--- a/.claude/skills/zenbu-personal-site/SKILL.md	Fri Aug 07 07:34:12 2026 -0700
+++ b/.claude/skills/zenbu-personal-site/SKILL.md	Fri Aug 07 10:50:30 2026 -0700
@@ -28,7 +28,10 @@
   `--zenbu-ref-color-*` or add new `--zen-*` compatibility-token usage.
 - `mrjunejune/test/`: integration tests and snapshots.
 - `mrjunejune/BUILD`: Bazel build, bundle, asset movement, and test-visible filegroups.
-- `mrjunejune/.config` and `.config.development`: server configuration. Do not commit secrets.
+- `mrjunejune/.config` is the single ignored runtime configuration source for
+  the server, auth, S3, inference, LiteLLM, and Copilot token paths.
+  `.config.development` is the committed copyable template. Do not use `.env`
+  files or require shell exports for normal build/run/deploy workflows.
 - The JRPG chat is a production route. Seobeo owns conversation CRUD and POST
   SSE, Deita stores turns, and a Bazel-managed Python Copilot SDK sidecar uses a
   loopback LiteLLM `github_copilot` provider. Never use a virtualenv or pip
@@ -88,17 +91,16 @@
 test process. Give every shard its own port, temporary database, and fixture
 state.
 
-Run the complete local inference stack with:
+Authenticate Copilot once, using the token directory from `.config`:
 
 ```bash
-export GITHUB_COPILOT_TOKEN_DIR="$HOME/.local/state/mrjunejune/inference/litellm-copilot"
-bazel run //mrjunejune/inference:litellm_proxy -- \
-  --authenticate \
-  --token-dir "$GITHUB_COPILOT_TOKEN_DIR"
+bazel run //mrjunejune:run_inference_stack -- --authenticate
+```
 
-LITELLM_MASTER_KEY='<local proxy key>' \
-  MRJUNEJUNE_ALLOW_ANONYMOUS_INFERENCE=1 \
-  bazel run //mrjunejune:run_inference_stack
+Then run live inference with no shell configuration:
+
+```bash
+bazel run //mrjunejune:run_inference_stack
 ```
 
 Use `bazel run //mrjunejune:run_inference_stack -- --mock` for deterministic
@@ -113,7 +115,12 @@
 - Use Dowa's fixed-width aliases and `boolean`/`TRUE`/`FALSE` in first-party C
   instead of introducing `<stdint.h>` `_t` types or `<stdbool.h>` `bool`.
 - Keep auth-protected APIs strict: missing auth should be `401`, invalid token `403`, malformed JSON/input `400`, unavailable DB/S3/ffmpeg `500`.
-- Never hardcode secrets. Read configuration from `.config` or environment wiring already used by the Bazel target.
+- Never hardcode secrets. Normal runtime configuration and secrets come from
+  the single ignored `.config`.
+- Normal runtime settings belong in the single ignored `.config`. Environment
+  variables may be used internally between supervised subprocesses or as
+  backwards-compatible test/deployment overrides, but must not be required user
+  setup and must not replace `.config` with a `.env` file.
 - For uploads and downloads, validate filenames and content lengths before touching `/tmp`.
 - For binary responses, set `content-length` and avoid string-only operations on body bytes.
 - If a route is part of the public website, add or update snapshot coverage in `mrjunejune/test`.