Declare an app fluently — from_dir().expose().secret() — and it implements HarmonyApp, so app_main gives ship/deploy/status/logs over any context. The example's main is now ~20 lines of pure declaration; the flag soup is gone. TDD: 4 tests pin the spec→Score derivation (local renders/RWO/HTTP, prod publishes/replicated/TLS, defaults, secrets). Verified end-to-end on k3d.