fix(#1320): placeholder-ize private-network topology, drop raw-curl force-merge recipe (#1322)

packages/mosaic/framework/guides/INFRASTRUCTURE.md

@@ -219,7 +219,7 @@ Use the Cloudflare tools for any DNS configuration: pointing domains at services
 
 # Update an existing record (get record ID from record-list first)
 ~/.config/mosaic/tools/cloudflare/record-update.sh \
-  -z example.com -r <record-id> -t A -n myapp -c 10.0.0.5 -p
+  -z example.com -r <record-id> -t A -n myapp -c 192.0.2.5 -p
 ```
 
 **DNS + Deployment integration**: When deploying a new service via Coolify or Portainer that needs a public domain, the typical sequence is:

packages/mosaic/framework/skills/mosaic-deploy/SKILL.md

@@ -42,14 +42,12 @@ cd ~/src/<repo>
 ~/.config/mosaic/tools/git/pr-merge.sh -n <pr#> -d
 ```
 
-For branch-protected repos (force merge):
-
-```bash
-GITEA_TOKEN=$(cat ~/.config/mosaic/credentials/gitea.env | grep TOKEN | cut -d= -f2)
-curl -X POST "https://git.mosaicstack.dev/api/v1/repos/<org>/<repo>/pulls/<pr#>/merge" \
-  -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" \
-  -d '{"Do":"squash","force_merge":true}'
-```
+Always merge through `pr-merge.sh`: it runs the CI queue guard first and pins
+the merge to the reviewed head. If branch protection blocks the merge, that is
+a gate telling you something — a failing check, a moved head, or a missing
+review. Fix the cause; never route around it with a raw API call, a shared
+credential, or `force_merge`. Exceptional cases go to the operator or the
+coordinating seat, still merged through the wrapper.
 
 ### Step 4: Redeploy Portainer stack
 
@@ -67,16 +65,18 @@ Check deployment:
 
 ## Stack Name Map
 
-| Project      | Stack Name     |
-| ------------ | -------------- |
-| mosaic-stack | `mosaic-stack` |
-| sage-phr     | `sage-phr`     |
-| openbrain    | `openbrain`    |
-| firefly      | `firefly`      |
+Maintain your estate's project → stack-name mapping in a skills-local override of
+this skill (local copies take precedence over the shipped canonical one). Example
+shape:
+
+| Project      | Stack Name        |
+| ------------ | ----------------- |
+| `sample-app` | `sample-app`      |
+| `sample-api` | `sample-api-prod` |
 
 ## Notes
 
 - Workers open PRs but **never merge** — orchestrator or Merge Guard handles step 3+
-- Docker Swarm image pinning: if `-p` doesn't pull a new image, SSH to `w-docker0` (10.1.1.45) and run `docker pull <image>` manually, then redeploy
+- Docker Swarm image pinning: if `-p` doesn't pull a new image, SSH to the Docker node (e.g. `node-01`) and run `docker pull <image>` manually, then redeploy
 - Worktrees: all coding work in `~/src/<repo>-worktrees/<task-slug>`, never in main checkout
 - Always clean up worktree after push: `git worktree remove ~/src/<repo>-worktrees/<task-slug>`

packages/mosaic/framework/skills/mosaic-gitea/SKILL.md

@@ -98,5 +98,5 @@ curl -X POST "https://git.mosaicstack.dev/api/v1/repos/<org>/<repo>/pulls/<PR>/m
 ## Notes
 
 - Mosaic policy: squash merges only, targeting `main`
-- Gitea SSH: `[email protected]` → resolves via `~/.ssh/config` to `10.1.1.90:2222`
+- Gitea SSH: `[email protected]` → resolves via `~/.ssh/config` to the Gitea host's SSH port (e.g. `gitea.example.internal:2222`)
 - Workers push branches and open PRs but **never merge** — orchestrator handles merges

packages/mosaic/framework/skills/mosaic-portainer/SKILL.md

@@ -56,7 +56,7 @@ source ~/.config/mosaic/tools/_lib/credentials.sh && load_credentials portainer
 
 ## Notes
 
-- Portainer URL: `https://10.1.1.43:9443`
-- Primary Docker host: `w-docker0` (10.1.1.45) managed via Portainer agent
+- Portainer URL: `https://portainer.example.internal:9443`
+- Primary Docker host: `node-01`, managed via Portainer agent
 - Docker Swarm image updates: `stack-redeploy.sh -p` does NOT guarantee new image pull if digest is pinned; SSH to node and `docker pull` first if needed
 - Credentials: `load_credentials portainer` (framework credentials store)

packages/mosaic/framework/tools/coolify/README.md

@@ -27,7 +27,7 @@ Manage Coolify container deployment platform (projects, services, deployments, e
 
 ## API Reference
 
-- Base URL: `http://10.1.1.44:8000`
+- Base URL: `http://coolify.example.internal:8000`
 - API prefix: `/api/v1/`
 - Auth: Bearer token in `Authorization` header
 - Rate limit: 200 requests per interval