type: create

title: deploy create should support external credential injection

type: feature

description: deploy create generates config.env but provides no mechanism to inject external credentials (API keys, tokens, etc.) at creation time. Operators must append to config.env after the fact, which mutates a build artifact. deploy create should accept --credentials-file or similar to include secrets in the generated config.env.


title: REGISTRY_TOKEN / imagePullSecret flow undocumented

type: bug

description: create_registry_secret() exists in deployment_create.py and is called during up(), but REGISTRY_TOKEN is not documented in spec.yml or any user-facing docs. The restart command warns "Registry token env var REGISTRY_TOKEN not set, skipping registry secret" but doesn't explain how to set it. For GHCR private images, this is required and the flow from spec.yml -> config.env -> imagePullSecret needs documentation.