@cassiomc1/forgeloop 2.0.0-rc.5 → 2.0.0

package/ENG/taste-frontend-eng.md

@@ -3,7 +3,7 @@ name: taste-frontend-eng
 language: en
 description: "Contextual visual-taste review for premium frontend and brand-heavy work."
 version: "2026.09"
-last-reviewed: "2026-08-17"
+last-reviewed: "2026-10-16"
 guide-id: taste
 ---
 
@@ -20,6 +20,25 @@ approach. ForgeLoop keeps the useful review vocabulary while applying its own
 protocol boundaries: user evidence, accessibility, performance, security, and
 the active product constraints have priority over aesthetic preference.
 
+## Upstream Baseline and Intentional Differences
+
+Reviewed baseline: [Taste Skill v2.0.0](https://github.com/Leonxlnx/taste-skill/tree/v2.0.0/skills/taste-skill),
+released 2026-10-13 and reviewed for this adaptation on 2026-10-16. See the
+[versioned instructions](https://github.com/Leonxlnx/taste-skill/blob/v2.0.0/skills/taste-skill/SKILL.md)
+and [changelog](https://github.com/Leonxlnx/taste-skill/blob/v2.0.0/CHANGELOG.md).
+This identifies the upstream reference, not full feature parity or automatic
+synchronization. The guide's frontmatter version follows ForgeLoop's guide
+versioning separately.
+
+ForgeLoop adapts the content inventory, subject-specific concept, and screenshot
+correction practices. It deliberately keeps direction selection contextual
+rather than requiring a scripted draw. It does not adopt universal bans on
+colors, gradients, borders, fonts, or headline line counts, or minimum image
+and animated-element counts. Existing brand constraints, language expansion,
+content needs, reduced motion, accessibility, and performance determine those
+choices. An aesthetic preference never becomes lifecycle or completion
+authority.
+
 ## Design Read
 
 Before editing, describe the existing or proposed system in observable terms:
@@ -35,6 +54,39 @@ Before editing, describe the existing or proposed system in observable terms:
 Separate observed evidence from inference. If the implementation is not yet
 available, record the read as a hypothesis and keep it reversible.
 
+## Client Content Inventory
+
+Collect a small, source-backed inventory before choosing a visual direction:
+
+- the client's actual product, audience, vocabulary, location, materials, and
+  distinguishing constraints, where relevant and supported;
+- available product views, photographs, illustrations, documents, and brand
+  assets, with their source and permitted use;
+- the content each requested section must deliver and the evidence supporting
+  its claims;
+- missing content, representative examples, and facts requiring confirmation.
+
+Reuse the inventory from the premium website brief when it exists. Do not
+invent a differentiator, price, metric, testimonial, customer, or asset to make
+the direction work. Label representative content and keep unsupported proof
+out of release claims. For each section, connect the visitor's question, the
+proposed claim, and its supporting source before committing to a layout.
+
+## Visual Concept
+
+Write one sentence connecting an evidenced client detail to a concrete visual
+decision and the visitor's goal. For example, an existing product workflow can
+organize the page's composition and sequence. Explain how that decision
+extends beyond the hero into supporting sections and narrow layouts.
+
+Check whether the sentence would fit a nearby competitor unchanged. If it
+would, refine it using the inventory rather than inventing a distinction.
+Keep an established brand or design system when appropriate. Add a distinctive
+interaction only when it serves the authorized scope and has an accessible
+fallback; a new interaction is not required merely to make the page unusual.
+Record reversible choices in the existing design artifact or contract
+assumptions, following the normal decision policy.
+
 ## Design Dials
 
 Use three lightweight dials to make an intentional decision rather than a
@@ -130,6 +182,61 @@ If visual evidence is unavailable, record `NOT_VERIFIED` or a bounded
 limitation. Never turn an imagined screenshot or an unrun browser check into
 an observed result.
 
+## Screenshot Review
+
+Use an already available, authorized browser to capture and inspect the real
+page. A useful starting set is 1440, 768, and 390 CSS pixels wide; adapt it to
+the supported device matrix and include required reflow, zoom, and interaction
+checks. These widths do not replace accessibility requirements.
+
+1. Record the tested URL or build, browser, viewport dimensions, relevant
+   state, and screenshot references in the task's evidence.
+2. Inspect each capture for hierarchy, content completeness, concept continuity,
+   typography, contrast, crops, overflow, and obscured or missing content.
+   Check interactive behavior separately; a screenshot alone cannot establish
+   keyboard access, form behavior, or runtime performance.
+3. Identify up to three actionable problems with their location, visible
+   evidence, and user impact. Prioritize required acceptance criteria over
+   stylistic preferences.
+4. Correct the scoped issues through the existing ForgeLoop diagnosis and
+   correction loop when verification fails. Re-run affected checks, capture
+   the changed states, and inspect them again.
+
+Use at most three review rounds by default, within the task contract's limits.
+Stop earlier when the applicable criteria are satisfied. The round limit does
+not waive a failure: report unresolved issues and their verification status,
+then follow the canonical next action or blocker. Do not fabricate aesthetic
+scores or claim browser, inspector, or screenshot evidence that was not
+actually obtained. This procedure adds no separate approval gate.
+
+## Optional Upstream Tools
+
+The upstream v2 scripts, direction library, and reference collection are not
+bundled with this guide or required by ForgeLoop runtime:
+
+| Upstream tool | Optional purpose |
+| --- | --- |
+| `scripts/draw.mjs` | Propose directions and composition blueprints |
+| `scripts/lint.mjs` | Review source against upstream style patterns |
+| `scripts/inspect.mjs` | Measure a page in a browser and capture screenshots |
+| `scripts/assets.mjs` | Find external media and record source and credit information |
+
+Use a separately available, reviewed copy only when appropriate and authorized;
+do not install, fetch, or execute it automatically. The reviewed inspector
+requires Node 22+ and an installed Chrome, Edge, or Chromium; the other scripts
+require Node 18+, and media discovery requires network access. Check the
+selected copy's requirements and output paths before use. Upstream tools may
+write project artifacts and user-level history outside ForgeLoop's evidence
+store; those files do not become attested evidence merely by existing.
+
+Prefer an available equivalent when it supports the same task checks. Treat
+upstream style findings as contextual recommendations, not new ForgeLoop gates.
+For external media, confirm the exact asset's license, attribution, and
+relevance; search results alone do not establish reuse rights. Identify found
+or generated imagery honestly rather than presenting it as the client's own.
+Record the tool version and checks actually run, and mark unavailable required
+evidence `NOT_VERIFIED` without claiming upstream tool coverage.
+
 ## Redesign Audit
 
 For an existing interface, scan first and classify each issue as hierarchy,

package/ENG/test-code-eng.md

@@ -3,7 +3,7 @@ name: test-code-eng
 language: en
 description: "Risk-based testing strategy and tools for modern languages and platforms."
 version: "2026.09"
-last-reviewed: "2026-08-10"
+last-reviewed: "2026-10-17"
 guide-id: test
 completion-evidence:
   - tests
@@ -15,7 +15,7 @@ completion-evidence:
 
 **Related documents**: for general clean code principles (names, small functions, formatting), see [`clean-code-eng.md`](./clean-code-eng.md). For security, including SAST/DAST, see [`sec-code-eng.md`](./sec-code-eng.md). For accessibility, use the repository's specific guide together with [WCAG 2.2](https://www.w3.org/TR/WCAG22/). For HTML video and motion, see [HyperFrames](https://hyperframes.heygen.com). This file is the canonical reference for deciding the testing strategy by language and platform.
 
-**Tooling policy**: identify the stack, the stage, and the applicable checks; prefer an already available equivalent that produces compatible evidence. Ask for authorization before installing a tool or changing the environment. If no safe equivalent exists, record the required check as blocked and never claim that it passed. Do not install merely optional resources.
+**Tooling policy**: identify the stack, the stage, and the applicable checks; prefer an already available equivalent that produces compatible evidence. Installation or environment changes require authority; reuse scoped authorization already given rather than asking again. If no safe equivalent exists, record the required check as blocked and never claim that it passed. Do not install merely optional resources.
 
 ## Start with risk, not a tool
 

package/GUIDE_ROUTER.md

@@ -73,6 +73,10 @@ structural detection and route tests are implemented.
 
 ## Domain rules
 
+For catalog upkeep, use the [engineering guide maintenance map](https://github.com/cassiomc1/forgeloop/blob/b9a16e9f665116306e9fca3b905b1f0fe2abd633/docs/GUIDE_MAINTENANCE.md).
+It distinguishes guide discovery, implemented routing, contextual defaults,
+and observed verification; it does not add runtime routing rules.
+
 ### `clean` — code and structure
 
 **Activate when:** creating or modifying code, fixing a bug, refactoring, changing architecture, reviewing quality, or producing development instructions.
@@ -117,6 +121,12 @@ rg -n '^## |authentication|authorization|upload|SSRF|CSP|OAuth|JWT|secrets|suppl
 
 **Expected evidence:** explicit trust boundaries, server-side validation, least privilege, no secrets in Git, and negative tests.
 
+For requested source audits or focused vulnerability investigations, consult
+the optional bundled Cloudflare `security-audit` companion described by the
+security guide. Ordinary security routing does not start a full audit or
+require the companion. Its reports remain advisory; canonical security gates
+and verification remain unchanged.
+
 ### `performance` — measurable cost
 
 **Activate when:** the request involves latency, scale, a critical path, rendering, bundles, databases, networking, memory, battery, load, Web Vitals, FPS, or a budget.
@@ -188,12 +198,16 @@ require GSAP or a static-site approach, prescribe fonts/layouts, or override
 accessibility, performance, security, or product evidence.
 
 ```bash
-rg -n '^## (Design Read|Design Dials|Anti-Slop Checks|Typography Quality|Layout Composition|Motion Restraint|Responsive Composition|Design-System Selection|Visual Pre-Flight|Redesign Audit)' ENG/taste-frontend-eng.md
+rg -n '^## (Upstream Baseline and Intentional Differences|Design Read|Client Content Inventory|Visual Concept|Design Dials|Anti-Slop Checks|Typography Quality|Layout Composition|Motion Restraint|Responsive Composition|Design-System Selection|Visual Pre-Flight|Screenshot Review|Optional Upstream Tools|Redesign Audit)' ENG/taste-frontend-eng.md
 ```
 
-**Expected evidence:** a contextual design read, intentional dials, bounded
-anti-slop review, and only the visual/accessibility/performance checks that are
-in scope. Mark unavailable visual evidence `NOT_VERIFIED`.
+**Expected evidence:** a source-backed client inventory, contextual design read,
+visual concept, intentional dials, bounded anti-slop review, and screenshot
+review with up to three correction rounds within the task contract. Run only
+the visual/accessibility/performance checks in scope and retain unresolved
+failures. Upstream scripts remain optional and unbundled; see the guide's
+versioned baseline and intentional differences. Mark unavailable visual
+evidence `NOT_VERIFIED`.
 
 ### `games` — web game architecture and operation
 

package/README.md

@@ -74,11 +74,13 @@ Routing uses bounded structural evidence; SQL remains a schema/query/migration
 overlay. Extensions, tool files, lockfiles, runtime images, and prose alone do
 not establish project identity. Public project evidence remains v1.
 
+See the [23-guide maintenance map](./docs/GUIDE_MAINTENANCE.md) for review scope and revalidation.
+
 ## Distribution and license
 
 GitHub hosts source and issues. The core npm package is publicly available;
-the MCP companion retains restricted distribution. RC5 targets `next`; `latest`
-remains at RC4. Stable SQLite acceptance is incomplete.
+the MCP companion retains restricted distribution. Stable `2.0.0` targets
+`latest`; publication requires verified release identity and native user audits.
 ForgeLoop-owned source and documentation are licensed under the
 [PolyForm Noncommercial License 1.0.0](./LICENSE). Commercial use is not granted
 by this license. Third-party notices are documented in
@@ -497,22 +499,18 @@ see [CONTRIBUTING.md](./CONTRIBUTING.md#focused-verification-and-maintenance).
 
 ## ForgeLoopAudit workspace
 
-The read-only auditor lives in `ForgeLoopAudit/`. See
-[setup, usage and screenshots](./docs/FORGELOOP_AUDIT.md) for the demo,
-project inspection and audit views.
+The read-only auditor lives in `ForgeLoopAudit/`; see its
+[setup, demo and screenshots](./docs/FORGELOOP_AUDIT.md).
 
 ## Protocol compatibility
 
-The npm package version is independent of protocol version. The current
-serializable artifact contract is `schemaVersion: 1` and `protocolVersion: 1`.
+The npm package version is independent of protocol version. Artifacts use
+`schemaVersion: 1` and `protocolVersion: 1`.
 
-- Patch releases preserve the v1 schemas, enums, transitions, and existing
-  command contracts while correcting implementation defects.
-- Minor releases preserve existing v1 artifacts and commands; they may add
-  documentation, commands, guides, or an explicitly named schema.
+- Patch releases preserve the v1 schemas and existing command contracts.
+- Minor releases preserve existing v1 artifacts; additions remain compatible.
 - Major releases may change required fields, enums, transitions, or safety
-  semantics and must document migration requirements with a protocol version
-  change.
+  semantics, requiring a new protocol version and documented migration.
 
 Consumers must reject unknown artifact fields rather than silently treating
 unrecognized protocol data as valid. The compatibility marker is
@@ -525,6 +523,10 @@ it must not infer current ownership from `task.json` or `recovery.json` alone.
 
 ## Security and dependency boundary
 
+Optional [security audits](./docs/SECURITY_AUDIT_SKILL.md) and
+[product design](./docs/REVENUE_CENTRIC_DESIGN.md) ship with pinned attribution,
+integrity checks and their respective licenses; guidance remains advisory.
+
 Runtime uses Node built-ins and the approved exact `@typesafe-ai/sdk` and
 `smol-toml` dependencies; it installs no agents, providers, plugins, services,
 or telemetry. Paths, symlinks, JSON,

package/THIRD_PARTY_NOTICES.md

@@ -97,13 +97,31 @@ dependencies, version, and distribution conditions before adoption.
   configure, or enable its CI/agent integrations. Verify current upstream
   license, CLI, telemetry, network behavior, and dependencies before use.
 
+### Cloudflare security audit skill — optional bundled companion
+
+- Project: [cloudflare/security-audit-skill](https://github.com/cloudflare/security-audit-skill).
+- Pinned source commit: `c1c8a8c1471069fb0e188eeaff69b8e8db6564a8`.
+- License: MIT, copyright (c) 2025-2026 Cloudflare, Inc.; the complete upstream
+  notice is preserved at `skills/security-audit/LICENSE`.
+- Use in this collection: the unchanged upstream `skills/security-audit/`
+  tree, including references, schema, validators and tests, is bundled for
+  optional agent guidance and explicitly requested source audits. The root
+  upstream license is copied alongside it. ForgeLoop-owned `PIN.json` records
+  the source and per-file SHA-256 digests.
+- Boundary: instruction content and local report validators, not a runtime
+  dependency, automatic scanner, Security Review provider, evidence importer,
+  or completion gate. It is not installed into a host by `init` or `update`.
+  The upstream files retain MIT terms independently of ForgeLoop's license.
+
 ### Runtime and validator boundary
 
 The distributed CLI and repository validators use Node.js and Python standard
 libraries plus the JSON Schema documents shipped in this repository. The core
-CLI has one approved runtime package, `smol-toml`, for structural Cargo
-manifest parsing; it is not used as an agent, provider, plugin, remote trace
-service, or model. Every future runtime capability must review its own license,
+CLI exact-pins `smol-toml` for structural Cargo manifest parsing and
+`@typesafe-ai/sdk` for the semantic decision plane. Parsing is local; configured
+semantic-required operations use the external TypeSafe service under the
+canonical decision contract. Neither dependency gains lifecycle or evidence
+authority. Every future runtime capability must review its own license,
 dependency tree, credentials, network behavior, and distribution terms
 separately.
 
@@ -207,14 +225,19 @@ The contextual frontend taste guide is informed by Taste Skill:
 
 - Taste Skill, Copyright (c) 2026 Leonxlnx, MIT License.
 - Source: <https://github.com/leonxlnx/taste-skill>
+- Reviewed baseline: [v2.0.0](https://github.com/Leonxlnx/taste-skill/tree/v2.0.0/skills/taste-skill),
+  released 2026-10-13; adaptation reviewed 2026-10-16.
 
 ForgeLoop includes a short, adapted guide under `ENG/taste-frontend-eng.md`.
-It does not vendor upstream runtime code, depend on its repository at runtime,
-or make its prescriptive examples universal.
+It incorporates selected content-inventory, visual-concept, and screenshot-review
+practices. It does not vendor upstream scripts or the direction library,
+depend on its repository at runtime, or claim full upstream feature parity.
+Upstream tooling is optional and separately supplied; its prescriptive style
+rules and media or motion counts are not universal ForgeLoop requirements.
 
 ## Runtime dependencies with upstream notices
 
-### smol-toml 1.8.0
+### smol-toml 1.9.0
 
 - Project/source: [squirrelchat/smol-toml](https://github.com/squirrelchat/smol-toml).
 - License declared by the upstream package: BSD-3-Clause.
@@ -224,6 +247,18 @@ or make its prescriptive examples universal.
   `package-lock.json`; the dependency has no role in routing authority beyond
   the parser result and is not exposed as a public ForgeLoop integration.
 
+### TypeSafe AI SDK 0.6.0
+
+- Package: `@typesafe-ai/sdk`; source:
+  [typesafe-ai/typesafe-sdk-js](https://github.com/typesafe-ai/typesafe-sdk-js).
+- License declared by the installed upstream package: MIT.
+- Use in this collection: exact-pinned client for the bounded semantic
+  decision plane documented in `docs/SEMANTIC_DECISION_PLANE.md`.
+- Boundary: credentials stay outside protocol artifacts. The SDK's responses
+  cannot execute commands, grant ownership, record evidence, or establish
+  completion. Network requirements remain explicit for semantic-required
+  operations; this is separate from optional security audit guidance.
+
 ### Microsoft tgrep
 
 - Project: [microsoft/tgrep](https://github.com/microsoft/tgrep).
@@ -247,3 +282,21 @@ or make its prescriptive examples universal.
 - Boundary: the ForgeLoop core package (`@cassiomc1/forgeloop`) has no
   dependency on the MCP SDK; the SDK ships only inside
   `@cassiomc1/forgeloop-mcp`. Review upstream terms before redistribution.
+
+## Revenue-centric design companion
+
+- Source: [heliocosta-dev/revenue-centric-design](https://github.com/heliocosta-dev/revenue-centric-design/tree/1942760c2242f609bf63ce2c97204f5a1791bd68).
+- Ideas, frameworks and the term Revenue-Centric Design: Richard
+  ([@richardrx](https://x.com/richardrx)); upstream curation is used with permission.
+- Terms: [complete custom source-available license](./skills/forgeloop/references/revenue-centric-design/LICENSE),
+  retained in full. Attribution and preservation of those terms are required.
+  Gambling, betting, casino and real-money games-of-chance uses, including
+  loot boxes, are excluded by the author's permission. These terms apply to
+  this companion, separately from ForgeLoop's PolyForm license; they are not
+  an OSI-approved open-source license.
+- Adaptation: a focused advisory skill and offline journey playbook under
+  `skills/forgeloop/references/revenue-centric-design/`, with a reviewed commit
+  and normalized-text integrity pin. Upstream themes are pinned links; media,
+  updater scripts and scraping dependencies are not bundled.
+- Authority: the companion adds no runtime dependency, guide ID, automatic
+  gate or completion authority. See [setup and boundaries](./docs/REVENUE_CENTRIC_DESIGN.md).

package/docs/AGENT_PROTOCOL_SUMMARY.md

@@ -7,7 +7,7 @@
 ForgeLoop is a portable protocol and support CLI for verifiable engineering workflows. It records and validates task state, contracts, routing, checks, evidence, continuity, and optional code attestations. It does not become an agent scheduler, delegation service, source-control authority, or secret manager.
 
 Protocol version: 1
-Package version: 2.0.0-rc.5
+Package version: 2.0.0
 
 ## Canonical loop
 

package/docs/AGENT_SKILL.md

@@ -74,8 +74,24 @@ authorization headers must never be persisted in ForgeLoop artifacts.
 External Agent Skills tooling is not a ForgeLoop dependency and is not used in
 CI. ForgeLoop adds no runtime Skill installation or synchronization command.
 
+## Optional product design guidance
+
+The [revenue-centric design companion](./REVENUE_CENTRIC_DESIGN.md) lives under
+`skills/forgeloop/references/revenue-centric-design/`. Its focused skill and
+local journey playbook support relevant product work with source attribution,
+custom license terms, informed choice and measurable hypotheses. It adds no
+runtime dependency, guide ID or lifecycle authority. The generator links to
+this maintained reference tree and does not overwrite or install it.
+
 ## Packaging
 
+The optional [Cloudflare security audit companion](./SECURITY_AUDIT_SKILL.md)
+ships separately at `skills/security-audit/`. The generated ForgeLoop Skill
+points to it for requested security work without starting a full audit or
+requiring installation. Its upstream files, license, and hash manifest remain
+separate from the generated ForgeLoop Skill. Host discovery copies are opt-in
+and are not synchronized by the generator or by `init`/`update`.
+
 The generated Skill, this document, and the bounded generator ship in the npm
 package as instruction/documentation content. They add no runtime dependency.
 Harness-specific installed copies and caches are not shipped.

package/docs/DOCUMENTATION_GUIDE.md

@@ -40,6 +40,12 @@ Persistent transport truth -> src/persistent-transport/*, CLI search dispatcher,
 
 Operational documentation must explain canonical behavior, not redefine it.
 
+For the 23 engineering guides, use the
+[guide maintenance map](./GUIDE_MAINTENANCE.md). Check activation descriptions
+against the detector/router and frontmatter requirements before changing a
+guide. Keep contextual styling and optional tools separate from lifecycle
+gates; do not update review dates on untouched material.
+
 Terminology must remain consistent across active documents: say “advisory
 context,” not “canonical memory”; “handoff acceptance,” not “ownership
 transfer”; and “operational receipt,” not “delegation.” Advisory output is

package/docs/GUIDE_MAINTENANCE.md

@@ -0,0 +1,106 @@
+# Engineering guide maintenance
+
+ForgeLoop's [guide registry](../src/config/guides.json) contains 23 guides.
+The [router](../GUIDE_ROUTER.md) selects relevant context; a catalog entry is
+not evidence that its toolchain is installed, its examples were executed, or
+its target application is ready for release.
+
+## Review scope and authority
+
+The catalog consistency review dated 2026-10-17 covered every registered guide
+for activation claims, precedence, optional-tool boundaries, verification
+language, version handling, and related documentation. Local source and
+validators govern routing, metadata, packaging, and evidence. Official
+version-matched sources govern language/platform semantics. This review is
+not a new certification of every API, release, framework, device, or external
+link, and it does not execute consumer applications.
+
+Use this precedence when maintaining guidance:
+
+1. Preserve platform rules, the user's request, repository constraints, and
+   the canonical ForgeLoop protocol.
+2. Derive activation from `src/core/project-detection.js`, its specialist
+   parsers, `src/core/router.js`, and the public project-evidence schemas.
+3. Read guide gates and completion requirements from registered frontmatter;
+   prose examples do not create extra lifecycle gates or protocol enums.
+4. Preserve project versions and architecture. Dated release examples are
+   reference material, not permission to upgrade a compiler or framework.
+5. Treat named tools and aesthetic defaults as contextual choices. Do not
+   install a missing optional tool or introduce a user-approval gate for a
+   reversible local choice. Reuse scoped authority already given.
+6. Keep unavailable checks and observations separate from passing evidence,
+   legal compliance, publication, deployment, and production readiness.
+
+## Catalog maintenance map
+
+The focus column records the boundary inspected and retained, or the
+substantive correction made. All rows remain subject to the review limits
+above; retained guidance does not imply a fresh external release audit.
+
+| ID | Guide | Maintenance focus |
+| --- | --- | --- |
+| `premium` | [Premium websites](../ENG/premium-sites-studio-eng.md) | Clarified production stages versus runtime gates and genuine client/publication authority |
+| `clean` | [Clean code](../ENG/clean-code-eng.md) | Retained cohesion, public contracts, cancellation, observability, and risk-based dependency guidance; clarified existing installation authority |
+| `test` | [Testing](../ENG/test-code-eng.md) | Retained proportional tests, protected checks, unavailable-tool reporting, and observed evidence; clarified existing installation authority |
+| `security` | [Security](../ENG/sec-code-eng.md) | Retained threat-boundary gate, negative tests, and advisory Cloudflare companion boundary; clarified existing installation authority |
+| `design` | [Design](../ENG/design-code-eng.md) | Preserved product tokens, made example styling and Impeccable contextual, and removed install-capable verifier examples |
+| `taste` | [Taste frontend](../ENG/taste-frontend-eng.md) | Retained contextual v2 adaptation, source/asset provenance, no aesthetic authority, and screenshot-based review |
+| `performance` | [Performance](../ENG/perf-code-eng.md) | Clarified async I/O versus CPU offloading; retained measured baselines, field/lab separation, and bounded resources |
+| `accessibility` | [Accessibility](../ENG/accessibility-eng.md) | Defaulted missing profile to AA without an artificial approval gate; corrected contrast and native-control keyboard guidance |
+| `games` | [Web games](../ENG/games-code-design-web-eng.md) | Retained bounded fixed-step simulation, authoritative resync, validated procedural generation, capability fallback, and deployment checks; clarified installation authority |
+| `documentation` | [Documentation](../ENG/documentation-quality-eng.md) | Added guide-specific checks for factual activation, gates, defaults, optional tools, and release claims |
+| `flutter` | [Flutter](../ENG/flutter-development-eng.md) | Replaced prospective routing instructions with implemented manifest detection and task-specific verification semantics |
+| `dotnet` | [.NET](../ENG/dotnet-aspnetcore-development-eng.md) | Retained structural SDK project detection, scoped ASP.NET/ABP overlays, version compatibility, and build/release distinctions |
+| `nodejs` | [Node.js](../ENG/nodejs-backend-development-eng.md) | Retained bounded backend evidence, module/runtime compatibility, cancellation, resource controls, and operational verification |
+| `rust` | [Rust](../ENG/rust-development-eng.md) | Grounded the release review in primary Rust sources and narrowed safety/API claims; retained Cargo/MSRV and ownership boundaries |
+| `c` | [C](../ENG/c-development-eng.md) | Retained bounded native build/source identity, pointer/ABI contracts, cleanup, sanitizers, and missing-tool limits |
+| `cpp` | [C++](../ENG/cpp-development-eng.md) | Retained native identity, RAII/lifetime/ABI policy, bounded concurrency, and exact-standard verification |
+| `java` | [Java](../ENG/java-development-eng.md) | Retained static Maven/Gradle/Bazel evidence, scoped topology, runtime/build separation, and bounded executor policy |
+| `sql` | [SQL](../ENG/sql-development-eng.md) | Retained host-project overlay, dialect/version discovery, transaction/retry policy, and separate migration authority |
+| `go` | [Go](../ENG/go-development-eng.md) | Retained bounded module/workspace topology, language/toolchain distinction, goroutine ownership, and race/fuzz evidence limits |
+| `typescript` | [TypeScript](../ENG/typescript-development-eng.md) | Retained JSONC/config ownership, runtime-neutral identity, erased-type/runtime validation distinction, and compiler API migration boundary |
+| `php` | [PHP](../ENG/php-development-eng.md) | Aligned the source fallback description with both `<?php` and `<?=` recognized by the parser |
+| `swift` | [Swift](../ENG/swift-development-eng.md) | Retained SwiftPM/native target composition, source-backed identity, concurrency/FFI policy, and signing/platform evidence limits |
+| `python` | [Python](../ENG/python-development-eng.md) | Explicitly documented reference-only status: automatic structural Python routing is not implemented |
+
+## Revalidation procedure
+
+For a guide change, inspect the registered path, frontmatter, related router
+rules, representative valid/invalid fixtures, and affected consumer docs.
+Check an external version-sensitive claim against the project's pinned
+version and the relevant official source before revising it. Update
+`last-reviewed` when that guide is materially revalidated; do not change dates
+on untouched guides merely to make the catalog look fresh.
+
+For policy changes, compare related guides as well: a safe default in one
+document must not become a mandatory tool, approval, rewrite, or installation
+in another. Preserve explicit user requirements and real blocking decisions.
+
+Run proportional checks, including the existing documentation suite:
+
+```bash
+npm run docs:check
+python3 scripts/validate_markdown.py
+npm run pack:check
+npm run security-skill:check
+```
+
+Use `npm run verify:fast` while editing and `npm run verify:prepush` before a
+PR. Those commands verify repository consistency and applicable code/package
+behavior; they do not run all 23 consumer toolchains. New documentation must
+be registered in the documentation manifest and review matrix. Add
+consumer-facing pages to the package allowlist, and derive generated content
+through its existing generator.
+
+## Primary reference points for changed guidance
+
+- [WCAG contrast](https://www.w3.org/WAI/WCAG22/Understanding/contrast-minimum.html)
+  and [ARIA Authoring Practices](https://www.w3.org/WAI/ARIA/apg/).
+- [Node.js event-loop guidance](https://nodejs.org/en/learn/asynchronous-work/dont-block-the-event-loop).
+- [Official Rust 1.99.0 announcement](https://blog.rust-lang.org/2026/10/01/Rust-1.99.0/).
+- ForgeLoop's [project detector](../src/core/project-detection.js),
+  [PHP recognizer](../src/core/php-project.js),
+  [guide registry](../src/config/guides.json), and
+  [project-evidence schema](../schemas/routing-input.schema.json).
+- [Repository dependency policy](https://github.com/cassiomc1/forgeloop/blob/main/scripts/check-dependency-policy.mjs) and
+  [package metadata](../package.json) for runtime dependencies and versions.

package/docs/PACKAGE_CONTENTS.md

@@ -56,6 +56,9 @@ The published tarball includes the following consumer-facing groups:
   ASP.NET Core and ABP are conditional routing overlays on the `dotnet` guide,
   not additional package guides. The package does not install or invoke
   framework, compiler, build, package-manager, or database tooling.
+  `docs/GUIDE_MAINTENANCE.md` ships the full catalog maintenance map and
+  revalidation boundaries; it does not add automatic Python routing or new
+  lifecycle gates.
 - **Initialization material:** the root protocol and integration documents,
   the PolyForm Noncommercial license, third-party notices, the target profile template, and every path listed by
   `src/core/templates.js`. These files are read by `init` and `update`, so
@@ -76,6 +79,12 @@ The published tarball includes the following consumer-facing groups:
    documentation are also packaged.
    The generated portable ForgeLoop Agent Skill and `docs/AGENT_SKILL.md` are
    packaged as instruction/documentation content, not runtime authority.
+   The optional Cloudflare companion at `skills/security-audit/` also ships,
+   including its upstream references, schema, validators and tests, MIT
+   license, and `PIN.json`. Its usage guide at `docs/SECURITY_AUDIT_SKILL.md`
+   and offline `scripts/verify-security-audit-skill.mjs` checker are packaged.
+   It adds no runtime dependency or automatic scan and is not copied by
+   `init`/`update` into host skill directories.
   Provider implementation modules ship under `src/`, but packaged source file
   does not mean a supported public import path; the generic `./providers`
   subpath remains unexported.
@@ -146,3 +155,12 @@ gate before `npm publish --provenance --access public`.
 Publication therefore remains owned by the authorized manual GitHub Actions
 workflow and uses public npm access for the core package; local package inspection proves the
 candidate boundary but does not publish it.
+
+## Optional product design companion
+
+The generated ForgeLoop skill includes the maintained
+`skills/forgeloop/references/revenue-centric-design/` reference tree. It ships
+a focused skill, local journey playbook, complete custom source-available
+license and integrity pin. `docs/REVENUE_CENTRIC_DESIGN.md` and
+`scripts/verify-revenue-design-skill.mjs` describe and verify it. Upstream media
+and updater scripts are excluded; external theme references are pinned links.