@cassiomc1/forgeloop 2.0.0-rc.4 → 2.0.0

package/ENG/taste-frontend-eng.md

@@ -3,7 +3,7 @@ name: taste-frontend-eng
 language: en
 description: "Contextual visual-taste review for premium frontend and brand-heavy work."
 version: "2026.09"
-last-reviewed: "2026-08-17"
+last-reviewed: "2026-10-16"
 guide-id: taste
 ---
 
@@ -20,6 +20,25 @@ approach. ForgeLoop keeps the useful review vocabulary while applying its own
 protocol boundaries: user evidence, accessibility, performance, security, and
 the active product constraints have priority over aesthetic preference.
 
+## Upstream Baseline and Intentional Differences
+
+Reviewed baseline: [Taste Skill v2.0.0](https://github.com/Leonxlnx/taste-skill/tree/v2.0.0/skills/taste-skill),
+released 2026-10-13 and reviewed for this adaptation on 2026-10-16. See the
+[versioned instructions](https://github.com/Leonxlnx/taste-skill/blob/v2.0.0/skills/taste-skill/SKILL.md)
+and [changelog](https://github.com/Leonxlnx/taste-skill/blob/v2.0.0/CHANGELOG.md).
+This identifies the upstream reference, not full feature parity or automatic
+synchronization. The guide's frontmatter version follows ForgeLoop's guide
+versioning separately.
+
+ForgeLoop adapts the content inventory, subject-specific concept, and screenshot
+correction practices. It deliberately keeps direction selection contextual
+rather than requiring a scripted draw. It does not adopt universal bans on
+colors, gradients, borders, fonts, or headline line counts, or minimum image
+and animated-element counts. Existing brand constraints, language expansion,
+content needs, reduced motion, accessibility, and performance determine those
+choices. An aesthetic preference never becomes lifecycle or completion
+authority.
+
 ## Design Read
 
 Before editing, describe the existing or proposed system in observable terms:
@@ -35,6 +54,39 @@ Before editing, describe the existing or proposed system in observable terms:
 Separate observed evidence from inference. If the implementation is not yet
 available, record the read as a hypothesis and keep it reversible.
 
+## Client Content Inventory
+
+Collect a small, source-backed inventory before choosing a visual direction:
+
+- the client's actual product, audience, vocabulary, location, materials, and
+  distinguishing constraints, where relevant and supported;
+- available product views, photographs, illustrations, documents, and brand
+  assets, with their source and permitted use;
+- the content each requested section must deliver and the evidence supporting
+  its claims;
+- missing content, representative examples, and facts requiring confirmation.
+
+Reuse the inventory from the premium website brief when it exists. Do not
+invent a differentiator, price, metric, testimonial, customer, or asset to make
+the direction work. Label representative content and keep unsupported proof
+out of release claims. For each section, connect the visitor's question, the
+proposed claim, and its supporting source before committing to a layout.
+
+## Visual Concept
+
+Write one sentence connecting an evidenced client detail to a concrete visual
+decision and the visitor's goal. For example, an existing product workflow can
+organize the page's composition and sequence. Explain how that decision
+extends beyond the hero into supporting sections and narrow layouts.
+
+Check whether the sentence would fit a nearby competitor unchanged. If it
+would, refine it using the inventory rather than inventing a distinction.
+Keep an established brand or design system when appropriate. Add a distinctive
+interaction only when it serves the authorized scope and has an accessible
+fallback; a new interaction is not required merely to make the page unusual.
+Record reversible choices in the existing design artifact or contract
+assumptions, following the normal decision policy.
+
 ## Design Dials
 
 Use three lightweight dials to make an intentional decision rather than a
@@ -130,6 +182,61 @@ If visual evidence is unavailable, record `NOT_VERIFIED` or a bounded
 limitation. Never turn an imagined screenshot or an unrun browser check into
 an observed result.
 
+## Screenshot Review
+
+Use an already available, authorized browser to capture and inspect the real
+page. A useful starting set is 1440, 768, and 390 CSS pixels wide; adapt it to
+the supported device matrix and include required reflow, zoom, and interaction
+checks. These widths do not replace accessibility requirements.
+
+1. Record the tested URL or build, browser, viewport dimensions, relevant
+   state, and screenshot references in the task's evidence.
+2. Inspect each capture for hierarchy, content completeness, concept continuity,
+   typography, contrast, crops, overflow, and obscured or missing content.
+   Check interactive behavior separately; a screenshot alone cannot establish
+   keyboard access, form behavior, or runtime performance.
+3. Identify up to three actionable problems with their location, visible
+   evidence, and user impact. Prioritize required acceptance criteria over
+   stylistic preferences.
+4. Correct the scoped issues through the existing ForgeLoop diagnosis and
+   correction loop when verification fails. Re-run affected checks, capture
+   the changed states, and inspect them again.
+
+Use at most three review rounds by default, within the task contract's limits.
+Stop earlier when the applicable criteria are satisfied. The round limit does
+not waive a failure: report unresolved issues and their verification status,
+then follow the canonical next action or blocker. Do not fabricate aesthetic
+scores or claim browser, inspector, or screenshot evidence that was not
+actually obtained. This procedure adds no separate approval gate.
+
+## Optional Upstream Tools
+
+The upstream v2 scripts, direction library, and reference collection are not
+bundled with this guide or required by ForgeLoop runtime:
+
+| Upstream tool | Optional purpose |
+| --- | --- |
+| `scripts/draw.mjs` | Propose directions and composition blueprints |
+| `scripts/lint.mjs` | Review source against upstream style patterns |
+| `scripts/inspect.mjs` | Measure a page in a browser and capture screenshots |
+| `scripts/assets.mjs` | Find external media and record source and credit information |
+
+Use a separately available, reviewed copy only when appropriate and authorized;
+do not install, fetch, or execute it automatically. The reviewed inspector
+requires Node 22+ and an installed Chrome, Edge, or Chromium; the other scripts
+require Node 18+, and media discovery requires network access. Check the
+selected copy's requirements and output paths before use. Upstream tools may
+write project artifacts and user-level history outside ForgeLoop's evidence
+store; those files do not become attested evidence merely by existing.
+
+Prefer an available equivalent when it supports the same task checks. Treat
+upstream style findings as contextual recommendations, not new ForgeLoop gates.
+For external media, confirm the exact asset's license, attribution, and
+relevance; search results alone do not establish reuse rights. Identify found
+or generated imagery honestly rather than presenting it as the client's own.
+Record the tool version and checks actually run, and mark unavailable required
+evidence `NOT_VERIFIED` without claiming upstream tool coverage.
+
 ## Redesign Audit
 
 For an existing interface, scan first and classify each issue as hierarchy,

package/ENG/test-code-eng.md

@@ -3,7 +3,7 @@ name: test-code-eng
 language: en
 description: "Risk-based testing strategy and tools for modern languages and platforms."
 version: "2026.09"
-last-reviewed: "2026-08-10"
+last-reviewed: "2026-10-17"
 guide-id: test
 completion-evidence:
   - tests
@@ -15,7 +15,7 @@ completion-evidence:
 
 **Related documents**: for general clean code principles (names, small functions, formatting), see [`clean-code-eng.md`](./clean-code-eng.md). For security, including SAST/DAST, see [`sec-code-eng.md`](./sec-code-eng.md). For accessibility, use the repository's specific guide together with [WCAG 2.2](https://www.w3.org/TR/WCAG22/). For HTML video and motion, see [HyperFrames](https://hyperframes.heygen.com). This file is the canonical reference for deciding the testing strategy by language and platform.
 
-**Tooling policy**: identify the stack, the stage, and the applicable checks; prefer an already available equivalent that produces compatible evidence. Ask for authorization before installing a tool or changing the environment. If no safe equivalent exists, record the required check as blocked and never claim that it passed. Do not install merely optional resources.
+**Tooling policy**: identify the stack, the stage, and the applicable checks; prefer an already available equivalent that produces compatible evidence. Installation or environment changes require authority; reuse scoped authorization already given rather than asking again. If no safe equivalent exists, record the required check as blocked and never claim that it passed. Do not install merely optional resources.
 
 ## Start with risk, not a tool
 

package/GUIDE_ROUTER.md

@@ -73,6 +73,10 @@ structural detection and route tests are implemented.
 
 ## Domain rules
 
+For catalog upkeep, use the [engineering guide maintenance map](https://github.com/cassiomc1/forgeloop/blob/b9a16e9f665116306e9fca3b905b1f0fe2abd633/docs/GUIDE_MAINTENANCE.md).
+It distinguishes guide discovery, implemented routing, contextual defaults,
+and observed verification; it does not add runtime routing rules.
+
 ### `clean` — code and structure
 
 **Activate when:** creating or modifying code, fixing a bug, refactoring, changing architecture, reviewing quality, or producing development instructions.
@@ -117,6 +121,12 @@ rg -n '^## |authentication|authorization|upload|SSRF|CSP|OAuth|JWT|secrets|suppl
 
 **Expected evidence:** explicit trust boundaries, server-side validation, least privilege, no secrets in Git, and negative tests.
 
+For requested source audits or focused vulnerability investigations, consult
+the optional bundled Cloudflare `security-audit` companion described by the
+security guide. Ordinary security routing does not start a full audit or
+require the companion. Its reports remain advisory; canonical security gates
+and verification remain unchanged.
+
 ### `performance` — measurable cost
 
 **Activate when:** the request involves latency, scale, a critical path, rendering, bundles, databases, networking, memory, battery, load, Web Vitals, FPS, or a budget.
@@ -188,12 +198,16 @@ require GSAP or a static-site approach, prescribe fonts/layouts, or override
 accessibility, performance, security, or product evidence.
 
 ```bash
-rg -n '^## (Design Read|Design Dials|Anti-Slop Checks|Typography Quality|Layout Composition|Motion Restraint|Responsive Composition|Design-System Selection|Visual Pre-Flight|Redesign Audit)' ENG/taste-frontend-eng.md
+rg -n '^## (Upstream Baseline and Intentional Differences|Design Read|Client Content Inventory|Visual Concept|Design Dials|Anti-Slop Checks|Typography Quality|Layout Composition|Motion Restraint|Responsive Composition|Design-System Selection|Visual Pre-Flight|Screenshot Review|Optional Upstream Tools|Redesign Audit)' ENG/taste-frontend-eng.md
 ```
 
-**Expected evidence:** a contextual design read, intentional dials, bounded
-anti-slop review, and only the visual/accessibility/performance checks that are
-in scope. Mark unavailable visual evidence `NOT_VERIFIED`.
+**Expected evidence:** a source-backed client inventory, contextual design read,
+visual concept, intentional dials, bounded anti-slop review, and screenshot
+review with up to three correction rounds within the task contract. Run only
+the visual/accessibility/performance checks in scope and retain unresolved
+failures. Upstream scripts remain optional and unbundled; see the guide's
+versioned baseline and intentional differences. Mark unavailable visual
+evidence `NOT_VERIFIED`.
 
 ### `games` — web game architecture and operation
 

package/README.md

@@ -74,12 +74,13 @@ Routing uses bounded structural evidence; SQL remains a schema/query/migration
 overlay. Extensions, tool files, lockfiles, runtime images, and prose alone do
 not establish project identity. Public project evidence remains v1.
 
+See the [23-guide maintenance map](./docs/GUIDE_MAINTENANCE.md) for review scope and revalidation.
+
 ## Distribution and license
 
 GitHub hosts source and issues. The core npm package is publicly available;
-the MCP companion retains restricted distribution. The owner-selected default
-`latest` channel targets `2.0.0-rc.2`, which remains a release candidate with
-incomplete stable SQLite acceptance.
+the MCP companion retains restricted distribution. Stable `2.0.0` targets
+`latest`; publication requires verified release identity and native user audits.
 ForgeLoop-owned source and documentation are licensed under the
 [PolyForm Noncommercial License 1.0.0](./LICENSE). Commercial use is not granted
 by this license. Third-party notices are documented in
@@ -89,7 +90,7 @@ by this license. Third-party notices are documented in
 
 ### Installation
 
-After your organization grants access, configure npm authentication and install:
+Install the public core package from npm; no organization access is required:
 
 ```bash
 npm install --global @cassiomc1/forgeloop
@@ -204,7 +205,7 @@ forgeloop protocol-info --json
 | Validate completion | Yes | Provides real work and evidence |
 | Schedule agents or LLM inference | No | External to the protocol |
 
-From the privately delivered package, initialize a target project with:
+Initialize a target project using the public npm package:
 
 ```bash
 npx @cassiomc1/forgeloop init
@@ -247,7 +248,7 @@ host-reported or `UNKNOWN`; values are never estimated.
 capability, but advisory recall remains Integration API only. The stock CLI
 does not auto-recall providers and does not expose a `context-recall` command.
 
-Validate the source checkout offline before any private release:
+Validate the source checkout before preparing a release:
 
 ```bash
 node src/cli.js init
@@ -496,18 +497,20 @@ CI audits each supplied task receipt explicitly. With no receipt it reports
 completion or attestation. For contributor checks and safe payload retention,
 see [CONTRIBUTING.md](./CONTRIBUTING.md#focused-verification-and-maintenance).
 
+## ForgeLoopAudit workspace
+
+The read-only auditor lives in `ForgeLoopAudit/`; see its
+[setup, demo and screenshots](./docs/FORGELOOP_AUDIT.md).
+
 ## Protocol compatibility
 
-The npm package version is independent of protocol version. The current
-serializable artifact contract is `schemaVersion: 1` and `protocolVersion: 1`.
+The npm package version is independent of protocol version. Artifacts use
+`schemaVersion: 1` and `protocolVersion: 1`.
 
-- Patch releases preserve the v1 schemas, enums, transitions, and existing
-  command contracts while correcting implementation defects.
-- Minor releases preserve existing v1 artifacts and commands; they may add
-  documentation, commands, guides, or an explicitly named schema.
+- Patch releases preserve the v1 schemas and existing command contracts.
+- Minor releases preserve existing v1 artifacts; additions remain compatible.
 - Major releases may change required fields, enums, transitions, or safety
-  semantics and must document migration requirements with a protocol version
-  change.
+  semantics, requiring a new protocol version and documented migration.
 
 Consumers must reject unknown artifact fields rather than silently treating
 unrecognized protocol data as valid. The compatibility marker is
@@ -520,6 +523,10 @@ it must not infer current ownership from `task.json` or `recovery.json` alone.
 
 ## Security and dependency boundary
 
+Optional [security audits](./docs/SECURITY_AUDIT_SKILL.md) and
+[product design](./docs/REVENUE_CENTRIC_DESIGN.md) ship with pinned attribution,
+integrity checks and their respective licenses; guidance remains advisory.
+
 Runtime uses Node built-ins and the approved exact `@typesafe-ai/sdk` and
 `smol-toml` dependencies; it installs no agents, providers, plugins, services,
 or telemetry. Paths, symlinks, JSON,
@@ -616,17 +623,15 @@ docs/diagrams/          typed Archify diagram source and inventory
 docs/assets/diagrams/   committed HTML, SVG, and generation receipt
 scripts/                checks, renderer, release identity, CI notes
 tests/                  Node and Python regression coverage
-.forgeloop/             project-scoped ForgeLoop configuration
+.forgeloop/             project-scoped configuration
 .forgeloop/task-state/  isolated live task protocol state
 DOCS_INDEX.md           documentation map and ownership boundaries
 ```
 
-Project-scoped configuration remains under `.forgeloop/`.
 Task-scoped mutable protocol state is stored under
 `.forgeloop/task-state/<taskKey>/`.
 
-For document ownership, guide routing, capability degradation, and integration
-details, start at [`DOCS_INDEX.md`](./DOCS_INDEX.md).
+For documentation ownership and integrations, see [`DOCS_INDEX.md`](./DOCS_INDEX.md).
 
 ## Programmatic integration and MCP
 
@@ -636,8 +641,7 @@ ForgeLoop exposes a stable programmatic surface:
 import { executeForgeLoopCommand } from "@cassiomc1/forgeloop/integration";
 ```
 
-The local MCP server (`@cassiomc1/forgeloop-mcp`, stdio) is an adapter over
-this exact API — it never reimplements ForgeLoop. See
+The local MCP server (`@cassiomc1/forgeloop-mcp`, stdio) wraps this API. See
 [`docs/UNIVERSAL_INTEGRATION.md`](./docs/UNIVERSAL_INTEGRATION.md) and
 [`docs/MCP.md`](./docs/MCP.md). MCP is optional; the CLI and instruction-only
 hosts remain fully supported without it.

package/THIRD_PARTY_NOTICES.md

@@ -97,13 +97,31 @@ dependencies, version, and distribution conditions before adoption.
   configure, or enable its CI/agent integrations. Verify current upstream
   license, CLI, telemetry, network behavior, and dependencies before use.
 
+### Cloudflare security audit skill — optional bundled companion
+
+- Project: [cloudflare/security-audit-skill](https://github.com/cloudflare/security-audit-skill).
+- Pinned source commit: `c1c8a8c1471069fb0e188eeaff69b8e8db6564a8`.
+- License: MIT, copyright (c) 2025-2026 Cloudflare, Inc.; the complete upstream
+  notice is preserved at `skills/security-audit/LICENSE`.
+- Use in this collection: the unchanged upstream `skills/security-audit/`
+  tree, including references, schema, validators and tests, is bundled for
+  optional agent guidance and explicitly requested source audits. The root
+  upstream license is copied alongside it. ForgeLoop-owned `PIN.json` records
+  the source and per-file SHA-256 digests.
+- Boundary: instruction content and local report validators, not a runtime
+  dependency, automatic scanner, Security Review provider, evidence importer,
+  or completion gate. It is not installed into a host by `init` or `update`.
+  The upstream files retain MIT terms independently of ForgeLoop's license.
+
 ### Runtime and validator boundary
 
 The distributed CLI and repository validators use Node.js and Python standard
 libraries plus the JSON Schema documents shipped in this repository. The core
-CLI has one approved runtime package, `smol-toml`, for structural Cargo
-manifest parsing; it is not used as an agent, provider, plugin, remote trace
-service, or model. Every future runtime capability must review its own license,
+CLI exact-pins `smol-toml` for structural Cargo manifest parsing and
+`@typesafe-ai/sdk` for the semantic decision plane. Parsing is local; configured
+semantic-required operations use the external TypeSafe service under the
+canonical decision contract. Neither dependency gains lifecycle or evidence
+authority. Every future runtime capability must review its own license,
 dependency tree, credentials, network behavior, and distribution terms
 separately.
 
@@ -207,14 +225,19 @@ The contextual frontend taste guide is informed by Taste Skill:
 
 - Taste Skill, Copyright (c) 2026 Leonxlnx, MIT License.
 - Source: <https://github.com/leonxlnx/taste-skill>
+- Reviewed baseline: [v2.0.0](https://github.com/Leonxlnx/taste-skill/tree/v2.0.0/skills/taste-skill),
+  released 2026-10-13; adaptation reviewed 2026-10-16.
 
 ForgeLoop includes a short, adapted guide under `ENG/taste-frontend-eng.md`.
-It does not vendor upstream runtime code, depend on its repository at runtime,
-or make its prescriptive examples universal.
+It incorporates selected content-inventory, visual-concept, and screenshot-review
+practices. It does not vendor upstream scripts or the direction library,
+depend on its repository at runtime, or claim full upstream feature parity.
+Upstream tooling is optional and separately supplied; its prescriptive style
+rules and media or motion counts are not universal ForgeLoop requirements.
 
 ## Runtime dependencies with upstream notices
 
-### smol-toml 1.8.0
+### smol-toml 1.9.0
 
 - Project/source: [squirrelchat/smol-toml](https://github.com/squirrelchat/smol-toml).
 - License declared by the upstream package: BSD-3-Clause.
@@ -224,6 +247,18 @@ or make its prescriptive examples universal.
   `package-lock.json`; the dependency has no role in routing authority beyond
   the parser result and is not exposed as a public ForgeLoop integration.
 
+### TypeSafe AI SDK 0.6.0
+
+- Package: `@typesafe-ai/sdk`; source:
+  [typesafe-ai/typesafe-sdk-js](https://github.com/typesafe-ai/typesafe-sdk-js).
+- License declared by the installed upstream package: MIT.
+- Use in this collection: exact-pinned client for the bounded semantic
+  decision plane documented in `docs/SEMANTIC_DECISION_PLANE.md`.
+- Boundary: credentials stay outside protocol artifacts. The SDK's responses
+  cannot execute commands, grant ownership, record evidence, or establish
+  completion. Network requirements remain explicit for semantic-required
+  operations; this is separate from optional security audit guidance.
+
 ### Microsoft tgrep
 
 - Project: [microsoft/tgrep](https://github.com/microsoft/tgrep).
@@ -247,3 +282,21 @@ or make its prescriptive examples universal.
 - Boundary: the ForgeLoop core package (`@cassiomc1/forgeloop`) has no
   dependency on the MCP SDK; the SDK ships only inside
   `@cassiomc1/forgeloop-mcp`. Review upstream terms before redistribution.
+
+## Revenue-centric design companion
+
+- Source: [heliocosta-dev/revenue-centric-design](https://github.com/heliocosta-dev/revenue-centric-design/tree/1942760c2242f609bf63ce2c97204f5a1791bd68).
+- Ideas, frameworks and the term Revenue-Centric Design: Richard
+  ([@richardrx](https://x.com/richardrx)); upstream curation is used with permission.
+- Terms: [complete custom source-available license](./skills/forgeloop/references/revenue-centric-design/LICENSE),
+  retained in full. Attribution and preservation of those terms are required.
+  Gambling, betting, casino and real-money games-of-chance uses, including
+  loot boxes, are excluded by the author's permission. These terms apply to
+  this companion, separately from ForgeLoop's PolyForm license; they are not
+  an OSI-approved open-source license.
+- Adaptation: a focused advisory skill and offline journey playbook under
+  `skills/forgeloop/references/revenue-centric-design/`, with a reviewed commit
+  and normalized-text integrity pin. Upstream themes are pinned links; media,
+  updater scripts and scraping dependencies are not bundled.
+- Authority: the companion adds no runtime dependency, guide ID, automatic
+  gate or completion authority. See [setup and boundaries](./docs/REVENUE_CENTRIC_DESIGN.md).

package/docs/AGENT_PROTOCOL_SUMMARY.md

@@ -7,7 +7,7 @@
 ForgeLoop is a portable protocol and support CLI for verifiable engineering workflows. It records and validates task state, contracts, routing, checks, evidence, continuity, and optional code attestations. It does not become an agent scheduler, delegation service, source-control authority, or secret manager.
 
 Protocol version: 1
-Package version: 2.0.0-rc.4
+Package version: 2.0.0
 
 ## Canonical loop
 

package/docs/AGENT_SKILL.md

@@ -48,6 +48,21 @@ behavioral certification for every external harness. Existing native
 `AGENTS.md`, `CLAUDE.md`, Cursor, and Copilot integration surfaces remain
 intact.
 
+## ForgeLoopAudit workspace guidance
+
+The generated Skill documents the Audit component at `ForgeLoopAudit/` inside
+the ForgeLoop repository, replacing the standalone repository and
+`../ForgeLoopAudit`. It directs agents to
+resolve the target project root before running commands: core ForgeLoop uses
+the parent root; Audit uses its own directory, instructions, package scripts,
+and configured protocol runtime. ForgeLoop is the source and contribution home
+for both components; their package commands, task state, and receipt provenance
+remain scoped to the target root. Audit remains a read-only auditor.
+
+Maintain this guidance in `scripts/generate-forgeloop-skill.mjs`, then run
+`npm run skill:generate` and `npm run skill:check`. An independently installed
+Skill must be updated separately; generation only writes the repository copy.
+
 ## Safety Boundaries
 
 Agents must discover tasks first, follow `next`, respect claims, require
@@ -59,8 +74,24 @@ authorization headers must never be persisted in ForgeLoop artifacts.
 External Agent Skills tooling is not a ForgeLoop dependency and is not used in
 CI. ForgeLoop adds no runtime Skill installation or synchronization command.
 
+## Optional product design guidance
+
+The [revenue-centric design companion](./REVENUE_CENTRIC_DESIGN.md) lives under
+`skills/forgeloop/references/revenue-centric-design/`. Its focused skill and
+local journey playbook support relevant product work with source attribution,
+custom license terms, informed choice and measurable hypotheses. It adds no
+runtime dependency, guide ID or lifecycle authority. The generator links to
+this maintained reference tree and does not overwrite or install it.
+
 ## Packaging
 
+The optional [Cloudflare security audit companion](./SECURITY_AUDIT_SKILL.md)
+ships separately at `skills/security-audit/`. The generated ForgeLoop Skill
+points to it for requested security work without starting a full audit or
+requiring installation. Its upstream files, license, and hash manifest remain
+separate from the generated ForgeLoop Skill. Host discovery copies are opt-in
+and are not synchronized by the generator or by `init`/`update`.
+
 The generated Skill, this document, and the bounded generator ship in the npm
 package as instruction/documentation content. They add no runtime dependency.
 Harness-specific installed copies and caches are not shipped.

package/docs/DOCUMENTATION_GUIDE.md

@@ -40,6 +40,12 @@ Persistent transport truth -> src/persistent-transport/*, CLI search dispatcher,
 
 Operational documentation must explain canonical behavior, not redefine it.
 
+For the 23 engineering guides, use the
+[guide maintenance map](./GUIDE_MAINTENANCE.md). Check activation descriptions
+against the detector/router and frontmatter requirements before changing a
+guide. Keep contextual styling and optional tools separate from lifecycle
+gates; do not update review dates on untouched material.
+
 Terminology must remain consistent across active documents: say “advisory
 context,” not “canonical memory”; “handoff acceptance,” not “ownership
 transfer”; and “operational receipt,” not “delegation.” Advisory output is

package/docs/FORGELOOP_AUDIT.md

@@ -0,0 +1,71 @@
+# ForgeLoopAudit — setup and usage
+
+ForgeLoopAudit is the local, read-only web interface for inspecting ForgeLoop
+projects. It lives in [`ForgeLoopAudit/`](https://github.com/cassiomc1/forgeloop/blob/main/ForgeLoopAudit/README.md) in this
+repository; the standalone repository is retired. Use it to inspect task
+progress, findings, verification evidence, quality, history and reports.
+ForgeLoop remains the authority for lifecycle and completion decisions.
+
+## Start ForgeLoopAudit
+
+Use Node.js **24.19.0 or newer**. From a checkout of this repository:
+
+```bash
+cd ForgeLoopAudit
+npm ci
+npm run build:web
+node dist/server/cli.mjs --demo
+```
+
+The CLI starts a loopback-only server and opens the browser. If it does not
+open automatically, use the one-time bootstrap URL printed in the terminal.
+Keep the terminal running while using Audit; press `Ctrl+C` to stop the server.
+
+To inspect your own ForgeLoop project, replace the demo command with an
+explicit project path, still from `ForgeLoopAudit/`:
+
+```bash
+node dist/server/cli.mjs --project /absolute/path/to/your-project
+```
+
+To inspect the parent ForgeLoop checkout itself, use `--project ..`.
+Audit reads native SQLite task state through ForgeLoop's public Integration API.
+Legacy JSON projects open as `ARTIFACT_ONLY`; Audit does not migrate them or
+change task state. Project selection stays with the local server rather than
+uploading a repository through the browser.
+
+## Explore the audit views
+
+1. Open **Audit Summary** for integrity, completion readiness, quality and trust
+   verdicts. Use **Run audit** to refresh the read-only assessment.
+2. Use **Projects** and **Task Board** to navigate registered projects and tasks
+   by canonical lifecycle phase; open **Tasks** for a task's detailed audit.
+3. Review **Findings** and **Evidence** to trace warnings and verification gaps.
+   Coverage, attestation and completion are separate signals.
+4. Inspect **Quality**, **Policy & Trust**, **Audit History** and **Diagnostics**
+   for supporting context. Use **Reports** for exports to managed local storage.
+   **Repository Search** is discovery only, not verification evidence.
+
+## Screenshots
+
+These are existing captures of the ForgeShop demo, taken from the production
+renderer at 1440 × 900 in the dark theme, aligned to Audit `0.3.0-rc.3` and
+ForgeLoop `2.0.0-rc.4`. The demo deliberately includes invalid, stale, blocked and
+unverified scenarios. Its warnings and coverage values do not establish
+completion or production readiness for your project.
+
+| Audit Summary | Task Board |
+| --- | --- |
+| ![ForgeShop demo audit summary with separate integrity, readiness, quality and trust verdicts](https://raw.githubusercontent.com/cassiomc1/forgeloop/main/ForgeLoopAudit/screen/audit-summary.png) | ![Read-only task board grouping demo tasks by canonical lifecycle phase](https://raw.githubusercontent.com/cassiomc1/forgeloop/main/ForgeLoopAudit/screen/kanban.png) |
+| Findings | Evidence |
+| ![ForgeShop demo findings with provenance and severity](https://raw.githubusercontent.com/cassiomc1/forgeloop/main/ForgeLoopAudit/screen/findings.png) | ![ForgeShop demo task evidence and verification scope](https://raw.githubusercontent.com/cassiomc1/forgeloop/main/ForgeLoopAudit/screen/evidence.png) |
+
+See the [complete screenshot gallery](https://github.com/cassiomc1/forgeloop/blob/main/ForgeLoopAudit/README.md#screenshots)
+and [capture provenance](https://github.com/cassiomc1/forgeloop/blob/main/ForgeLoopAudit/screen/README.md) for the full set.
+For development, verification and command-root details, see the
+[Audit README](https://github.com/cassiomc1/forgeloop/blob/main/ForgeLoopAudit/README.md),
+[Audit documentation index](https://github.com/cassiomc1/forgeloop/blob/main/ForgeLoopAudit/docs/README.md) and
+[workspace guidance](./AGENT_SKILL.md#forgeloopaudit-workspace-guidance).
+Audit has its own dependencies, build and verification commands. Its application
+source and screenshots are excluded from the core npm package; npm users can
+[read this section and its images on GitHub](https://github.com/cassiomc1/forgeloop#forgeloopaudit-workspace).

package/docs/GETTING_STARTED.md

@@ -117,6 +117,12 @@ and numeric limits.
 
 ### Global installation
 
+The public core package is available without organization access. As of
+2026-10-14, both npm `latest` and `next` resolve to `2.0.0-rc.4`. The default
+installation below uses `latest`; use `@cassiomc1/forgeloop@2.0.0-rc.4` when an
+exact reproducible version is required. RC4 remains a release candidate;
+its passing new-user checks do not establish stable SQLite acceptance.
+
 Install the ForgeLoop CLI globally to make the `forgeloop` command available
 in your terminal: