docs: use authorized local live fixtures

docs/superpowers/plans/2026-07-13-kbqa-mvp-implementation.md

@@ -22,7 +22,8 @@
 - Do not use TDD. Implement first, then smoke-check; add automated tests only in Task 12.
 - Do not mock Chat or Embedding models. Model-path tests belong to the explicitly enabled live suite.
 - Use `uv` for Python and `npm` for Node.js.
-- Keep secrets only in ignored `.env`; rotate credentials currently present in `1.md` before live testing.
+- Use the user-authorized credentials from ignored `1.md` only for local real calls; map them into ignored `.env`, never print/commit them, and recommend rotation after acceptance.
+- Use the ignored root `test.txt` as the user-provided large real knowledge file through `KBQA_LIVE_TEST_FILE`.
 - Test the frontend with `agent-browser` against real Vite and FastAPI processes.
 
 ---
@@ -67,14 +68,14 @@
 - Create: `.python-version`, `.env.example`, `README.md`
 - Create: `backend/pyproject.toml`, `backend/src/kbqa/__init__.py`
 - Modify: `.gitignore`
-- Remove after credential rotation: `1.md`
+- Keep local and ignored: `1.md`, `test.txt`
 
 **Interfaces:**
 - Produces: Python 3.12 environment and environment-variable contract used by every later task.
 
-- [ ] **Step 1: Rotate exposed credentials**
+- [ ] **Step 1: Prepare authorized local credentials without exposing them**
 
-Rotate DashScope and LangSmith keys in their provider consoles. Put only new values in local `.env`. Confirm `git check-ignore -v .env 1.md`, then remove `1.md`; never commit or copy its old values.
+Confirm `git check-ignore -v .env 1.md test.txt` reports all paths ignored. Copy `1.md` to mode-600 `.env` without printing it, rename `DASHSCOPE_API_KEY`/`DASHSCOPE_BASE_URL`/`MODEL` keys to their `KBQA_` application names, retain standard `LANGSMITH_` names, and add `KBQA_LIVE_TEST_FILE` pointing to the absolute root `test.txt`. Never show the resulting file in tool output.
 
 - [ ] **Step 2: Pin Python and define dependencies**
 
@@ -82,7 +83,7 @@ Create `.python-version` containing `3.12`. Create `backend/pyproject.toml` with
 
 - [ ] **Step 3: Define safe configuration examples**
 
-Create `.env.example` with every variable from Spec section 16. Leave keys empty; use `KBQA_` for application config and standard `LANGSMITH_` names for LangSmith.
+Create `.env.example` with every variable from Spec section 16, including empty `KBQA_LIVE_TEST_FILE`. Leave keys empty; use `KBQA_` for application config and standard `LANGSMITH_` names for LangSmith.
 
 - [ ] **Step 4: Lock and synchronize**
 
@@ -760,6 +761,6 @@ git commit -m "test: verify real kbqa workflow"
 ## Execution Notes
 
 - Execute with `superpowers:executing-plans`; `subagent-driven-development` is not available in this repository/session.
-- Do not start live tests until exposed credentials are rotated.
+- Use `1.md` credentials only under the user's explicit local-test authorization; never surface their values. Recommend rotation after acceptance.
 - Never run Uvicorn with more than one worker.
 - If an installed LangChain 1.x signature differs from a snippet, consult official docs/Context7, preserve this plan's interface/behavior, and record the verified signature in the implementing commit.

docs/superpowers/specs/2026-07-13-kbqa-system-design.md

@@ -471,12 +471,13 @@ KBQA_MAX_SOURCES=8
 KBQA_HISTORY_MESSAGE_LIMIT=20
 KBQA_MAX_UPLOAD_MIB=20
 KBQA_RUN_LIVE_TESTS=0
+KBQA_LIVE_TEST_FILE=
 LANGSMITH_TRACING=true
 LANGSMITH_API_KEY=
 LANGSMITH_PROJECT=kbqa-local
 ```
 
-现有明文密钥必须在开发前轮换。真实密钥只存在于被 Git 忽略的 `.env`。LangSmith 会接收 Agent 输入、工具结果和运行轨迹，这是产品已确认的外部数据传输。
+按用户当前授权，`1.md` 中现有 DashScope 与 LangSmith 密钥可用于本地真实测试；该文件必须保持 Git 忽略，真实值只映射到同样被忽略的 `.env`。密钥不得出现在日志、测试报告、截图或提交中，项目验收后仍建议在提供商控制台轮换。本地 `test.txt` 作为用户提供的大型真实知识文件，通过 `KBQA_LIVE_TEST_FILE` 指向，不提交到 Git。LangSmith 会接收 Agent 输入、工具结果和运行轨迹，这是产品已确认的外部数据传输。
 
 开发环境 CORS 默认只允许 `http://localhost:5173` 与 `http://127.0.0.1:5173`，可通过显式配置增加本地来源，不允许通配符来源。