chore: remove examples files

ARCHITECTURE.md

@@ -224,7 +224,7 @@ boundaries.
     applied result, or a failure) into the reports and exit status defined
     in PRODUCT_SPEC.md. Responsible for never altering the substance of
     what it reports. For credential-loading failures, it may add the fixed,
-    non-sensitive wrapper hint defined by the product specification, but it
+    non-sensitive `--env-file` hint defined by the product specification, but it
     must never print credential values.
 
 ---
@@ -257,7 +257,7 @@ boundaries.
   when target and staging are on the same filesystem.
 - **Result Reporter** owns communication of outcomes only. It has no
   authority to alter, retry, or reinterpret the outcome it is given. A
-  credential-loading failure may include the fixed wrapper hint, but no
+  credential-loading failure may include the fixed `--env-file` hint, but no
   credential value.
 - Authorization is a single boolean fact carried by the invocation from
   the Invocation Validator onward. Only the boundary between Restore

FRAMEWORK.md

@@ -372,21 +372,9 @@ credential provider chain.
 
 The tool must not accept credential values through CLI flags or positional
 arguments. Operators may use a protected external environment file selected
-with `--env-file`, or a wrapper script to provide these variables for repeated
-restores. Repository
-examples live under:
-
-```text
-examples/
-    coolrestore.env.example
-    coolrestore-wrapper.sh
-```
-
-Examples must contain placeholders only and must never contain real
-credentials. When the credential provider chain cannot load credentials, the
-failure report must include a concise wrapper hint without displaying any
-credential value. Release distribution must make the same wrapper pattern
-available to operators who obtain only the binary.
+with `--env-file` for repeated restores. When the credential provider chain
+cannot load credentials, the failure report must include a concise
+`--env-file` hint without displaying any credential value.
 
 ---
 

PRODUCT_SPEC.md

@@ -75,7 +75,7 @@ cannot be trusted to be well-formed.
   complete, describing which step failed and confirming whether the target
   directory was left unchanged or may contain merge-mode partial changes. If
   S3 credentials cannot be loaded, the report also gives a non-sensitive hint
-  about the supported environment wrapper mechanism without displaying any
+  about the supported `--env-file` mechanism without displaying any
   credential value.
 - A **process exit status** indicating success or failure, suitable for
   use in automated scripts.
@@ -150,7 +150,7 @@ cannot be trusted to be well-formed.
 17. When an S3 source is used, the product must load credentials only through
     the configured environment variables or the AWS SDK default credential
     provider chain. If no credentials are available, it must report the
-    supported wrapper mechanism without displaying credential values.
+    supported `--env-file` mechanism without displaying credential values.
 18. When `--env-file` is supplied, the product must load that file before
     acquiring the target lock or archive. It must accept only the supported
     `KEY=VALUE` S3 environment entries, ignore blank lines and full-line

README.md

@@ -125,14 +125,18 @@ The file uses simple `KEY=VALUE` entries. Blank lines and full-line comments
 are allowed; shell commands and `export` statements are not evaluated.
 `./coolrestore.env` is never auto-discovered.
 
-For repeated restores, use the wrapper examples in [`examples/`](./examples/) with a protected environment file instead of manually exporting credentials for each command:
+For repeated restores, keep `coolrestore.env` protected and pass it explicitly:
 
 ```bash
-install -m 600 examples/coolrestore.env.example /etc/coolrestore/env
-export COOLRESTORE_ENV_FILE=/etc/coolrestore/env
+install -m 600 ./coolrestore.env /etc/coolrestore/env
+coolrestore \
+  --env-file /etc/coolrestore/env \
+  --source 's3://bucket/object-key.tar.gz' \
+  --target /tmp/coolrestore-test
 ```
 
-Replace the placeholder values before use. The release also includes the examples as `coolrestore-examples.tar.gz` for operators who only download the binary. For a user-specific setup, use `~/.config/coolrestore/env` instead.
+For a user-specific setup, use `~/.config/coolrestore/env` and pass that path
+with `--env-file`.
 
 ---
 
@@ -296,7 +300,7 @@ Verify:
 - `AWS_S3_FORCE_PATH_STYLE=true` when required by the endpoint
 - bucket and object-key permissions
 
-If credentials cannot be loaded, coolrestore prints a short wrapper hint. It never prints credential values. The default system-wide environment file is `/etc/coolrestore/env`; `COOLRESTORE_ENV_FILE` can point to another protected file.
+If credentials cannot be loaded, coolrestore prints a short `--env-file` hint. It never prints credential values. Use a protected file such as `/etc/coolrestore/env` and pass it explicitly with `--env-file`.
 
 ### Replace mode was rejected
 

TASKS.md

@@ -114,17 +114,15 @@ are complete.
   - **Acceptance Criteria**
     - An operator can obtain a runnable copy of the tool for the server environments it is intended to run on, without needing a local development setup to build it themselves.
     - The tool runs correctly in that environment using only what is already present on a typical target server plus network access to the archive source.
-- [x] **Task 7.2 — Provide safe credential wrapper guidance**
+- [x] **Task 7.2 — Provide safe environment-file guidance**
   - **Acceptance Criteria**
     - Given an S3 restore and credentials supplied through a protected
-      environment wrapper, the tool can acquire the archive without CLI
+      environment file, the tool can acquire the archive without CLI
       credential arguments.
     - Given missing S3 credentials, the failure report includes a concise
-      wrapper hint without displaying credential values.
-    - Repository examples contain placeholders only and document the
-      environment-variable wrapper pattern for repeated S3-compatible restores.
-    - Release distribution makes the same wrapper guidance available to
-      operators who obtain the binary without cloning the repository.
+      `--env-file` hint without displaying credential values.
+    - Documentation describes the protected environment-file pattern for
+      repeated S3-compatible restores.
 
 - [x] **Task 7.3 — Select S3 credentials with an explicit environment file**
   - **Acceptance Criteria**

internal/source/source.go

@@ -17,7 +17,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 )
 
-const credentialWrapperHint = "hint: use --env-file with a protected environment file or a protected environment wrapper; see the release examples bundle"
+const credentialWrapperHint = "hint: use --env-file with a protected environment file"
 
 // Artifact is an archive made available to later restore stages. Local
 // artifacts point at the supplied file; remote artifacts point at a temporary

internal/source/source_test.go

@@ -137,11 +137,11 @@ func TestVerifySizeRejectsTruncatedReader(t *testing.T) {
 	}
 }
 
-func TestCredentialWrapperHintDoesNotContainCredentialValues(t *testing.T) {
+func TestCredentialHintDoesNotContainCredentialValues(t *testing.T) {
 	if strings.Contains(credentialWrapperHint, "AWS_SECRET_ACCESS_KEY=") {
 		t.Fatal("credential wrapper hint contains a credential assignment")
 	}
-	if !strings.Contains(credentialWrapperHint, "protected environment wrapper") {
+	if !strings.Contains(credentialWrapperHint, "--env-file") {
 		t.Fatalf("credential wrapper hint = %q", credentialWrapperHint)
 	}
 }