diff --git a/.procoder/config.toml b/.procoder/config.toml
new file mode 100644
index 0000000..cfafcc8
--- /dev/null
+++ b/.procoder/config.toml
@@ -0,0 +1,2 @@
+[git]
+default_branch_policy = "report"  # rulebook allows docs/evidence commits to main
diff --git a/.procoder/context.md b/.procoder/context.md
new file mode 100644
index 0000000..0226bfa
--- /dev/null
+++ b/.procoder/context.md
@@ -0,0 +1,13 @@
+# Context — anwarpy.ai
+
+## effective access
+
+The single server-side decision (launch.ts policy + doc.access + doc.status) consumed identically by the article page, public JSON route, download gate, and llms-full.
+
+## ghost-read
+
+Fetching an intended-VIP post logged out to assert what a stranger sees; the acceptance check for any access-logic change.
+
+## honest 503
+
+A dependency-down response with a fixed Arabic sentence (e.g. billing disabled, mail transport down) instead of a fake success; reference implementation: /api/notify.
diff --git a/.procoder/hosts.json b/.procoder/hosts.json
new file mode 100644
index 0000000..cb1e9b5
--- /dev/null
+++ b/.procoder/hosts.json
@@ -0,0 +1,3 @@
+[
+  "skills"
+]
diff --git a/.procoder/state/env.json b/.procoder/state/env.json
new file mode 100644
index 0000000..3a5db58
--- /dev/null
+++ b/.procoder/state/env.json
@@ -0,0 +1,29 @@
+{
+  "version": 1,
+  "synced_at": "2026-10-13T02:31:48Z",
+  "lockfiles": {
+    "web/package-lock.json": "b0168d824c755b061aeb7dc8bddb7faa05b7a236ccc82b196843d5752e3632d3"
+  },
+  "migrations": {
+    "web/src/migrations": {
+      "count": 14,
+      "entries": [
+        "20261002_130505_init.json",
+        "20261002_130505_init.ts",
+        "20261002_170000_add_full_name.ts",
+        "20261003_111451.json",
+        "20261003_111451.ts",
+        "20261003_133758.json",
+        "20261003_133758.ts",
+        "20261003_201454.json",
+        "20261003_201454.ts",
+        "20261009_130817.json",
+        "20261009_130817.ts",
+        "20261010_142214.json",
+        "20261010_142214.ts",
+        "index.ts"
+      ]
+    }
+  },
+  "env_keys": {}
+}
diff --git a/AGENTS.md b/AGENTS.md
index 95e5d96..da91658 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,4 +1,5 @@
 <!-- gstack digest, source: https://github.com/garrytan/gstack (agents-digest/gstack-AGENTS.md) -->
+
 # gstack digest v1.91.12.0 — regenerate/re-copy after upgrading gstack
 
 Behavioral rules from gstack (https://github.com/garrytan/gstack), compressed
@@ -15,6 +16,7 @@ reviews, and evals on top of these rules.
 ## The reuse ladder
 
 Before writing new code, stop at the first rung that holds:
+
 1. A helper, util, or pattern already in this repo.
 2. The standard library.
 3. A native platform feature (CSS over JS, DB constraint over app code).
@@ -86,4 +88,3 @@ ssh root@147.79.102.201 'cd /root/anwarpi && docker compose -f docker-compose.vp
 ```
 
 Prod scripts (no `scripts/` in the standalone image): `ssh -f -N -L 15432:<db-container-ip>:5432 root@…`, then locally `set -a; source <tmp env>; set +a; DATABASE_URI=postgresql://anwarpi:$DB_PASSWORD@127.0.0.1:15432/anwarpi npx tsx scripts/<script>.ts`; delete the temp env file after. Never echo the password.
-
diff --git a/web/docs/agent-publish-api.md b/web/docs/agent-publish-api.md
index 5d534c1..b60ee04 100644
--- a/web/docs/agent-publish-api.md
+++ b/web/docs/agent-publish-api.md
@@ -24,7 +24,7 @@ Publish and manage blog posts programmatically. Auth: send the agent key in the
 ## Create + publish a post with an image
 
 ```bash
-KEY=033d1eed44ca6abf483de10735c47155d38f7b5bc9d46449
+KEY="$AGENT_API_KEY"   # never hardcode — export AGENT_API_KEY in your shell; it lives in the server's .env.production
 
 # Inline base64 image (jpeg/png/webp, ≤5MB)
 python3 - <<'EOF' > /tmp/post.json
@@ -54,11 +54,20 @@ Response `201`:
 
 ```json
 {
-  "id": 113, "title": "دليلي الجديد", "slug": "my-new-guide",
-  "status": "published", "access": "vip", "category": "agents",
+  "id": 113,
+  "title": "دليلي الجديد",
+  "slug": "my-new-guide",
+  "status": "published",
+  "access": "vip",
+  "category": "agents",
   "cover": { "id": 113, "url": "/api/media/file/my-cover.jpg" },
   "attachments": [
-    { "id": 42, "filename": "agent-state.md", "access": "vip", "url": "/api/files/42" }
+    {
+      "id": 42,
+      "filename": "agent-state.md",
+      "access": "vip",
+      "url": "/api/files/42"
+    }
   ]
 }
 ```
diff --git a/web/package-lock.json b/web/package-lock.json
index 6f16165..0142b55 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -23,6 +23,7 @@
         "@types/nodemailer": "^8.0.2",
         "@types/react": "^19.2.0",
         "@types/react-dom": "^19.2.0",
+        "prettier": "^3.9.10",
         "typescript": "^5.9.0"
       },
       "engines": {
@@ -5661,9 +5662,9 @@
       }
     },
     "node_modules/prettier": {
-      "version": "3.9.9",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.9.tgz",
-      "integrity": "sha512-Z/CJHIkdujO/OtN7nXUii0Rf3VT5SRuhjBA82Xvu2XhBUgX3nhP67T0LHceBdQLex7OOFGTox+Q5Yg8Jk2Qivg==",
+      "version": "3.9.10",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.10.tgz",
+      "integrity": "sha512-skGHTH1Yb9QvaTC4hWnRTzEYtCpApF0UMBPz+t/0ZPzP8ihefo/btKd+QA7pUE0fEwA1SbS/NmhyEcstdXOIdA==",
       "license": "MIT",
       "bin": {
         "prettier": "bin/prettier.cjs"
diff --git a/web/package.json b/web/package.json
index 50eb25f..83cdf1c 100644
--- a/web/package.json
+++ b/web/package.json
@@ -27,6 +27,7 @@
     "@types/nodemailer": "^8.0.2",
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",
+    "prettier": "^3.9.10",
     "typescript": "^5.9.0"
   },
   "engines": {