@@ -24,7 +24,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: codefly-dev/runnable-python
-          ref: 207c50f5b11fc0d439e06eadf916ada7d8b2c2d7
+          ref: cee8544982ae9e4589848eef806a1016d6744801
           path: .qualification-agent
       # The pinned agent requires Go 1.27.1; CLI's 1.27.0 minimum is lower.
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 
@@ -67,7 +67,7 @@ new runbook (and its skill) whenever you do a multi-step operational task a seco
 ### Extending the CLI
 - **Add a new command** (Cobra wiring, help, MCP exposure) → [docs/runbooks/add-a-command.md](docs/runbooks/add-a-command.md)
 - **Rebuild the CLI and agents from local source** → [docs/runbooks/update-agents.md](docs/runbooks/update-agents.md)
-- **Point a workspace at a cell** (import explicit `codefly/cell/v2` environment declarations) → [docs/commands.md#codefly-environment](docs/commands.md)
+- **Point a workspace at a coordinate** (import explicit `codefly/coordinate/v1` environment declarations) → [docs/commands.md#codefly-environment](docs/commands.md)
 - **Export a module's API contracts** → [docs/commands.md#generate-contracts](docs/commands.md#generate-contracts)
 
 ### Reference (deep dives, not step-by-step)
@@ -160,6 +160,11 @@ relative paths.
 
 ## Key Patterns & Rules
 
+- **Deployment declarations belong to CLI.** `pkg/environments` owns the coordinate
+  parser, cluster/registry/namespace, GitOps, ingress, quotas, service injection and
+  identity attachments. Core owns runtime configuration and secrets; pass `Runtime()`
+  to agents. Producers emit the CLI contract, never private inventories to translate.
+  See [docs/configuration-contract.md](docs/configuration-contract.md).
 - **CLI ↔ Agent communication is ALWAYS gRPC.** Never import agent code, never call agent
   functions. The agent runs as a separate process. Clients: `runtimev0.RuntimeClient`,
   `builderv0.BuilderClient`, `agentv0.AgentClient`, `codev0.CodeClient`.
 
@@ -1,9 +1,10 @@
 package build
 
 import (
+	"testing"
+
 	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/require"
-	"testing"
 )
 
 func TestBuildCommandsExposeCachePolicy(t *testing.T) {
 
@@ -7,6 +7,7 @@ import (
 	"github.com/codefly-dev/cli/cmd/common"
 	"github.com/codefly-dev/cli/pkg/builder"
 	"github.com/codefly-dev/cli/pkg/cli"
+	"github.com/codefly-dev/cli/pkg/environments"
 	"github.com/codefly-dev/cli/pkg/orchestration"
 	"github.com/codefly-dev/core/resources"
 	"github.com/codefly-dev/core/services"
@@ -73,7 +74,7 @@ var ModuleCmd = &cobra.Command{
 	},
 }
 
-func buildOneService(ctx context.Context, workspace *resources.Workspace, module *resources.Module, name string, env *resources.Environment) error {
+func buildOneService(ctx context.Context, workspace *resources.Workspace, module *resources.Module, name string, env *environments.Environment) error {
 	w := wool.Get(ctx).In("buildModule.buildOneService", wool.NameField(name))
 
 	service, err := module.LoadServiceFromName(ctx, name)
 
@@ -1,9 +1,10 @@
 package ci
 
 import (
+	"testing"
+
 	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/require"
-	"testing"
 )
 
 func TestCIBuildPathsExposeCachePolicy(t *testing.T) {
 
@@ -4,13 +4,14 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"github.com/codefly-dev/core/resources"
 	"net"
 	"os"
 	"path/filepath"
 	"reflect"
 	"strings"
 	"testing"
+
+	"github.com/codefly-dev/core/resources"
 )
 
 func TestReplayPreservesSelectionAndRejectsAlterations(t *testing.T) {
 
@@ -7,6 +7,7 @@ import (
 
 	"github.com/codefly-dev/cli/cmd/common"
 	"github.com/codefly-dev/cli/pkg/cli"
+	"github.com/codefly-dev/cli/pkg/environments"
 	"github.com/codefly-dev/cli/pkg/orchestration"
 	runtimev0 "github.com/codefly-dev/core/generated/go/codefly/services/runtime/v0"
 	"github.com/codefly-dev/core/resources"
@@ -37,7 +38,7 @@ func testFlowOwner(flow *orchestration.Flow) flowStopper {
 	return flow
 }
 
-func testEnvironment(workspace *resources.Workspace, disposable bool) (*resources.Environment, error) {
+func testEnvironment(workspace *resources.Workspace, disposable bool) (*environments.Environment, error) {
 	env, err := orchestration.SelectEnvironment(workspace, orchestration.LocalEnvironmentName)
 	if err != nil {
 		return nil, err
 
@@ -1,13 +1,15 @@
 package ci
 
 import (
-	"github.com/codefly-dev/core/resources"
 	"testing"
+
+	"github.com/codefly-dev/cli/pkg/environments"
+	"github.com/codefly-dev/core/resources"
 )
 
 func TestDisposableTestEnvironmentCannotReuseFixtureState(t *testing.T) {
-	declared := &resources.Environment{Name: "local", NamingScope: "retained-fixture", Fixture: "controlled"}
-	workspace := &resources.Workspace{Environments: []*resources.Environment{declared}}
+	declared := &environments.Environment{Name: "local", NamingScope: "retained-fixture", Fixture: "controlled"}
+	workspace := &resources.Workspace{Environments: []*resources.Environment{declared.Runtime()}}
 	first, err := testEnvironment(workspace, true)
 	if err != nil {
 		t.Fatal(err)
@@ -16,7 +18,7 @@ func TestDisposableTestEnvironmentCannotReuseFixtureState(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	for _, env := range []*resources.Environment{first, second} {
+	for _, env := range []*environments.Environment{first, second} {
 		if env.NamingScope == "" || env.NamingScope == declared.NamingScope {
 			t.Fatalf("disposable flow could reach retained fixture: %q", env.NamingScope)
 		}
 
@@ -1,9 +1,10 @@
 package common
 
 import (
+	"testing"
+
 	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/require"
-	"testing"
 )
 
 func TestBuildCacheFlagsValidateAndPreserveReadOnlyPolicy(t *testing.T) {
 
@@ -2,9 +2,9 @@ package composition
 
 import (
 	"encoding/json"
-	"fmt"
 
 	"github.com/codefly-dev/cli/pkg/deployments"
+	"github.com/codefly-dev/cli/pkg/environments"
 	"github.com/codefly-dev/core/resources"
 	"github.com/spf13/cobra"
 )
@@ -24,9 +24,9 @@ func newTargetCommand(workspace *string) *cobra.Command {
 			if err != nil {
 				return err
 			}
-			env := current.FindEnvironment(args[0])
-			if env == nil {
-				return fmt.Errorf("environment %q is not declared in %s", args[0], resources.WorkspaceConfigurationName)
+			env, err := environments.Select(current, args[0])
+			if err != nil {
+				return err
 			}
 			var inspected *deployments.KubernetesTargetInspection
 			if cmd.Flags().Changed("expected-identity") {