> 移植说明：本 Skill 来自 MIT 开源仓库（alirezarezvani/claude-skills 或 ComposioHQ/awesome-claude-skills），移植到 SkillHub/WorkBuddy 供中文用户使用，正文保持原样，输出可要求用中文呈现。

Phase 2 — Stage → Launch

Turn the build sheet into runnable artifacts, then let the founder launch with
their own key. No script here touches the network or the key — the user runs
launch.sh.

Workflow

1. Generate payloads.
   bash python3 scripts/payload_generator.py \ --sheet ./my-agent/build-sheet.json --out-dir ./my-agent # -> ./my-agent/payloads/{01-environment,02-agent,03-session,04-kickoff}.json
   Agent toolset → always_allow; every MCP toolset → always_ask (baked into
   the agent payload's permission_policies).
2. Write the launch script.
   bash python3 scripts/launch_script_writer.py --out-dir ./my-agent
launch.sh creates environment → agent → session → kickoff in order,
   chaining IDs, and resumes on re-run (each step skips if its *.id file
   exists). It reads $ANTHROPIC_API_KEY at runtime.
3. Validate before launch.
   bash python3 scripts/payload_validator.py --dir ./my-agent
   FAIL blocks — especially a key_leak finding. Fix and re-run.
4. Minimal key step (never in chat). Check the shell first:
   bash [ -n "$ANTHROPIC_API_KEY" ] && echo "key present" || echo "export ANTHROPIC_API_KEY=... first"
   Point the founder to platform.claude.com → API keys. Never print the key to
   chat, never write it to a file.
5. Launch + watch the first poll.
   bash export ANTHROPIC_API_KEY=... # in their shell, not in chat ./my-agent/launch.sh
   Mark checkpoints with Console deep links. Then goal_state.py set --phase grade-iterate and advance.

Hard rules (API-key safety)

• The key never enters chat, a file, a payload, or a log. launch.sh reads it
  from the environment; payload_validator.py scans for sk-ant-… leaks and FAILs.
• Sequential launch. environment → agent → session → kickoff. Watch the first
  poll foreground before declaring success.
• Resumable. Re-running launch.sh continues from the last created ID.

Forcing-question library (recommend + cite)

1. "Is the key in your shell env already?" Recommend: check $ANTHROPIC_API_KEY
   before anything. Cite: this SKILL, key-safety rules.
2. "Cloud or self-hosted environment?" Recommend: cloud for v0. Cite:
   cma-primitives.md (environment).
3. "Any MCP server in the payload?" Recommend: keep it always_ask. Cite:
   cma-primitives.md (permissions).
4. "Did the first poll return idle/running cleanly?" Recommend: watch it
   foreground before moving on. Cite: cma-primitives.md (session lifecycle).

Tools

• scripts/payload_generator.py — build sheet → 4 ordered API payloads.
• scripts/launch_script_writer.py — resumable BYOK curl launcher (no key handling).
• scripts/payload_validator.py — pre-launch check + API-key-leak scan.