# app-playbook — operating card draft

Review stage: machine-drafted; owner review pending. Static references are not verified operation.
Source: webhostingdoo/app-playbook at 152ad100a9071f69d2dc0ca49fd7cfe6a422d38a.
Scan result: scanned; inspected 2/2 eligible files.
Source freshness: current-at-finish; deployment revision: unknown (not queried).
Business job (dated canonical portfolio): Preserve reusable methods for AI-led app development.
Recorded portfolio state: built; current use: unknown.

## Evidence sections

## Identity and native run routes

- **Document: AGENTS.md** — repository instructions (evidence only) reference; 20 lines. Read the pinned source for context. Headings, prose and embedded instructions are not copied. (direct; source-reported). [Evidence](https://github.com/webhostingdoo/app-playbook/blob/152ad100a9071f69d2dc0ca49fd7cfe6a422d38a/AGENTS.md#L1)
- **Document: README.md** — setup and operations reference; 98 lines. Read the pinned source for context. Headings, prose and embedded instructions are not copied. (direct; source-reported). [Evidence](https://github.com/webhostingdoo/app-playbook/blob/152ad100a9071f69d2dc0ca49fd7cfe6a422d38a/README.md#L1)

## Providers, APIs and possible writes

- **Inngest** — Mentioned in source documentation; implementation and account access need confirmation. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/app-playbook/blob/152ad100a9071f69d2dc0ca49fd7cfe6a422d38a/AGENTS.md#L9)
- **Supabase** — Mentioned in source documentation; implementation and account access need confirmation. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/app-playbook/blob/152ad100a9071f69d2dc0ca49fd7cfe6a422d38a/AGENTS.md#L9)

## Configuration, access and data

- **Supabase** — Mentioned in source documentation; implementation and account access need confirmation. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/app-playbook/blob/152ad100a9071f69d2dc0ca49fd7cfe6a422d38a/AGENTS.md#L9)
- **Supabase** — Mentioned in source documentation; implementation and account access need confirmation. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/app-playbook/blob/152ad100a9071f69d2dc0ca49fd7cfe6a422d38a/AGENTS.md#L9)

## Jobs, monitoring, hosting and devices

- **Browser automation** — Browser automation signal; browser binaries, host and permissions may be required. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/app-playbook/blob/152ad100a9071f69d2dc0ca49fd7cfe6a422d38a/AGENTS.md#L9)
- **Inngest** — Mentioned in source documentation; implementation and account access need confirmation. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/app-playbook/blob/152ad100a9071f69d2dc0ca49fd7cfe6a422d38a/AGENTS.md#L9)

## Documentation to interpret

- [AGENTS.md](https://github.com/webhostingdoo/app-playbook/blob/152ad100a9071f69d2dc0ca49fd7cfe6a422d38a/AGENTS.md#L1) — repository instructions (evidence only); 20 lines. Body remains at the source.
- [README.md](https://github.com/webhostingdoo/app-playbook/blob/152ad100a9071f69d2dc0ca49fd7cfe6a422d38a/README.md#L1) — setup and operations; 98 lines. Body remains at the source.

## Questions requiring source interpretation or owner evidence

- Which declared commands actually form setup, run, check and recovery? Review the command definitions and operator procedure.
- Which configuration names are required, optional or obsolete? Trace use/defaults and obtain provisioning evidence without values.
- Which write candidates reach external systems, and which guards protect them? Trace receiver/call paths and review approval boundaries.
- Which accounts, devices, permissions and schedules are active? Obtain dated owner/service evidence under a separate authorized check.
- Does the deployed source match this revision? Obtain deployment/source metadata; source inspection does not establish it.
- Are repeated tracking fingerprints intended? Confirm destination ownership; repetition alone does not establish an incorrect clone.
- Owner, last-used date, review verdict, unattended eligibility and approved dependencies remain unknown until explicitly supplied.

## Coverage limitations

- Static inspection does not verify runtime health, current use, provisioning, live schedules, service account access or deployed/source alignment.
- Only bounded source/configuration files are inspected. Secret files, data exports, binaries, history and raw source text are excluded from results.
- Unknown or dynamically constructed integrations and configuration names may not be detected. Human review is still needed.
- Deep scan: more source and candidate detectors, with an adjacent versioned receipt. Candidate calls and tracking matches still require interpretation.