@cassiomc1/forgeloop 2.0.0-rc.5 → 2.0.0

package/docs/documentation-manifest.json

@@ -1416,6 +1416,250 @@
       ],
       "canonicalFor": [],
       "packaged": true
+    },
+    {
+      "path": "docs/SECURITY_AUDIT_SKILL.md",
+      "id": "security-audit-skill",
+      "class": "guide",
+      "audience": [
+        "user",
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [
+        "security-audit-companion"
+      ],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/AI-AND-LLM.md",
+      "id": "cloudflare-audit-ai-and-llm",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/ATTACK-CLASSES.md",
+      "id": "cloudflare-audit-attack-classes",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/CLIENT-SIDE.md",
+      "id": "cloudflare-audit-client-side",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/CLOUD-AND-DEPLOYMENT.md",
+      "id": "cloudflare-audit-cloud-and-deployment",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/DATA-ISOLATION-AND-LIFECYCLE.md",
+      "id": "cloudflare-audit-data-isolation-and-lifecycle",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/DESKTOP-MOBILE-AND-LOCAL-IPC.md",
+      "id": "cloudflare-audit-desktop-mobile-and-local-ipc",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/HUNTING.md",
+      "id": "cloudflare-audit-hunting",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/MEMORY-SAFETY-AND-BINARY.md",
+      "id": "cloudflare-audit-memory-safety-and-binary",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/PROTOCOLS-RPC-AND-MESSAGING.md",
+      "id": "cloudflare-audit-protocols-rpc-and-messaging",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/RECONNAISSANCE.md",
+      "id": "cloudflare-audit-reconnaissance",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/RESOURCE-EXHAUSTION-AND-AVAILABILITY.md",
+      "id": "cloudflare-audit-resource-exhaustion-and-availability",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/SKILL.md",
+      "id": "cloudflare-audit-skill",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/SUPPLY-CHAIN-AND-RELEASE.md",
+      "id": "cloudflare-audit-supply-chain-and-release",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/VALIDATION-AND-REPORTING.md",
+      "id": "cloudflare-audit-validation-and-reporting",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/security-audit/WEB-PROTOCOL-AND-AUTH.md",
+      "id": "cloudflare-audit-web-protocol-and-auth",
+      "class": "reference",
+      "audience": [
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "docs/GUIDE_MAINTENANCE.md",
+      "id": "guide-maintenance",
+      "class": "guide",
+      "audience": [
+        "maintainer",
+        "harness",
+        "user"
+      ],
+      "canonicalFor": [
+        "guide-maintenance"
+      ],
+      "packaged": true
+    },
+    {
+      "path": "docs/REVENUE_CENTRIC_DESIGN.md",
+      "id": "revenue-centric-design",
+      "class": "guide",
+      "audience": [
+        "user",
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [
+        "revenue-design-companion"
+      ],
+      "packaged": true
+    },
+    {
+      "path": "skills/forgeloop/references/revenue-centric-design/SKILL.md",
+      "id": "revenue-centric-design-skill",
+      "class": "reference",
+      "audience": [
+        "user",
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "skills/forgeloop/references/revenue-centric-design/references/playbook.md",
+      "id": "revenue-centric-design-playbook",
+      "class": "reference",
+      "audience": [
+        "user",
+        "harness",
+        "maintainer"
+      ],
+      "canonicalFor": [],
+      "packaged": true
+    },
+    {
+      "path": "docs/STABLE_2_ACCEPTANCE.md",
+      "id": "stable-2-acceptance",
+      "class": "reference",
+      "audience": [
+        "user",
+        "maintainer"
+      ],
+      "canonicalFor": [
+        "stable-storage-release-acceptance"
+      ],
+      "packaged": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cassiomc1/forgeloop",
-  "version": "2.0.0-rc.5",
+  "version": "2.0.0",
   "description": "Evidence-first engineering protocol for AI coding environments and developer workflows",
   "repository": {
     "type": "git",
@@ -122,7 +122,14 @@
     "!src/core/workflow-compatibility.js",
     "!src/core/cli-metadata.js",
     "LICENSE",
-    "scripts/run-mcp-clean-tests.mjs"
+    "scripts/run-mcp-clean-tests.mjs",
+    "docs/SECURITY_AUDIT_SKILL.md",
+    "scripts/verify-security-audit-skill.mjs",
+    "skills/security-audit",
+    "docs/GUIDE_MAINTENANCE.md",
+    "docs/REVENUE_CENTRIC_DESIGN.md",
+    "scripts/verify-revenue-design-skill.mjs",
+    "docs/STABLE_2_ACCEPTANCE.md"
   ],
   "scripts": {
     "test": "node scripts/run-tests.js",
@@ -184,7 +191,9 @@
     "mcp:test:clean": "node scripts/run-mcp-clean-tests.mjs",
     "release:quick": "node scripts/run-rc-release.mjs",
     "release:rc:check": "node scripts/check-rc-release.mjs",
-    "storage:writer-inventory": "node scripts/storage-writer-inventory.mjs"
+    "storage:writer-inventory": "node scripts/storage-writer-inventory.mjs",
+    "security-skill:check": "node scripts/verify-security-audit-skill.mjs",
+    "revenue-skill:check": "node scripts/verify-revenue-design-skill.mjs"
   },
   "devDependencies": {
     "c8": "^12.0.0",

package/scripts/generate-forgeloop-skill.mjs

@@ -64,6 +64,14 @@ Respect active write claims. Do not steal, override, manually release, or edit o
 
 \`run-check\` executes the exact command and records ForgeLoop-owned provenance. \`record-check\` is serialization-only; its command text is metadata and is never executed. Claims, provider/advisory output, screenshots, and actor summaries are not evidence by themselves. Missing tools remain unavailable; do not auto-install a verifier.
 
+## Optional Security Audit Companion
+
+For requested source security questions or vulnerability reviews, ForgeLoop bundles Cloudflare's pinned \`security-audit\` companion under \`skills/security-audit/\` in its package/source root. Consult \`docs/SECURITY_AUDIT_SKILL.md\` there for setup, provenance, and authority boundaries. Load the companion only when available and relevant. Host discovery is opt-in; \`init\` and \`update\` do not install it. Routine security routing does not require a full audit. Full audits require an explicit audit/report request, independent verifiers, and the upstream execution isolation controls; unavailable capabilities remain explicit blockers. Preserve \`confirmed\`, \`needs_validation\`, and \`rejected\`; reports and report-validator success do not establish canonical evidence or ForgeLoop completion. This companion is separate from ForgeLoopAudit and the host-injected Security Review provider.
+
+## Optional Product Design Companion
+
+For relevant SaaS product journeys, activation, pricing clarity or retention work, read the bundled \`references/revenue-centric-design/SKILL.md\` relative to this skill directory. Consult \`docs/REVENUE_CENTRIC_DESIGN.md\` in the package root for setup and provenance. The adaptation credits Richard (@richardrx) and preserves the full custom source-available license, including its gambling/betting/casino-use exclusion. It is advisory, adds no guide ID or gate, and grants no lifecycle, evidence, payment or publication authority. Use measured user value, informed choice and accessibility as constraints; do not claim conversion lift from UI tests. No updater or media is bundled, and host discovery copies remain opt-in.
+
 ## Recovery Rules
 
 Use supported recovery only. Preserve failed evidence and follow \`next\` through diagnosis/correction. For state or ledger divergence, stop lifecycle mutation and inspect validation/classification. Never edit task state, receipts, recovery, continuity, claims, hashes, or \`events.ndjson\` manually. Reconcile \`COMMIT_UNKNOWN\` before any retry.

package/scripts/verify-revenue-design-skill.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { lstat, readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const defaultRoot = fileURLToPath(new URL("../skills/forgeloop/references/revenue-centric-design/", import.meta.url));
+const files = ["LICENSE", "SKILL.md", "references/playbook.md"];
+async function regular(filename, directory = false) {
+  const metadata = await lstat(filename);
+  if (metadata.isSymbolicLink() || !(directory ? metadata.isDirectory() : metadata.isFile())) throw new Error("Design companion must contain regular files and directories only");
+}
+export async function verifyRevenueDesignSkill({ rootDir = defaultRoot } = {}) {
+  await regular(rootDir, true);
+  await regular(path.join(rootDir, "references"), true);
+  await regular(path.join(rootDir, "PIN.json"));
+  const pin = JSON.parse(await readFile(path.join(rootDir, "PIN.json"), "utf8"));
+  if (pin.schemaVersion !== 1 || pin.repository !== "https://github.com/heliocosta-dev/revenue-centric-design"
+    || pin.commit !== "1942760c2242f609bf63ce2c97204f5a1791bd68"
+    || JSON.stringify(Object.keys(pin.files ?? {}).sort()) !== JSON.stringify(files)) throw new Error("Invalid design companion pin");
+  const rootNames = (await readdir(rootDir)).sort();
+  if (JSON.stringify(rootNames) !== JSON.stringify(["LICENSE", "PIN.json", "SKILL.md", "references"])
+    || JSON.stringify(await readdir(path.join(rootDir, "references"))) !== JSON.stringify(["playbook.md"])) throw new Error("Unexpected design companion files");
+  for (const name of files) {
+    const filename = path.join(rootDir, name);
+    await regular(filename);
+    const bytes = (await readFile(filename, "utf8")).replaceAll("\r\n", "\n");
+    const digest = createHash("sha256").update(bytes).digest("hex");
+    if (digest !== pin.files[name]) throw new Error(`Design companion hash mismatch: ${name}`);
+  }
+  if (pin.files.LICENSE !== pin.upstreamLicenseSha256) throw new Error("Upstream design license differs");
+  return { valid: true, commit: pin.commit, filesChecked: files.length, digestFormat: pin.digestFormat };
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try { console.log(JSON.stringify(await verifyRevenueDesignSkill())); }
+  catch (error) { console.error(error.message); process.exitCode = 1; }
+}

package/scripts/verify-security-audit-skill.mjs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+
+import { createHash } from "node:crypto";
+import { lstat, readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const defaultRoot = fileURLToPath(new URL("../skills/security-audit/", import.meta.url));
+const upstream = "https://github.com/cloudflare/security-audit-skill";
+const requiredFiles = ["SKILL.md", "LICENSE", "report-schema.json", "validate-findings.cjs", "validate-coverage-ledger.cjs"];
+
+async function regularFile(file) {
+  let metadata;
+  try { metadata = await lstat(file); } catch (error) {
+    if (error.code === "ENOENT") throw new Error(`Skill integrity: missing ${path.basename(file)}`);
+    throw error;
+  }
+  if (!metadata.isFile() || metadata.isSymbolicLink()) {
+    throw new Error(`Skill integrity: expected a regular file, no symlink: ${path.basename(file)}`);
+  }
+  return readFile(file);
+}
+
+function validatePin(pin) {
+  if (pin?.schemaVersion !== 1 || pin.repository !== upstream
+    || pin.upstreamDirectory !== "skills/security-audit" || pin.license !== "MIT"
+    || typeof pin.commit !== "string" || !/^[a-f0-9]{40}$/u.test(pin.commit)
+    || !pin.files || typeof pin.files !== "object" || Array.isArray(pin.files)) {
+    throw new Error("Skill integrity: invalid upstream pin");
+  }
+  for (const [name, digest] of Object.entries(pin.files)) {
+    if (name === "PIN.json" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(name)
+      || typeof digest !== "string" || !/^[a-f0-9]{64}$/u.test(digest)) {
+      throw new Error(`Skill integrity: unsafe filename or invalid digest: ${name}`);
+    }
+  }
+  if (requiredFiles.some(name => !Object.hasOwn(pin.files, name))) {
+    throw new Error("Skill integrity: invalid pin missing required resources");
+  }
+}
+
+export async function verifySecurityAuditSkill({ rootDir = defaultRoot } = {}) {
+  const metadata = await lstat(rootDir);
+  if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new Error("Skill integrity: expected a directory, no symlink");
+  const pin = JSON.parse(await regularFile(path.join(rootDir, "PIN.json")));
+  validatePin(pin);
+  const expected = [...Object.keys(pin.files), "PIN.json"].sort();
+  const actual = (await readdir(rootDir)).sort();
+  if (JSON.stringify(expected) !== JSON.stringify(actual)) {
+    throw new Error("Skill integrity: missing or unexpected files");
+  }
+  for (const [name, digest] of Object.entries(pin.files)) {
+    const bytes = await regularFile(path.join(rootDir, name));
+    if (createHash("sha256").update(bytes).digest("hex") !== digest) {
+      throw new Error(`Skill integrity: SHA-256 mismatch: ${name}`);
+    }
+  }
+  return { valid: true, commit: pin.commit, filesChecked: Object.keys(pin.files).length };
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    console.log(JSON.stringify(await verifySecurityAuditSkill()));
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+}

package/skills/forgeloop/SKILL.md

@@ -49,6 +49,14 @@ Respect active write claims. Do not steal, override, manually release, or edit o
 
 `run-check` executes the exact command and records ForgeLoop-owned provenance. `record-check` is serialization-only; its command text is metadata and is never executed. Claims, provider/advisory output, screenshots, and actor summaries are not evidence by themselves. Missing tools remain unavailable; do not auto-install a verifier.
 
+## Optional Security Audit Companion
+
+For requested source security questions or vulnerability reviews, ForgeLoop bundles Cloudflare's pinned `security-audit` companion under `skills/security-audit/` in its package/source root. Consult `docs/SECURITY_AUDIT_SKILL.md` there for setup, provenance, and authority boundaries. Load the companion only when available and relevant. Host discovery is opt-in; `init` and `update` do not install it. Routine security routing does not require a full audit. Full audits require an explicit audit/report request, independent verifiers, and the upstream execution isolation controls; unavailable capabilities remain explicit blockers. Preserve `confirmed`, `needs_validation`, and `rejected`; reports and report-validator success do not establish canonical evidence or ForgeLoop completion. This companion is separate from ForgeLoopAudit and the host-injected Security Review provider.
+
+## Optional Product Design Companion
+
+For relevant SaaS product journeys, activation, pricing clarity or retention work, read the bundled `references/revenue-centric-design/SKILL.md` relative to this skill directory. Consult `docs/REVENUE_CENTRIC_DESIGN.md` in the package root for setup and provenance. The adaptation credits Richard (@richardrx) and preserves the full custom source-available license, including its gambling/betting/casino-use exclusion. It is advisory, adds no guide ID or gate, and grants no lifecycle, evidence, payment or publication authority. Use measured user value, informed choice and accessibility as constraints; do not claim conversion lift from UI tests. No updater or media is bundled, and host discovery copies remain opt-in.
+
 ## Recovery Rules
 
 Use supported recovery only. Preserve failed evidence and follow `next` through diagnosis/correction. For state or ledger divergence, stop lifecycle mutation and inspect validation/classification. Never edit task state, receipts, recovery, continuity, claims, hashes, or `events.ndjson` manually. Reconcile `COMMIT_UNKNOWN` before any retry.

package/skills/forgeloop/references/revenue-centric-design/LICENSE

@@ -0,0 +1,30 @@
+Revenue-Centric Design Skill — License & Usage Terms
+Copyright (c) 2026 the curators of this repository.
+
+The underlying ideas, frameworks, examples, and the coined term "Revenue-Centric
+Design" are the intellectual property of Richard (@richardrx on X) and are used
+here WITH PERMISSION. This repository is a distilled, translated index of his
+public posts, shared for educational and reference use.
+
+You are granted permission to use, copy, and share this material, subject to ALL
+of the following conditions:
+
+1. ATTRIBUTION. You must retain clear attribution to Richard (@richardrx) and a
+   link to the source. Do not misrepresent the origin of these ideas.
+
+2. NO GAMBLING / BETTING / CASINO USE. You may NOT use this material — in whole
+   or in part — to design, build, optimize, market, or grow betting, casino,
+   gambling, or other real-money games-of-chance products or projects (including
+   loot-box and real-money-gaming mechanics). This restriction was set by the
+   original author as an explicit condition of reuse and MUST be preserved in any
+   copy or derivative.
+
+3. PRESERVE THESE TERMS. Any copy or derivative work must include this license in
+   full, including the restrictions above.
+
+4. NO WARRANTY. This material is provided "AS IS", without warranty of any kind,
+   express or implied. The curators and the original author are not liable for any
+   claim, damages, or other liability arising from its use.
+
+Note: Because of the field-of-use restriction in clause 2, this is a
+SOURCE-AVAILABLE license, not an OSI-approved open-source license.

package/skills/forgeloop/references/revenue-centric-design/PIN.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "repository": "https://github.com/heliocosta-dev/revenue-centric-design",
+  "commit": "1942760c2242f609bf63ce2c97204f5a1791bd68",
+  "license": "Custom source-available; attribution and no gambling/betting/casino use",
+  "adaptation": "ForgeLoop-focused entry point and local playbook; full upstream license retained; upstream references linked at the pinned commit; no updater or media bundled.",
+  "digestFormat": "SHA-256 of UTF-8 file bytes after CRLF to LF normalization",
+  "upstreamLicenseSha256": "29e6d8b0a1e3dd78776b46b22b9a9a3df94fdbf6a73482f59d688dee7fd38e32",
+  "files": {
+    "LICENSE": "29e6d8b0a1e3dd78776b46b22b9a9a3df94fdbf6a73482f59d688dee7fd38e32",
+    "SKILL.md": "666ca4a0a7a1b2a8adf2882aa4571c30d51316c2163ea1ba1fd4d3424183d655",
+    "references/playbook.md": "0cdf065d41e4baa33a45bd0ad0e13bc57fcb237e768a27f8b494415aebb24805"
+  }
+}

package/skills/forgeloop/references/revenue-centric-design/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: revenue-centric-design
+description: Improve SaaS product journeys, activation, pricing clarity and retention using evidence-led design hypotheses. Use for relevant product or UX work; exclude gambling, betting, casino and real-money games-of-chance products.
+---
+
+# Revenue-centric design for ForgeLoop
+
+Adapted from [heliocosta-dev/revenue-centric-design](https://github.com/heliocosta-dev/revenue-centric-design/tree/1942760c2242f609bf63ce2c97204f5a1791bd68),
+curated from **Richard ([@richardrx](https://x.com/richardrx))**. Preserve this
+attribution, source link and the complete [custom license](LICENSE) in copies
+or derivatives. This material is source-available, with a field-of-use restriction;
+it is not covered by ForgeLoop's license.
+
+Do not apply this material to betting, casino, gambling or real-money
+games-of-chance products, including loot-box and real-money-gaming mechanics.
+The upstream permission excludes those uses.
+
+## Apply to the actual journey
+
+Use when product work concerns landing-page clarity, signup, checkout,
+onboarding, pricing, useful dashboards or retention. Do not load it for
+unrelated storage, security or protocol maintenance. For ForgeLoopAudit,
+use it only when changing the auditor's user journey: optimize comprehension,
+first successful inspection and actionable evidence, never simulated revenue.
+
+Read [the focused playbook](references/playbook.md) and only the upstream
+pinned theme relevant to the request. The playbook links each theme separately.
+No updater, media download, external account or Skills CLI is needed.
+
+1. Inspect the implemented journey and real product facts. Identify the user's
+   intended outcome, the friction observed and one measurable value event.
+   Avoid inventing customer segments, pricing, conversion baselines or proof.
+2. Choose a small reversible intervention. State the mechanism as a hypothesis,
+   the expected user benefit, the business metric and possible user harm.
+   A cited anecdote or statistic is not an expected result for this product.
+3. Follow the project's ForgeLoop contract, selected design/accessibility guides
+   and canonical `next` actions. This companion neither adds guide IDs or gates
+   nor grants lifecycle, evidence, publication or payment authority.
+4. Verify the changed journey: understandable copy, complete price and renewal
+   disclosure, keyboard/focus behavior, errors, responsive layout and an honest
+   empty state. Use the host's available browser tools when behavior changes.
+5. Report observed usability separately from measured commercial impact.
+   Without sufficient real traffic or a sound experiment, report a design
+   hypothesis and qualitative observations, not a conversion improvement.
+
+## Preserve informed choice
+
+Keep cancellation, opt-out and account deletion findable and usable. Explain
+consequences accurately and allow the user to continue. Do not introduce fake
+urgency, fabricated reviews/logos, concealed charges, misleading plan comparisons,
+preselected paid upgrades or obstacles designed to trap users. Defaults should
+serve the intended task and remain visible and reversible. Do not add tracking,
+paid experiments or third-party services merely to use this companion.
+
+Upstream examples and numeric rules are contextual source claims. Check their
+original sources before quoting them as facts; do not treat them as universal
+thresholds, verified research or financial guidance.
+
+## Suggested review result
+
+Return the inspected journey, observed friction, selected source principle,
+proposed change, user-value metric, guardrail metric, verification performed
+and unresolved measurement. Implementation remains within the user's scope.
+The companion's review is advisory and cannot establish `COMPLETE` or `VALID`.

package/skills/forgeloop/references/revenue-centric-design/references/playbook.md

@@ -0,0 +1,36 @@
+# Focused journey playbook
+
+Adapted with attribution to Richard ([@richardrx](https://x.com/richardrx)) and
+[the pinned upstream curation](https://github.com/heliocosta-dev/revenue-centric-design/tree/1942760c2242f609bf63ce2c97204f5a1791bd68).
+The complete [custom license](../LICENSE), including its no-gambling-use
+restriction, applies. The prompts below are design hypotheses, not measured
+results or universal benchmarks.
+
+| Journey | Useful intervention | Observe | Guardrail | Read when needed |
+| --- | --- | --- | --- | --- |
+| Landing page | Describe the actual audience, problem, delivered outcome and next step; show available product proof | Can a new visitor explain the offer and begin the intended task? | No invented claims, testimonials or customer logos | [Conversion](https://github.com/heliocosta-dev/revenue-centric-design/blob/1942760c2242f609bf63ce2c97204f5a1791bd68/references/conversion-and-landing-pages.md) |
+| Signup and checkout | Request information when needed and show total cost before commitment | Task completion, field errors and abandonment at a specific step | No hidden fees or unconsented paid choices; preserve security checks | [Forms](https://github.com/heliocosta-dev/revenue-centric-design/blob/1942760c2242f609bf63ce2c97204f5a1791bd68/references/checkout-and-forms.md) |
+| First use | Make the first real value event obvious; provide a useful empty state and recoverable errors | Time to the first successful value event | No fake success, mandatory unrelated setup or premature upgrade interruption | [Activation](https://github.com/heliocosta-dev/revenue-centric-design/blob/1942760c2242f609bf63ce2c97204f5a1791bd68/references/onboarding-and-activation.md) |
+| Pricing and limits | Explain who a plan serves, actual limits, billing cadence and upgrade consequences | Understanding of the choice and successful intended purchase | Total price, renewals and trial conditions stay explicit | [Pricing](https://github.com/heliocosta-dev/revenue-centric-design/blob/1942760c2242f609bf63ce2c97204f5a1791bd68/references/pricing-and-monetization.md) |
+| Retention and cancellation | Fix mismatches between promised and delivered value; offer relevant alternatives while preserving an easy exit | Repeated value events, cancellation reasons and support burden | Successful cancellation and opt-out remain first-class outcomes | [Retention](https://github.com/heliocosta-dev/revenue-centric-design/blob/1942760c2242f609bf63ce2c97204f5a1791bd68/references/churn-and-retention.md) |
+| Dashboard | Put the user's next decision beside understandable evidence and explicit freshness | Can the user interpret the state and take the next useful action? | Missing or stale data must remain visible; color is not the only signal | [Dashboards](https://github.com/heliocosta-dev/revenue-centric-design/blob/1942760c2242f609bf63ce2c97204f5a1791bd68/references/dashboards-and-data-viz.md) |
+| Feature scope | Prefer the smallest feature that resolves observed user friction | Adoption and completion of the value event | Avoid increasing setup cost or hiding existing core functionality | [Product strategy](https://github.com/heliocosta-dev/revenue-centric-design/blob/1942760c2242f609bf63ce2c97204f5a1791bd68/references/product-strategy-and-features.md) |
+| Positioning | Use confirmed customer needs and demonstrated differentiation | Whether the intended audience understands the offer | An assumption is labeled until validated | [Positioning](https://github.com/heliocosta-dev/revenue-centric-design/blob/1942760c2242f609bf63ce2c97204f5a1791bd68/references/positioning-icp-and-gtm.md) |
+| Experiment | Define the value event, hypothesis, comparison and stopping rule before measurement | Sample size, uncertainty and guardrail outcomes | Do not stop opportunistically or infer business lift from a UI test | [Measurement](https://github.com/heliocosta-dev/revenue-centric-design/blob/1942760c2242f609bf63ce2c97204f5a1791bd68/references/metrics-and-experimentation.md) |
+
+For cross-cutting rationale, read the pinned [design method](https://github.com/heliocosta-dev/revenue-centric-design/blob/1942760c2242f609bf63ce2c97204f5a1791bd68/references/revenue-centric-design.md),
+[behavioral toolkit](https://github.com/heliocosta-dev/revenue-centric-design/blob/1942760c2242f609bf63ce2c97204f5a1791bd68/references/behavioral-science-toolkit.md)
+or [differentiation discussion](https://github.com/heliocosta-dev/revenue-centric-design/blob/1942760c2242f609bf63ce2c97204f5a1791bd68/references/ai-era-differentiation.md)
+only when relevant. These are external references; offline use remains possible
+with this local playbook. A reference link does not authorize scraping X or
+running upstream updater scripts.
+
+## ForgeLoop and ForgeLoopAudit example
+
+For a new auditor opening a project, define the value event as a successful
+read-only inspection with a comprehensible finding and canonical next action.
+Review project selection, empty/error states, evidence freshness and navigation.
+Measure task success and time-to-understanding in a user study if available.
+A successful browser test demonstrates that the journey works; it does not
+prove activation, retention or revenue lift. Preserve read-only authority,
+source identity, accessibility and every integrity warning.