docs: use authorized local live fixtures

docs/superpowers/plans/2026-07-13-kbqa-mvp-implementation.md

@@ -22,7 +22,8 @@
 - Do not use TDD. Implement first, then smoke-check; add automated tests only in Task 12.
 - Do not mock Chat or Embedding models. Model-path tests belong to the explicitly enabled live suite.
 - Use `uv` for Python and `npm` for Node.js.
-- Keep secrets only in ignored `.env`; rotate credentials currently present in `1.md` before live testing.
+- Use the user-authorized credentials from ignored `1.md` only for local real calls; map them into ignored `.env`, never print/commit them, and recommend rotation after acceptance.
+- Use the ignored root `test.txt` as the user-provided large real knowledge file through `KBQA_LIVE_TEST_FILE`.
 - Test the frontend with `agent-browser` against real Vite and FastAPI processes.
 
 ---
@@ -67,14 +68,14 @@
 - Create: `.python-version`, `.env.example`, `README.md`
 - Create: `backend/pyproject.toml`, `backend/src/kbqa/__init__.py`
 - Modify: `.gitignore`
-- Remove after credential rotation: `1.md`
+- Keep local and ignored: `1.md`, `test.txt`
 
 **Interfaces:**
 - Produces: Python 3.12 environment and environment-variable contract used by every later task.
 
-- [ ] **Step 1: Rotate exposed credentials**
+- [ ] **Step 1: Prepare authorized local credentials without exposing them**
 
-Rotate DashScope and LangSmith keys in their provider consoles. Put only new values in local `.env`. Confirm `git check-ignore -v .env 1.md`, then remove `1.md`; never commit or copy its old values.
+Confirm `git check-ignore -v .env 1.md test.txt` reports all paths ignored. Copy `1.md` to mode-600 `.env` without printing it, rename `DASHSCOPE_API_KEY`/`DASHSCOPE_BASE_URL`/`MODEL` keys to their `KBQA_` application names, retain standard `LANGSMITH_` names, and add `KBQA_LIVE_TEST_FILE` pointing to the absolute root `test.txt`. Never show the resulting file in tool output.
 
 - [ ] **Step 2: Pin Python and define dependencies**
 
@@ -82,7 +83,7 @@ Create `.python-version` containing `3.12`. Create `backend/pyproject.toml` with
 
 - [ ] **Step 3: Define safe configuration examples**
 
-Create `.env.example` with every variable from Spec section 16. Leave keys empty; use `KBQA_` for application config and standard `LANGSMITH_` names for LangSmith.
+Create `.env.example` with every variable from Spec section 16, including empty `KBQA_LIVE_TEST_FILE`. Leave keys empty; use `KBQA_` for application config and standard `LANGSMITH_` names for LangSmith.
 
 - [ ] **Step 4: Lock and synchronize**
 
@@ -760,6 +761,6 @@ git commit -m "test: verify real kbqa workflow"
 ## Execution Notes
 
 - Execute with `superpowers:executing-plans`; `subagent-driven-development` is not available in this repository/session.
-- Do not start live tests until exposed credentials are rotated.
+- Use `1.md` credentials only under the user's explicit local-test authorization; never surface their values. Recommend rotation after acceptance.
 - Never run Uvicorn with more than one worker.
 - If an installed LangChain 1.x signature differs from a snippet, consult official docs/Context7, preserve this plan's interface/behavior, and record the verified signature in the implementing commit.