@fraylabs/possible 0.1.9 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fray Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/possible/SKILL.md

@@ -1,124 +1,117 @@
 ---
 name: possible
-description: Turn an unclear ambition into a concrete, verified outcome through a short guided conversation, then assemble and run the right reviewed Codex skills after confirmation. Use when the user invokes $possible, asks what they should build, ship, fund, release, operate, or schedule, wants help defining an outcome before implementation, or wants a Working Web App, Playable Web Game, Robot Prototype, Hardware Launch, Software Launch, Open-Source Release, Production Web Release, Billion-Dollar SaaS, Kickstarter Funding, Kickstarter Fulfillment, recurring Web App Operations, or recurring Marketing Operations outcome coordinated end to end.
+description: Discover proven Outcomes and turn a rough request into one complete execution prompt for a fresh agent. Also author and validate source-owned Outcomes for Possible.
 ---
 
 # Possible
 
-Possible.sh is an open-source library of Outcome Packs. `$possible` is the installed agent skill that helps the user clarify a finished outcome, recommends the right Outcome Pack, and runs it after confirmation. Keep the experience conversational: help shape the idea before choosing how to achieve it.
+Possible connects three things:
 
-## Begin with the outcome
+- the user's **original prompt**;
+- the complete **execution prompt** sent to a working agent;
+- the resulting **Outcome**.
 
-When invoked as only `$possible`, warmly invite the user to begin. Use this default unless the conversation suggests more fitting language:
+An Outcome is precedent to inspect and remix, not a rigid workflow. Preserve useful creative freedom while giving a fresh agent the context, current methods, and concrete inputs it needs.
 
-> What would you like to make possible today? A rough idea is enough — we can brainstorm it together.
+## Discover before writing
 
-“What are you trying to make real?” is an acceptable shorter variation when it better matches the user's tone.
+Preserve the user's original prompt verbatim. Determine whether they want to browse possibilities, prepare a prompt, execute work, or publish completed work.
 
-Do not inspect files, name Outcome Packs, install agent skills, create artifacts, or start subagents yet.
+For browsing or execution, call `search_outcomes` using ordinary language. Show up to five relevant Outcomes when the user is browsing. When preparing work, fetch the strongest candidates with `fetch_outcome` and read their exact prompts. Search scores indicate text similarity, not quality.
 
-When the invocation already includes an idea, respond with genuine interest, reflect the idea in one short sentence, and ask the single most useful unanswered question. Ask only one question per turn so the exchange feels like a shared brainstorm, not a form. If the user wants to explore possibilities, help them shape the idea instead of forcing premature specificity.
+Use Outcomes as concrete precedent. If none fit, use current primary sources rather than forcing an unrelated example. Prefer official documentation, current source repositories and registries, then reproducible community examples. Check volatile information at run time. Popularity is a discovery signal, not proof that an Outcome is good.
 
-Discover only what can change the outcome:
+## Resolve consequential unknowns
 
-- what the user wants to exist when the work is finished;
-- what is already real: idea, repository, prototype, users, assets, or evidence;
-- who the outcome is for and what it must help them do;
-- the deadline or proof standard that matters;
-- for recurring work, the cadence, timezone, project, evidence source, and whether each run should only report findings or may prepare repo-local changes;
-- whether any external action such as deployment, publishing, outreach, spending, fabrication, or data collection is authorized.
+Collect only what can materially improve execution:
 
-Inspect the project read-only when it can answer a question. Do not ask the user for facts available in the workspace. Stop interviewing when another answer is unlikely to change the recommended outcome, boundaries, or acceptance checks; two to five questions is usually enough.
+- the intended result, audience, use, and strong preferences;
+- supplied files, measurements, references, credentials, and constraints;
+- required inputs that the executor cannot safely invent;
+- relevant prior Outcomes and what they actually produced;
+- current Products, Skills, tools, environment, permissions, and limits;
+- what the user will inspect to decide that the result is finished.
 
-During the brainstorm:
+Ask the fewest questions necessary. Discover safe facts yourself. Infer harmless aesthetic details when a restrained default is sufficient. Do not turn the conversation into a form.
 
-- Do not mention Outcome Pack names or selected agent skills.
-- Do not create `PRODUCT-BRIEF.md`, `RUN-PROMPT.md`, or `AGENTS.md`.
-- Do not install dependencies, edit files, or spawn subagents.
-- Do not invent facts to make the idea appear more complete.
+## Prepare one execution prompt
 
-## Recommend one Outcome Pack
+Write one readable, self-contained prompt for a fresh agent. It should naturally state:
 
-After the walkthrough, read [references/packs.md](references/packs.md). If `list_packs` and `compile_pack` are available, use them to check for a newer canonical Outcome Pack definition; otherwise the bundled reference is the runtime source.
+- the exact result and who it is for;
+- relevant user context and supplied materials;
+- concrete requirements and preferences;
+- current Products, Skills, or tools that matter;
+- deliverables and where to place them;
+- constraints, permissions, and separately authorized external actions;
+- what the user will inspect to judge the result;
+- unknowns the executor must preserve rather than invent.
 
-Recommend one primary Outcome Pack. Use multiple Outcome Packs only when the user has explicitly described multiple independently valuable outcomes; stage the runs instead of merging their workstreams.
+Adapt prior prompts to the current request, date, model, environment, and evidence. Never substitute a summary for a strong full prompt. Never claim an old method is current without checking. Keep the published prompt distinct from the new prompt you prepare.
 
-Catalog categories are browsing metadata, not intake choices. Do not ask the user to choose one; recommend across the complete catalog from the desired finished outcome.
+Before handoff, confirm that a fresh agent can start without hidden conversation history, missing essential files, consequential unresolved choices, unsupported current claims, or unclear success conditions. Research further or ask one focused question if it cannot.
 
-Keep the recommendation compact and conversational. Present:
+Show the proposed execution prompt and name the prior Outcomes and current official sources that materially shaped it.
 
-1. **What I think you want to make** — a brief outcome statement and any material assumption.
-2. **Recommended Outcome Pack** — link its name to `https://possible.sh/packs/<slug>` and explain in one or two sentences why it fits.
-3. **What it will produce** — the concrete outputs and the most important acceptance checks.
-4. **Before I run it** — note any relevant boundary or external action that remains unauthorized.
+## Hand off once
 
-Treat scheduling as an execution option, not a separate Outcome Pack or catalog category. If the user asks to “schedule operations,” distinguish the repeated job: recommend Web App Operations for live-product reliability and maintenance, Marketing Operations for recurring positioning, campaign planning, draft production, measurement, and review, or Kickstarter Fulfillment for a funded campaign's production-to-shipment control loop. Ask one concise disambiguating question when needed. Say that the first cycle will be tested manually before any recurring task is enabled. Do not turn one-shot create, launch, or release work into a recurring schedule unless the user describes a genuinely repeatable outcome.
+After approval, send the execution prompt unchanged to a fresh subagent when that capability is available. Include explicit paths or attachments for every supplied file. One-shot means complete starting context; it does not forbid the executor from inspecting, testing, or repairing its work.
 
-End with:
+If fresh subagents are unavailable, return the execution prompt in a copyable block. Do not pretend a handoff occurred.
 
-> Want me to proceed with this Outcome Pack? If you say yes, I’ll install its reviewed agent skills in this project, create the shared outcome brief, and start the run. I won’t take any external action without separate approval.
+Products and Skills describe capabilities. They do not grant permission to spend money, purchase, publish, deploy, contact people, fabricate, operate hardware, or perform another external action.
 
-“Proceed with this outcome?” is an acceptable shorter confirmation question, but never omit what confirmation authorizes.
+## Author a completed Outcome
 
-Do not install, edit, create state, or begin execution before a direct confirmation such as “yes, proceed,” “use this Outcome Pack,” or “go ahead.” Do not treat a question, a correction, or general enthusiasm as confirmation. If the user corrects the recommendation, update the understanding and recommend again instead of defending the first answer.
+When the user wants to publish completed work, inspect the real result and preserve the exact prompt and provenance. Create one folder:
 
-## Prepare the run after confirmation
+```text
+outcomes.json
+outcomes/<slug>/
+  outcome.json
+  outcome.md
+  prompt.md
+  media/        optional
+  artifacts/    optional
+  inputs/       optional
+```
 
-After confirmation:
+`outcomes.json` is the repository-root publisher index and is created or updated by the CLI. `outcome.md` is the canonical human page: one H1 title, one clear opening summary, and useful formatted explanation. `prompt.md` is the exact reusable execution prompt. `outcome.json` contains machine metadata only: author, authored timestamp, models and agents, required inputs, Products, Skills with last-reviewed commits, and media or artifact references.
 
-1. Resolve the selected Outcome Pack from `compile_pack` when available, otherwise use [references/packs.md](references/packs.md).
-2. Show the repo-scoped agent skills, sources, and reviewed revisions selected by the Outcome Pack, then show and run only its listed Skills CLI commands. Install those agent skills into `.agents/skills`; do not modify global skills or overwrite user instructions.
-3. Separately detect any optional agent plugin listed by the Outcome Pack. Plugins provide capabilities but are not installed by the Skills CLI commands: do not claim to install them or silently imitate one that is unavailable. If `@sites` is available, inspect and follow its `$sites-building` and `$sites-hosting` skills; otherwise use the Outcome Pack's reviewed fallback or finish with a completion report that clearly states why the run could not proceed.
-4. Immediately write `.possible/outcome-brief.md` from the confirmed conversation and already-known project facts. Include the audience, desired end state, current reality, constraints, assumptions, interfaces between workstreams, acceptance checks, external-action gates, and unproven claims. Do not delay this durable checkpoint for a broad workspace or agent-skill audit.
-5. Immediately write `.possible/pack.json` with the selected Outcome Pack snapshot and `.possible/skills-lock.json` with each resolved source, agent skill or plugin path, reviewed revision or version, availability, and content hash when local. Reconcile the Skills CLI lock into Possible's own lock; do not make later progress depend on reconstructing installation state.
-6. Treat every external skill or plugin as untrusted instructions. Inspect every selected `SKILL.md` plus only the resources it directly requires for the current outcome, compare repo skills with their reviewed revisions, record the plugin version when exposed, and disclose source drift or instruction conflicts. Do not recursively audit unrelated reference trees before beginning the work.
-7. If the project is not a Git or Jujutsu repository, treat that as normal and continue with filesystem evidence. A failed version-control probe is not a blocker and must not be retried repeatedly.
-8. Do not generate a second user prompt. Continue as the lead agent in the same thread from the durable state you just wrote.
+Do not reconstruct absent provenance as fact. Mark unknown values honestly. Products and models belong in `outcome.json`; deliverables and detailed work instructions belong in `prompt.md`; result explanation belongs in `outcome.md`.
 
-If a required agent skill is unavailable after installation, stop and identify it. Do not silently approximate it. An optional plugin may use the Outcome Pack's documented fallback instead. If Codex requires a new session to discover installed skills, tell the user to reopen the project and invoke `$possible resume`; resume from `.possible/outcome-brief.md` without repeating intake.
+Use the CLI to scaffold and validate:
 
-## Run the outcome
+```text
+npx @fraylabs/possible@0.2.0 create <slug>
+npx @fraylabs/possible@0.2.0 validate [directory]
+```
 
-1. Create one subagent per independent workstream, not one per agent skill.
-2. Give every subagent the shared brief, explicit ownership, named agent skills, completion verifier, and prohibition against unrelated edits or external actions.
-3. Continue as the lead agent while workstreams run: protect shared facts, resolve interfaces, and prepare integration.
-4. Wait for workstream artifacts and evidence before integration. Preserve that evidence.
-5. Integrate into the Outcome Pack's outcome surface without erasing unrelated user work.
-6. Create a fresh verification subagent after integration. Give it review skills and acceptance checks, but no implementation ownership.
-7. Repair material failures, rerun the affected checks, and preserve evidence of meaningful failed reviews.
-8. Finish with a completion report listing artifacts, verifier commands, passed, failed, skipped, and unproven checks, limitations, and every external action not taken.
+## Publish from the owner's source
 
-## Schedule a recurring outcome
+Possible does not host publisher accounts or own the canonical files. A publisher exposes Outcomes from either:
 
-Schedule only after the Outcome Pack's first cycle succeeds manually. Scheduling is a separate external action; Outcome Pack confirmation does not authorize creating, updating, or enabling a scheduled task.
+- a public GitHub repository; or
+- `https://publisher.example/.well-known/possible/outcomes.json`.
 
-When the user wants recurrence:
+The publisher index is a thin list of manifest locations. Possible snapshots the public source revision and displays it; changing the source creates a new revision rather than rewriting history.
 
-1. Draft the exact schedule: task name, cadence, timezone, project, standalone task or existing chat, local checkout or worktree, durable prompt, allowed inputs, expected completion report, stop conditions, and permissions. Ask only for material unknowns.
-2. Default recurring operations to a standalone scheduled task in an isolated worktree so each run is reviewable and cannot collide with unfinished local work. Use the existing chat only when conversational continuity is essential. Use the local checkout only after disclosing that unattended runs can modify active files.
-3. Default the task to report findings and prepare reviewable repo-local evidence. Never grant unattended authority for deployment, restarts, production configuration, DNS, paging, customer communication, spending, publishing, issue-tracker writes, secrets, or customer data.
-4. Make the durable prompt invoke `$possible resume`, read `.possible/outcome-brief.md`, `.possible/pack.json`, `.possible/skills-lock.json`, and the latest completion report under the selected Outcome Pack's artifact root, run exactly one cycle, carry unresolved work forward, write a new collision-free dated completion report, report material findings, and stop for any gated action. Existing `receipt` path names remain valid compatibility paths.
-5. Show the complete proposed schedule and request direct approval to create or update that exact task. After approval, use the product's scheduled-task capability when available and record its returned identifier, cadence, timezone, project, execution mode, prompt, and enabled state in `.possible/schedule.json`.
-6. If scheduled-task management is unavailable on the current surface, finish and test the durable prompt, then tell the user to create it from ChatGPT web or the desktop app. Do not claim it is scheduled. For a local project, disclose that the machine must remain on, the app must be running, and the project must remain available.
+```text
+npx @fraylabs/possible@0.2.0 publish [owner/repository | https://publisher.example]
+npx @fraylabs/possible@0.2.0 add <owner/repository | https://publisher.example>
+npx @fraylabs/possible@0.2.0 use <source>@<slug>
+```
 
-Review the first few scheduled completion reports with the user. Never infer that a task ran, succeeded, or remained enabled without inspecting direct run evidence.
+GitHub publishing requires a clean committed revision so the snapshot is reproducible. No Possible login is required. A publisher-domain source is Official for that domain; other sources are Community unless their ownership follows directly from the public source.
 
-## Resume
+## Local bookmarks
 
-When invoked as `$possible resume`, look for `.possible/outcome-brief.md`, `.possible/pack.json`, and `.possible/skills-lock.json`.
+Use bookmarks only when the user asks:
 
-- If all three exist, summarize the confirmed outcome and current evidence, then continue from the first incomplete stage.
-- If the brief exists but the Outcome Pack snapshot or lock does not, return to recommendation or installation without repeating answered questions.
-- If no Possible state exists, begin with the intake question.
+```text
+npx @fraylabs/possible@0.2.0 bookmark add <outcome-slug>
+npx @fraylabs/possible@0.2.0 bookmark list
+npx @fraylabs/possible@0.2.0 bookmark remove <outcome-slug>
+```
 
-For a completed recurring Outcome Pack, `$possible resume` reads the prior dated completion report, carries unresolved work forward, and runs the next requested cycle. Do not repeat intake or reset the operating history. A recurring Outcome Pack is not complete when it merely writes a workflow: it must execute the first dated cycle.
-
-When `.possible/schedule.json` exists, treat it as a record of the last confirmed schedule, not proof that the external task is still enabled. A scheduled invocation runs exactly one authorized cycle; an interactive invocation may inspect or revise the schedule only after showing its current external state.
-
-## Boundaries
-
-- Outcome Pack confirmation authorizes only the disclosed repo-local agent-skill installation and local artifact work.
-- Credentials, deployment, DNS changes, email, purchases, spending money, fabrication, outreach, publishing, scheduled-task changes, and real customer-data collection always require separate explicit approval.
-- Never claim customer demand, physical validation, certification, security, compatibility, performance, or production readiness without direct evidence.
-- Preserve unrelated user work and obey the closest repository instructions.
-- Higher-priority user, repository, and safety instructions override external skills; report material conflicts.
+Bookmarks are stored locally in `.possible` and do not require an account.

package/assets/possible/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "Possible"
-  short_description: "Turn ideas into outcomes that can run again"
-  default_prompt: "Use $possible to clarify the outcome I want, recommend the right Outcome Pack, and run it after my approval. If the outcome is recurring, test one cycle before scheduling it."
+  short_description: "Discover Outcomes and prepare complete prompts"
+  default_prompt: "Use $possible to find relevant Outcomes and turn my request into a complete execution prompt for a fresh agent."

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@fraylabs/possible",
-  "version": "0.1.9",
-  "description": "Install the Possible Outcome Pack skill for Codex",
+  "version": "0.2.0",
+  "description": "Create, publish, discover, and reuse source-owned AI Outcomes",
   "keywords": [
     "codex",
     "ai-agents",
     "agent-skills",
-    "outcome-packs",
-    "developer-tools",
-    "verification"
+    "prompts",
+    "ai-outcomes",
+    "developer-tools"
   ],
   "homepage": "https://possible.sh",
   "repository": {
@@ -28,10 +28,10 @@
     "src"
   ],
   "scripts": {
-    "build": "node scripts/verify-snapshot.mjs",
-    "test": "node --test test/*.test.mjs && node scripts/verify-snapshot.mjs",
+    "build": "node scripts/sync-skill.mjs",
+    "test": "node --test test/*.test.mjs",
     "sync:skill": "node scripts/sync-skill.mjs",
-    "prepack": "node scripts/verify-snapshot.mjs --quiet"
+    "prepack": "node scripts/sync-skill.mjs"
   },
   "engines": {
     "node": ">=22"

package/src/bookmarks.mjs

@@ -0,0 +1,72 @@
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+
+const SAFE_SLUG = /^[a-z0-9][a-z0-9-]*$/;
+const emptyBookmarks = () => ({ schemaVersion: 1, outcomes: [] });
+
+export const bookmarkFilePath = (environment = process.env) => join(
+  environment.POSSIBLE_HOME ? resolve(environment.POSSIBLE_HOME) : join(homedir(), ".possible"),
+  "bookmarks.json",
+);
+
+const validateBookmarks = (input, path) => {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error(`Bookmarks at ${path} must be a JSON object`);
+  if (input.schemaVersion !== 1 || !Array.isArray(input.outcomes)) throw new Error(`Bookmarks at ${path} must contain schemaVersion 1 and an outcomes array`);
+  const slugs = new Set();
+  const outcomes = input.outcomes.map((bookmark, index) => {
+    if (bookmark === null || typeof bookmark !== "object" || Array.isArray(bookmark)) throw new Error(`Bookmark ${index + 1} must be an object`);
+    if (Object.keys(bookmark).some((key) => !["slug", "savedAt"].includes(key))) throw new Error(`Bookmark ${index + 1} contains an unsupported field`);
+    if (!SAFE_SLUG.test(bookmark.slug)) throw new Error(`Bookmark ${index + 1}.slug must be lowercase and hyphenated`);
+    if (slugs.has(bookmark.slug)) throw new Error(`Bookmarks at ${path} contain duplicate Outcome ${bookmark.slug}`);
+    if (typeof bookmark.savedAt !== "string" || Number.isNaN(Date.parse(bookmark.savedAt))) throw new Error(`Bookmark ${index + 1}.savedAt must be an ISO date or date-time`);
+    slugs.add(bookmark.slug);
+    return { slug: bookmark.slug, savedAt: bookmark.savedAt };
+  });
+  return { schemaVersion: 1, outcomes };
+};
+
+const readBookmarks = async (path) => {
+  const contents = await readFile(path, "utf8").catch((error) => error?.code === "ENOENT" ? undefined : Promise.reject(error));
+  if (contents === undefined) return emptyBookmarks();
+  try {
+    return validateBookmarks(JSON.parse(contents), path);
+  } catch (error) {
+    if (error instanceof SyntaxError) throw new Error(`Bookmarks at ${path} contain invalid JSON and were left unchanged`);
+    throw error;
+  }
+};
+
+const writeBookmarks = async (path, bookmarks) => {
+  await mkdir(dirname(path), { recursive: true });
+  const temporaryPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+  await writeFile(temporaryPath, `${JSON.stringify(bookmarks, null, 2)}\n`, { flag: "wx" });
+  await rename(temporaryPath, path);
+};
+
+export async function runBookmarkCommand(args, options = {}) {
+  const [command, slug, ...rest] = args;
+  if (rest.length > 0) throw new Error("Bookmark commands accept only one Outcome slug");
+  const path = bookmarkFilePath(options.environment);
+  const bookmarks = await readBookmarks(path);
+
+  if (command === "list") {
+    if (slug !== undefined) throw new Error("Usage: possible bookmark list");
+    return bookmarks.outcomes.length ? bookmarks.outcomes.map(({ slug: value }) => value).join("\n") : "No bookmarked Outcomes.";
+  }
+  if ((command === "add" || command === "remove") && (!slug || !SAFE_SLUG.test(slug))) throw new Error(`Usage: possible bookmark ${command} <outcome-slug>`);
+  if (command === "add") {
+    if (bookmarks.outcomes.some(({ slug: value }) => value === slug)) return `${slug} is already bookmarked.`;
+    bookmarks.outcomes.push({ slug, savedAt: new Date().toISOString() });
+    bookmarks.outcomes.sort((left, right) => left.slug.localeCompare(right.slug));
+    await writeBookmarks(path, bookmarks);
+    return `Bookmarked ${slug}.`;
+  }
+  if (command === "remove") {
+    if (!bookmarks.outcomes.some(({ slug: value }) => value === slug)) throw new Error(`No bookmarked Outcome matches ${slug}`);
+    bookmarks.outcomes = bookmarks.outcomes.filter(({ slug: value }) => value !== slug);
+    await writeBookmarks(path, bookmarks);
+    return `Removed bookmark ${slug}.`;
+  }
+  throw new Error(`Unknown bookmark command: ${command ?? ""}`);
+}

package/src/index.mjs

@@ -1,33 +1,93 @@
 #!/usr/bin/env node
 
 import process from "node:process";
+import { runBookmarkCommand } from "./bookmarks.mjs";
 import { installPossibleSkill } from "./init.mjs";
+import { addOutcomeSource, createOutcome, publishOutcomeSource, useOutcome, validateOutcomes } from "./outcome-commands.mjs";
 
 const HELP = `Possible CLI
 
 Usage:
   possible init
+  possible create <slug>
+  possible validate [directory]
+  possible publish [owner/repository | https://publisher.example]
+  possible add <owner/repository | https://publisher.example>
+  possible use <source>@<slug>
+  possible bookmark <command>
 
 Commands:
-  init  Install the Possible skill into the current project
+  init      Install the optional Possible prompt-preparation skill into this project
+  create    Create outcome.json, outcome.md, prompt.md, and media/ for one Outcome
+  validate  Validate every Outcome folder below a directory
+  publish   Validate and submit one public publisher source; no account required
+  add       Discover a public source and save it to .possible/sources.json
+  use       Print one exact execution prompt to standard output
+  bookmark  add | list | remove locally saved Outcome slugs
 `;
 
 const args = process.argv.slice(2);
-
 if (args.length === 0 || args.includes("--help") || args.includes("-h")) {
   process.stdout.write(HELP);
   process.exitCode = args.length === 0 ? 1 : 0;
+} else if (args[0] === "bookmark") {
+  try {
+    const result = await runBookmarkCommand(args.slice(1));
+    if (result) process.stdout.write(`${result}\n`);
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+  }
+} else if (args[0] === "create" && args.length === 2) {
+  try {
+    const folder = await createOutcome(args[1]);
+    process.stdout.write(`Created ${folder}\n`);
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+  }
+} else if (args[0] === "validate" && args.length <= 2) {
+  try {
+    const result = await validateOutcomes(args[1] ?? process.cwd());
+    process.stdout.write(`Validated ${result.count} Outcome${result.count === 1 ? "" : "s"}.\n`);
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+  }
+} else if (args[0] === "add" && args.length === 2) {
+  try {
+    const result = await addOutcomeSource(args[1]);
+    process.stdout.write(`Added ${result.discovery.locator}: ${result.discovery.outcomes.length} Outcome${result.discovery.outcomes.length === 1 ? "" : "s"}.\nSaved ${result.sourcesPath}\n`);
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+  }
+} else if (args[0] === "use" && args.length === 2) {
+  try {
+    const result = await useOutcome(args[1]);
+    process.stdout.write(`${result.outcome.prompt}\n`);
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+  }
+} else if (args[0] === "publish" && args.length <= 2) {
+  try {
+    const result = await publishOutcomeSource(args[1]);
+    const publicUrl = result.result.url ?? result.result.href;
+    const outcomes = Array.isArray(result.result.outcomes) ? result.result.outcomes : [];
+    const locator = result.result.source?.locator ?? result.source;
+    process.stdout.write(`Published ${outcomes.length} Outcome${outcomes.length === 1 ? "" : "s"} from ${locator}.${publicUrl ? `\n${publicUrl}` : ""}\n`);
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+  }
 } else if (args.length !== 1 || args[0] !== "init") {
   process.stderr.write(`Unknown command: ${args.join(" ")}\n\n${HELP}`);
   process.exitCode = 1;
 } else {
   try {
     const result = await installPossibleSkill();
-    process.stdout.write(
-      `${result.changed ? "Possible installed" : "Possible is already installed"} at ${result.installPath}\n\n` +
-        "Open Codex in this project and type:\n\n" +
-        "  $possible\n",
-    );
+    process.stdout.write(`${result.changed ? "Possible installed" : "Possible is already installed"} at ${result.installPath}\n\nOpen Codex in this project and type:\n\n  $possible\n`);
   } catch (error) {
     process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
     process.exitCode = 1;

package/src/outcome-commands.mjs

@@ -0,0 +1,134 @@
+import { execFile } from "node:child_process";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { promisify } from "node:util";
+import { discoverLocalOutcomes } from "./outcome-format.mjs";
+import { discoverOutcomeSource } from "./sources.mjs";
+
+const execFileAsync = promisify(execFile);
+const SAFE_SLUG = /^[a-z0-9][a-z0-9-]*$/;
+const DEFAULT_PUBLISH_ENDPOINT = "https://abutwsaahahtbtlopczi.supabase.co/functions/v1/register-outcome-source";
+
+export async function createOutcome(slug, { directory = process.cwd() } = {}) {
+  if (!SAFE_SLUG.test(slug ?? "")) throw new Error("Outcome slug must be lowercase and hyphenated");
+  const root = resolve(directory);
+  const indexPath = join(root, "outcomes.json");
+  let publisherIndex = {
+    schemaVersion: 1,
+    publisher: { name: "Replace with publisher name", url: "https://example.com" },
+    outcomes: [],
+  };
+  try {
+    publisherIndex = JSON.parse(await readFile(indexPath, "utf8"));
+    if (publisherIndex.schemaVersion !== 1 || !Array.isArray(publisherIndex.outcomes)) throw new Error("outcomes.json must be a publisher index with schemaVersion 1");
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+  const folder = join(root, "outcomes", slug);
+  await mkdir(join(folder, "media"), { recursive: true });
+  const manifestPath = join(folder, "outcome.json");
+  const manifest = {
+    schemaVersion: 3,
+    slug,
+    files: { about: "outcome.md", prompt: "prompt.md" },
+    authoredAt: null,
+    author: { name: "Replace with publisher name", url: "https://example.com" },
+    models: [{ provider: "Replace with provider", model: "Replace with model", role: "execution" }],
+    requirements: [],
+  };
+  await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { flag: "wx" });
+  await writeFile(join(folder, "outcome.md"), `# Replace with Outcome name\n\nDescribe the concrete result in one clear opening paragraph.\n`, { flag: "wx" });
+  await writeFile(join(folder, "prompt.md"), "Replace this line with the exact reusable execution prompt.\n", { flag: "wx" });
+  const entry = { slug, url: `./outcomes/${slug}/outcome.json` };
+  publisherIndex.outcomes = [...publisherIndex.outcomes.filter((outcome) => outcome?.slug !== slug), entry]
+    .sort((left, right) => String(left.slug).localeCompare(String(right.slug)));
+  await writeFile(indexPath, `${JSON.stringify(publisherIndex, null, 2)}\n`);
+  return folder;
+}
+
+export async function validateOutcomes(directory = process.cwd()) {
+  const root = resolve(directory);
+  const outcomes = await discoverLocalOutcomes(root);
+  const indexPath = join(root, "outcomes.json");
+  let publisherIndex;
+  try { publisherIndex = JSON.parse(await readFile(indexPath, "utf8")); }
+  catch (error) {
+    if (error?.code === "ENOENT") throw new Error("outcomes.json is required at the publisher repository root");
+    throw error;
+  }
+  if (publisherIndex?.schemaVersion !== 1 || !Array.isArray(publisherIndex.outcomes) || publisherIndex.outcomes.length === 0) throw new Error("outcomes.json must be a non-empty publisher index with schemaVersion 1");
+  if (!publisherIndex.publisher || typeof publisherIndex.publisher.name !== "string" || !publisherIndex.publisher.name.trim()) throw new Error("outcomes.json requires publisher.name");
+  try {
+    if (new URL(publisherIndex.publisher.url).protocol !== "https:") throw new Error();
+  } catch { throw new Error("outcomes.json requires an HTTPS publisher.url"); }
+  const indexed = new Map();
+  for (const [position, entry] of publisherIndex.outcomes.entries()) {
+    if (!entry || typeof entry.slug !== "string" || !SAFE_SLUG.test(entry.slug)) throw new Error(`outcomes.json outcomes[${position}].slug is invalid`);
+    const expectedUrl = `./outcomes/${entry.slug}/outcome.json`;
+    if (entry.url !== expectedUrl) throw new Error(`outcomes.json outcomes[${position}].url must be ${expectedUrl}`);
+    if (indexed.has(entry.slug)) throw new Error(`outcomes.json contains duplicate slug ${entry.slug}`);
+    indexed.set(entry.slug, entry);
+  }
+  const discovered = new Set(outcomes.map(({ slug }) => slug));
+  for (const slug of indexed.keys()) if (!discovered.has(slug)) throw new Error(`outcomes.json references missing Outcome ${slug}`);
+  for (const slug of discovered) if (!indexed.has(slug)) throw new Error(`outcomes.json does not list Outcome ${slug}`);
+  return { count: outcomes.length, outcomes };
+}
+
+async function gitOutput(directory, args) {
+  const result = await execFileAsync("git", args, { cwd: directory, encoding: "utf8" });
+  return result.stdout.trim();
+}
+
+export async function inferGitHubSource(directory = process.cwd()) {
+  const root = await gitOutput(directory, ["rev-parse", "--show-toplevel"]);
+  const dirty = await gitOutput(root, ["status", "--porcelain"]);
+  if (dirty) throw new Error("Commit the Outcome files before publishing so Possible can snapshot an exact public revision");
+  const remote = await gitOutput(root, ["remote", "get-url", "origin"]);
+  const match = remote.match(/github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?$/);
+  if (!match) throw new Error("The repository origin must be a public GitHub repository");
+  return `${match[1]}/${match[2]}`;
+}
+
+export async function addOutcomeSource(source, { directory = process.cwd(), fetchOptions } = {}) {
+  const discovery = await discoverOutcomeSource(source, fetchOptions);
+  const possibleDirectory = join(directory, ".possible");
+  const sourcesPath = join(possibleDirectory, "sources.json");
+  await mkdir(possibleDirectory, { recursive: true });
+  let current = { schemaVersion: 1, sources: [] };
+  try { current = JSON.parse(await readFile(sourcesPath, "utf8")); } catch (error) { if (error?.code !== "ENOENT") throw error; }
+  const nextSource = { type: discovery.type, locator: discovery.locator, installUrl: discovery.installUrl, revision: discovery.revision };
+  const sources = [...(Array.isArray(current.sources) ? current.sources : []).filter((entry) => !(entry.type === nextSource.type && entry.locator === nextSource.locator)), nextSource]
+    .sort((left, right) => left.locator.localeCompare(right.locator));
+  await writeFile(sourcesPath, `${JSON.stringify({ schemaVersion: 1, sources }, null, 2)}\n`);
+  return { discovery, sourcesPath };
+}
+
+function splitUseReference(reference) {
+  const separator = reference.lastIndexOf("@");
+  if (separator <= 0 || separator === reference.length - 1) throw new Error("Use an Outcome as <source>@<slug>");
+  return { source: reference.slice(0, separator), slug: reference.slice(separator + 1) };
+}
+
+export async function useOutcome(reference, { fetchOptions } = {}) {
+  const { source, slug } = splitUseReference(reference);
+  const discovery = await discoverOutcomeSource(source, fetchOptions);
+  const outcome = discovery.outcomes.find((entry) => entry.slug === slug);
+  if (!outcome) throw new Error(`${source} does not publish an Outcome named ${slug}`);
+  return { discovery, outcome };
+}
+
+export async function publishOutcomeSource(source, { directory = process.cwd(), endpoint = process.env.POSSIBLE_PUBLISH_URL ?? DEFAULT_PUBLISH_ENDPOINT } = {}) {
+  const resolvedSource = source || await inferGitHubSource(directory);
+  if (!source) await validateOutcomes(directory);
+  const response = await fetch(endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ source: resolvedSource }),
+  });
+  const body = await response.text();
+  if (!response.ok) throw new Error(`Possible publishing returned HTTP ${response.status}${body ? `: ${body}` : ""}`);
+  let result = {};
+  try { result = body ? JSON.parse(body) : {}; } catch { result = { message: body }; }
+  return { source: resolvedSource, result };
+}