{
  "_comment": "Pre-deploy pipeline project registry. One entry per deployable project. Consumed by the deterministic scripts (regression-guard, config-env-check, build-test, post-deploy-verify), the judgment agents, and the /predeploy skill. Copy this file to registry.json (in the repo root, or point PREDEPLOY_REGISTRY at it) and replace the example entry with your own. registry.json is gitignored so your real project details never get committed.",

  "_fieldDocs": {
    "slug": "Short unique id you pass on the CLI, e.g. --project=<slug>.",
    "name": "Human-readable project name (used only in report output).",
    "repo": "Absolute path to the local repo/working copy to check and build.",
    "liveRepo": "Optional. Absolute path to the CURRENTLY-DEPLOYED repo when it differs from `repo` (i.e. a cutover / repo swap). Omit for normal in-repo deploys.",
    "cutover": "Optional boolean. true forces cutover mode (route-parity + forced human sign-off) instead of the git-ancestor check. Use when a brand-new repo is replacing the live app.",
    "cutoverNote": "Optional free-text note explaining the cutover for humans reading the report.",
    "prodBranch": "The branch (or ref) that represents production. Used to resolve the live SHA when you don't pass --live-sha.",
    "deployMethod": "How this project deploys: 'vercel-git' | 'vercel-cli' | 'pm2' | or your own. Anything starting with 'vercel' enables the best-effort `vercel env ls` prod check.",
    "isPublic": "true for public-facing sites -> adds the public-tier judgment agents (visual-parity, seo-guard, perf-check). false for internal/admin apps.",
    "liveUrl": "The production base URL, used by post-deploy-verify and the visual/seo agents. null if there is no public URL (e.g. a worker/bot).",
    "criticalPaths": "Array of URL paths that MUST serve 2xx after deploy. post-deploy-verify curls each one; '/' is used if empty.",
    "requiredEnv": "Env vars that MUST be present on the deploy target. config-env-check flags any that are missing.",
    "devBypassFlags": "Env vars that enable a dev/demo/auth bypass. If any is truthy in an env file, config-env-check BLOCKS (you'd ship a bypass to prod).",
    "serverOnlySecrets": "Secrets that must stay server-side. config-env-check BLOCKS if any is exposed as a NEXT_PUBLIC_* alias or hardcoded in client source.",
    "rollbackMethod": "Plain-text description of exactly how to roll this project back. The rollback-verify agent checks that this path is real, not assumed."
  },

  "projects": [
    {
      "slug": "example-project",
      "name": "Example Project",
      "repo": "/absolute/path/to/your/project",
      "prodBranch": "main",
      "deployMethod": "vercel-git",
      "isPublic": true,
      "liveUrl": "https://example.com",
      "criticalPaths": ["/", "/pricing", "/login", "/sitemap.xml"],
      "requiredEnv": [
        "NEXT_PUBLIC_API_URL",
        "NEXT_PUBLIC_ANON_KEY",
        "SERVICE_ROLE_KEY",
        "CRON_SECRET"
      ],
      "devBypassFlags": ["NEXT_PUBLIC_ADMIN_BYPASS", "NEXT_PUBLIC_DEMO_MODE", "LOCAL_AUTH"],
      "serverOnlySecrets": ["SERVICE_ROLE_KEY", "CRON_SECRET"],
      "rollbackMethod": "Vercel dashboard -> Deployments -> promote the previous READY production deployment. (For a CLI/alias setup: `vercel alias set <previous-prod-deployment-url> example.com`.)"
    }
  ]
}