Read-only local campaign artifact

env-setup-validation-report.md

direct-runtime-wave-36/env-setup-validation-report.md

# env-setup isolated validate-only fixture

Run at `2026-08-12T04:47:40Z`.

The documented validate-only workflow was exercised against an isolated fixture written only inside this wave folder. Its source declares two variables and uses no secret values:

| Rule | Fixture result |
| --- | --- |
| Framework detection | Next.js rule selected from a fixture `next.config.mjs`. |
| Source coverage | PASS: `NEXT_PUBLIC_API_BASE_URL` and `OPENAI_API_KEY` are both represented in `.env.example`. |
| Prefix security | PASS: only the public URL uses `NEXT_PUBLIC_`; `OPENAI_API_KEY` remains server-only. |
| Gitignore rule | PASS: fixture `.gitignore` excludes `.env*` while preserving `!.env.example`. |
| Orphan check | PASS: both example variables have a source reference. |

This is a real local parser assertion over placeholder-only fixture files, not a live project validation. The skill cannot be marked PASS because its normal workflow requires a named target project and may create or populate environment files. No key vault or actual `.env` was accessed.