@aotter/mantle 0.0.11-alpha.73 → 0.1.0-alpha.10

package/docs/labels.md

@@ -26,14 +26,14 @@ For package README or package-local docs changes, prefer the package area label
 
 | Label | Meaning |
 |---|---|
-| `area:runtime` | `packages/mantle-runtime` behavior, ports, use cases, dispatcher, render, MCP runtime. |
+| `area:runtime` | `packages/mantle-runtime` behavior, ports, use cases, dispatcher, and MCP runtime. |
 | `area:spec` | `packages/mantle-spec`, manifest parsing, validation, diagnostics, CLI, spec types. |
 | `area:cf` | `packages/adapters/cloudflare`, Workers adapter, D1/KV/ASSETS wiring, Cloudflare deploy behavior. |
 | `area:starters` | External `aotter/mantle-starters` integration, release fanout, and the local moved-starter stub. |
 | `area:skills` | `skills/*` agent briefs and install/extend/provision workflows. |
 | `area:admin-ui` | `packages/mantle-admin-ui` React admin SPA. |
 | `area:docs` | Repo-wide human docs, governance docs, ADR text, release docs, root README content, and cross-cutting documentation work. |
-| `area:adapter` | Adapter boundary work spanning Cloudflare, Netlify stub, or future adapters. |
+| `area:adapter` | Adapter boundary work spanning Cloudflare or future adapters. |
 
 ## Release and review gates
 
@@ -41,7 +41,8 @@ For package README or package-local docs changes, prefer the package area label
 |---|---|---|---|
 | `release-gate` | Blocks a public release or release-quality claim. | Must be resolved or explicitly deferred before release. | The gate is closed or deferred by maintainer decision. |
 | `v0.1.0` | Required for the v0.1.0 release gate. | Track in the v0.1.0 release pass. | The item lands or is moved out of v0.1.0. |
-| `breaking-change` | Semver-relevant breaking change. | Changelog and release notes must call it out. | The change is redesigned to be non-breaking. |
+| `breaking-change` | Semver-relevant breaking change. | Generated release notes must call it out. | The change is redesigned to be non-breaking. |
+| `skip-release-notes` | Release bookkeeping with no user-facing change. | Excluded from generated GitHub Release notes. | The PR contains a user-facing change. |
 | `needs-adr` | Architecture, trust boundary, package boundary, or long-lived decision needs an ADR or ADR-lite proposal. | Do not merge implementation until the decision is captured. | ADR/proposal lands or maintainer confirms an existing ADR covers it. |
 | `needs-grammar-revise` | Manifest grammar or closed-enum change. | Requires grammar-revise round before code/types/starters change. | Grammar decision lands or the change no longer affects grammar. |
 | `needs-discussion` | Not converged enough for implementation. | Do not start coding from this issue. | Closing criteria are met and scope is concrete. |
@@ -60,6 +61,7 @@ gh label create "area:admin-ui" --description "React admin UI" --color "1d76db"
 gh label create "area:docs" --description "Documentation and governance" --color "1d76db"
 gh label create "area:adapter" --description "Adapter boundary and future adapter work" --color "1d76db"
 gh label create "breaking-change" --description "Semver-relevant breaking change" --color "b60205"
+gh label create "skip-release-notes" --description "Release bookkeeping only; omit from generated GitHub notes" --color "ededed"
 gh label create "needs-adr" --description "Requires an ADR or ADR-lite decision before merge" --color "d93f0b"
 gh label create "needs-grammar-revise" --description "Requires manifest grammar review before implementation" --color "d93f0b"
 gh label create "needs-discussion" --description "Not converged enough for implementation" --color "fbca04"

package/docs/media-uploads.md

@@ -78,7 +78,7 @@ wrangler secret put R2_SECRET_ACCESS_KEY
 ## `src/mantle/config.ts`
 
 ```ts
-import { R2MediaStorage, type CmsConfig } from "@aotter/mantle/cloudflare";
+import { R2MediaStorage, type MantleCloudflareConfig } from "@aotter/mantle/cloudflare";
 import { AwsClient } from "aws4fetch";
 
 export interface Env {
@@ -89,7 +89,7 @@ export interface Env {
   readonly MEDIA_PUBLIC_URL_BASE?: string;
 }
 
-function buildMediaStorage(env: Env): CmsConfig["bindings"]["mediaStorage"] {
+function buildMediaStorage(env: Env): MantleCloudflareConfig["bindings"]["mediaStorage"] {
   if (
     !env.MEDIA_BUCKET ||
     !env.R2_ACCOUNT_ID ||
@@ -177,3 +177,10 @@ Preserve source semantics:
 - animated GIFs must stay animated;
 - do not silently flatten, resize, or recompress user assets without
   asking.
+
+## Cleanup
+
+Run the version-matched `media-gc` skill when an upload reached R2 but was
+never committed. It audits first and removes only stale objects without
+`committedAt` metadata after explicit operator confirmation. Do not use an R2
+lifecycle rule: committed and uncommitted media share the same purpose prefix.

package/docs/migration-0.1.2.md

@@ -0,0 +1,45 @@
+# Migrating from 0.1.0-alpha.7 to 0.1.2
+
+0.1.2 removes the temporary full-site compatibility stack. Mantle Core is now
+an embeddable parse → link → compile → prepare → bind pipeline; Web, Admin,
+Admin UI, Bun, Vercel, and Cloudflare are selected separately.
+
+| alpha.7 | 0.1.2 |
+|---|---|
+| `parseManifests*` | `parseManifestSources({ sources })` |
+| raw `Manifest[]` validation/runtime input | `ParsedManifestSet` → `LinkedManifestSet` → `RuntimePlan` |
+| `createCmsRuntime({ manifests, db })` | `bootMantleRuntime({ plan, storage })`, or explicit prepare then `createMantleRuntime({ prepared })` |
+| `CmsRuntime.db` / `entryReader` | keep the application DB handle; use `runtime.entries` for Mantle reads |
+| generated `manifest`, `site.ts`, `types.d.ts` | generated `plan`, `createMantle`, `bindMantle`, and types in `mantle.ts` |
+| `mantle introspect` | install `@aotter/mantle-spec` directly and run `mantle-spec introspect` |
+| `mantle emit-types` | use `mantle generate`; for raw declarations, run `mantle-spec emit-types` |
+| generated `.agent/skills/` | generated `.agents/skills/`; legacy user files are left untouched |
+| `bindMantleSite` / string-keyed Views | `bindMantle(runtime)` and generated lower-camel properties |
+| `createCmsRef` / `CmsConfig` | `createMantleRuntimeRef` / `MantleCloudflareConfig` |
+| `mountServerEndpoints` | explicitly compose `mountRuntimeEndpoints` and optional `mountAdmin` |
+
+Delete stale generated `site.ts` and `types.d.ts` files once, then run
+`mantle generate`. Install only the optional package used by the host;
+installing the umbrella alone now pulls only Spec and Runtime.
+
+Intentional behavior changes:
+
+- Generated-plan fingerprint or version mismatches fail immediately and ask
+  the developer to regenerate.
+- Runtime HTTP trigger JSON bodies must be objects. Arrays and primitives are
+  rejected at the request boundary.
+- Malformed percent-encoded paths are routing misses (`404`), not claimed
+  Mantle routes.
+- Better Auth and every `@better-auth/*` package move together to 1.7.
+  `oauthProvider.validAudiences` becomes protected `resources`; MCP uses one
+  canonical `${PUBLIC_ORIGIN}/mcp` resource and CIMD client discovery.
+- The Cloudflare adapter no longer requires `OAUTH_KV` or
+  `@cloudflare/workers-oauth-provider`. Old opaque tokens and KV registrations
+  cannot be migrated safely and must reconnect.
+- Canonical plan ordering may change stable field/export order (including
+  Admin CSV columns) without changing field values.
+
+This alpha changes the Better Auth D1 schema, including required account
+issuer identity and OAuth resource/client tables. Reset and re-bootstrap a
+pre-1.7 alpha auth database; do not guess an issuer backfill. Content tables
+remain portable through the normal application migration/export path.

package/docs/performance-harness.md

@@ -10,30 +10,29 @@ make a normal content/API/page change.
 | Read or state | Owner | Notes |
 |---|---|---|
 | Entry get/list and public slug/data-field/published reads | `DatabaseEntryRepository` through `EntryRepository` / `EntryReader` | Schema-aware field resolution is shared here. |
-| Manifest View execution | `ExecuteViewUseCase` + `ViewSqlCompiler` | The deliberate compiled-query exception; it still resolves declared Schema indexes. |
+| Manifest View execution | `ExecuteViewUseCase` + prepared `ViewQueryExecutor` | Core owns authorization and request validation; selected storage lowers queries once and resolves declared Schema indexes. |
 | Editable settings and code-owned locale/media policy | `DatabaseSiteConfigRepository` | Editable values and dynamic media tool policy are read fresh; boot-seeded locale policy may be memoized within the runtime instance. |
 | Pending media uploads | `DatabasePendingUploadRepository` | Canonical, read-after-write D1 state; never publish-cache state. |
-| Rendered HTML, Markdown, and `llms.txt` | `HtmlPublishOrchestrator` plus the Cloudflare public-route cache policy | Reproducible derivatives live in KV. Settings updates invalidate through a runtime use case. |
-| D1/KV transport and optional query metrics | Cloudflare bindings | Bindings stay thin. Query/cache policy does not belong in a generic provider `BaseRepository`. |
+| Rendered HTML, Markdown, and `llms.txt` | Request-time render use cases plus the Cloudflare public-route cache policy | D1 is canonical; version-local Workers Cache stores anonymous HTTP responses. |
+| D1 transport and optional query metrics | Cloudflare bindings | Bindings stay thin. Query/cache policy does not belong in a generic provider `BaseRepository`. |
 
-`CmsRuntime.db` remains deprecated compatibility surface. New site code uses
-Manifests, runtime use cases, `entryReader`, and `siteConfig`. A site may own
+The runtime exposes no raw database handle. Application and adapter code uses
+the sealed plan, runtime use cases, `entries`, and `siteConfig`. An application may own
 additional tables behind its own repository at the composition root, but it
-must not query Mantle-owned tables through `runtime.db`.
+must not query Mantle-owned tables outside the selected storage adapter.
 
 ## Cache contract
 
 - D1 is canonical for entries, site settings, media metadata, and pending
-  uploads. KV contains only reproducible public artifacts.
-- A public KV hit checks the cache before loading full editable site settings.
-  Locale policy is the small boot-seeded exception. A warm entry/page artifact
-  therefore performs zero D1 queries.
-- A safe cache miss renders from canonical state and schedules KV write-back
-  with the request execution context. It waits inline only when no execution
-  context exists, such as a direct unit call.
-- Site-setting writes call the runtime settings use case, which completes
-  public-artifact invalidation before reporting success. HTTP routes do not
-  scan/delete KV prefixes themselves.
+  uploads. Core stores no rendered artifact copies.
+- Public routes render canonical state and return
+  `Cache-Control: public, max-age=0, s-maxage=300`.
+- Cloudflare Workers Cache checks eligible anonymous responses before invoking
+  the Worker. Cache keys are version-local, so a deploy starts with no stale
+  response from the previous Worker version.
+- Successful publishing-content and site-setting writes purge the shared
+  `mantle-public` Cache-Tag through Cloudflare's native cache API. Operational
+  records and immutable assets stay outside that invalidation boundary.
 - Do not cache every repository read. Cross-isolate correctness for editable
   data wins unless a read has a measured hot-path contract and explicit
   invalidation.
@@ -76,11 +75,12 @@ Timing always reports p50/p95/max. A test-only Worker wrapper may also return
 `x-mantle-query-count` and `x-mantle-rows-read`; those become distributions in
 the same report. Do not expose these diagnostic headers in production.
 
-Core CI runs `pnpm bench:wrangler` against real Wrangler-local D1, KV, Worker
-HTTP routing, View execution, and live page rendering. It compares 100 and
-10,000 row fixtures, then samples page MISS and HIT separately. CI gates
-row-read scaling, endpoint query budgets, and zero-D1 warm hits, not absolute
-milliseconds.
+Core CI runs `pnpm bench:wrangler` against real Wrangler-local D1, Worker HTTP
+routing, View execution, and origin page rendering. It compares 100 and 10,000
+row fixtures and gates row-read scaling plus endpoint query budgets, not
+absolute milliseconds. Wrangler-local does not emulate the new entrypoint
+Workers Cache, so cache hits are a deployment-level smoke check rather than a
+fabricated local metric.
 
 ## Seven findings: measured disposition
 
@@ -89,12 +89,12 @@ diagnostic, while query/row counts are the stable assertions.
 
 | Finding | Disposition |
 |---|---|
-| Public KV hits read D1 first | Fixed. A 10,000-row warm page measured 0 queries / 0 rows read. |
+| Public cache hits read D1 first | Removed from Worker code. Cloudflare's entrypoint Workers Cache runs before the Worker; Core has no inner render cache. |
 | Slug/locale reads bypass generated indexes | Fixed by the shared schema-aware entry-read boundary. A 10,000-row page MISS measured 2 queries / 5 rows read. |
 | OFFSET pagination | Accepted for the v0.1 bounded-result surfaces: every response is capped at 500 rows and public hot paths must stay shallow. Deep/export workloads require a purpose-shaped cursor API before they are declared hot. |
 | Admin substring search scans | Accepted only for the authenticated Admin collection browser, with a 500-row response cap. Large/search-heavy sites should add a purpose-shaped indexed View or dedicated search service; do not expose this scan publicly. |
 | Published list/sitemap/llms paths lack system indexes | Fixed with measured partial indexes for published global, locale, collection, and collection+locale ordering. The 100-row and 10,000-row API runs both measured 1 query / 20 rows read. |
-| Page MISS waits for KV write-back | Fixed. Reproducible artifacts write through `waitUntil`; regression coverage proves response completion does not await KV. |
+| Page MISS waits for cache write-back | Removed. Origin rendering returns directly; Workers Cache owns response storage outside the Worker. |
 | Benchmark stops at fake in-process dispatch | Fixed by the Node planner and Wrangler-local Worker/API/page layers. The old dispatch microbenchmark remains a narrow CPU signal only. |
 
 The retained OFFSET and substring-search trade-offs are visible exceptions,

package/docs/release-process.md

@@ -1,8 +1,9 @@
 # Release process
 
-Mantle is in `0.0.x-alpha` until the v0.1.0 gate closes. Published package
-versions, Git tags, GitHub releases, and Starter tags are immutable: repair a
-bad release with the next version, never by replacing public state.
+Mantle remains prerelease software until the stable v0.1.0 gate closes.
+Published package versions, Git tags, GitHub releases, and Starter tags are
+immutable: repair a bad release with the next version, never by replacing
+public state.
 
 ## Authority
 
@@ -15,10 +16,12 @@ The controller owns this order:
 ```text
 Core source + exact-packed Starter gates
   -> Core tag
-  -> npmjs + GitHub Packages
+  -> npmjs + GitHub Packages candidate packages (`mantle-release`)
   -> Starter release worker
   -> immutable Starter tag
   -> public-registry Starter gate
+  -> clean-create + reviewed Landing compatibility gates
+  -> npmjs + GitHub Packages public channel promotion
   -> Core GitHub Release
   -> optional Landing worker
 ```
@@ -45,23 +48,54 @@ verdict expires when that SHA changes. After two patch rounds, a new
 foundational blocker returns to the state table and the user for a scope
 decision instead of starting another local redesign loop.
 
+For the candidate-to-channel transition, the controller follows this finite
+state table:
+
+| Durable state | Permitted next mutation | Re-run behavior | Public channel |
+|---|---|---|---|
+| Source gated; version unused | Create the immutable Core tag | Existing tag must match or the run fails | Unchanged |
+| Core tag exists; candidate packages incomplete | Publish and verify missing exact versions under `mantle-release` through each registry's sole publish step | Existing versions are verified and skipped | Unchanged |
+| Candidate packages verified; Starter tag absent | Dispatch the pinned Starter release and wait | The Starter worker resumes or reports its matching no-op | Unchanged |
+| Matching Starter tag exists | Validate its Core/base provenance; run the frozen Starter, clean-create, and Landing compatibility gates | Validation and gates repeat without mutation | Unchanged |
+| All downstream consumer gates pass | Promote npmjs and GitHub Packages channel tags monotonically | Same version is a no-op; an older run preserves a newer tag | Candidate or newer version |
+| Channels promoted or preserved newer | Create the Core GitHub Release | Existing matching release is a no-op | Candidate or newer version |
+| Core GitHub Release exists | Dispatch Landing only when explicitly enabled | Landing remains untouched by default | Candidate or newer version |
+
+Invariants:
+
+- immutable package versions and Core/Starter tags must keep the requested
+  version, Core SHA, and pinned Starter SHA identity;
+- public channel tags cannot move until the released Starter, clean-create, and
+  reviewed Landing compatibility gates pass;
+- channel updates use the controller's monotonic promotion boundary, so an
+  older re-run cannot move a channel backward;
+- the candidate version may be fetched explicitly or through the temporary
+  `mantle-release` tag before promotion, but is not the public channel default.
+
+Non-goals: this transition does not change Starter worker ownership, add
+rollback or unpublish behavior, or deploy Landing unless
+`deploy_landing=true`.
+
 ## Branches and channels
 
 - Feature and release PRs target `develop`.
-- Pre-v0.1 alphas release directly from the merged `develop` release commit.
+- Alpha prereleases before stable v0.1.0 release directly from the merged
+  `develop` release commit.
 - Beta, RC, and stable promotion to `main` remains a deliberate human decision;
   it is not part of the alpha controller.
 - Alpha, beta, and RC GitHub releases are prereleases.
 - npm dist-tags follow the suffix: `alpha`, `beta`, `rc`, or `latest` for
   stable versions.
-- During the current `0.0.x-alpha` cadence, `latest` follows the current alpha
-  while the `alpha` tag remains available.
+- During the legacy `0.0.x-alpha` cadence, `latest` follows the current alpha.
+  The final `0.1.0-alpha.N` candidates advance only `alpha`; `latest` moves to
+  `0.1.0` after the stable gate passes.
 
 ## Release PR
 
 1. Fetch Core and Starter remotes and choose the next unused version.
-2. Read `CHANGELOG.md` completely. Add a dated Keep-a-Changelog entry from the
-   merged commits since the previous tag; do not add an `[Unreleased]` bucket.
+2. Preview GitHub's generated notes for the merged commits since the previous
+   tag. Correct PR titles and labels before release; do not duplicate the notes
+   in `CHANGELOG.md`. Label the release-only PR `skip-release-notes`.
 3. Set that exact version in every workspace package and in all four agent
    plugin manifests. Set `.agents/plugins/marketplace.json` to the immutable
    `v<version>` ref.
@@ -75,18 +109,37 @@ decision instead of starting another local redesign loop.
    packed-consumer gate. Review and merge a same-repository PR into `develop`;
    the controller rejects a direct-push release commit.
 
-The five public packages publish in dependency order:
+Preview the native notes before merging the release PR:
+
+```bash
+gh api --method POST repos/aotter/mantle/releases/generate-notes \
+  -f tag_name=vX.Y.Z \
+  -f target_commitish="$(git rev-parse origin/develop)" \
+  -f previous_tag_name=vPREVIOUS \
+  --jq .body
+```
+
+The nine public packages publish in dependency order:
 
 1. `@aotter/mantle-spec`
 2. `@aotter/mantle-admin-ui`
 3. `@aotter/mantle-runtime`
-4. `@aotter/mantle-cloudflare`
-5. `@aotter/mantle`
+4. `@aotter/mantle-web`
+5. `@aotter/mantle-admin`
+6. `@aotter/mantle-bun`
+7. `@aotter/mantle-vercel`
+8. `@aotter/mantle-cloudflare`
+9. `@aotter/mantle`
 
 The umbrella package must contain its version-matched `docs/` and `skills/`
 payload. No tarball may contain `workspace:*` dependencies, secrets, local
-state, or workspace-only files. Starter projects are released from the
-versioned `mantle-starters` repository; Core does not publish a scaffolder.
+state, or workspace-only files. Starter content is still authored and released
+from the versioned `mantle-starters` repository — Core owns no starter source.
+Core's umbrella CLI is the canonical consumer of that release: `mantle create`
+resolves the official immutable `v${packageVersion}` starter tag and renders it
+through Core's shared provision module. A published Core version
+therefore requires the matching starter tag to exist; see
+[ADR-0018](adr/0018-core-starters-repository-boundary.md).
 
 ## Run the controller
 
@@ -101,16 +154,20 @@ Before creating the Core tag, the controller proves:
 - the requested version matches every package, plugin, and marketplace ref;
 - `pnpm check` passes;
 - packed Core passes in the exact pinned Starter source;
-- all five release tarballs exist;
+- all nine release tarballs exist;
 - npm and cross-repository credentials are present and readable;
 - a fresh version is unused across npmjs, GitHub Packages, and Starter tags;
 - the pinned Starter commit is still the remote `develop` tip.
 
-After npm publication, it compares each public registry integrity value with
-the locally packed tarball, rejects leaked `workspace:*` dependencies, waits
-for the Starter tag, checks that tag's exact Core/base provenance, installs its
-frozen locks from the public registry, and reruns the Starter bundle gates.
-Only then does it create the Core GitHub Release.
+After candidate publication under `mantle-release`, it compares each public
+registry integrity value with the locally packed tarball, rejects leaked
+`workspace:*` dependencies, waits for the Starter tag, checks that tag's exact
+Core/base provenance, installs its frozen locks from the public registry, and
+reruns the Starter bundle gates. It then creates clean Blank and multilingual
+Transaction projects through the registry candidate, frozen-installs and checks
+both, and runs the reviewed Landing consumer against the exact packed candidate.
+Only then does it promote the public npmjs and GitHub Packages channel tags and
+create the Core GitHub Release.
 
 ## Idempotency and recovery
 
@@ -135,7 +192,7 @@ Core repository secrets:
 
 | Secret | Minimum purpose |
 |---|---|
-| `NPM_TOKEN` | Publish the five `@aotter/*` packages on npmjs. |
+| `NPM_TOKEN` | Publish the nine `@aotter/*` packages on npmjs. |
 | `RELEASE_FANOUT_TOKEN` | Read and dispatch `aotter/mantle-starters`; also read and dispatch `aotter/mantle-landing` only when Landing is enabled. |
 
 Core's job-scoped `GITHUB_TOKEN` creates the Core tag and release and mirrors
@@ -158,18 +215,24 @@ for p in \
   @aotter/mantle-spec \
   @aotter/mantle-admin-ui \
   @aotter/mantle-runtime \
+  @aotter/mantle-web \
+  @aotter/mantle-admin \
+  @aotter/mantle-bun \
+  @aotter/mantle-vercel \
   @aotter/mantle-cloudflare \
   @aotter/mantle; do
   npm view "$p@X.Y.Z" version dist.integrity dependencies --json
 done
 ```
 
-Clone the exact Starter tag into a fresh directory, install with frozen locks,
-run its bundle gates, and materialize at least one typed project. Confirm the
-generated project contains version-matched repo-local Mantle skills and the
-expected typed runtime surface. `blank` remains headless and contains no Kiwa;
-a typed Starter revision may retain its replaceable offline UI palette, but
-runtime code must not import it.
+The controller already creates and checks clean Blank and multilingual
+Transaction projects. For 0.1.2 release acceptance, give a coding agent with no
+Mantle checkout or repository knowledge only the generated instructions and
+confirm it reaches a running Worker. This is one manual clean-room acceptance,
+not a nondeterministic CI framework. Confirm the generated project contains
+version-matched repo-local Mantle skills and the expected typed runtime surface.
+`blank` remains headless and contains no Kiwa; a typed Starter revision may
+retain its replaceable offline UI palette, but runtime code must not import it.
 
 If `deploy_landing=false`, also verify that no Landing release dispatch or
 deployment was started.
@@ -177,7 +240,7 @@ deployment was started.
 ## Fix-forward policy
 
 - Broken public package or Starter bundle: publish the next alpha and explain
-  the re-spin in `CHANGELOG.md`.
+  the re-spin in the fix PR and generated GitHub Release notes.
 - Use `npm deprecate` to steer consumers away from a broken version.
 - Unpublish only for secrets, private files, or similarly severe exposure;
   npm versions cannot be reused and registry metadata may remain unavailable

package/docs/schema-indexes.md

@@ -11,7 +11,7 @@ kind: Schema
 metadata: { name: account-members }
 spec:
   title: Account members
-  lifecycle: none
+  lifecycle: operational
   schema:
     type: object
     properties:

package/docs/sealed-pipeline-ownership.md

@@ -0,0 +1,100 @@
+# Sealed pipeline ownership ledger
+
+This is the migration evidence for ADR-0019 and epic #656. It records the
+`v0.1.0-alpha.7` owners before code moves, the single target owner, and the
+issue that must delete or delegate the old path.
+
+## Rule ownership
+
+| Behavior | Current owner(s) | Target owner | Migration |
+|---|---|---|---|
+| YAML document decode, empty documents, syntax errors, alias cap | `ManifestParser.parseOneStream` | Parse/decode in `mantle-spec` | #663 |
+| Four-atom discrimination, envelope keys, primitive/enum shape | `ManifestParser` | Parse/normalize | #663 |
+| Source identity and document location | Synthetic parser doc index plus `loadManifests`/`ManifestPathDiagnoser` reconstruction | `ManifestSourceSet` authored metadata | #663 |
+| Schema atom-local shape, index/search/UI shape | Parser plus `ValidateManifestsUseCase` checkers | Parse/normalize | #663; old checks deleted in #673 |
+| Defaults for localized/lifecycle/indexes/search/order | `IntrospectManifestsUseCase`, runtime lifecycle checks, and callers using `??` | Parse/normalize exactly once | #663, #667 |
+| Duplicate names | `ValidateManifestsUseCase` | Link | #664 |
+| Schema/View/Procedure/Trigger cross-references | `ValidateManifestsUseCase` and repeated boot checks | Link | #664 |
+| Guard existence, self-reference, builtin/chain rules | Validate plus `ValidateBootUseCase` | Link | #664 |
+| Locale/translates graph | `checkLocaleAndTranslates` in validate and boot | Link for manifest graph; Prepare for selected deployment locales | #664, #666 |
+| Manifest-owned HTTP/MCP collisions | Validate plus boot | Link | #664 |
+| Handler source/registry availability | Optional CLI source scan plus boot registry scan | Prepare | #666 |
+| Optional Web/Admin/Auth path reservations | Fixed boot/Cloudflare prefix lists | Prepare selected capabilities only | #666, #669, #670 |
+| Kind/name lookup maps | `ValidateManifestsUseCase`, `ValidateBootUseCase`, `createCmsRuntime`, adapters | Compile once into `RuntimePlan` | #665 |
+| Authorization/guard descriptors | Raw manifests interpreted by validators, runtime use cases, and mounts | Compile plan; evaluate in Core invocation | #665, #667 |
+| Trigger indices and Procedure descriptors | Runtime construction/use cases | Compile plan | #665 |
+| Semantic fingerprint | Runtime boot from raw manifests | Compile plan | #665 |
+| Declarative View resolution | `ViewSqlCompiler` during each `ExecuteViewUseCase` call | Compile logical plan once | #665 |
+| SQLite/JSON1 View lowering and native `spec.sql` | `ViewSqlCompiler` plus `DatabaseDriver` invocation | Selected storage preparation | #666 |
+| Canonical SQL migrations, indexes, schema SQL Views, readiness | `createCmsRuntime.bootInit` and runtime infrastructure | Prepare | #666 |
+| Entry/media/site repositories | Runtime constructs `Database*Repository` from `DatabaseDriver` | Prepared semantic storage ports; media/config move with final owner | #666, #669, #670 |
+| Content, View, Procedure, Trigger, lifecycle invocation | Runtime use cases over raw maps/driver | `MantleRuntime` over plan + semantic ports | #667 |
+| Target authorization/admin bypass | Runtime plus adapter entry points | One Core invocation policy; adapter resolves caller only | #667 |
+| Generated manifest module and TypeScript names | `packages/mantle/src/cli/generate.ts` + `EmitTypesUseCase` | Pure linked/plan projection and `bindMantle` | #668 |
+| Admin asset copy during generation | `packages/mantle/src/cli/generate.ts` | Removed; Admin install/composition owns assets | #668, #670 |
+| HTML/templates/public paths/Markdown/SEO/preview/`llms.txt`/sitemap | Runtime render services plus Cloudflare public routes | Optional `mantle-web` | #669 |
+| Public request mapping and cache policy | `mountPublicRoutes` | Platform adapter using selected Web projection | #669 |
+| Admin API/application/static assets | Optional `mantle-admin`; Cloudflare only binds auth/request context/assets | Optional `mantle-admin` + existing UI artifact | #670 |
+| View/HTTP Trigger route transport | Combined Cloudflare mounts | Platform adapters over the same Core descriptors | #669–#672 |
+| Bun SQLite/process lifecycle | `mantle-bun`; host owns server/database | `mantle-bun`; host owns server/database | #671 |
+| Vercel function/durable-storage lifecycle | `mantle-vercel`; host owns handler/client | `mantle-vercel`; host owns handler/client | #672 |
+| Legacy overloads, aliases, combined mounts, duplicate tests | Current public API plus temporary migration delegates | Deleted | #673 |
+| Contributor/agent/release guidance | `AGENTS.md`, `CLAUDE.md`, `CONTRIBUTING.md`, two release skill copies | One tool-neutral authority and one release skill | #674 |
+
+## Deletion evidence
+
+All baseline production callers now consume `ParsedManifestSet`,
+`LinkedManifestSet`, or `RuntimePlan` according to their pipeline stage.
+`scripts/check-boundaries.mjs` fails if the removed runtime facade, generated
+site API, raw parser facade, or combined Cloudflare route owner returns.
+Parser-focused tests may inspect parser output, but runtime and platform tests
+must compile and prepare the same sealed plan used by production.
+
+## Consumer manifest corpus
+
+The Core repository does not vendor every downstream manifest. That would
+create a second source of truth. The reusable golden fixture under
+`packages/mantle-spec/test/fixtures/pipeline-v0.1/` covers every shipped atom,
+auth/guard references, all Trigger surfaces, multi-document YAML, empty
+documents, aliases, unknown keys, malformed YAML, and deterministic
+diagnostics.
+
+Exact downstream sources and their gate authorities are pinned here. The public
+Starter runs in Core CI and release preflight. Private consumers run the same
+exact-tarball checker in their own repositories, so public Core PRs never
+receive cross-repository credentials:
+
+| Consumer | Revision | Gate authority | Manifest paths |
+|---|---|---|---|
+| `aotter/mantle-starters` | `157e8f49e1e25ae1c52c0115f0dd9e8b6017ef0e` | Core CI + release | `blank/manifests/site.yaml`; `overlays/{community,intake,presence,publication,reservation,transaction}/manifests/site.yaml`; `recipes/typed-web/manifests/site.yaml` |
+| `aotter/mantle-landing` | `4381354dd25d5d94f4096cf3e55a4cb9eecbf3ad` | Landing CI + Core release | `manifests/site.yaml` |
+| `aotter/mantle-platform` (Remote Mantle/control plane) | `3cc0d9ad6ee47b15f06c915c12f56fc4b9143f32` | Platform `exact-packed-core` | `manifests/platform.yaml` |
+| Core i18n fixture | this repository | Core CI | `packages/mantle-spec/test/fixtures/i18n-parent-child/manifests/site.yaml` |
+
+## Baseline gates
+
+The alpha.7 baseline was captured from tag `v0.1.0-alpha.7` on 2026-08-16
+with Node 22, pnpm 9, Wrangler local mode, and datasets of 100/10,000 rows:
+
+| Route | p95 queries | p95 rows read | local p95 timing |
+|---|---:|---:|---:|
+| public View, 10k rows | 1 | 20 | 3.01 ms |
+| public page miss, 10k rows | 2 | 5 | 3.92 ms |
+| Admin list, 10k rows | 1 | 21–22 | 2.49–3.24 ms |
+| Admin related detail, dense | 4 | 151 | 5.23 ms |
+| public builtin create | 1 | 0 | 2.55 ms |
+
+Wall-clock values are evidence, not a cross-machine budget. The normative
+baseline is the existing `pnpm bench:wrangler` query/row gate: every gate must
+remain true, unchanged revisions must perform no repeated preparation, and any
+intentional budget change needs its own reviewed evidence.
+
+Existing full-facade behavior is covered by Cloudflare authorization, Admin,
+public-route/cache, View REST, HTTP Trigger, media, form, and facade tests.
+Issues #669–#673 move those assertions to selected modules and exact packed
+consumers; they do not duplicate the suite under new names.
+
+Issue #674 leaves `CONTRIBUTING.md` plus accepted ADRs as the contributor
+authority. `AGENTS.md`, `CLAUDE.md`, and the Claude release-skill entry are
+small routers; `.agent/skills/mantle-release/SKILL.md` is the only maintainer
+release procedure. Shipped `skills/*` remain separate consumer artifacts.