@aotter/mantle 0.1.0-alpha.7 → 0.1.0-alpha.8

package/docs/design-atoms.md

@@ -25,7 +25,7 @@ primitives Postgres has shipped for 30 years.
 |---|---|---|---|
 | **`Schema`** | `CREATE TABLE` | no (manipulated via View / Procedure) | no |
 | **`View`** | `CREATE VIEW` | **yes** (auto-mounted on its declared public/staff REST and MCP surface; see ADR-0012) | no |
-| **`Procedure`** | `CREATE FUNCTION ... LANGUAGE plpgsql` | **no** (transport-agnostic; needs a `Trigger` to bind it) | **yes — handler ref to consumer's TS file** |
+| **`Procedure`** | `CREATE FUNCTION ... LANGUAGE plpgsql` | **no** (transport-agnostic; needs a `Trigger` to bind it) | **yes — handler ref to the consumer's registry** |
 | **`Trigger`** | `CREATE TRIGGER` + route/tool binding | yes (the binding atom — turns Procedures into HTTP endpoints, MCP tools, and lifecycle hooks) | no |
 
 The **read/write asymmetry is by design** and matches HTTP safe-vs-unsafe
@@ -45,15 +45,14 @@ these four plus your own TypeScript.
 apiVersion: cms.mantle.aotter.net/v1
 kind: Schema | View | Procedure | Trigger
 metadata:
-  name: posts                # required, kebab-case, unique within deployment
+  name: posts                # required, non-empty, unique within its kind
 spec:
   ...                        # kind-specific
 ```
 
-There is **no `namespace` field**. Resource names are unique within the
-deployment. K8s-style namespaces are a "premature scale" abstraction for
-our scope; SaaS multi-tenancy belongs in the consumer's app layer with a
-`tenant_id` column gated by RBAC, not in the SDK metadata layer.
+There is **no manifest `namespace` field**. Resource names are unique within
+their kind, so a Schema and View may share a name. SaaS multi-tenancy belongs
+in the consumer's app layer, not in manifest metadata.
 
 ### Multi-doc YAML — keeping file count down
 
@@ -65,7 +64,7 @@ A logical feature commonly bundles a Procedure + a Trigger (and often a
 Schema and a View). Put related atoms in one file separated by `---`:
 
 ```yaml
-# manifests/site.yaml
+# manifests/contact.yml
 apiVersion: cms.mantle.aotter.net/v1
 kind: Procedure
 metadata: { name: send-contact-message }
@@ -85,8 +84,9 @@ spec:
   target: { procedure: send-contact-message }
 ```
 
-One fixed file, two documents. Add every atom to `manifests/site.yaml` with
-`---`; the loader rejects other manifest filenames.
+Use one file or split features across files. Mantle reads every immediate
+`.yaml` and `.yml` file in `./manifests` by default; `---` separates multiple
+documents in one file.
 
 ## What each atom is for (v0.1 minimum essential grammar)
 
@@ -128,6 +128,10 @@ spec:
 in the user's primary language (the install-time chosen locale); the
 SPA shows this everywhere instead of `metadata.name`.
 
+Schema titles and optional descriptions accept either a string or a locale
+map such as `{ en: Products, "zh-TW": 商品 }`. Procedure titles and
+descriptions and View titles use the same shape; all are optional.
+
 **`spec.searchableFields`** — optional allowlist of top-level string
 properties used by Admin and Staff MCP substring search. Entry id is always
 searchable. This is separate from `indexes`; ordinary B-tree indexes do not
@@ -208,9 +212,9 @@ extensions. Three are part of `cms.mantle.aotter.net/v1`:
 > See ADR-0002 for rationale — why this is a closed enum and not an
 > open expression language.
 
-Marks a property as **server-controlled**. The SDK fills the value at
-write time; the caller MUST NOT supply it (callers who try to set a
-bound field get `INPUT_VALIDATION_FAILED`). Eliminates the entire
+Marks a property as **server-controlled**. On create, the SDK overwrites any
+caller value with the bound value; updates preserve the existing stamp. This
+eliminates the entire
 class of handler-side `userId: ctx.user.id` boilerplate, and gives
 the dispatcher an authoritative "who/when" tag without trusting the
 wire.
@@ -221,13 +225,11 @@ wire.
 |---|---|---|
 | `ctx.user` | UUID of the signed-in end-user (from session cookie); `null` if anonymous | row ownership: `authorId`, `submittedBy`, `creatorId` |
 | `ctx.staff` | UUID of the staff member acting (when a staff session is active); `null` for end-user-only paths | audit trail: `approvedBy`, `moderatedBy`, `grantedBy` |
-| `now` | Server timestamp at write (ISO-8601 string with timezone) | `createdAt`, `submittedAt`, `grantedAt` |
+| `now` | Server timestamp at write (Unix epoch milliseconds) | `createdAt`, `submittedAt`, `grantedAt` |
 
 **v0.1 stamping behavior**:
 - Stamped on `INSERT` only.
-- Caller-supplied value: rejected at input validation. The Procedure's
-  effective input schema strips bound fields before checking caller
-  input, so callers can't accidentally send them.
+- Caller-supplied create value: ignored and replaced by the server stamp.
 - Visible in View output: yes, as ordinary columns. No special masking.
 
 **Why a closed enum** (highest-leverage discipline in the spec): bind
@@ -241,9 +243,9 @@ named bounds the semantic surface forever.
 properties:
   title:     { type: string, minLength: 1, maxLength: 200 }
   authorId:  { type: string, format: uuid, x-mantle-bind: ctx.user }
-  createdAt: { type: string, format: date-time, x-mantle-bind: now }
+  createdAt: { type: integer, x-mcp-hint: timestamp-ms, x-mantle-bind: now }
   # caller sends only: { title }
-  # SDK stamps: { title, authorId: <session UUID>, createdAt: <now ISO> }
+  # SDK stamps: { title, authorId: <session UUID>, createdAt: <epoch ms> }
 ```
 
 #### `x-mantle-ref: <other-schema-name>` — cross-Schema reference
@@ -582,9 +584,8 @@ That split is intentional and load-bearing.
   draft-2020-12 JSON Schema documents. This is what AI authors and
   human authors write, what the admin UI feeds JSON Forms, and what
   the OpenAPI emitter relays unchanged.
-- **Runtime engine** = zod (v3). The `@aotter/mantle-spec`
-  package ships a JSON-Schema → zod converter
-  (`src/json-schema-zod.ts`); the runtime calls the converted zod
+- **Runtime engine** = zod 4. The `@aotter/mantle-spec`
+  package ships a JSON-Schema → zod converter; the runtime calls the converted zod
   schema on every Procedure invocation, View parameter parse, and
   manifest boot check.
 
@@ -657,119 +658,16 @@ thing as a composition of the four; almost always it works.
 > fold into JSON Schema inside `Schema` rather than becoming new
 > kinds.
 
-Postgres exposes ~25 object kinds total; an application developer
-typically only writes 4–6 of them. The rest are engine internals that
-Cloudflare D1 / KV abstract away.
-
-## Storage backend — D1 today, Postgres-via-Hyperdrive tomorrow
-
-> See the `mantle-cloudflare` README for rationale — why D1 for
-> v0.1 (no-CC OSS onboarding, platform-native), and the documented
-> PG path.
-
-### How `Schema` data is stored on D1 today
-
-All collections share one `entries` table (defined by the
-Cloudflare adapter's storage migrations in
-`@aotter/mantle-cloudflare`):
-
-```sql
-CREATE TABLE entries (
-  id          TEXT PRIMARY KEY,
-  collection  TEXT NOT NULL,        -- discriminator: 'posts', 'comments', ...
-  status      TEXT NOT NULL,        -- 'draft' / 'published' / ...
-  version     INTEGER NOT NULL,
-  data        TEXT NOT NULL,        -- JSON blob: every Schema property (incl. locale, per ADR-0010)
-  created_at  INTEGER NOT NULL,
-  updated_at  INTEGER NOT NULL,
-  author_id   TEXT REFERENCES users(id)
-);
-```
+Postgres exposes ~25 object kinds total; an application developer typically
+only writes 4–6 of them. The rest belong behind the selected storage adapter.
 
-Reserved metadata are native columns; **everything in your Schema's
-`spec.schema.properties` lives inside the `data` JSON blob**. Locale
-on localized Schemas lives at `data.locale` (per ADR-0010); for
-indexing it surfaces as a JSON-extracted virtual generated column
-(`json_extract(data, '$.locale')`) with a partial unique index, not as
-a top-level column.
-
-`uniqueIndexes` and ordered, non-unique `indexes` declarations compile
-into affinity-correct virtual generated columns plus partial B-tree
-indexes via the spec engine's DDL emitter (`@aotter/mantle-spec`).
-Different collections coexist on the same table without colliding
-because each generated-column expression is gated by `WHEN collection
-= '<name>'`. See [Schema indexes on D1](schema-indexes.md) for the
-grammar, leftmost-prefix rules, SQL helper, and query-plan examples.
-
-### What works well on D1
-
-- D1's SQLite has the **JSON1 extension built in**: `json_extract`,
-  `json_each`, `json_object`, `json_array`, `json_set`, `json_valid`,
-  plus `->` / `->>` operators.
-- Reserved-column queries (`status = 'published'`, `ORDER BY
-  updated_at`) use native indexes — fast.
-- `uniqueIndexes`- and `indexes`-declared paths use virtual columns +
-  partial indexes. Core-compiled Views and repository lookups reference
-  those columns instead of repeating `json_extract`.
-
-### Where D1's JSON support has limits (vs Postgres)
-
-| Concern | D1 / SQLite | Postgres |
-|---|---|---|
-| JSON storage | TEXT — re-parsed on every `json_extract` | JSONB — stored as compact binary; faster repeated extraction |
-| Index any JSON path | must declare each path explicitly via virtual column + index | GIN index on JSONB indexes all paths automatically |
-| Array containment | `EXISTS (SELECT 1 FROM json_each(...) WHERE value = ?)` — full scan unless indexed | `data @> ARRAY[x]` with GIN — native operator |
-| Path operators | `->`, `->>` only | `->`, `->>`, `#>`, `#>>`, `@>`, `?`, `?|`, `?&` |
-| `DEFAULT now()` | not at column level — SDK-stamped via `x-mantle-bind: now` | native column default |
-| Foreign key on JSON path | not supported on `VIRTUAL` columns; needs `STORED` (extra space) | not natively, but B-tree on expression OK |
-| Row-level security | none — SDK-side filter rewriting | native RLS policies |
-| Multi-statement transactions | session API serializes; not true ACID across statements | full ACID transactions |
-
-### Practical scale envelope on D1
-
-- **Blog-scale (< 10k entries / collection)**: today's design is
-  comfortable. Anonymous public responses can hit version-local Workers
-  Cache before the Worker; origin misses use indexed D1 reads.
-- **Mid-scale (10k – 100k entries)**: declare measured list/filter
-  access paths with ordered `indexes`.
-- **Hard D1 limits**: 1 MB max row size; 5,000 rows per query result;
-  single-writer per database (concurrent writes serialize).
-- **Cross-region read**: D1 is region-pinned; first origin hit from a
-  far region may pay replica latency. Eligible anonymous responses are
-  then served by version-local Workers Cache.
-
-### Scale-up path: D1 → Postgres via Cloudflare Hyperdrive
-
-Cloudflare does not run a first-party Postgres service. The supported
-path when D1 limits bind is **Cloudflare Hyperdrive** (a connection
-pooler + query-cache that lets a Worker connect to any external
-Postgres at near-edge latency):
-
-- **Neon** (serverless Postgres with scale-to-zero) — closest
-  ergonomic match; tightest CF integration.
-- **Supabase** (PG + auth + storage) — works out of the box.
-- **AWS RDS / Google Cloud SQL / Azure DB / self-hosted PG** — also
-  supported via Hyperdrive.
-
-When this path is taken (post-v0.1; not implemented yet), the
-**author-facing YAML stays unchanged**. The SDK's compile target swaps:
-
-| What changes (SDK runtime) | Author impact |
-|---|---|
-| `data TEXT` → `data JSONB` | none |
-| Virtual generated columns → optional (PG can use GIN) | author may stop declaring `indexes` if defaults suffice; the same YAML remains valid |
-| `json_each` → array operators (`@>`, `&&`) | none — predicates stay declarative |
-| SDK-stamped `now` → `DEFAULT now()` (optional) | none |
-| SDK-side policy rewriting → native RLS (optional) | none |
-
-Migration shape: `entries` table dumped from D1, restored to PG. Stay
-single-table-with-discriminator (drop-in) or split into
-table-per-collection (more PG-idiomatic, longer migration). Both shapes
-remain valid `cms.mantle.aotter.net/v1` deployments.
-
-**v0.1 commitment**: D1 only via the Cloudflare adapter. Hyperdrive +
-PG is an upgrade route, not an implemented adapter. SDKs and starters target
-D1 exclusively.
+## Storage adapters
+
+Manifests compile to semantic storage ports; they do not select a database.
+Use the shared SQLite adapter for SQLite-compatible hosts, or implement the
+same ports over PostgreSQL, MongoDB, or existing application repositories.
+See the [adapter guide](adapter-guide.md); SQLite index lowering is documented
+separately in [Schema indexes](schema-indexes.md).
 
 ## Detailed shipped grammar
 

package/docs/labels.md

@@ -26,7 +26,7 @@ For package README or package-local docs changes, prefer the package area label
 
 | Label | Meaning |
 |---|---|
-| `area:runtime` | `packages/mantle-runtime` behavior, ports, use cases, dispatcher, render, MCP runtime. |
+| `area:runtime` | `packages/mantle-runtime` behavior, ports, use cases, dispatcher, and MCP runtime. |
 | `area:spec` | `packages/mantle-spec`, manifest parsing, validation, diagnostics, CLI, spec types. |
 | `area:cf` | `packages/adapters/cloudflare`, Workers adapter, D1/KV/ASSETS wiring, Cloudflare deploy behavior. |
 | `area:starters` | External `aotter/mantle-starters` integration, release fanout, and the local moved-starter stub. |

package/docs/media-uploads.md

@@ -78,7 +78,7 @@ wrangler secret put R2_SECRET_ACCESS_KEY
 ## `src/mantle/config.ts`
 
 ```ts
-import { R2MediaStorage, type CmsConfig } from "@aotter/mantle/cloudflare";
+import { R2MediaStorage, type MantleCloudflareConfig } from "@aotter/mantle/cloudflare";
 import { AwsClient } from "aws4fetch";
 
 export interface Env {
@@ -89,7 +89,7 @@ export interface Env {
   readonly MEDIA_PUBLIC_URL_BASE?: string;
 }
 
-function buildMediaStorage(env: Env): CmsConfig["bindings"]["mediaStorage"] {
+function buildMediaStorage(env: Env): MantleCloudflareConfig["bindings"]["mediaStorage"] {
   if (
     !env.MEDIA_BUCKET ||
     !env.R2_ACCOUNT_ID ||

package/docs/migration-0.1.2.md

@@ -0,0 +1,45 @@
+# Migrating from 0.1.0-alpha.7 to 0.1.2
+
+0.1.2 removes the temporary full-site compatibility stack. Mantle Core is now
+an embeddable parse → link → compile → prepare → bind pipeline; Web, Admin,
+Admin UI, Bun, Vercel, and Cloudflare are selected separately.
+
+| alpha.7 | 0.1.2 |
+|---|---|
+| `parseManifests*` | `parseManifestSources({ sources })` |
+| raw `Manifest[]` validation/runtime input | `ParsedManifestSet` → `LinkedManifestSet` → `RuntimePlan` |
+| `createCmsRuntime({ manifests, db })` | `bootMantleRuntime({ plan, storage })`, or explicit prepare then `createMantleRuntime({ prepared })` |
+| `CmsRuntime.db` / `entryReader` | keep the application DB handle; use `runtime.entries` for Mantle reads |
+| generated `manifest`, `site.ts`, `types.d.ts` | generated `plan`, `createMantle`, `bindMantle`, and types in `mantle.ts` |
+| `mantle introspect` | install `@aotter/mantle-spec` directly and run `mantle-spec introspect` |
+| `mantle emit-types` | use `mantle generate`; for raw declarations, run `mantle-spec emit-types` |
+| generated `.agent/skills/` | generated `.agents/skills/`; legacy user files are left untouched |
+| `bindMantleSite` / string-keyed Views | `bindMantle(runtime)` and generated lower-camel properties |
+| `createCmsRef` / `CmsConfig` | `createMantleRuntimeRef` / `MantleCloudflareConfig` |
+| `mountServerEndpoints` | explicitly compose `mountRuntimeEndpoints` and optional `mountAdmin` |
+
+Delete stale generated `site.ts` and `types.d.ts` files once, then run
+`mantle generate`. Install only the optional package used by the host;
+installing the umbrella alone now pulls only Spec and Runtime.
+
+Intentional behavior changes:
+
+- Generated-plan fingerprint or version mismatches fail immediately and ask
+  the developer to regenerate.
+- Runtime HTTP trigger JSON bodies must be objects. Arrays and primitives are
+  rejected at the request boundary.
+- Malformed percent-encoded paths are routing misses (`404`), not claimed
+  Mantle routes.
+- Better Auth and every `@better-auth/*` package move together to 1.7.
+  `oauthProvider.validAudiences` becomes protected `resources`; MCP uses one
+  canonical `${PUBLIC_ORIGIN}/mcp` resource and CIMD client discovery.
+- The Cloudflare adapter no longer requires `OAUTH_KV` or
+  `@cloudflare/workers-oauth-provider`. Old opaque tokens and KV registrations
+  cannot be migrated safely and must reconnect.
+- Canonical plan ordering may change stable field/export order (including
+  Admin CSV columns) without changing field values.
+
+This alpha changes the Better Auth D1 schema, including required account
+issuer identity and OAuth resource/client tables. Reset and re-bootstrap a
+pre-1.7 alpha auth database; do not guess an issuer backfill. Content tables
+remain portable through the normal application migration/export path.

package/docs/performance-harness.md

@@ -10,16 +10,16 @@ make a normal content/API/page change.
 | Read or state | Owner | Notes |
 |---|---|---|
 | Entry get/list and public slug/data-field/published reads | `DatabaseEntryRepository` through `EntryRepository` / `EntryReader` | Schema-aware field resolution is shared here. |
-| Manifest View execution | `ExecuteViewUseCase` + `ViewSqlCompiler` | The deliberate compiled-query exception; it still resolves declared Schema indexes. |
+| Manifest View execution | `ExecuteViewUseCase` + prepared `ViewQueryExecutor` | Core owns authorization and request validation; selected storage lowers queries once and resolves declared Schema indexes. |
 | Editable settings and code-owned locale/media policy | `DatabaseSiteConfigRepository` | Editable values and dynamic media tool policy are read fresh; boot-seeded locale policy may be memoized within the runtime instance. |
 | Pending media uploads | `DatabasePendingUploadRepository` | Canonical, read-after-write D1 state; never publish-cache state. |
 | Rendered HTML, Markdown, and `llms.txt` | Request-time render use cases plus the Cloudflare public-route cache policy | D1 is canonical; version-local Workers Cache stores anonymous HTTP responses. |
 | D1 transport and optional query metrics | Cloudflare bindings | Bindings stay thin. Query/cache policy does not belong in a generic provider `BaseRepository`. |
 
-`CmsRuntime.db` remains deprecated compatibility surface. New site code uses
-Manifests, runtime use cases, `entryReader`, and `siteConfig`. A site may own
+The runtime exposes no raw database handle. Application and adapter code uses
+the sealed plan, runtime use cases, `entries`, and `siteConfig`. An application may own
 additional tables behind its own repository at the composition root, but it
-must not query Mantle-owned tables through `runtime.db`.
+must not query Mantle-owned tables outside the selected storage adapter.
 
 ## Cache contract
 

package/docs/release-process.md

@@ -1,8 +1,9 @@
 # Release process
 
-Mantle is in `0.0.x-alpha` until the v0.1.0 gate closes. Published package
-versions, Git tags, GitHub releases, and Starter tags are immutable: repair a
-bad release with the next version, never by replacing public state.
+Mantle remains prerelease software until the stable v0.1.0 gate closes.
+Published package versions, Git tags, GitHub releases, and Starter tags are
+immutable: repair a bad release with the next version, never by replacing
+public state.
 
 ## Authority
 
@@ -15,10 +16,12 @@ The controller owns this order:
 ```text
 Core source + exact-packed Starter gates
   -> Core tag
-  -> npmjs + GitHub Packages
+  -> npmjs + GitHub Packages candidate packages (`mantle-release`)
   -> Starter release worker
   -> immutable Starter tag
   -> public-registry Starter gate
+  -> clean-create + reviewed Landing compatibility gates
+  -> npmjs + GitHub Packages public channel promotion
   -> Core GitHub Release
   -> optional Landing worker
 ```
@@ -45,6 +48,34 @@ verdict expires when that SHA changes. After two patch rounds, a new
 foundational blocker returns to the state table and the user for a scope
 decision instead of starting another local redesign loop.
 
+For the candidate-to-channel transition, the controller follows this finite
+state table:
+
+| Durable state | Permitted next mutation | Re-run behavior | Public channel |
+|---|---|---|---|
+| Source gated; version unused | Create the immutable Core tag | Existing tag must match or the run fails | Unchanged |
+| Core tag exists; candidate packages incomplete | Publish and verify missing exact versions under `mantle-release` through each registry's sole publish step | Existing versions are verified and skipped | Unchanged |
+| Candidate packages verified; Starter tag absent | Dispatch the pinned Starter release and wait | The Starter worker resumes or reports its matching no-op | Unchanged |
+| Matching Starter tag exists | Validate its Core/base provenance; run the frozen Starter, clean-create, and Landing compatibility gates | Validation and gates repeat without mutation | Unchanged |
+| All downstream consumer gates pass | Promote npmjs and GitHub Packages channel tags monotonically | Same version is a no-op; an older run preserves a newer tag | Candidate or newer version |
+| Channels promoted or preserved newer | Create the Core GitHub Release | Existing matching release is a no-op | Candidate or newer version |
+| Core GitHub Release exists | Dispatch Landing only when explicitly enabled | Landing remains untouched by default | Candidate or newer version |
+
+Invariants:
+
+- immutable package versions and Core/Starter tags must keep the requested
+  version, Core SHA, and pinned Starter SHA identity;
+- public channel tags cannot move until the released Starter, clean-create, and
+  reviewed Landing compatibility gates pass;
+- channel updates use the controller's monotonic promotion boundary, so an
+  older re-run cannot move a channel backward;
+- the candidate version may be fetched explicitly or through the temporary
+  `mantle-release` tag before promotion, but is not the public channel default.
+
+Non-goals: this transition does not change Starter worker ownership, add
+rollback or unpublish behavior, or deploy Landing unless
+`deploy_landing=true`.
+
 ## Branches and channels
 
 - Feature and release PRs target `develop`.
@@ -88,18 +119,27 @@ gh api --method POST repos/aotter/mantle/releases/generate-notes \
   --jq .body
 ```
 
-The five public packages publish in dependency order:
+The nine public packages publish in dependency order:
 
 1. `@aotter/mantle-spec`
 2. `@aotter/mantle-admin-ui`
 3. `@aotter/mantle-runtime`
-4. `@aotter/mantle-cloudflare`
-5. `@aotter/mantle`
+4. `@aotter/mantle-web`
+5. `@aotter/mantle-admin`
+6. `@aotter/mantle-bun`
+7. `@aotter/mantle-vercel`
+8. `@aotter/mantle-cloudflare`
+9. `@aotter/mantle`
 
 The umbrella package must contain its version-matched `docs/` and `skills/`
 payload. No tarball may contain `workspace:*` dependencies, secrets, local
-state, or workspace-only files. Starter projects are released from the
-versioned `mantle-starters` repository; Core does not publish a scaffolder.
+state, or workspace-only files. Starter content is still authored and released
+from the versioned `mantle-starters` repository — Core owns no starter source.
+Core's umbrella CLI is the canonical consumer of that release: `mantle create`
+resolves the official immutable `v${packageVersion}` starter tag and renders it
+through Core's shared provision module. A published Core version
+therefore requires the matching starter tag to exist; see
+[ADR-0018](adr/0018-core-starters-repository-boundary.md).
 
 ## Run the controller
 
@@ -114,16 +154,20 @@ Before creating the Core tag, the controller proves:
 - the requested version matches every package, plugin, and marketplace ref;
 - `pnpm check` passes;
 - packed Core passes in the exact pinned Starter source;
-- all five release tarballs exist;
+- all nine release tarballs exist;
 - npm and cross-repository credentials are present and readable;
 - a fresh version is unused across npmjs, GitHub Packages, and Starter tags;
 - the pinned Starter commit is still the remote `develop` tip.
 
-After npm publication, it compares each public registry integrity value with
-the locally packed tarball, rejects leaked `workspace:*` dependencies, waits
-for the Starter tag, checks that tag's exact Core/base provenance, installs its
-frozen locks from the public registry, and reruns the Starter bundle gates.
-Only then does it create the Core GitHub Release.
+After candidate publication under `mantle-release`, it compares each public
+registry integrity value with the locally packed tarball, rejects leaked
+`workspace:*` dependencies, waits for the Starter tag, checks that tag's exact
+Core/base provenance, installs its frozen locks from the public registry, and
+reruns the Starter bundle gates. It then creates clean Blank and multilingual
+Transaction projects through the registry candidate, frozen-installs and checks
+both, and runs the reviewed Landing consumer against the exact packed candidate.
+Only then does it promote the public npmjs and GitHub Packages channel tags and
+create the Core GitHub Release.
 
 ## Idempotency and recovery
 
@@ -148,7 +192,7 @@ Core repository secrets:
 
 | Secret | Minimum purpose |
 |---|---|
-| `NPM_TOKEN` | Publish the five `@aotter/*` packages on npmjs. |
+| `NPM_TOKEN` | Publish the nine `@aotter/*` packages on npmjs. |
 | `RELEASE_FANOUT_TOKEN` | Read and dispatch `aotter/mantle-starters`; also read and dispatch `aotter/mantle-landing` only when Landing is enabled. |
 
 Core's job-scoped `GITHUB_TOKEN` creates the Core tag and release and mirrors
@@ -171,18 +215,24 @@ for p in \
   @aotter/mantle-spec \
   @aotter/mantle-admin-ui \
   @aotter/mantle-runtime \
+  @aotter/mantle-web \
+  @aotter/mantle-admin \
+  @aotter/mantle-bun \
+  @aotter/mantle-vercel \
   @aotter/mantle-cloudflare \
   @aotter/mantle; do
   npm view "$p@X.Y.Z" version dist.integrity dependencies --json
 done
 ```
 
-Clone the exact Starter tag into a fresh directory, install with frozen locks,
-run its bundle gates, and materialize at least one typed project. Confirm the
-generated project contains version-matched repo-local Mantle skills and the
-expected typed runtime surface. `blank` remains headless and contains no Kiwa;
-a typed Starter revision may retain its replaceable offline UI palette, but
-runtime code must not import it.
+The controller already creates and checks clean Blank and multilingual
+Transaction projects. For 0.1.2 release acceptance, give a coding agent with no
+Mantle checkout or repository knowledge only the generated instructions and
+confirm it reaches a running Worker. This is one manual clean-room acceptance,
+not a nondeterministic CI framework. Confirm the generated project contains
+version-matched repo-local Mantle skills and the expected typed runtime surface.
+`blank` remains headless and contains no Kiwa; a typed Starter revision may
+retain its replaceable offline UI palette, but runtime code must not import it.
 
 If `deploy_landing=false`, also verify that no Landing release dispatch or
 deployment was started.

package/docs/sealed-pipeline-ownership.md

@@ -0,0 +1,100 @@
+# Sealed pipeline ownership ledger
+
+This is the migration evidence for ADR-0019 and epic #656. It records the
+`v0.1.0-alpha.7` owners before code moves, the single target owner, and the
+issue that must delete or delegate the old path.
+
+## Rule ownership
+
+| Behavior | Current owner(s) | Target owner | Migration |
+|---|---|---|---|
+| YAML document decode, empty documents, syntax errors, alias cap | `ManifestParser.parseOneStream` | Parse/decode in `mantle-spec` | #663 |
+| Four-atom discrimination, envelope keys, primitive/enum shape | `ManifestParser` | Parse/normalize | #663 |
+| Source identity and document location | Synthetic parser doc index plus `loadManifests`/`ManifestPathDiagnoser` reconstruction | `ManifestSourceSet` authored metadata | #663 |
+| Schema atom-local shape, index/search/UI shape | Parser plus `ValidateManifestsUseCase` checkers | Parse/normalize | #663; old checks deleted in #673 |
+| Defaults for localized/lifecycle/indexes/search/order | `IntrospectManifestsUseCase`, runtime lifecycle checks, and callers using `??` | Parse/normalize exactly once | #663, #667 |
+| Duplicate names | `ValidateManifestsUseCase` | Link | #664 |
+| Schema/View/Procedure/Trigger cross-references | `ValidateManifestsUseCase` and repeated boot checks | Link | #664 |
+| Guard existence, self-reference, builtin/chain rules | Validate plus `ValidateBootUseCase` | Link | #664 |
+| Locale/translates graph | `checkLocaleAndTranslates` in validate and boot | Link for manifest graph; Prepare for selected deployment locales | #664, #666 |
+| Manifest-owned HTTP/MCP collisions | Validate plus boot | Link | #664 |
+| Handler source/registry availability | Optional CLI source scan plus boot registry scan | Prepare | #666 |
+| Optional Web/Admin/Auth path reservations | Fixed boot/Cloudflare prefix lists | Prepare selected capabilities only | #666, #669, #670 |
+| Kind/name lookup maps | `ValidateManifestsUseCase`, `ValidateBootUseCase`, `createCmsRuntime`, adapters | Compile once into `RuntimePlan` | #665 |
+| Authorization/guard descriptors | Raw manifests interpreted by validators, runtime use cases, and mounts | Compile plan; evaluate in Core invocation | #665, #667 |
+| Trigger indices and Procedure descriptors | Runtime construction/use cases | Compile plan | #665 |
+| Semantic fingerprint | Runtime boot from raw manifests | Compile plan | #665 |
+| Declarative View resolution | `ViewSqlCompiler` during each `ExecuteViewUseCase` call | Compile logical plan once | #665 |
+| SQLite/JSON1 View lowering and native `spec.sql` | `ViewSqlCompiler` plus `DatabaseDriver` invocation | Selected storage preparation | #666 |
+| Canonical SQL migrations, indexes, schema SQL Views, readiness | `createCmsRuntime.bootInit` and runtime infrastructure | Prepare | #666 |
+| Entry/media/site repositories | Runtime constructs `Database*Repository` from `DatabaseDriver` | Prepared semantic storage ports; media/config move with final owner | #666, #669, #670 |
+| Content, View, Procedure, Trigger, lifecycle invocation | Runtime use cases over raw maps/driver | `MantleRuntime` over plan + semantic ports | #667 |
+| Target authorization/admin bypass | Runtime plus adapter entry points | One Core invocation policy; adapter resolves caller only | #667 |
+| Generated manifest module and TypeScript names | `packages/mantle/src/cli/generate.ts` + `EmitTypesUseCase` | Pure linked/plan projection and `bindMantle` | #668 |
+| Admin asset copy during generation | `packages/mantle/src/cli/generate.ts` | Removed; Admin install/composition owns assets | #668, #670 |
+| HTML/templates/public paths/Markdown/SEO/preview/`llms.txt`/sitemap | Runtime render services plus Cloudflare public routes | Optional `mantle-web` | #669 |
+| Public request mapping and cache policy | `mountPublicRoutes` | Platform adapter using selected Web projection | #669 |
+| Admin API/application/static assets | Optional `mantle-admin`; Cloudflare only binds auth/request context/assets | Optional `mantle-admin` + existing UI artifact | #670 |
+| View/HTTP Trigger route transport | Combined Cloudflare mounts | Platform adapters over the same Core descriptors | #669–#672 |
+| Bun SQLite/process lifecycle | `mantle-bun`; host owns server/database | `mantle-bun`; host owns server/database | #671 |
+| Vercel function/durable-storage lifecycle | `mantle-vercel`; host owns handler/client | `mantle-vercel`; host owns handler/client | #672 |
+| Legacy overloads, aliases, combined mounts, duplicate tests | Current public API plus temporary migration delegates | Deleted | #673 |
+| Contributor/agent/release guidance | `AGENTS.md`, `CLAUDE.md`, `CONTRIBUTING.md`, two release skill copies | One tool-neutral authority and one release skill | #674 |
+
+## Deletion evidence
+
+All baseline production callers now consume `ParsedManifestSet`,
+`LinkedManifestSet`, or `RuntimePlan` according to their pipeline stage.
+`scripts/check-boundaries.mjs` fails if the removed runtime facade, generated
+site API, raw parser facade, or combined Cloudflare route owner returns.
+Parser-focused tests may inspect parser output, but runtime and platform tests
+must compile and prepare the same sealed plan used by production.
+
+## Consumer manifest corpus
+
+The Core repository does not vendor every downstream manifest. That would
+create a second source of truth. The reusable golden fixture under
+`packages/mantle-spec/test/fixtures/pipeline-v0.1/` covers every shipped atom,
+auth/guard references, all Trigger surfaces, multi-document YAML, empty
+documents, aliases, unknown keys, malformed YAML, and deterministic
+diagnostics.
+
+Exact downstream sources and their gate authorities are pinned here. The public
+Starter runs in Core CI and release preflight. Private consumers run the same
+exact-tarball checker in their own repositories, so public Core PRs never
+receive cross-repository credentials:
+
+| Consumer | Revision | Gate authority | Manifest paths |
+|---|---|---|---|
+| `aotter/mantle-starters` | `157e8f49e1e25ae1c52c0115f0dd9e8b6017ef0e` | Core CI + release | `blank/manifests/site.yaml`; `overlays/{community,intake,presence,publication,reservation,transaction}/manifests/site.yaml`; `recipes/typed-web/manifests/site.yaml` |
+| `aotter/mantle-landing` | `4381354dd25d5d94f4096cf3e55a4cb9eecbf3ad` | Landing CI + Core release | `manifests/site.yaml` |
+| `aotter/mantle-platform` (Remote Mantle/control plane) | `3cc0d9ad6ee47b15f06c915c12f56fc4b9143f32` | Platform `exact-packed-core` | `manifests/platform.yaml` |
+| Core i18n fixture | this repository | Core CI | `packages/mantle-spec/test/fixtures/i18n-parent-child/manifests/site.yaml` |
+
+## Baseline gates
+
+The alpha.7 baseline was captured from tag `v0.1.0-alpha.7` on 2026-08-16
+with Node 22, pnpm 9, Wrangler local mode, and datasets of 100/10,000 rows:
+
+| Route | p95 queries | p95 rows read | local p95 timing |
+|---|---:|---:|---:|
+| public View, 10k rows | 1 | 20 | 3.01 ms |
+| public page miss, 10k rows | 2 | 5 | 3.92 ms |
+| Admin list, 10k rows | 1 | 21–22 | 2.49–3.24 ms |
+| Admin related detail, dense | 4 | 151 | 5.23 ms |
+| public builtin create | 1 | 0 | 2.55 ms |
+
+Wall-clock values are evidence, not a cross-machine budget. The normative
+baseline is the existing `pnpm bench:wrangler` query/row gate: every gate must
+remain true, unchanged revisions must perform no repeated preparation, and any
+intentional budget change needs its own reviewed evidence.
+
+Existing full-facade behavior is covered by Cloudflare authorization, Admin,
+public-route/cache, View REST, HTTP Trigger, media, form, and facade tests.
+Issues #669–#673 move those assertions to selected modules and exact packed
+consumers; they do not duplicate the suite under new names.
+
+Issue #674 leaves `CONTRIBUTING.md` plus accepted ADRs as the contributor
+authority. `AGENTS.md`, `CLAUDE.md`, and the Claude release-skill entry are
+small routers; `.agent/skills/mantle-release/SKILL.md` is the only maintainer
+release procedure. Shipped `skills/*` remain separate consumer artifacts.