@aotter/mantle 0.1.3 → 0.1.5-alpha.1

package/dist/cli/main.js

@@ -25,15 +25,16 @@ async function main() {
             return 2;
     }
 }
-export const MANTLE_OVERVIEW = `mantle — compile manifests into a RuntimePlan and typed binding
+export const MANTLE_OVERVIEW = `mantle — compile manifests and assemble selected application features
 
 Overview
-  Optional surfaces — take only what you need. Admin is opt-in. You can ship a
-  complete service with no Dev UI, no visitor frontend, and no extra packages.
+  New applications default to Spec, Runtime, API, MCP, Admin, and a blank Web
+  home. Pass --host cf or --host chatgpt-sites, or use --features for a smaller
+  positive selection. Existing authored applications keep compile-only mode.
 
-  Minimal — Spec + generate
-    validate + generate compile manifests into a sealed plan and typed binding.
-    Embed that binding in an existing host. No Admin, no visitor UI.
+  Host-free — Spec only
+    mantle generate --features spec compiles a sealed plan and typed binding
+    without Runtime, Admin, visitor UI, or a host.
 
   Runtime / adapter
     Bind Runtime through an adapter (Cloudflare Worker, Bun, Vercel, or yours).
@@ -41,10 +42,9 @@ Overview
     See docs/examples/host-minimal-worker or
     node_modules/@aotter/mantle/docs/examples/host-minimal-worker.
 
-  Opt-in — Admin / Dev UI
-    Add @aotter/mantle-admin and @aotter/mantle-admin-ui only when humans need
-    a console. Then re-run generate, bind wrangler ASSETS, and open
-    /admin/sign-in (local email OTP via ConsoleEmailSender).
+  Selected Admin / Dev UI
+    New full applications include the prebuilt UI. Reduced applications can
+    omit it; selected packages must be installed before generation completes.
     See docs/examples/host-local-admin-otp or
     node_modules/@aotter/mantle/docs/examples/host-local-admin-otp.
 
@@ -66,7 +66,7 @@ Documentation:
   Features:      node_modules/@aotter/mantle/docs/handbook/reference/features.md
   Admin UI:      node_modules/@aotter/mantle/docs/handbook/guides/admin-ui.md
   Online:        https://mantle.tools/
-  Install skill: npx skills add aotter/mantle --skill install
+  Install skill: npx skills add aotter/mantle
 `;
 main().then((code) => {
     process.exitCode = code;

package/dist/cli/skills.js

@@ -116,7 +116,7 @@ export function projectionScopes(skillMarkdown) {
 }
 async function skillSourceRoot() {
     const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
-    for (const candidate of [join(packageRoot, "skills"), resolve(packageRoot, "../../skills")]) {
+    for (const candidate of [join(packageRoot, "skills"), resolve(packageRoot, "../../docs/skills")]) {
         if ((await stat(candidate).catch(() => null))?.isDirectory())
             return candidate;
     }

package/dist/cli/skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/cli/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,CAAC,SAAS,EAAE,SAAS,CAAU,CAAC;AAElE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA0B;IACxD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;YAC3B,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC;YAClB,OAAO,EAAE;gBACP,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gBAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;aACtC;SACF,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACvF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7E,KAAK,MAAM,IAAI,IAAI,yBAAyB,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;gBAC7E,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACjE,IAAI,OAAO,KAAK,QAAQ;oBAAE,SAAS;gBACnC,KAAK,GAAG,IAAI,CAAC;gBACb,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,KAAK,CAAC,0BAA0B,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;oBACpE,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAChE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mHAAmH,CAAC,CAAC;QAC3L,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,kBAAkB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,CAAC,KAAK,CAAC;;;;;EAKb,yBAAyB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;;;;;;;;CAQvE,CAAC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IACnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChG,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,UAAU,gBAAgB,CAAC,aAAqB;IACpD,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,eAAe;IAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9E,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QAC5F,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,EAAE;YAAE,OAAO,SAAS,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/cli/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,CAAC,SAAS,EAAE,SAAS,CAAU,CAAC;AAElE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA0B;IACxD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;YAC3B,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC;YAClB,OAAO,EAAE;gBACP,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gBAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;aACtC;SACF,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACvF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7E,KAAK,MAAM,IAAI,IAAI,yBAAyB,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;gBAC7E,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACjE,IAAI,OAAO,KAAK,QAAQ;oBAAE,SAAS;gBACnC,KAAK,GAAG,IAAI,CAAC;gBACb,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,KAAK,CAAC,0BAA0B,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;oBACpE,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAChE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mHAAmH,CAAC,CAAC;QAC3L,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,kBAAkB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,CAAC,KAAK,CAAC;;;;;EAKb,yBAAyB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;;;;;;;;CAQvE,CAAC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IACnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChG,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,UAAU,gBAAgB,CAAC,aAAqB;IACpD,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,eAAe;IAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9E,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;QACjG,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,EAAE;YAAE,OAAO,SAAS,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/docs/adr/0001-four-atom-manifest-model.md

@@ -214,8 +214,9 @@ See § Authoring shape below for the full retirement rationale.
 Names + PG-1:1 framing are documented in this ADR and the manifest grammar
 reference. Manifest TS types live in `packages/mantle-spec/`. The external
 [`aotter/mantle-starters`](https://github.com/aotter/mantle-starters)
-repository declares consumer instances of each atom. Runtime dispatcher, View
-executor, and Procedure dispatcher live in this repository.
+repository declared alpha-era consumer instances of each atom; new applications
+are authored directly under [ADR-0021](0021-retire-starter-scaffolding.md).
+Runtime dispatcher, View executor, and Procedure dispatcher live in this repository.
 
 ---
 

package/docs/adr/0013-agent-provisioned-consumer-projects.md

@@ -2,8 +2,8 @@
 
 ## Status
 
-Superseded for first launch by provisioning v2 (2026-06-27). Historical
-record only.
+Superseded by [ADR-0021](0021-retire-starter-scaffolding.md) for 0.1.2 and
+later. Historical pre-stable install flow only.
 
 ## Date
 
@@ -11,7 +11,7 @@ record only.
 
 ## Context
 
-> **Current direction:** Mantle landing creates the GitHub repo from
+> **Historical 2026-06-27 direction, no longer current:** Mantle landing creates the GitHub repo from
 > `mantle-starters` `provision-bundles/<type>.json`, commits the blank
 > or type bundle, and connects Cloudflare Workers CI when possible.
 > Do not extend the old `create-mantle launch --session` or
@@ -144,7 +144,7 @@ they are debugging a failed provision.
 
 ## Implementation status
 
-- `skills/install/SKILL.md` and `skills/provision/SKILL.md` encode the
+- `skills/install/SKILL.md` and `docs/skills/provision/SKILL.md` encode the
   current agent workflow, including the launch-session fast path.
 - `aotter/mantle-starters` hosts `packages/create-mantle`, whose
   `launch --session` mode validates the session before writing files.

package/docs/adr/0016-site-semantic-layer.md

@@ -2,9 +2,10 @@
 
 ## Status
 
-Accepted (slimmed 2026-05-12 per Epic #116; `mantle/site.md` letter
-surface suspended 2026-06-19 and removed from first-run scaffolds;
-amended 2026-06-27 for landing provision bundles).
+Superseded by [ADR-0021](0021-retire-starter-scaffolding.md) for 0.1.2 and
+later. The launch-state and provision-bundle rules below describe the legacy
+Starter/Landing flow; new applications are authored directly from the installed
+SDK's skill and handbook.
 
 ## Decision
 
@@ -65,5 +66,5 @@ and to the landing substitution pass.
   generated `.mantle/*.template` bundle files.
 - Substitution: Mantle landing provision-bundle substitution.
 - Install handoff: `skills/install/SKILL.md` describes how agents continue from the landing-provisioned repo.
-- Provision update: `skills/provision/SKILL.md` describes the `AGENTS.md` public-site rewrite after deploy.
+- Provision update: `docs/skills/provision/SKILL.md` describes the `AGENTS.md` public-site rewrite after deploy.
 - Type overlays are applied while building `provision-bundles/<type>.json`; generated repos should not need a second overlay step.

package/docs/adr/0018-core-starters-repository-boundary.md

@@ -3,7 +3,7 @@
 > Superseded for 0.1.2 by [ADR-0021](0021-retire-starter-scaffolding.md).
 > The contract below is retained as alpha.17 history, not current launch/release guidance.
 
-**Status:** Accepted for now; revisit only under the triggers below
+**Status:** Superseded by ADR-0021 for 0.1.2 and later. Historical alpha.17 decision only.
 
 **Date:** 2026-08-02
 

package/docs/adr/0021-retire-starter-scaffolding.md

@@ -1,6 +1,6 @@
 # ADR-0021: Author applications directly; retire Starter scaffolding
 
-Status: Accepted by owner, 2026-09-08 (#786). Supersedes ADR-0018 for the 0.1.2 line.
+Status: Accepted by owner, 2026-09-08 (#786). Supersedes ADR-0018 for the 0.1.2 line. Its no-initialization clause is superseded by [ADR-0026](0026-progressive-generate.md) for 0.1.5.
 
 Core is an embeddable manifest engine. Applications own package manifests,
 Worker entries, provider configuration, business manifests and visitor UI.

package/docs/adr/0026-progressive-generate.md

@@ -0,0 +1,36 @@
+# ADR-0026: Progressive application generation
+
+**Status:** Accepted by owner for the 0.1.5 line (#1081–#1086). Supersedes the no-initialization clause of ADR-0021; direct authorship and optional package boundaries remain.
+
+Mantle is progressive. A new application defaults to Spec, Runtime, API, MCP, Admin, and an editable blank Web home so an agent does not forget the optional Admin composition. `--features` is a positive replacement list over `spec,runtime,api,mcp,admin,web`; dependencies are closed automatically. `spec` alone is host-free. The first generated hosts are `cf` and `chatgpt-sites`. Only host-dependent selections require `--host`; a TTY may prompt, while headless use must pass it explicitly.
+
+| Feature | Required features | Direct package additions |
+| --- | --- | --- |
+| `spec` | — | `@aotter/mantle`, `zod` peer |
+| `runtime` | `spec` | Host adapter; current CF adapter also brings Admin/Auth/Web transitively |
+| `api` | `runtime` | Host route composition and `hono` peer |
+| `mcp` | `runtime` | Host MCP route composition |
+| `admin` | `runtime,api,mcp` | `@aotter/mantle-admin`, `@aotter/mantle-admin-ui`; CF owner auth also uses `@aotter/mantle-auth` |
+| `web` | `runtime` | `@aotter/mantle-web` and a user-owned blank home |
+
+The host adapter's declared peers (`better-auth`, `hono`, `zod`, `aws4fetch`) are installed for host-dependent selections until its package dependency graph is split. A reduced selection still omits unselected routes and assets; it does not claim smaller transitive installation today.
+
+An application with only Git, installed skills, package metadata, a lockfile, README, and installed dependencies is new. Existing manifests or application code remain in direct-authoring compile mode. A saved `mantle.config.json` decides subsequent runs before that heuristic. V1 refuses host changes and feature-list changes after selection; application owners can make an explicit migration rather than have generation delete routes or data. An explicitly named missing manifest path is an error. A new default manifest directory may be absent or empty, yielding a valid empty plan without a fake business Schema.
+
+Generation preflights selection, manifest validity, package/script conflicts, file ownership, and symlink escapes before writing. It saves the selection and adds only absent package declarations and scripts; it does not run a package manager. Selected Mantle packages use the running CLI's exact version. Missing selected packages produce an incomplete, nonzero result and an explicit install-and-rerun instruction. `--check` never writes, installs, prompts, or provisions. Generated code and assets remain CLI-owned; the editable frontend, host config, identity, secrets, handlers, and historical migrations are application-owned. A later SDK upgrade does not overwrite them. Clean builds remove only copied output.
+
+Cloudflare currently has a facade with transitive Admin/Auth/Web dependencies and mounts OAuth/MCP unconditionally. Host generation must use a lower-level composition for reduced selections or change that facade; omitting dependencies from a manifest does not prove route omission. Cloudflare D1 remains runtime-managed. ChatGPT Sites uses reviewed, append-only managed migrations with applied-state checks (owned by #1086). Neither host generator provisions resources or deploys.
+
+This decision restores a convenient default while keeping the sealed Manifest-to-RuntimePlan pipeline and user-owned application source. It does not reintroduce a remote Starter catalog or a `mantle create` command.
+
+## 2026-09-25 amendment — existing application integration
+
+The original implementation added `--adopt` to convert an existing authored
+application into the generated-project layout. This amendment removes that
+mode. Applications with their own host shape continue direct authoring;
+integrating Mantle is guided by the version-matched `integrate` consumer skill.
+The agent may embed selected capabilities, replace one part at a time, or
+build a fresh Mantle application and migrate frontend and data. The CLI owns
+only deterministic generation and its declared checks; it does not certify
+arbitrary user-owned host wiring. A saved generated project still reruns from
+its own configuration, with file ownership and migration safeguards intact.

package/docs/adr/0027-scheduled-procedure-triggers.md

@@ -0,0 +1,31 @@
+# ADR-0027: Scheduled Procedure Triggers
+
+**Status:** Accepted for 0.1.5 (#1087). Revises the closed Trigger-source grammar from ADR-0001 and the host-only cron guidance of #322.
+
+**Date:** 2026-09-25
+
+## Context
+
+The earlier contract kept cron outside the Manifest graph. That forced an application Worker to invoke a Procedure by name with its own caller context, leaving scheduling invisible to validation and the compiled plan. A portable declaration is needed without pretending that every host can register a cron event.
+
+## Decision
+
+`Trigger.spec.source` gains `kind: schedule`, a five-field Cloudflare UTC `cron` (weekday 1=Sunday), and optional `enabled` (default true). It targets one Procedure whose input accepts `{}` and requires no user or staff authorization. The compiled plan carries Trigger identity, expression, target, enabled state, and the required `cloudflare` host. No HTTP route or user identity is granted.
+
+Cloudflare's `scheduled` entry finds enabled plan entries with the exact incoming expression and invokes them in Trigger-name order through the existing Procedure pipeline, continuing after individual failures and reporting them together. The system context has null user and staff, no credential, and `ctx.schedule` with stable `${trigger}:${scheduledTime}` identity. The application registers exact expressions with Wrangler. Cloudflare Cron Triggers do not document automatic retries; handlers still use the identity for possible duplicate/manual replay. Other hosts reject enabled schedules rather than silently omit them.
+
+## Consequences
+
+The grammar and sealed plan version advance. Applications must rerun `mantle generate` after upgrading. A Procedure needing staff authorization cannot run from a schedule. Cron provisioning, retries, retention and exactly-once execution remain host/operator responsibilities; the runtime does not claim them.
+
+## Alternatives
+
+Keeping host-only calls would preserve the old grammar but fail static validation and omit the feature from introspection. A general background-job framework would add storage and scheduling responsibilities without a second host implementation.
+
+## How to apply
+
+Declare a schedule Trigger, export `worker.scheduled`, and register its expression in `wrangler.jsonc`. Use `ctx.schedule.id` to deduplicate writes. See [Trigger reference](../handbook/reference/trigger.md#schedule-source).
+
+## Implementation status
+
+Implemented in the 0.1.5 scheduled Procedure PR, with parser, linker, compiler, runtime and Cloudflare adapter tests.

package/docs/adr/0028-schema-ttl-expiry.md

@@ -0,0 +1,33 @@
+# ADR-0028: Logical Schema TTL before explicit physical cleanup
+
+**Status:** Accepted for 0.1.5 (#1088).
+
+**Date:** 2026-09-25
+
+## Context
+
+An application needs a portable expiry rule across D1 and Bun SQLite. A cron-only delete task cannot guarantee that readers stop seeing expired data if it runs late or fails. Applying a new policy to a populated table must not silently bulk-delete rows.
+
+## Decision
+
+`Schema.spec.ttl` names one top-level date-time field and a nonnegative `expireAfterSeconds`. At `timestamp + duration <= now`, semantic reads exclude the row. Missing, null and unparseable legacy dates never expire. Declarative Views include the same predicate. Native SQL Views are rejected while any TTL Schema exists, and shared caching of a TTL View is rejected. The compiled plan and introspection expose the policy. Public Cloudflare pages derived from TTL collections use `no-store` rather than shared caching.
+
+SQLite storage implements an optional bounded `ExpirySweeper`. A sweep previews by default; `delete: true` is required for physical removal. It returns counts and a cursor, selects at most 100 expired IDs in stable order, and rechecks expiry in one bounded delete statement. A failed page can be retried with the previous cursor. Ref Procedures can call the semantic capability, including from a scheduled Trigger. No host automatically invokes it.
+
+Physical TTL removal does not fire before/after entry lifecycle hooks. Expiry already changed logical visibility; cleanup reclaims storage rather than representing an editorial deletion. Consumers needing business actions at expiry must implement them in an idempotent scheduled Procedure before calling the sweep.
+
+## Consequences
+
+Adding or shortening TTL changes read visibility immediately but never starts physical deletion. Owners preview counts and choose when to sweep; expired rows can still occupy unique indexes until removal. Other adapters must implement equivalent read filtering and a sweep or fail closed for TTL plans. The runtime does not promise an exact deletion time.
+
+## Alternatives
+
+Scheduler-driven deletion alone leaves a visibility gap. Implicit migration-time cleanup risks irreversible bulk deletion. Firing ordinary deletion hooks during storage reclamation would cause delayed, retry-sensitive business effects after the row was already logically gone.
+
+## How to apply
+
+Declare `ttl` on a Schema, use declarative Views, preview with `runtime.sweepExpired`, then explicitly request deletion page by page. See [Schema TTL](../handbook/reference/schema.md#ttl).
+
+## Implementation status
+
+Implemented in the 0.1.5 TTL PR for the SQLite family, with Bun and local D1 conformance checks.

package/docs/adr/README.md

@@ -14,17 +14,20 @@ Records of *why* mantle ended up shaped this way. The numbering preserves POC AD
 | [0010](0010-locale-and-translates.md) | Locale 3-layer (manifest / D1 site_config / data field) + translates pattern. Boot decoupled from `site_config` (issue #60 fix). | Accepted (refreshed) |
 | [0011](0011-adapter-port-spec.md) | Adapter port spec. Required runtime ports plus optional feature ports. | Accepted (new) |
 | [0012](0012-views-as-public-rest.md) | Views auto-expose matching REST and `query_view_*` MCP reads on their declared `public` or `staff` surface. Schemas never get a public REST endpoint. | Accepted + amended |
-| [0013](0013-agent-provisioned-consumer-projects.md) | Historical agent-provisioned consumer projects path. Superseded for first launch by landing provision bundles. | Superseded |
+| [0013](0013-agent-provisioned-consumer-projects.md) | Historical agent-provisioned consumer projects path. | Superseded by 0021 |
 | [0014](0014-auth-better-auth-and-multi-tenant-mcp.md) | The Cloudflare adapter owns one Better Auth 1.7 identity/OAuth/MCP authority with native method options and CIMD discovery. Verified callers are normalized into runtime context; mutable staff role and target authorization are re-evaluated per call. | Accepted + amended |
-| [0016](0016-site-semantic-layer.md) | Site semantic layer: `AGENTS.md` (cross-tool entry) + `.mantle/launch-state.json` (deterministic install context). The older `mantle/site.md` letter surface is suspended from first-run scaffolds. | Accepted (slimmed) |
+| [0016](0016-site-semantic-layer.md) | Historical Starter/Landing `AGENTS.md` and launch-state contract. | Superseded by 0021 |
 | [0017](0017-media-multi-variant-agent-side-optimization.md) | Multi-variant media assets with agent-side optimization and asset-id entry references. | Accepted |
 | [0018](0018-core-starters-repository-boundary.md) | Core produces published SDK artifacts; the separate starters repository validates them as an external consumer. Revisit after release-contract simplification. | Superseded by 0021 |
 | [0019](0019-sealed-manifest-runtime-pipeline.md) | One sealed source-to-runtime pipeline, semantic storage seam, and optional Web/Admin/platform dependency direction. | Accepted |
 | [0020](0020-builtin-handler-contracts-and-matched-upsert.md) | Static builtin handler contracts and natural-key matched upsert (`handler.match`). | Accepted + amended by 0022 |
-| [0021](0021-retire-starter-scaffolding.md) | Direct authoring; retire Starter scaffolding. | Accepted; supersedes 0018 |
+| [0021](0021-retire-starter-scaffolding.md) | Direct authoring; retire Starter scaffolding. | Accepted; no-initialization clause superseded by 0026 |
 | [0022](0022-caller-observed-version-occ.md) | Caller-observed `expectedVersion` for Admin bind and builtin upsert OCC. | Accepted |
 | [0024](0024-manifest-native-schema-tables.md) | Materialize each Schema as a native storage table and deploy reviewed migration artifacts. | Accepted; authored-native-name clauses superseded by 0025 |
 | [0025](0025-reserved-native-columns-and-published-only-public-views.md) | Reserve the six native column names, let `indexes` reference them, and compile public publishing Views published-only. | Accepted |
+| [0026](0026-progressive-generate.md) | Progressive `mantle generate` with a full default, positive features, saved host selection, and user-owned source. | Accepted; supersedes part of 0021 |
+| [0027](0027-scheduled-procedure-triggers.md) | Schedule Triggers in the sealed plan with Cloudflare-hosted invocation and system identity. | Accepted for 0.1.5 |
+| [0028](0028-schema-ttl-expiry.md) | Logical TTL on Schema reads with preview-first, explicit bounded cleanup. | Accepted for 0.1.5 |
 
 ## Reading order
 
@@ -36,7 +39,7 @@ If you're new to the codebase:
 4. **0007** — what running the SDK feels like as an AI author (and as the operator agent).
 5. **0011** — the boundary between the runtime and the adapter.
 6. **0010** — how locale flows through the system.
-7. **0021** — current direct-authoring boundary; **0013** is historical install-session context.
+7. **0026** — current progressive generation boundary; **0021** retains the direct-authoring history and **0013** is historical install-session context.
 8. **0002, 0008** — the two ADRs that touch every diagnostic and every binding.
 
 ## What's NOT here (and why)

package/docs/agent-prompts.md

@@ -1,101 +1,64 @@
 # Task-specific agent prompts
 
-Cold start from GitHub or a marketplace host is the install skill:
+First install the small bootstrap skill:
 
 ```sh
-npx skills add aotter/mantle --skill install
+npx skills add aotter/mantle
 ```
 
-Copy one block into a coding agent after that skill is present. Paths below
-are relative to the Mantle docs root: `node_modules/@aotter/mantle/docs/`
-after `@aotter/mantle` is installed. A standalone `skills add` installation
-contains only the selected skill, not these docs.
-`npx --no-install mantle --help` is the layered CLI overview; it mirrors the
-authoring docs. A live `/mcp` catalog mirrors the Manifest → RuntimePlan, not
-the CLI. Resolve only missing requirements first; do not assume a host. There is no `mantle create`. Empty `generate` fails until
-manifests exist. Admin is opt-in.
+The installed skill locates the target project, resolves its actual SDK
+version, and sends the agent to that package's CLI and docs. A GitHub skill
+may be newer than npm: published 0.1.4 uses the direct-authoring path;
+0.1.5-alpha.1 adds full generated projects. Never assume a new flag exists without
+checking the installed CLI.
 
-### Interview then build
+## New full Cloudflare app
 
 ```text
-Interview me about the service: host, who uses it, whether humans need a
-Dev UI, and whether we only embed Spec/Runtime. If the install skill is
-missing, run npx skills add aotter/mantle --skill install. Read the
-installer-reported skill, choose and install an exact SDK version, then read
-its embedded skills/install/SKILL.md, run npx --no-install mantle --help, and
-read handbook/start/overview.md.
-Use examples/README.md as the examples index; copy builtin-* Manifests only
-(not cf-primitives-*). Implement locally first. Take only the surfaces we
-chose. For Spec-only use, skip Runtime and code generation. For a Worker
-without Admin, follow examples/host-minimal-worker/. For a Worker with
-Dev UI, follow examples/host-local-admin-otp/README.md. ChatGPT Sites only
-if I name that host. No mantle create. Pin all @aotter/mantle* packages
-to one exact version.
+Build a Mantle app on Cloudflare. Follow the installed mantle skill, pin one
+exact stable SDK version, and use its project-generation path if supported.
+Select the full default Spec, Runtime, API, MCP, Admin and blank home. Install
+the CLI-declared dependencies and rerun generation. Ask for my actual data and
+workflow before adding Manifests. For local Admin, copy .dev.vars.example,
+set the real owner email and a random secret, and verify OTP, Admin assets,
+unauthorized access, public API and MCP. Do not claim production Auth is set
+up from a local OTP test.
 ```
 
-### Embed Runtime with typed APIs
+## Small API or Spec-only app
 
 ```text
-Read handbook/start/project-and-cli.md and npx --no-install mantle --help.
-Pin @aotter/mantle at the exact version we agree, author manifests for
-this existing host, then run mantle generate. Embed
-the typed binding from .mantle/generated/mantle.ts into the current
-system. Do not add Admin, mantle-admin-ui, a visitor frontend, or a
-Cloudflare adapter unless I ask. Do not invent a default Schema.
+Use the installed Mantle CLI and version-matched docs. For a Cloudflare API,
+select --host cf --features spec,api if that CLI supports project generation.
+For manifest parsing only, use --features spec without a host. Keep unselected
+Admin, Web and MCP packages out. Author the Schema and View I request, then
+run generate, validate, typecheck and a real route probe when a host exists.
+Preserve an existing direct-authored application instead of regenerating it.
 ```
 
-### Minimal API service locally
+## ChatGPT Sites
 
 ```text
-Read handbook/start/quickstart-worker.md and examples/host-minimal-worker/.
-Author a Cloudflare Worker from that official example or from scratch:
-one Schema, one public View (copy the contract, not the tree wholesale).
-Pin every @aotter/mantle* package to the same exact version. Run
-pnpm install && pnpm generate && pnpm dev (or wrangler dev --local).
-Probe GET /api/views/<name> with curl. GET / may 404. Do not install
-Admin or wrangler ASSETS unless I ask.
+Build with ChatGPT Sites and Mantle. Start from the installed SDK's generated
+blank app when supported; otherwise follow that version's Sites reference.
+Pin all selected Mantle packages exactly, install declared dependencies,
+review and apply the initial local D1 migration, then add my Manifests and
+review each appended migration. Configure OWNER_EMAIL and PUBLIC_ORIGIN. The
+local owner smoke simulates Sites identity; deployed ChatGPT sign-in needs a
+separate check. Show how I will maintain content through Admin, browser
+WebMCP, public MCP and Sites-session staff MCP. Add R2 only if my workflow
+requires uploads. Never deploy the Worker directly or claim remote staff OAuth
+MCP from a Sites browser session.
 ```
 
-### Full local Dev UI (opt-in)
+## Existing project with typed queries
 
 ```text
-I want the optional Admin / Dev UI. Read examples/host-local-admin-otp/README.md
-(the procedural SSOT) and the thin pointer at handbook/start/quickstart-admin.md.
-Interview me for a bootstrap owner email, then follow that example locally.
-Prefer 127.0.0.1 over localhost. After pnpm check / smoke, restore .dev.vars
-from .dev.vars.example before pnpm dev.
+Read this project's package.json, lockfile, installed Mantle package and
+projected develop skill. Keep its host and selected surfaces. Use the installed
+CLI's help and handbook to add the requested Schema/View/Procedure, then run
+its generate/check, validation, TypeScript and host smoke. Do not use another
+checkout's SDK docs or overwrite user-owned files.
 ```
 
-### Later layer: MCP or public web (opt-in)
-
-```text
-Do not add Admin unless it is already in this project. Read
-handbook/concepts/mcp-and-agents.md and/or
-handbook/cloudflare/public-web.md. Add only the surface I name: MCP
-Triggers at /mcp or /mcp/staff, or optional @aotter/mantle-web
-composition. Keep Core adapter-neutral. Probe the new route; do not
-claim Auth or Admin works from a public 200.
-```
-
-### Mantle on ChatGPT Sites, including media
-
-Use only when the user names ChatGPT Sites as the host.
-
-```text
-Build with ChatGPT Sites; use Mantle for content management and publishing.
-Read handbook/sites/index.md and examples/host-chatgpt-sites/README.md.
-Use that runnable host as a reference and install its pinned
-dependencies from the registry. Derive Schema, View,
-Procedure and Trigger from my requirements and check the Admin editor/picker and public
-projections against them. Request both Sites D1 and R2 when my workflow
-includes uploads. Bind the R2 media port, declare media.purposes, and keep
-the same-origin PUT and committed-only public GET checks. Pin every
-@aotter/mantle* dependency to one exact version. Run the local smoke,
-show a draft-to-publish walkthrough, then save and deploy through Sites when
-requested. Verify the deployed owner/member role, R2 upload, published page, and anonymous draft 404. Treat public read-only
-MCP, Admin WebMCP, and staff OAuth MCP as separate acceptance gates; never
-claim staff MCP from a working browser session or connector URL alone.
-```
-
-
-[Back to the Core README](../README.md#for-engineers-and-agents).
+[Back to the Core README](../README.md).

package/docs/examples/README.md

@@ -19,4 +19,4 @@ Drop a `builtin-*` YAML block into `host-local-admin-otp/manifests/` (or `host-m
 | [`cf-primitives-guarded-api.md`](./cf-primitives-guarded-api.md) | API keys, scopes, live entitlement `ref` guards over REST and MCP | cf-primitives | no | none | `host-minimal-worker` plus credential resolver |
 | [`host-minimal-worker/`](./host-minimal-worker/README.md) | Executable Spec + adapter without Admin | host | no | none | itself |
 | [`host-local-admin-otp/`](./host-local-admin-otp/README.md) | Executable opt-in Admin / Dev UI with email OTP | host | no | required | itself |
-| [Mantle on ChatGPT Sites](../handbook/sites/index.md) · [runnable reference](./host-chatgpt-sites/README.md) | Runnable Sites D1/R2, ChatGPT identity, Admin media, published web and public read-only MCP | host | no | required | itself |
+| [Mantle on ChatGPT Sites](../handbook/chatgpt-sites/index.md) · [runnable reference](./host-chatgpt-sites/README.md) | Runnable Sites D1/R2, ChatGPT identity, Admin media, published web and public read-only MCP | host | no | required | itself |

package/docs/examples/host-chatgpt-sites/README.md

@@ -1,8 +1,8 @@
 # Mantle on ChatGPT Sites: runnable reference
 
-The runnable application for [Mantle on ChatGPT Sites](../../handbook/sites/index.md) connects Sites D1 + R2 bindings, Sign in with ChatGPT identity, Mantle Admin and staff roles, same-origin media upload, a published-only article frontend, anonymous read-only `/api/mcp`, and Sites-session staff tools at `/api/mcp/staff`. Remote OAuth MCP remains a separate integration; see [MCP support](../../handbook/sites/host-reference.md#remote-mcp-is-a-separate-gate).
+The runnable application for [Mantle on ChatGPT Sites](../../handbook/chatgpt-sites/index.md) connects Sites D1 + R2 bindings, Sign in with ChatGPT identity, Mantle Admin and staff roles, same-origin media upload, a published-only article frontend, anonymous read-only `/api/mcp`, and Sites-session staff tools at `/api/mcp/staff`. Remote OAuth MCP remains a separate integration; see [MCP support](../../handbook/chatgpt-sites/host-reference.md#remote-mcp-is-a-separate-gate).
 
-After setup, follow [Publish your first article](../../handbook/sites/index.md#publish-your-first-article) to verify the editorial workflow in Admin.
+After setup, follow [Publish your first article](../../handbook/chatgpt-sites/index.md#publish-your-first-article) to verify the editorial workflow in Admin, then [maintain content with an agent](../../handbook/chatgpt-sites/index.md#maintain-content-with-an-agent). Article pages advertise their Markdown mirror through an HTML `rel="alternate"` link; the example does not add a visible Markdown button to the reader UI.
 
 ## Before writing code
 
@@ -10,7 +10,7 @@ Read the user's business request and author the manifest for **their** records a
 
 ## Install and run
 
-Requires Mantle 0.1.2 or newer. Copy this directory outside the SDK checkout, then:
+Requires Mantle 0.1.2 or newer. Copy this directory from the selected installed SDK version into a new application directory. Replace every `@aotter/mantle*` `latest` dependency in `package.json` with that same exact version, then:
 
 ```bash
 npm install                                  # or: bun install
@@ -21,24 +21,41 @@ npm run dev -- --port 4174                   # leave running
 npm test                                     # smoke, in a second terminal
 ```
 
-`npm install` resolves `@aotter/mantle*` from the `latest` dist-tag; this
-example does not commit a lockfile, so every fresh install picks up the
-current stable release. `bun install` works too, resolving from
-`package.json` the same way.
+This example does not commit a lockfile. Commit the lockfile created by your
+first install and use `npm ci` for subsequent installs. `bun install` also
+works when you use Bun's lockfile consistently.
+
+## Add a manifest HTTP Trigger
+
+Mounting Admin does not register a manifest HTTP Trigger on the Site's Hono
+router. For an anonymous JSON form whose Trigger declares `POST /api/rsvp`, add
+the corresponding route inside `assemble` in `src/index.ts`:
+
+```ts
+import { createMantleRequestHandler } from '@aotter/mantle/runtime';
+
+const handleHttp = createMantleRequestHandler({ plan, getRuntime: get });
+app.post('/api/rsvp', async c =>
+  (await handleHttp(c.req.raw, { user: null, staff: null, env: c.env }))
+    ?? new Response('Not found', { status: 404 }));
+```
+
+Return the handler's `Response` directly: it validates the JSON body and maps
+Mantle diagnostics to HTTP status codes. If the Trigger requires a signed-in
+user or staff role, derive that context from the verified Sites session instead
+of copying the anonymous context above. See [Procedures and Triggers](../../handbook/concepts/procedures-and-triggers.md#the-http-envelope).
 
 Keep `.openai/hosting.json`; do not copy an existing Site's `project_id`. To use another port, also set the Worker's `PUBLIC_ORIGIN` and the test's `MANTLE_TEST_ORIGIN` to that same localhost origin. Local test headers simulate Sites' trusted dispatcher; they do **not** prove deployed ChatGPT login.
 
 Review the entire [smoke script](./scripts/check.mjs) before adapting it. It covers D1 CRUD/version conflict, owner/member/role revocation, R2 read/write/delete, media create → PUT → commit → public read, both advertised MCP URLs, public MCP `initialize`/`tools/list`/View call, staff MCP authentication/catalog, draft isolation, published article HTML/Markdown/SEO, and negative auth/Origin/size checks. It creates and deletes only its own test records and objects.
 
-To run this example against an unreleased Mantle checkout instead of the registry, use `node scripts/check-packed-consumer.mjs --project docs/examples/host-chatgpt-sites --output <new dir> -- pnpm build` from a clean SDK checkout and work in its `consumer/`. That path is for SDK development only.
-
-The checked-in `drizzle/` migrations and `src/storage-fingerprint.json` match the example manifest. `scripts/migration.mjs` shows the one-time generation mechanism; do **not** run it against a deployed database or overwrite an applied migration. For a new business manifest, generate/review an initial migration before the first deployment; for a later change, generate an additive migration from the previous schema state.
+The checked-in `drizzle/` migrations and `src/storage-fingerprint.json` match the example manifest and runtime. Apply all pending D1 migrations before deploying updated code; managed storage refuses to boot against an older database. After changing a Schema, first apply the current migrations to local D1, then run `npm run generate` and `npm run migrate:generate`. Review the newly appended SQL and apply it with `wrangler d1 migrations apply mantle-sites-reference-local --local`. Commit the new migration, `drizzle/meta/mantle-state.json`, journal, and fingerprint together. The generator checks the local database fingerprint before appending; it never changes an applied SQL file or applies D1 migrations itself. Deploy the reviewed migration before deploying code that expects its fingerprint.
 
 ## Publish with Sites
 
 1. Create a new Site through Sites and request **both D1 and R2**. Confirm its saved hosting manifest has `d1: "DB"` and `r2: "MEDIA_BUCKET"`; the local example intentionally omits `project_id` until Sites provisions one. A missing R2 binding cannot be repaired by adding an R2 type to TypeScript. Sites controls provisioning and publishing, not `wrangler deploy`.
 2. In Sites settings, set `PUBLIC_ORIGIN` to the exact production origin and `OWNER_EMAIL` to the intended first owner. Do not commit hosted secrets or identity headers. Keep the Site audience narrow until verification. A Site Viewer is not automatically a Mantle staff member.
-3. Review the D1 migration, save a Sites version, then deploy that version. Every deployment URL is production. Confirm the deployed artifact includes `dist/server/index.js`, `dist/client/`, `dist/.openai/hosting.json` and `dist/.openai/drizzle/`; `npm run build` prepares those artifacts.
+3. Review the D1 migration, save a Sites version, then deploy that version. Every deployment URL is production. Confirm the deployed artifact includes `dist/server/index.js`, `dist/client/`, `dist/.openai/hosting.json` and `dist/.openai/drizzle/`; `npm run build` replaces `dist` before preparing those artifacts, so removed migrations cannot remain in a later build.
 4. On the deployed Site, check `/health`, `/admin/sign-in`, one `/_mantle/admin/assets/*` file, owner login and staff revocation, Admin media upload and committed public image URL, then publish an article with that asset as its cover. Anonymous draft and uncommitted image URLs must return 404. Check public HTML, Markdown, canonical/JSON-LD, sitemap and `llms.txt`; POST `/api/mcp` should discover only the public View tool, while `/api/mcp/staff` must reject anonymous/member requests and expose staff tools to a current staff session. The root `/mcp` path was intercepted in the lab and is not used by this reference.
 
 The media path uses only the R2 binding: `ports.mediaStorage` + `media.purposes` + authenticated same-origin PUT + committed-only public GET. It does not need an R2 S3 endpoint or API keys. The upload route is browser-session authenticated, so it is **not** an MCP agent upload route. Do not expose the Worker outside Sites' identity-stripping ingress: `src/chatgpt-auth.ts` trusts the `oai-*` headers only under that condition.
@@ -50,4 +67,4 @@ The media path uses only the R2 binding: `ports.mediaStorage` + `media.purposes`
 - `/api/mcp/staff` uses the Sites-injected browser identity and re-reads the Mantle staff role. It is mounted and advertised in Admin, but it is not an OAuth resource server. Do not register it as a remote ChatGPT connector until OAuth discovery, a standards-compliant bearer challenge and token verification are implemented and tested.
 - OAuth discovery returns sign-in HTML: Sites' page session is not an OAuth bearer challenge. Do not bypass Sites auth or trust browser cookies as remote MCP credentials.
 
-See the [Sites host reference](../../handbook/sites/host-reference.md) and [OpenAI Sites documentation](https://learn.chatgpt.com/docs/sites).
+See the [Sites host reference](../../handbook/chatgpt-sites/host-reference.md) and [OpenAI Sites documentation](https://learn.chatgpt.com/docs/sites).

package/docs/examples/host-chatgpt-sites/drizzle/0003_store_instance_id.sql

@@ -0,0 +1 @@
+ALTER TABLE _mantle_boot_state ADD COLUMN store_instance_id TEXT;

package/docs/examples/host-chatgpt-sites/drizzle/0004_mantle.sql

@@ -0,0 +1,10 @@
+CREATE TABLE IF NOT EXISTS _mantle_managed_runtime_state (
+  id INTEGER PRIMARY KEY CHECK (id = 1),
+  canonical_version TEXT NOT NULL
+);
+--> statement-breakpoint
+INSERT INTO _mantle_schema_tables(name,projection) VALUES ('articles','{"columns":[["body","TEXT","string",false],["coverAssetId","TEXT","string",false],["summary","TEXT","string",false],["title","TEXT","string",false]],"indexes":[]}') ON CONFLICT(name) DO UPDATE SET projection=excluded.projection;
+--> statement-breakpoint
+INSERT INTO _mantle_managed_runtime_state(id,canonical_version) VALUES (1,'0006-managed-runtime-version') ON CONFLICT(id) DO UPDATE SET canonical_version=excluded.canonical_version;
+--> statement-breakpoint
+INSERT INTO _mantle_storage_state(id,fingerprint) VALUES (1,(SELECT CASE WHEN fingerprint='9ef85f9933e22328140e924045820af6be2a6985ed8ecc19b63a4f2a37826618' THEN '9ef85f9933e22328140e924045820af6be2a6985ed8ecc19b63a4f2a37826618' ELSE NULL END FROM _mantle_storage_state WHERE id=1)) ON CONFLICT(id) DO UPDATE SET fingerprint=excluded.fingerprint;

package/docs/examples/host-chatgpt-sites/drizzle/0005_mantle.sql

@@ -0,0 +1,24 @@
+CREATE TABLE IF NOT EXISTS _mantle_schedule_runs (
+      run_id TEXT NOT NULL,
+      attempt INTEGER NOT NULL,
+      schedule_id TEXT NOT NULL,
+      scheduled_at INTEGER NOT NULL,
+      started_at INTEGER NOT NULL,
+      finished_at INTEGER,
+      status TEXT NOT NULL,
+      error_summary TEXT,
+      counts TEXT,
+      PRIMARY KEY (run_id, attempt)
+    );
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS _mantle_schedule_runs_recent
+      ON _mantle_schedule_runs (started_at DESC);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS _mantle_schedule_runs_schedule_recent
+      ON _mantle_schedule_runs (schedule_id, started_at DESC);
+--> statement-breakpoint
+INSERT INTO _mantle_schema_tables(name,projection) VALUES ('articles','{"columns":[["body","TEXT","string",false],["coverAssetId","TEXT","string",false],["summary","TEXT","string",false],["title","TEXT","string",false]],"indexes":[]}') ON CONFLICT(name) DO UPDATE SET projection=excluded.projection;
+--> statement-breakpoint
+INSERT INTO _mantle_managed_runtime_state(id,canonical_version) VALUES (1,(SELECT CASE WHEN canonical_version='0006-managed-runtime-version' THEN '0007-schedule-run-observations' ELSE NULL END FROM _mantle_managed_runtime_state WHERE id=1)) ON CONFLICT(id) DO UPDATE SET canonical_version=excluded.canonical_version;
+--> statement-breakpoint
+INSERT INTO _mantle_storage_state(id,fingerprint) VALUES (1,(SELECT CASE WHEN fingerprint='9ef85f9933e22328140e924045820af6be2a6985ed8ecc19b63a4f2a37826618' THEN '9ef85f9933e22328140e924045820af6be2a6985ed8ecc19b63a4f2a37826618' ELSE NULL END FROM _mantle_storage_state WHERE id=1)) ON CONFLICT(id) DO UPDATE SET fingerprint=excluded.fingerprint;

package/docs/examples/host-chatgpt-sites/drizzle/meta/_journal.json

@@ -1 +1 @@
-{"version":"7","dialect":"sqlite","entries":[{"idx":0,"version":"6","when":1790000000000,"tag":"0000_sites_users","breakpoints":true},{"idx":1,"version":"6","when":1790000000001,"tag":"0001_mantle","breakpoints":true},{"idx":2,"version":"6","when":1790000000002,"tag":"0002_article_cover","breakpoints":true}]}
+{"version":"7","dialect":"sqlite","entries":[{"idx":0,"version":"6","when":1790000000000,"tag":"0000_sites_users","breakpoints":true},{"idx":1,"version":"6","when":1790000000001,"tag":"0001_mantle","breakpoints":true},{"idx":2,"version":"6","when":1790000000002,"tag":"0002_article_cover","breakpoints":true},{"idx":3,"version":"6","when":1790000000003,"tag":"0003_store_instance_id","breakpoints":true},{"idx":4,"version":"6","when":1790000000004,"tag":"0004_mantle","breakpoints":true},{"idx":5,"version":"6","when":1790300000000,"tag":"0005_mantle","breakpoints":true}]}