docs: v2 zombie content — quickstart, concepts, how-it-works, changelog

[indykish]

• quickstart.mdx: full rewrite for v2 (install → credential add → up → kill) replaces v1 spec-to-PR workflow
• concepts.mdx: rewritten around Zombie, Trigger, Skill, Credential Firewall, Activity Stream, Session Checkpoint, Kill Switch, Budget, Event Loop; keeps NullClaw + Executor; removes v1-only concepts (Spec, Gate loop, Scorecard, Harness, Agent profile, Worktree as spec concept)
• how-it-works.mdx: runtime architecture diagram updated to v2 event loop sequence; step descriptions aligned to zombie install/up flow
• index.mdx: description + CTA tightened; concepts card subtitle updated
• changelog.mdx: v0.5.0 entry added ahead of April 11 release

[greptile-apps]

Greptile Summary

This PR rewrites the core docs for the v2 agent hosting model — quickstart, concepts, how-it-works, and index — replacing the v1 spec-to-PR workflow with the new zombie install/up/kill flow, and adds a v0.5.0 changelog entry. All remaining findings are P2 style issues against AGENTS.md rules (time estimate in a CTA, a lingering v1 internal term in the Executor accordion, and an operational task note in the changelog).

Confidence Score: 5/5

Safe to merge — all remaining findings are non-blocking P2 style issues.

Prior P1 concerns (internal vault path in 1Password references) have been resolved with generic placeholders. The three remaining findings are minor AGENTS.md style violations that don't affect correctness or security.

concepts.mdx (Executor accordion), index.mdx (CTA card title), changelog.mdx (line 51)

Vulnerabilities

No security concerns identified. The op:// credential references in quickstart.mdx and concepts.mdx have been updated to use generic your-vault placeholders. A .gitleaks.toml allowlist was added to suppress false-positive detection of the your-webhook-token placeholder used throughout the docs.

Important Files Changed

Filename	Overview
index.mdx	CTA tightened for v2; "Get started in 2 minutes" card title violates AGENTS.md time-estimate prohibition.
concepts.mdx	Full rewrite around v2 concepts; Executor accordion retains a v1 internal reference ("harness compilation") that contradicts the v2-only scope of the page.
changelog.mdx	v0.5.0 entry is thorough and well-structured; one line reads as an internal dev task reminder ("Mintlify sync required") rather than user-facing release notes.
quickstart.mdx	Full rewrite for v2 install→credential→up→kill flow; credential placeholder updated to generic op://your-vault/agentmail/api_key.
how-it-works.mdx	Architecture diagrams updated to v2 event-loop sequence; step descriptions align cleanly with the new zombie install/up flow.
.gitleaks.toml	New gitleaks allowlist config that permits the your-webhook-token placeholder used in doc examples.

Sequence Diagram

sequenceDiagram
    participant User as Developer
    participant CLI as zombiectl
    participant API as zombied API
    participant WH as Webhook endpoint
    participant Q as Redis Streams
    participant EL as Event loop
    participant S as NullClaw sandbox
    participant F as Credential firewall

    User->>CLI: zombiectl install lead-collector
    CLI-->>User: lead-collector.md created
    User->>CLI: zombiectl credential add agentmail --key api_key
    CLI->>API: store encrypted credential
    User->>CLI: zombiectl up
    CLI->>API: POST /v1/webhooks/install (zombie config)
    API-->>CLI: webhook URL + zombie ID
    Note over WH,Q: Zombie is now live
    WH->>API: POST /v1/webhooks/{zombie_id} (inbound event)
    API->>Q: XADD zombie:{id}:events
    Q->>EL: XREADGROUP (claim event)
    EL->>S: deliver event to NullClaw
    S->>F: skill invocation (no credentials)
    F->>F: inject credential + audit log
    EL->>API: checkpoint session state
    EL->>Q: XACK
    User->>CLI: zombiectl kill lead-collector
    CLI->>API: terminate agent process

Loading

Prompt To Fix All With AI

This is a comment left during a code review.
Path: index.mdx
Line: 22

Comment:
**Time estimate in CTA card**

`AGENTS.md` explicitly prohibits time estimates in user-facing docs ("Do not use time estimates or effort ratings in user-facing docs"). "2 minutes" will create expectation drift as the onboarding flow evolves.

```suggestion
  <Card title="Get started" icon="rocket" href="/quickstart" horizontal>
```

**Context Used:** AGENTS.md ([source](https://app.greptile.com/review/custom-context?memory=e994989b-b25e-4468-be5d-6bde3ddb0ce6))

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: concepts.mdx
Line: 107-109

Comment:
**v1 internal detail leaking into v2 concepts doc**

"harness compilation and spec preview in legacy v1 workflows" documents an internal pipeline concept (`harness compilation`) and a deprecated workflow in a page that is otherwise fully scoped to v2. `AGENTS.md` says to "keep operator docs at the operational level" and avoid internal pipeline internals. This sentence also reintroduces "harness" — a term removed elsewhere in this PR.

```suggestion
    The executor is the sidecar process (`zombied-executor`) that owns the sandbox lifecycle. The executor
    spawns NullClaw agents inside isolated sandbox containers, enforces resource limits (CPU,
    memory, time), and reports execution results back to the event loop.
```

**Context Used:** AGENTS.md ([source](https://app.greptile.com/review/custom-context?memory=e994989b-b25e-4468-be5d-6bde3ddb0ce6))

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: changelog.mdx
Line: 51

Comment:
**Operational task note in user-facing changelog**

"Mintlify sync required — see [API Reference](/api-reference/introduction)" reads like an internal developer reminder rather than release-note content. Users reading the changelog don't need to perform a Mintlify sync; maintainers do. Consider removing this sentence or moving it to an internal deployment checklist.

```suggestion
  `POST /v1/webhooks/{zombie_id}` added. See [API Reference](/api-reference/introduction).
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (2): Last reviewed commit: "docs: fix greptile P1/P2 — vault paths, ..." | Re-trigger Greptile}