Phase B/2: workflow audit before the first push, not after

The excalidraw lesson, applied. This repo inherited the boilerplate's
workflows and had never run them; the first push would have run them
against another site.

(a) SCRIPTS. Every script the workflows invoke — network_smoke.py,
smoke_live.py, dev.sh — exists in this tree. Nothing missing.

(b) NAMES AND URLS. cd.yml carried
`SITE_URL: https://boilerplate.2plot.dev` hard-coded. Unguarded, the
inaugural push would have polled ANOTHER SITE's /healthz for fifteen
minutes waiting for a commit it will never serve, failed, then run both
live batteries against it and reported red — a fork failing CD on day one
over a host it does not own. ci.yml's Docker image was still tagged
`dash-docs-boilerplate:ci` ("a fork changes the matrix and the image
name", which this fork had not), and its header described this repo as
the template every satellite copies. Both fixed. The remaining mentions
of boilerplate.2plot.dev now correctly name it as a DIFFERENT site.

(c) THE LIVE HALF IS GUARDED. Everything touching a running host — the
build-match wait and the whole `verify` job — is gated on the repository
variable SITE_URL, with no hard-coded fallback: an empty value IS the
signal that no service exists. A default would silently re-point this
workflow at somebody else's host, which is the defect being fixed.
Pointing it at llms.2plot.dev today would be no better — that domain
still serves the OUTGOING site this migration replaces.

Unguarding takes no workflow edit, twice:
  B3 staging  — set the repo variable SITE_URL to https://<name>.onrender.com
  B5 cutover  — change that same variable to https://llms.2plot.dev

Marked B3 TODO in cd.yml's header and at both guarded sites. A dormant
run now prints a notice saying exactly what is skipped and how to bring
it up, so a green-but-inert CD is legible rather than mysterious.

The `environment.url` is omitted rather than evaluated to an empty
string: the first run in this repo's history should not hinge on how
GitHub treats a blank environment URL. B3 restores it with the variable.

Both workflows and dependabot.yml parse.

Phase B/3: the social card is verification-only, and it verifies.
OG_IMAGE_URL is exactly
https://cdn.2plot.ai/github_assets/llms.2plot.dev.png; the object is
live (HTTP 200, image/png, 56,587 bytes) and its real IHDR pixels are
1200x630, matching OG_IMAGE_WIDTH/HEIGHT. Nothing generated, nothing
uploaded.

Author: pip-install-python

.github/workflows/cd.yml

@@ -1,12 +1,37 @@
 name: CD
 
-# Deploys boilerplate.2plot.dev, then checks the live site.
+# Deploys llms.2plot.dev, then checks the live site.
+#
+# ============================ B3 TODO =====================================
+# THE LIVE HALF OF THIS WORKFLOW IS DORMANT UNTIL A RENDER SERVICE EXISTS.
+#
+# Everything that touches a running host — the build-match wait and the whole
+# `verify` job — is gated on the repository variable `SITE_URL`. While it is
+# unset those steps skip with a notice and CD is effectively "CI plus an
+# optional deploy trigger".
+#
+# This is not caution for its own sake. The template shipped
+# SITE_URL=https://boilerplate.2plot.dev hard-coded, so an unguarded run here
+# would poll ANOTHER SITE's /healthz for fifteen minutes waiting for a commit
+# it will never serve, then battery it and report red — a fork failing CD on
+# day one over a host it does not own. (Same class as the excalidraw finding:
+# inherited workflows reference things that do not exist in the fork and
+# deploy hosts that are not yours.) Pointing it at llms.2plot.dev today is no
+# better: that domain still serves the OUTGOING site this migration replaces.
+#
+# TO UNGUARD, in two steps, no workflow edit either time:
+#   B3 (staging): set the repo variable SITE_URL to the service's
+#                 https://<name>.onrender.com URL. The wait and the battery
+#                 come alive against staging.
+#   B5 (cutover): change that same variable to https://llms.2plot.dev once
+#                 the domain moves.
+# ==========================================================================
 #
 # The deploy step POSTs to a Render deploy hook held in the
 # RENDER_DEPLOY_HOOK_URL secret. Without that secret the step is skipped and
 # the workflow goes straight to verification — useful when Render is already
-# auto-deploying from GitHub on its own, and it means a fork of this template
-# doesn't fail CD on day one for a secret it was never given.
+# auto-deploying from GitHub on its own, and it means this repo doesn't fail
+# CD on day one for a secret it was never given.
 on:
   push:
     branches: [main]
@@ -26,7 +51,10 @@ concurrency:
 
 env:
   PIP_DISABLE_PIP_VERSION_CHECK: "1"
-  SITE_URL: ${{ inputs.target_url || 'https://boilerplate.2plot.dev' }}
+  # No hard-coded fallback, deliberately: an empty SITE_URL is the signal
+  # that no service exists yet, and every live step keys off it. A default
+  # here would silently re-point this workflow at somebody else's host.
+  SITE_URL: ${{ inputs.target_url || vars.SITE_URL }}
 
 jobs:
   test:
@@ -44,10 +72,19 @@ jobs:
     timeout-minutes: 20
     environment:
       name: production
-      url: https://boilerplate.2plot.dev
+      # B3 TODO: restore `url: ${{ inputs.target_url || vars.SITE_URL }}`
+      # when SITE_URL is set. Omitted while dormant rather than evaluated to
+      # an empty string — the deployment panel simply shows no link, and the
+      # first run in this repo's history does not hinge on how GitHub treats
+      # a blank environment URL.
     outputs:
       deployed: ${{ steps.hook.outputs.deployed }}
     steps:
+      - name: Say plainly that the live half is dormant
+        if: env.SITE_URL == ''
+        run: |
+          echo "::notice::No Render service yet — SITE_URL repo variable is unset, so the build-match wait and the live batteries are skipped. Set SITE_URL to the .onrender.com URL at B3 to bring them up (see this workflow's header)."
+
       - name: Trigger the Render deploy hook
         id: hook
         env:
@@ -62,6 +99,10 @@ jobs:
           echo "deployed=true" >> "$GITHUB_OUTPUT"
 
       - name: Wait for THIS build to serve traffic
+        # B3 TODO: skips while SITE_URL is unset — see the header. Without
+        # this guard the loop below polls a host this repo does not own for
+        # fifteen minutes and then fails the run.
+        if: env.SITE_URL != ''
         # NOT gated on the hook step: with RENDER_DEPLOY_HOOK_URL unset,
         # Render's own autoDeploy ships the commit minutes after the push —
         # and the old shape skipped this wait and ran the battery three
@@ -105,7 +146,12 @@ jobs:
   verify:
     name: verify the live site
     needs: [deploy]
-    if: always() && needs.deploy.result != 'cancelled'
+    # B3 TODO: the whole job is dormant until SITE_URL names a real service.
+    # `vars.SITE_URL` rather than `env.SITE_URL` because job-level `if` is
+    # evaluated before the job's env context exists.
+    if: >-
+      always() && needs.deploy.result != 'cancelled'
+      && (inputs.target_url || vars.SITE_URL) != ''
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:

.github/workflows/ci.yml

@@ -1,8 +1,8 @@
-# CI for boilerplate.2plot.dev — and the TEMPLATE every 2plot satellite copies.
+# CI for llms.2plot.dev — the documentation site for dash-improve-my-llms.
 #
-# This repo is the one the other documentation sites are forked from, so the
-# shape of this file is part of the deliverable. It implements the network's
-# CI baseline (2plot.ai and 2plot.dev run the same one):
+# Inherited from dash-documentation-boilerplate, which is where the shape of
+# this file is the deliverable. Here it is just the network's CI baseline
+# (2plot.ai and 2plot.dev run the same one):
 #
 #   * least-privilege `permissions` and a cancel-in-progress `concurrency`
 #     group, so a workflow cannot write more than it reads and a rapid second
@@ -18,8 +18,9 @@
 #     provable when nothing is configured;
 #   * an advisory pip-audit.
 #
-# A fork changes the matrix and the image name. Everything else is the
-# standard; see the 2plot network standard on boilerplate.2plot.dev.
+# A fork changes the matrix and the image name — both done here. Everything
+# else is the standard; see the 2plot network standard on
+# boilerplate.2plot.dev (the template's own live site, not this one).
 
 name: CI
 
@@ -215,7 +216,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          tags: dash-docs-boilerplate:ci
+          tags: llms-2plot-dev:ci
           load: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -224,7 +225,7 @@ jobs:
       # are asserted here, inside the artifact that actually ships.
       - name: Version fingerprints inside the image
         run: |
-          docker run --rm dash-docs-boilerplate:ci python -c "
+          docker run --rm llms-2plot-dev:ci python -c "
           from importlib.metadata import version
 
           def parts(v):
@@ -256,7 +257,7 @@ jobs:
       # platform loops the worker and the deploy never goes live.
       - name: Boot the container and wait for /healthz
         run: |
-          docker run -d --name docs -p 8550:8550 dash-docs-boilerplate:ci
+          docker run -d --name docs -p 8550:8550 llms-2plot-dev:ci
           for i in $(seq 1 60); do
             if curl -sf http://127.0.0.1:8550/healthz > /dev/null; then
               echo "healthy after ~$((i*2))s"
@@ -273,8 +274,9 @@ jobs:
           docker logs --tail 100 docs
           exit 1
 
-      # The SAME script CD runs against https://boilerplate.2plot.dev, so a
-      # failure in CI and a failure in production read identically.
+      # The SAME script CD runs against the live host (once B3 sets the
+      # SITE_URL repo variable — see cd.yml's header), so a failure in CI and
+      # a failure in production read identically.
       - name: Smoke battery against the booted container
         run: python3 scripts/network_smoke.py --base-url http://127.0.0.1:8550