Merge pull request #152 from mq-rest-admin-project/feature/151-tooling-refresh

chore(tooling): refresh managed config to Vergil v2.0.76 (items 1/3/6/7)

Author: wphillipmoore

.claude/settings.json

@@ -21,7 +21,7 @@
     "vergil-marketplace": {
       "source": {
         "source": "github",
-        "repo": "vergil-project/vergil-plugin"
+        "repo": "vergil-project/vergil-claude-plugin"
       }
     }
   },

.github/workflows/cd.yml

@@ -30,6 +30,4 @@ jobs:
       language: ruby
       container-tag: "3.4"
       registry-publish: true
-    secrets:
-      APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
-      APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
+    secrets: inherit

.gitignore

@@ -50,3 +50,6 @@ doc/yard/
 # RuboCop remote config cache
 .rubocop-https?--*
 .worktrees/
+
+# Vergil tooling scratch dir
+.vergil/

CLAUDE.md

@@ -36,27 +36,27 @@ on-ramp.
 ### Structure
 
 ```text
-~/dev/github/mq-rest-admin-ruby/          ← sessions ALWAYS start here
+<project-root>/                              ← sessions ALWAYS start here
   .git/
-  CLAUDE.md, lib/, spec/, …               ← main worktree (usually `develop`)
-  .worktrees/                             ← container for parallel worktrees
-    issue-105-adopt-worktree-convention/  ← worktree on feature/105-...
+  CLAUDE.md, …                               ← main worktree (usually `develop`)
+  .worktrees/                                ← container for parallel worktrees
+    issue-<N>-<short-slug>/                  ← worktree on feature/<N>-<short-slug>
     …
 ```
 
 ### Rules
 
 1. **Sessions always start at the project root.**
-   `cd ~/dev/github/mq-rest-admin-ruby && claude` — never from inside
-   `.worktrees/<name>/`. This keeps the memory-path slug stable and shared.
+   Never start Claude from inside `.worktrees/<name>/`. This keeps the
+   memory-path slug stable and shared.
 2. **Each parallel agent is assigned exactly one worktree.** The session
    prompt names the worktree (see Agent prompt contract below).
    - For Read / Edit / Write tools: use the worktree's absolute path.
    - For Bash commands that touch files: `cd` into the worktree first,
      or use absolute paths.
 3. **The main worktree is read-only.** All edits flow through a worktree
    on a feature branch — the logical endpoint of the standing
-   "no direct commits to `develop`" policy.
+   "no direct commits to develop" policy.
 4. **One worktree per issue.** Don't stack in-flight issues. When a
    branch lands, remove the worktree before starting the next.
 5. **Naming: `issue-<N>-<short-slug>`.** `<N>` is the GitHub issue
@@ -70,22 +70,44 @@ placeholders):
 ```text
 You are working on issue #<N>: <issue title>.
 
-Your worktree is: /Users/pmoore/dev/github/mq-rest-admin-ruby/.worktrees/issue-<N>-<slug>/
+Your worktree is: <project-root>/.worktrees/issue-<N>-<slug>/
 Your branch is:   feature/<N>-<slug>
 
 Rules for this session:
 - Do all git operations from inside your worktree:
-    cd <absolute-worktree-path> && git <command>
+    cd <absolute-worktree-path> && vrg-git <command>
 - For Read / Edit / Write tools, use the absolute worktree path.
 - For Bash commands that touch files, cd into the worktree first
   or use absolute paths.
 - Do not edit files at the project root. The main worktree is
   read-only — all changes flow through your worktree on your
   feature branch.
+- When you need to run validation, run it from inside your worktree
+  (vrg-container-run mounts the current directory).
 ```
 
 All fields are required.
 
+## Shell command policy
+
+Use `vrg-git` instead of `git` for all git operations. Use `vrg-gh`
+instead of `gh` for all GitHub CLI operations. These wrappers enforce
+subcommand allowlists, flag deny lists, and credential selection.
+
+Raw `git` and `gh` are denied by the permission model. If a command
+is not available through the wrappers, explain the situation to the
+human who can run it directly via `! <command>` in the prompt.
+
+## Validation
+
+```bash
+vrg-container-run -- vrg-validate
+```
+
+This is the **only** validation command. Do not run individual linters,
+formatters, or other tools outside of `vrg-validate`. If a tool is not
+invoked by `vrg-validate`, it is not part of the validation pipeline.
+
 ## Project Overview
 
 `mq-rest-admin` is a Ruby wrapper for the IBM MQ administrative REST
@@ -101,24 +123,12 @@ translation between Ruby idioms and native MQSC parameter names.
 
 ## Development Commands
 
-### Standard Tooling
-
-The Claude Code PreToolUse hook guard (`.claude/hooks/guard.sh`)
-blocks raw `git` and `gh` commands — use `vrg-git` / `vrg-gh`
-wrappers.
-
 ### Environment Setup
 
 ```bash
 bundle install
 ```
 
-### Validation
-
-```bash
-vrg-docker-run -- vrg-validate   # Canonical validation (runs in dev container)
-```
-
 ### CI
 
 PR CI (`.github/workflows/ci.yml`) uses vergil-actions v2.0 reusable

README.md

@@ -31,8 +31,9 @@ require "mq/rest/admin"
 session = MQ::REST::Admin::Session.new(
   "https://localhost:9443/ibmmq/rest/v2",
   "QM1",
-  credentials: MQ::REST::Admin::BasicAuth.new(username: "mqadmin", password: "mqadmin"),
-  verify_tls: false
+  credentials: MQ::REST::Admin::BasicAuth.new(username: "mqadmin", password: "mqadmin")
+  # TLS is always verified. For a self-signed/dev queue manager, pass
+  # tls_ca_file: "/path/to/dev-ca.pem"
 )
 
 # Display queue manager attributes

docs/site/docs/api/session.md

@@ -14,7 +14,7 @@ session = MQ::REST::Admin::Session.new(
   qmgr_name,
   credentials:,
   gateway_qmgr: nil,
-  verify_tls: true,
+  tls_ca_file: nil,
   timeout_seconds: 30.0,
   map_attributes: true,
   mapping_strict: false,
@@ -33,7 +33,7 @@ session = MQ::REST::Admin::Session.new(
 | `qmgr_name` | `String` | (required) | Target queue manager name |
 | `credentials` | Auth object | (required) | `BasicAuth`, `LTPAAuth`, or `CertificateAuth` |
 | `gateway_qmgr` | `String` | `nil` | Gateway queue manager name for routing |
-| `verify_tls` | `Boolean` | `true` | Verify TLS certificates |
+| `tls_ca_file` | `String` | `nil` | PEM CA bundle to trust for TLS (nil = system store); certificates are always verified |
 | `timeout_seconds` | `Float` | `30.0` | HTTP request timeout |
 | `map_attributes` | `Boolean` | `true` | Enable attribute mapping |
 | `mapping_strict` | `Boolean` | `false` | Raise on unknown attributes |

docs/site/docs/api/transport.md

@@ -44,12 +44,11 @@ Any object responding to `post_json` with the following signature can be used
 as a transport:
 
 ```ruby
-def post_json(url, payload, headers:, timeout_seconds:, verify_tls:)
+def post_json(url, payload, headers:, timeout_seconds:)
   # url: String - full URL
   # payload: Hash - JSON body to POST
   # headers: Hash - HTTP headers
   # timeout_seconds: Float or nil - request timeout
-  # verify_tls: Boolean - whether to verify TLS certificates
   #
   # Returns: TransportResponse
   # Raises: TransportError on network failure
@@ -80,7 +79,7 @@ class MockTransport
     @calls = []
   end
 
-  def post_json(url, payload, headers:, timeout_seconds:, verify_tls:)
+  def post_json(url, payload, headers:, timeout_seconds:)
     @calls << { url: url, payload: payload, headers: headers }
     response = @responses[@call_index]
     @call_index += 1

docs/site/docs/architecture.md

@@ -48,7 +48,7 @@ In Ruby, the transport is defined by a duck-type contract:
 
 ```ruby
 # Any object responding to #post_json with this signature
-def post_json(url, payload, headers:, timeout_seconds:, verify_tls:)
+def post_json(url, payload, headers:, timeout_seconds:)
   # Returns a TransportResponse
 end
 ```
@@ -69,7 +69,7 @@ class MockTransport
     @calls = []
   end
 
-  def post_json(url, payload, headers:, timeout_seconds:, verify_tls:)
+  def post_json(url, payload, headers:, timeout_seconds:)
     @calls << { url: url, payload: payload }
     response = @responses[@call_index]
     @call_index += 1

docs/site/docs/getting-started.md

@@ -34,7 +34,9 @@ session = MQ::REST::Admin::Session.new(
     username: 'mqadmin',
     password: 'mqadmin'
   ),
-  verify_tls: false  # for local development only
+  # TLS is always verified. For a self-signed/dev queue manager, trust its
+  # CA explicitly (nil uses the system trust store):
+  tls_ca_file: ENV.fetch('MQ_REST_TLS_CA_FILE', nil)
 )
 ```
 
@@ -157,8 +159,7 @@ session = MQ::REST::Admin::Session.new(
   'https://qm1-host:9443/ibmmq/rest/v2',
   'QM2',                                     # target queue manager
   credentials: MQ::REST::Admin::BasicAuth.new(username: 'mqadmin', password: 'mqadmin'),
-  gateway_qmgr: 'QM1',                       # local gateway queue manager
-  verify_tls: false
+  gateway_qmgr: 'QM1'                        # local gateway queue manager
 )
 
 qmgr = session.display_qmgr

examples/channel_status.rb

@@ -109,7 +109,7 @@ def self.append_undefined_channels(results, definitions, live_status)
       username: ENV.fetch('MQ_ADMIN_USER', 'mqadmin'),
       password: ENV.fetch('MQ_ADMIN_PASSWORD', 'mqadmin')
     ),
-    verify_tls: false
+    tls_ca_file: ENV.fetch('MQ_REST_TLS_CA_FILE', nil)
   )
 
   MQ::REST::Admin::Examples::ChannelStatus.main(session)