chore: harden Varlock runtime contract

.env.example

@@ -21,6 +21,10 @@ OPENAI_API_KEY=
 # Get a key at https://flowyo.ai
 # FLOYO_KEY=
 
+# Optional: Replicate keyframe stills (`generate.py keyframes generate --execute`)
+# Get a token at https://replicate.com/account/api-tokens
+# REPLICATE_API_TOKEN=
+
 # Optional: Notion gallery export (`generate.py notion-export <project>`)
 # Create an internal integration at https://www.notion.so/my-integrations
 # Then share the target database with that integration. See docs/NOTION-EXPORT.md.

.env.schema

@@ -14,6 +14,11 @@ GOOGLE_API_KEY=
 # @docs(https://platform.openai.com/api-keys)
 OPENAI_API_KEY=
 
+# Replicate API token for keyframe and LoRA-backed still-image workflows.
+# @sensitive
+# @docs(https://replicate.com/account/api-tokens)
+REPLICATE_API_TOKEN=
+
 # Optional Chrome/Chromium executable for HTML-to-PNG rendering.
 # @public
 # @docs(docs/CHROME-PUPPETEER.md)
@@ -41,3 +46,13 @@ NOTION_API_KEY=
 # @sensitive
 # @docs(docs/NOTION-EXPORT.md)
 NOTION_DATABASE_ID=
+
+# Agentic provider adapter selection for local/workflow issue runners.
+# @public
+# @docs(docs/DELIVERY-PIPELINE.md)
+AGENTIC_PROVIDER=
+
+# Command executed by the agentic command provider.
+# @sensitive
+# @docs(docs/DELIVERY-PIPELINE.md)
+AGENTIC_PROVIDER_COMMAND=

AGENTS.md

@@ -0,0 +1,11 @@
+# Agent Instructions
+
+- Treat `.env.schema` as the agent-readable environment contract.
+- Do not read `.env`, `.env.local`, ignored env files, or local credential stores.
+- Do not run commands that reveal raw secret values, including `varlock reveal`,
+  `varlock printenv`, `varlock encrypt`, `env`, or `printenv`.
+- Do not print `process.env`, `os.environ`, full Varlock load output, or provider
+  settings. Report only redacted status such as "set" or "not set".
+- Use `varlock load --agent --show-all` for redacted validation.
+- Use `varlock run --inject vars -- ...` when a command needs provider-capable
+  environment variables injected into a child process.

README.md

@@ -74,12 +74,19 @@ To inspect the schema safely:
 varlock load --agent --show-all
 ```
 
+To prove Varlock injection reaches a child process without printing a secret:
+
+```bash
+varlock run --inject vars -- node -e "console.log(process.env.OPENAI_API_KEY ? 'OPENAI_API_KEY=set' : 'OPENAI_API_KEY=not set')"
+```
+
 When an agent needs to run a real provider-capable command, inject values
 through Varlock instead of reading `.env`:
 
 ```bash
 varlock run --inject vars -- npx rafiki --prompt "..." --output output.png
 varlock run --inject vars -- ./.venv/bin/python generate.py --prompt "..." --output output.png
+varlock run --inject vars -- python3 scripts/agentic/provider_adapter.py --provider command --issue-file issue.md --json-output /tmp/agentic-provider-result.json
 ```
 
 ### 3. Run setup diagnostics
@@ -349,6 +356,9 @@ python generate.py link-projects
 - Provider keys belong in your shell environment or an untracked `.env`
 - `.env.schema` is the committed env contract for agents; use
   `varlock load --agent --show-all` instead of reading `.env`
+- Agents must not read env files, print raw Varlock load data, print
+  `process.env`/`os.environ`, or run `env`/`printenv`; report only redacted
+  set/not-set status.
 - Agent-invoked commands that may make real provider calls should be wrapped
   with `varlock run --inject vars --`
 - `python generate.py serve` binds to `127.0.0.1` by default

docs/FLOYO.md

@@ -73,8 +73,7 @@ Floyo/FloTime is a **video** backend and **cannot load FLUX image LoRAs**, so th
 character image LoRA, e.g. `walkswithaswagger/alexandra-samuel`). Floyo then animates them.
 
 ```bash
-# from a project dir with keyframes.json + REPLICATE_API_TOKEN in rafiki/.env
-python generate.py keyframes generate --beat situ_02_backstage --num-outputs 4 --execute
+varlock run --inject vars -- python generate.py keyframes generate --beat situ_02_backstage --num-outputs 4 --execute
 # or by number:  --beat 02
 ```