources/`, `binary/`, editor folders, or other ignored build artifacts.
+- Never stage or commit `winutil.ps1`, `binary/`, or anything else ignored by the root `.gitignore` or `docs/.gitignore` — read those files rather than assuming. `docs/public/` is tracked source for static assets, not generated output.
 - Do not remove `.gitignore` rules that keep generated artifacts out of Git.
 - Before finishing, check `git status --short` and separate your changes from pre-existing user changes.
 - Do not revert user changes unless explicitly asked.
 - Commit messages, when requested, should be descriptive: short subject under 72 characters, body explaining why when needed.
+- When committing, split changes into small, logical commits rather than one large commit, so each commit's diff is reviewable as a single group of related changes.
 
-## 10. Documentation Expectations
+## 9. Documentation Expectations
 
-- Update `docs/content/` when user-facing behavior changes.
-- Update developer docs when architecture, build flow, config schema, or contribution workflow changes.
+- Update `docs/src/content/docs/guides/` when user-facing behavior changes.
+- Update `docs/src/content/docs/code-reference/architecture.mdx` and other hand-written developer docs when architecture, build flow, config schema, or contribution workflow changes — but never hand-edit the auto-generated `code-reference/tweaks/` or `code-reference/features/` subfolders (see Non-Negotiables).
+- Keep sidebar entries in `docs/astro.config.mjs` in sync with page slugs (see SPEC.md's Docs Site).
 - Keep README changes brief and high-level.
 - Put detailed user and developer documentation under `docs/`.
-- Keep `SPEC.md` aligned with build/runtime contract changes.
+- Keep SPEC.md aligned with project/architecture changes, and this file aligned with process changes.
 
-## 11. Communication Style
+## 10. Communication Style
 
 - Be direct and concise. Start with the answer or action.
 - No flattery, filler, ceremonial closings, or fake certainty.
@@ -163,7 +139,7 @@ If a check cannot be run, say exactly why and what residual risk remains.
 - Report what changed, how it was verified, and anything not done.
 - If the user asks for a review, lead with findings and file/line references.
 
-## 12. When To Ask
+## 11. When To Ask
 
 Ask before proceeding when:
 
@@ -178,7 +154,7 @@ Proceed without asking when:
 - Ambiguity can be resolved by reading the code or running a local command.
 - The user already answered the question in this session.
 
-## 13. Project Learnings
+## 12. Project Learnings
 
 When the user corrects an agent approach, add or tighten one concrete rule here before ending the session. Keep this section short and prune rules that no longer matter.