@cassiomc1/forgeloop 2.0.0-rc.4 → 2.0.0

package/docs/TROUBLESHOOTING.md

@@ -27,7 +27,7 @@ install the kit before expecting the complete `doctor` report to be healthy.
 ## Concurrent task creation
 
 Task creation revalidates write claims atomically. If the catalog changes while
-a command is prepared, RC3 refreshes authoritative claim inputs with bounded
+a command is prepared, RC4 refreshes authoritative claim inputs with bounded
 backoff and jitter without replaying the command or its external effects.
 Overlapping claims still fail. Sustained contention can exhaust the retry
 bound and return a catalog-change refusal; inspect fresh task discovery
@@ -133,7 +133,8 @@ tests or change assertions. Local coverage remains an explicit command because
 instrumentation adds measurable overhead; the PR unit lane wraps that same
 `test:ci` process across four deterministic shards, then aggregates coverage
 without running the suite again. Docs-only changes run the quick suite only on
-the first Node 24 shard; the other shards and the Node 20 lane do not install.
+the first Node 24 shard; the other shards do not install. The minimum Node
+24.19.0 compatibility lane runs only for applicable source or runtime changes.
 
 #### Native Windows guidance
 
@@ -279,6 +280,18 @@ forgeloop record-diagnosis --task <id> \
   --next-safe-action="Smallest safe action to address the hypothesis"
 ```
 
+A new finding discovered in `REVIEWING` can also be diagnosed there. First
+record the actual negative observation with `record-check --kind manual-review
+--status failed --evidence-kind OBSERVED`, binding it to the affected
+requirement. A blocked finding uses `--status blocked --evidence-kind BLOCKED`.
+Passed evidence remains restricted to `VERIFYING`. Both legacy and structured
+diagnoses must reference a failed or blocked check from the current cycle.
+Then follow `next`, enter `CORRECTING`, and rerun verification in the new cycle.
+A task already in `CORRECTING` from review follows the same finding and
+diagnosis requirements. Repository-only drift may be refreshed through
+`reconcile-closure` after its contract-bound check passes; that refresh neither
+creates a diagnosis nor authorizes a retry.
+
 Then advance to `CORRECTING`:
 
 ```bash

package/docs/documentation-manifest.json

@@ -1405,6 +1405,261 @@
         "self-hosted-node-validation"
       ],
       "packaged": true
+    },
+    {
+      "path": "docs/FORGELOOP_AUDIT.md",
+      "id": "forgeloop-audit",
+      "class": "operational",
+      "audience": [
+        "user",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "docs/SECURITY_AUDIT_SKILL.md",
+      "id": "security-audit-skill",
+      "class": "guide",
+      "audience": [
+        "user",
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [
+        "security-audit-companion"
+      ],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/AI-AND-LLM.md",
+      "id": "cloudflare-audit-ai-and-llm",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/ATTACK-CLASSES.md",
+      "id": "cloudflare-audit-attack-classes",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/CLIENT-SIDE.md",
+      "id": "cloudflare-audit-client-side",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/CLOUD-AND-DEPLOYMENT.md",
+      "id": "cloudflare-audit-cloud-and-deployment",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/DATA-ISOLATION-AND-LIFECYCLE.md",
+      "id": "cloudflare-audit-data-isolation-and-lifecycle",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/DESKTOP-MOBILE-AND-LOCAL-IPC.md",
+      "id": "cloudflare-audit-desktop-mobile-and-local-ipc",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/HUNTING.md",
+      "id": "cloudflare-audit-hunting",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/MEMORY-SAFETY-AND-BINARY.md",
+      "id": "cloudflare-audit-memory-safety-and-binary",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/PROTOCOLS-RPC-AND-MESSAGING.md",
+      "id": "cloudflare-audit-protocols-rpc-and-messaging",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/RECONNAISSANCE.md",
+      "id": "cloudflare-audit-reconnaissance",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/RESOURCE-EXHAUSTION-AND-AVAILABILITY.md",
+      "id": "cloudflare-audit-resource-exhaustion-and-availability",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/SKILL.md",
+      "id": "cloudflare-audit-skill",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/SUPPLY-CHAIN-AND-RELEASE.md",
+      "id": "cloudflare-audit-supply-chain-and-release",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/VALIDATION-AND-REPORTING.md",
+      "id": "cloudflare-audit-validation-and-reporting",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/WEB-PROTOCOL-AND-AUTH.md",
+      "id": "cloudflare-audit-web-protocol-and-auth",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "docs/GUIDE_MAINTENANCE.md",
+      "id": "guide-maintenance",
+      "class": "guide",
+      "audience": [
+        "maintainer",
+        "harness",
+        "user"
+      ],
+      "canonicalFor": [
+        "guide-maintenance"
+      ],
+      "packaged": true
+    },
+    {
+      "path": "docs/REVENUE_CENTRIC_DESIGN.md",
+      "id": "revenue-centric-design",
+      "class": "guide",
+      "audience": [
+        "user",
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [
+        "revenue-design-companion"
+      ],
+      "packaged": true
+    },
+    {
+      "path": "skills/forgeloop/references/revenue-centric-design/SKILL.md",
+      "id": "revenue-centric-design-skill",
+      "class": "reference",
+      "audience": [
+        "user",
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/forgeloop/references/revenue-centric-design/references/playbook.md",
+      "id": "revenue-centric-design-playbook",
+      "class": "reference",
+      "audience": [
+        "user",
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "docs/STABLE_2_ACCEPTANCE.md",
+      "id": "stable-2-acceptance",
+      "class": "reference",
+      "audience": [
+        "user",
+        "maintainer"
+      ],
+      "canonicalFor": [
+        "stable-storage-release-acceptance"
+      ],
+      "packaged": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cassiomc1/forgeloop",
-  "version": "2.0.0-rc.4",
+  "version": "2.0.0",
   "description": "Evidence-first engineering protocol for AI coding environments and developer workflows",
   "repository": {
     "type": "git",
@@ -82,6 +82,7 @@
     "docs/MCP.md",
     "docs/UNIVERSAL_INTEGRATION.md",
     "docs/AUDIT_UX.md",
+    "docs/FORGELOOP_AUDIT.md",
     "docs/DIAGNOSTIC_MODEL.md",
     "docs/EXECUTION_TRACE.md",
     "docs/CODE_ATTESTATION.md",
@@ -121,7 +122,14 @@
     "!src/core/workflow-compatibility.js",
     "!src/core/cli-metadata.js",
     "LICENSE",
-    "scripts/run-mcp-clean-tests.mjs"
+    "scripts/run-mcp-clean-tests.mjs",
+    "docs/SECURITY_AUDIT_SKILL.md",
+    "scripts/verify-security-audit-skill.mjs",
+    "skills/security-audit",
+    "docs/GUIDE_MAINTENANCE.md",
+    "docs/REVENUE_CENTRIC_DESIGN.md",
+    "scripts/verify-revenue-design-skill.mjs",
+    "docs/STABLE_2_ACCEPTANCE.md"
   ],
   "scripts": {
     "test": "node scripts/run-tests.js",
@@ -183,7 +191,9 @@
     "mcp:test:clean": "node scripts/run-mcp-clean-tests.mjs",
     "release:quick": "node scripts/run-rc-release.mjs",
     "release:rc:check": "node scripts/check-rc-release.mjs",
-    "storage:writer-inventory": "node scripts/storage-writer-inventory.mjs"
+    "storage:writer-inventory": "node scripts/storage-writer-inventory.mjs",
+    "security-skill:check": "node scripts/verify-security-audit-skill.mjs",
+    "revenue-skill:check": "node scripts/verify-revenue-design-skill.mjs"
   },
   "devDependencies": {
     "c8": "^12.0.0",
@@ -193,7 +203,7 @@
   },
   "dependencies": {
     "@typesafe-ai/sdk": "0.6.0",
-    "smol-toml": "1.8.0"
+    "smol-toml": "1.9.0"
   },
   "exports": {
     ".": "./src/cli.js",

package/scripts/generate-forgeloop-skill.mjs

@@ -42,6 +42,12 @@ Runtime registries and validators outrank canonical protocol docs; canonical doc
 
 In ForgeLoop's own source repository, use \`node src/cli.js\`. In a consumer repository, use that repository's configured local invocation. Never silently install or upgrade ForgeLoop, and never use a stale global CLI when repository-local code exists. If compatibility is uncertain, inspect \`protocol-info --json\`.
 
+## ForgeLoopAudit Workspace
+
+ForgeLoopAudit is maintained at \`ForgeLoopAudit/\` inside the ForgeLoop repository, replacing the standalone repository and sibling path \`../ForgeLoopAudit\`. ForgeLoop is its source and contribution home. This source layout is not a prerequisite for consumer projects or npm installations. Audit remains a read-only auditor with its own package, documentation, build, and verification commands; it is not included in the core ForgeLoop npm package.
+
+Resolve the target root before running commands. For core work, stay at the ForgeLoop root and use \`node src/cli.js\`. For Audit work, enter \`ForgeLoopAudit/\`, read its own project instructions and \`README.md\`, and resolve its configured ForgeLoop runtime there. Audit development uses \`npm run dev:web\`; its full verification uses \`npm run verify:full\`, both from the Audit root. Do not apply the parent's CLI path blindly in the child directory or merge their task state. A directory move does not rebind receipts, workspace bindings, or stored project paths; inspect affected artifacts through supported tooling and never rewrite protocol state to repair a moved root.
+
 ## Operating Workflow
 
 1. Discover existing work with \`node src/cli.js task-list --json\`.
@@ -58,6 +64,14 @@ Respect active write claims. Do not steal, override, manually release, or edit o
 
 \`run-check\` executes the exact command and records ForgeLoop-owned provenance. \`record-check\` is serialization-only; its command text is metadata and is never executed. Claims, provider/advisory output, screenshots, and actor summaries are not evidence by themselves. Missing tools remain unavailable; do not auto-install a verifier.
 
+## Optional Security Audit Companion
+
+For requested source security questions or vulnerability reviews, ForgeLoop bundles Cloudflare's pinned \`security-audit\` companion under \`skills/security-audit/\` in its package/source root. Consult \`docs/SECURITY_AUDIT_SKILL.md\` there for setup, provenance, and authority boundaries. Load the companion only when available and relevant. Host discovery is opt-in; \`init\` and \`update\` do not install it. Routine security routing does not require a full audit. Full audits require an explicit audit/report request, independent verifiers, and the upstream execution isolation controls; unavailable capabilities remain explicit blockers. Preserve \`confirmed\`, \`needs_validation\`, and \`rejected\`; reports and report-validator success do not establish canonical evidence or ForgeLoop completion. This companion is separate from ForgeLoopAudit and the host-injected Security Review provider.
+
+## Optional Product Design Companion
+
+For relevant SaaS product journeys, activation, pricing clarity or retention work, read the bundled \`references/revenue-centric-design/SKILL.md\` relative to this skill directory. Consult \`docs/REVENUE_CENTRIC_DESIGN.md\` in the package root for setup and provenance. The adaptation credits Richard (@richardrx) and preserves the full custom source-available license, including its gambling/betting/casino-use exclusion. It is advisory, adds no guide ID or gate, and grants no lifecycle, evidence, payment or publication authority. Use measured user value, informed choice and accessibility as constraints; do not claim conversion lift from UI tests. No updater or media is bundled, and host discovery copies remain opt-in.
+
 ## Recovery Rules
 
 Use supported recovery only. Preserve failed evidence and follow \`next\` through diagnosis/correction. For state or ledger divergence, stop lifecycle mutation and inspect validation/classification. Never edit task state, receipts, recovery, continuity, claims, hashes, or \`events.ndjson\` manually. Reconcile \`COMMIT_UNKNOWN\` before any retry.

package/scripts/verify-revenue-design-skill.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { lstat, readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const defaultRoot = fileURLToPath(new URL("../skills/forgeloop/references/revenue-centric-design/", import.meta.url));
+const files = ["LICENSE", "SKILL.md", "references/playbook.md"];
+async function regular(filename, directory = false) {
+  const metadata = await lstat(filename);
+  if (metadata.isSymbolicLink() || !(directory ? metadata.isDirectory() : metadata.isFile())) throw new Error("Design companion must contain regular files and directories only");
+}
+export async function verifyRevenueDesignSkill({ rootDir = defaultRoot } = {}) {
+  await regular(rootDir, true);
+  await regular(path.join(rootDir, "references"), true);
+  await regular(path.join(rootDir, "PIN.json"));
+  const pin = JSON.parse(await readFile(path.join(rootDir, "PIN.json"), "utf8"));
+  if (pin.schemaVersion !== 1 || pin.repository !== "https://github.com/heliocosta-dev/revenue-centric-design"
+    || pin.commit !== "1942760c2242f609bf63ce2c97204f5a1791bd68"
+    || JSON.stringify(Object.keys(pin.files ?? {}).sort()) !== JSON.stringify(files)) throw new Error("Invalid design companion pin");
+  const rootNames = (await readdir(rootDir)).sort();
+  if (JSON.stringify(rootNames) !== JSON.stringify(["LICENSE", "PIN.json", "SKILL.md", "references"])
+    || JSON.stringify(await readdir(path.join(rootDir, "references"))) !== JSON.stringify(["playbook.md"])) throw new Error("Unexpected design companion files");
+  for (const name of files) {
+    const filename = path.join(rootDir, name);
+    await regular(filename);
+    const bytes = (await readFile(filename, "utf8")).replaceAll("\r\n", "\n");
+    const digest = createHash("sha256").update(bytes).digest("hex");
+    if (digest !== pin.files[name]) throw new Error(`Design companion hash mismatch: ${name}`);
+  }
+  if (pin.files.LICENSE !== pin.upstreamLicenseSha256) throw new Error("Upstream design license differs");
+  return { valid: true, commit: pin.commit, filesChecked: files.length, digestFormat: pin.digestFormat };
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try { console.log(JSON.stringify(await verifyRevenueDesignSkill())); }
+  catch (error) { console.error(error.message); process.exitCode = 1; }
+}

package/scripts/verify-security-audit-skill.mjs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+
+import { createHash } from "node:crypto";
+import { lstat, readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const defaultRoot = fileURLToPath(new URL("../skills/security-audit/", import.meta.url));
+const upstream = "https://github.com/cloudflare/security-audit-skill";
+const requiredFiles = ["SKILL.md", "LICENSE", "report-schema.json", "validate-findings.cjs", "validate-coverage-ledger.cjs"];
+
+async function regularFile(file) {
+  let metadata;
+  try { metadata = await lstat(file); } catch (error) {
+    if (error.code === "ENOENT") throw new Error(`Skill integrity: missing ${path.basename(file)}`);
+    throw error;
+  }
+  if (!metadata.isFile() || metadata.isSymbolicLink()) {
+    throw new Error(`Skill integrity: expected a regular file, no symlink: ${path.basename(file)}`);
+  }
+  return readFile(file);
+}
+
+function validatePin(pin) {
+  if (pin?.schemaVersion !== 1 || pin.repository !== upstream
+    || pin.upstreamDirectory !== "skills/security-audit" || pin.license !== "MIT"
+    || typeof pin.commit !== "string" || !/^[a-f0-9]{40}$/u.test(pin.commit)
+    || !pin.files || typeof pin.files !== "object" || Array.isArray(pin.files)) {
+    throw new Error("Skill integrity: invalid upstream pin");
+  }
+  for (const [name, digest] of Object.entries(pin.files)) {
+    if (name === "PIN.json" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(name)
+      || typeof digest !== "string" || !/^[a-f0-9]{64}$/u.test(digest)) {
+      throw new Error(`Skill integrity: unsafe filename or invalid digest: ${name}`);
+    }
+  }
+  if (requiredFiles.some(name => !Object.hasOwn(pin.files, name))) {
+    throw new Error("Skill integrity: invalid pin missing required resources");
+  }
+}
+
+export async function verifySecurityAuditSkill({ rootDir = defaultRoot } = {}) {
+  const metadata = await lstat(rootDir);
+  if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new Error("Skill integrity: expected a directory, no symlink");
+  const pin = JSON.parse(await regularFile(path.join(rootDir, "PIN.json")));
+  validatePin(pin);
+  const expected = [...Object.keys(pin.files), "PIN.json"].sort();
+  const actual = (await readdir(rootDir)).sort();
+  if (JSON.stringify(expected) !== JSON.stringify(actual)) {
+    throw new Error("Skill integrity: missing or unexpected files");
+  }
+  for (const [name, digest] of Object.entries(pin.files)) {
+    const bytes = await regularFile(path.join(rootDir, name));
+    if (createHash("sha256").update(bytes).digest("hex") !== digest) {
+      throw new Error(`Skill integrity: SHA-256 mismatch: ${name}`);
+    }
+  }
+  return { valid: true, commit: pin.commit, filesChecked: Object.keys(pin.files).length };
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    console.log(JSON.stringify(await verifySecurityAuditSkill()));
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+}

package/skills/forgeloop/SKILL.md

@@ -27,6 +27,12 @@ Runtime registries and validators outrank canonical protocol docs; canonical doc
 
 In ForgeLoop's own source repository, use `node src/cli.js`. In a consumer repository, use that repository's configured local invocation. Never silently install or upgrade ForgeLoop, and never use a stale global CLI when repository-local code exists. If compatibility is uncertain, inspect `protocol-info --json`.
 
+## ForgeLoopAudit Workspace
+
+ForgeLoopAudit is maintained at `ForgeLoopAudit/` inside the ForgeLoop repository, replacing the standalone repository and sibling path `../ForgeLoopAudit`. ForgeLoop is its source and contribution home. This source layout is not a prerequisite for consumer projects or npm installations. Audit remains a read-only auditor with its own package, documentation, build, and verification commands; it is not included in the core ForgeLoop npm package.
+
+Resolve the target root before running commands. For core work, stay at the ForgeLoop root and use `node src/cli.js`. For Audit work, enter `ForgeLoopAudit/`, read its own project instructions and `README.md`, and resolve its configured ForgeLoop runtime there. Audit development uses `npm run dev:web`; its full verification uses `npm run verify:full`, both from the Audit root. Do not apply the parent's CLI path blindly in the child directory or merge their task state. A directory move does not rebind receipts, workspace bindings, or stored project paths; inspect affected artifacts through supported tooling and never rewrite protocol state to repair a moved root.
+
 ## Operating Workflow
 
 1. Discover existing work with `node src/cli.js task-list --json`.
@@ -43,6 +49,14 @@ Respect active write claims. Do not steal, override, manually release, or edit o
 
 `run-check` executes the exact command and records ForgeLoop-owned provenance. `record-check` is serialization-only; its command text is metadata and is never executed. Claims, provider/advisory output, screenshots, and actor summaries are not evidence by themselves. Missing tools remain unavailable; do not auto-install a verifier.
 
+## Optional Security Audit Companion
+
+For requested source security questions or vulnerability reviews, ForgeLoop bundles Cloudflare's pinned `security-audit` companion under `skills/security-audit/` in its package/source root. Consult `docs/SECURITY_AUDIT_SKILL.md` there for setup, provenance, and authority boundaries. Load the companion only when available and relevant. Host discovery is opt-in; `init` and `update` do not install it. Routine security routing does not require a full audit. Full audits require an explicit audit/report request, independent verifiers, and the upstream execution isolation controls; unavailable capabilities remain explicit blockers. Preserve `confirmed`, `needs_validation`, and `rejected`; reports and report-validator success do not establish canonical evidence or ForgeLoop completion. This companion is separate from ForgeLoopAudit and the host-injected Security Review provider.
+
+## Optional Product Design Companion
+
+For relevant SaaS product journeys, activation, pricing clarity or retention work, read the bundled `references/revenue-centric-design/SKILL.md` relative to this skill directory. Consult `docs/REVENUE_CENTRIC_DESIGN.md` in the package root for setup and provenance. The adaptation credits Richard (@richardrx) and preserves the full custom source-available license, including its gambling/betting/casino-use exclusion. It is advisory, adds no guide ID or gate, and grants no lifecycle, evidence, payment or publication authority. Use measured user value, informed choice and accessibility as constraints; do not claim conversion lift from UI tests. No updater or media is bundled, and host discovery copies remain opt-in.
+
 ## Recovery Rules
 
 Use supported recovery only. Preserve failed evidence and follow `next` through diagnosis/correction. For state or ledger divergence, stop lifecycle mutation and inspect validation/classification. Never edit task state, receipts, recovery, continuity, claims, hashes, or `events.ndjson` manually. Reconcile `COMMIT_UNKNOWN` before any retry.

package/skills/forgeloop/references/revenue-centric-design/LICENSE

@@ -0,0 +1,30 @@
+Revenue-Centric Design Skill — License & Usage Terms
+Copyright (c) 2026 the curators of this repository.
+
+The underlying ideas, frameworks, examples, and the coined term "Revenue-Centric
+Design" are the intellectual property of Richard (@richardrx on X) and are used
+here WITH PERMISSION. This repository is a distilled, translated index of his
+public posts, shared for educational and reference use.
+
+You are granted permission to use, copy, and share this material, subject to ALL
+of the following conditions:
+
+1. ATTRIBUTION. You must retain clear attribution to Richard (@richardrx) and a
+   link to the source. Do not misrepresent the origin of these ideas.
+
+2. NO GAMBLING / BETTING / CASINO USE. You may NOT use this material — in whole
+   or in part — to design, build, optimize, market, or grow betting, casino,
+   gambling, or other real-money games-of-chance products or projects (including
+   loot-box and real-money-gaming mechanics). This restriction was set by the
+   original author as an explicit condition of reuse and MUST be preserved in any
+   copy or derivative.
+
+3. PRESERVE THESE TERMS. Any copy or derivative work must include this license in
+   full, including the restrictions above.
+
+4. NO WARRANTY. This material is provided "AS IS", without warranty of any kind,
+   express or implied. The curators and the original author are not liable for any
+   claim, damages, or other liability arising from its use.
+
+Note: Because of the field-of-use restriction in clause 2, this is a
+SOURCE-AVAILABLE license, not an OSI-approved open-source license.

package/skills/forgeloop/references/revenue-centric-design/PIN.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "repository": "https://github.com/heliocosta-dev/revenue-centric-design",
+  "commit": "1942760c2242f609bf63ce2c97204f5a1791bd68",
+  "license": "Custom source-available; attribution and no gambling/betting/casino use",
+  "adaptation": "ForgeLoop-focused entry point and local playbook; full upstream license retained; upstream references linked at the pinned commit; no updater or media bundled.",
+  "digestFormat": "SHA-256 of UTF-8 file bytes after CRLF to LF normalization",
+  "upstreamLicenseSha256": "29e6d8b0a1e3dd78776b46b22b9a9a3df94fdbf6a73482f59d688dee7fd38e32",
+  "files": {
+    "LICENSE": "29e6d8b0a1e3dd78776b46b22b9a9a3df94fdbf6a73482f59d688dee7fd38e32",
+    "SKILL.md": "666ca4a0a7a1b2a8adf2882aa4571c30d51316c2163ea1ba1fd4d3424183d655",
+    "references/playbook.md": "0cdf065d41e4baa33a45bd0ad0e13bc57fcb237e768a27f8b494415aebb24805"
+  }
+}

package/skills/forgeloop/references/revenue-centric-design/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: revenue-centric-design
+description: Improve SaaS product journeys, activation, pricing clarity and retention using evidence-led design hypotheses. Use for relevant product or UX work; exclude gambling, betting, casino and real-money games-of-chance products.
+---
+
+# Revenue-centric design for ForgeLoop
+
+Adapted from [heliocosta-dev/revenue-centric-design](https://github.com/heliocosta-dev/revenue-centric-design/tree/1942760c2242f609bf63ce2c97204f5a1791bd68),
+curated from **Richard ([@richardrx](https://x.com/richardrx))**. Preserve this
+attribution, source link and the complete [custom license](LICENSE) in copies
+or derivatives. This material is source-available, with a field-of-use restriction;
+it is not covered by ForgeLoop's license.
+
+Do not apply this material to betting, casino, gambling or real-money
+games-of-chance products, including loot-box and real-money-gaming mechanics.
+The upstream permission excludes those uses.
+
+## Apply to the actual journey
+
+Use when product work concerns landing-page clarity, signup, checkout,
+onboarding, pricing, useful dashboards or retention. Do not load it for
+unrelated storage, security or protocol maintenance. For ForgeLoopAudit,
+use it only when changing the auditor's user journey: optimize comprehension,
+first successful inspection and actionable evidence, never simulated revenue.
+
+Read [the focused playbook](references/playbook.md) and only the upstream
+pinned theme relevant to the request. The playbook links each theme separately.
+No updater, media download, external account or Skills CLI is needed.
+
+1. Inspect the implemented journey and real product facts. Identify the user's
+   intended outcome, the friction observed and one measurable value event.
+   Avoid inventing customer segments, pricing, conversion baselines or proof.
+2. Choose a small reversible intervention. State the mechanism as a hypothesis,
+   the expected user benefit, the business metric and possible user harm.
+   A cited anecdote or statistic is not an expected result for this product.
+3. Follow the project's ForgeLoop contract, selected design/accessibility guides
+   and canonical `next` actions. This companion neither adds guide IDs or gates
+   nor grants lifecycle, evidence, publication or payment authority.
+4. Verify the changed journey: understandable copy, complete price and renewal
+   disclosure, keyboard/focus behavior, errors, responsive layout and an honest
+   empty state. Use the host's available browser tools when behavior changes.
+5. Report observed usability separately from measured commercial impact.
+   Without sufficient real traffic or a sound experiment, report a design
+   hypothesis and qualitative observations, not a conversion improvement.
+
+## Preserve informed choice
+
+Keep cancellation, opt-out and account deletion findable and usable. Explain
+consequences accurately and allow the user to continue. Do not introduce fake
+urgency, fabricated reviews/logos, concealed charges, misleading plan comparisons,
+preselected paid upgrades or obstacles designed to trap users. Defaults should
+serve the intended task and remain visible and reversible. Do not add tracking,
+paid experiments or third-party services merely to use this companion.
+
+Upstream examples and numeric rules are contextual source claims. Check their
+original sources before quoting them as facts; do not treat them as universal
+thresholds, verified research or financial guidance.
+
+## Suggested review result
+
+Return the inspected journey, observed friction, selected source principle,
+proposed change, user-value metric, guardrail metric, verification performed
+and unresolved measurement. Implementation remains within the user's scope.
+The companion's review is advisory and cannot establish `COMPLETE` or `VALID`.