@inneranimalmedia/agentsam-sdk 2.6.10 → 2.6.12

package/docs/plans/TOMORROW-EXTENSIVE-TODO-2026-09-26.md

@@ -1,7 +1,7 @@
 # Tomorrow — comprehensive work list (2026-09-26 evening snapshot)
 
-**Repo:** `/Users/samprimeaux/agentsam-sdk` · `main`  
-**Also read:** [`TOMORROW-MACHINE-FIRST-BRIEFING.md`](./TOMORROW-MACHINE-FIRST-BRIEFING.md) · [`MACHINE_INTELLIGENCE.md`](../MACHINE_INTELLIGENCE.md)  
+**Repo:** `repo://agentsam-sdk` · `main`
+**Also read:** [`TOMORROW-MACHINE-FIRST-BRIEFING.md`](./TOMORROW-MACHINE-FIRST-BRIEFING.md) · [`MACHINE_INTELLIGENCE.md`](../MACHINE_INTELLIGENCE.md)
 **Settings merge:** Settings v2 (`packages/agentsam-settings` + Local Studio host) is **on `main`** as of this evening. Fixture-backed localhost UI — **no D1/vault migration yet**.
 
 **Preserve:** do not reset/stash/regenerate unrelated WIP. Inspect `git status` before editing. Other open branch (not merged tonight): `feat/project-control-workbench-20260925` @ `agentsam-sdk-project-control` worktree.
@@ -10,11 +10,11 @@
 
 ## A. Visual signoff — Settings v2 (do first if UI not yet approved)
 
-- [ ] Cold-load Local Studio Settings on localhost: `/settings/general` and all 13 units  
-- [ ] Nested views: `agents?view=models`, `customize?view=mcps`, `keys?view={credentials,secrets,sessions,audit}`  
-- [ ] Fixture modes: `?fixture=first-run|degraded|security-findings`  
-- [ ] Confirm package boundary feels right: `packages/agentsam-settings` owns UI/contracts; Local Studio only composes host  
-- [ ] **Do not** apply D1 migrations or rewrite vault from this pass until signoff  
+- [ ] Cold-load Local Studio Settings on localhost: `/settings/general` and all 13 units
+- [ ] Nested views: `agents?view=models`, `customize?view=mcps`, `keys?view={credentials,secrets,sessions,audit}`
+- [ ] Fixture modes: `?fixture=first-run|degraded|security-findings`
+- [ ] Confirm package boundary feels right: `packages/agentsam-settings` owns UI/contracts; Local Studio only composes host
+- [ ] **Do not** apply D1 migrations or rewrite vault from this pass until signoff
 
 **Package layout already on main:**
 
@@ -50,51 +50,51 @@ apps/local-studio/backend/settings/
 
 Browser API (no unwrap endpoint):
 
-- `GET/POST/DELETE …/api/settings/credentials/account[/:id/rotate]`  
-- `…/credentials/service[/:id/rotate]`  
-- `GET/POST/PATCH/DELETE …/api/settings/secrets` + `POST …/:id/test`  
-- `GET/DELETE …/sessions` · `GET …/audit` · `GET …/usage`  
+- `GET/POST/DELETE …/api/settings/credentials/account[/:id/rotate]`
+- `…/credentials/service[/:id/rotate]`
+- `GET/POST/PATCH/DELETE …/api/settings/secrets` + `POST …/:id/test`
+- `GET/DELETE …/sessions` · `GET …/audit` · `GET …/usage`
 
 Account mint **adapts** to existing `/api/sdk/api-keys` — do not duplicate mint algorithm.
 
 ### B2. Replace fixture → read-only real adapters
 
-- [ ] Wire `/api/auth/me` account id into host  
-- [ ] Read-only credentials/secrets/sessions from real stores  
-- [ ] Keep UI green while adapters land  
+- [ ] Wire `/api/auth/me` account id into host
+- [ ] Read-only credentials/secrets/sessions from real stores
+- [ ] Keep UI green while adapters land
 
 ### B3. Normalize vault ownership
 
-- [ ] Kill Worker vault paths that invent `user_id` / `tenant_id` / `workspace_id` as identity  
-- [ ] All rows keyed by `account_id` → `accounts.id` (= `auth_users.id` normalized)  
-- [ ] Migration **last**, after code paths exist  
+- [ ] Kill Worker vault paths that invent `user_id` / `tenant_id` / `workspace_id` as identity
+- [ ] All rows keyed by `account_id` → `accounts.id` (= `auth_users.id` normalized)
+- [ ] Migration **last**, after code paths exist
 
 ### B4. Service credentials + usage ledger
 
-- [ ] Table `agentsam_service_credentials` (per `account_id` + `caller_kind`/`caller_id`)  
-- [ ] Append-only `credential_usage_events` for Last used / Monthly spend  
-- [ ] Materialize `last_used_at` / `usage_count` on credential rows  
+- [ ] Table `agentsam_service_credentials` (per `account_id` + `caller_kind`/`caller_id`)
+- [ ] Append-only `credential_usage_events` for Last used / Monthly spend
+- [ ] Materialize `last_used_at` / `usage_count` on credential rows
 
 ### B5. Production identity cleanup (Settings + Studio)
 
-- [ ] Audit `apps/local-studio/frontend/src/lib/auth/*` → KEEP / REPLACE / PREVIEW / DELETE  
-- [ ] Production session from `/api/auth/me` (packages/identity) — **not** Better Auth / Grok / PGLite donor authority  
-- [ ] No second “Local Studio user”  
+- [ ] Audit `apps/local-studio/frontend/src/lib/auth/*` → KEEP / REPLACE / PREVIEW / DELETE
+- [ ] Production session from `/api/auth/me` (packages/identity) — **not** Better Auth / Grok / PGLite donor authority
+- [ ] No second “Local Studio user”
 
 ---
 
-## C. Desktop installer + IAM identity (Connor / newuser123)
+## C. Desktop installer + IAM identity (Operator / newuser123)
 
 **Production already healthy:** `/`, `/auth/login`, `/agentsam` (cbad565 era). Desktop shell: `packages/agentsam-desktop-shell`, manifest `local-studio`.
 
 ### C1. Rebuild real installed app
 
-- [ ] Confirm `packages/agentsam-desktop-shell/manifests/local-studio.json`  
-  - `base_url`: `https://agentsam.inneranimalmedia.com`  
-  - `launch_path`: `/agentsam` (**never** `/`)  
-- [ ] Build macOS `.app` + `.dmg`; replace `/Applications/AgentSam Local Studio.app`  
-- [ ] Prove cold launch opens `/agentsam`  
-- [ ] Do **not** redesign Workbench or bundle Vite app in this slice  
+- [ ] Confirm `packages/agentsam-desktop-shell/manifests/local-studio.json`
+  - `base_url`: `https://agentsam.inneranimalmedia.com`
+  - `launch_path`: `/agentsam` (**never** `/`)
+- [ ] Build macOS `.app` + `.dmg`; replace `/Applications/AgentSam Local Studio.app`
+- [ ] Prove cold launch opens `/agentsam`
+- [ ] Do **not** redesign Workbench or bundle Vite app in this slice
 
 ### C2. One identity authority
 
@@ -106,40 +106,40 @@ auth_users → one canonical account
   └── app/product state
 ```
 
-- [ ] No Tauri auth DB; no Local-Studio-only accounts  
-- [ ] Hosted Studio uses `GET/POST /api/auth/{me,login,signup,logout}` + `/api/oauth/*`  
+- [ ] No Tauri auth DB; no Local-Studio-only accounts
+- [ ] Hosted Studio uses `GET/POST /api/auth/{me,login,signup,logout}` + `/api/oauth/*`
 
 ### C3. Existing-user signup UX
 
-- [ ] `email_already_registered` → “An account already exists. Sign in instead.” → `/auth/login?next=/agentsam`  
-- [ ] Preserve `next=/agentsam` through signup/login/reset/Google/GitHub/Cloudflare/logout  
-- [ ] OAuth-only users: offer provider login / password-setup — **not** “create another account”  
-- [ ] Auto email-link only when provider **verified** email ownership  
+- [ ] `email_already_registered` → “An account already exists. Sign in instead.” → `/auth/login?next=/agentsam`
+- [ ] Preserve `next=/agentsam` through signup/login/reset/Google/GitHub/Cloudflare/logout
+- [ ] OAuth-only users: offer provider login / password-setup — **not** “create another account”
+- [ ] Auto email-link only when provider **verified** email ownership
 
 ### C4. Thin desktop auth adapter
 
-- [ ] session status · begin login · finish callback · logout  
-- [ ] System browser → IAM portal → one-time `agentsamstudio://callback?code=…`  
-- [ ] Deep link = **single-use code only** (no session cookie / API key / OAuth token in URL)  
-- [ ] Reuse existing Rust deep-link plumbing  
+- [ ] session status · begin login · finish callback · logout
+- [ ] System browser → IAM portal → one-time `agentsamstudio://callback?code=…`
+- [ ] Deep link = **single-use code only** (no session cookie / API key / OAuth token in URL)
+- [ ] Reuse existing Rust deep-link plumbing
 
 ### C5. Real installer surface
 
-- [ ] Canonical: `npx @inneranimalmedia/agentsam-sdk app install local-studio`  
-- [ ] `curl …/install/studio | bash` → same machinery  
-- [ ] Preserve old `--app studio` CLI-launcher behavior if needed for compat; add explicit **desktop** mode  
-- [ ] Do **not** publish `apps/local-studio` (private 0.0.0) to npm as the app  
-- [ ] Optional later: tiny `@inneranimalmedia/agentsam-local-studio` shim  
-- [ ] Commands: `app install|doctor|open|uninstall local-studio`  
-- [ ] Installer: OS/arch → download → digest/signature → install → receipt → register → doctor  
+- [ ] Canonical: `npx @inneranimalmedia/agentsam-sdk app install local-studio`
+- [ ] `curl …/install/studio | bash` → same machinery
+- [ ] Preserve old `--app studio` CLI-launcher behavior if needed for compat; add explicit **desktop** mode
+- [ ] Do **not** publish `apps/local-studio` (private 0.0.0) to npm as the app
+- [ ] Optional later: tiny `@inneranimalmedia/agentsam-local-studio` shim
+- [ ] Commands: `app install|doctor|open|uninstall local-studio`
+- [ ] Installer: OS/arch → download → digest/signature → install → receipt → register → doctor
 
 ### C6. Release truth
 
-- [ ] Receipt distinguishes `dev_unsigned` | `signed` | `notarized`  
-- [ ] Use `desktop_shell_releases` / `agentsam-desktop-updates` / R2 — no second release backend  
-- [ ] If Worker/table not live → **blocked step**, not fake success  
+- [ ] Receipt distinguishes `dev_unsigned` | `signed` | `notarized`
+- [ ] Use `desktop_shell_releases` / `agentsam-desktop-updates` / R2 — no second release backend
+- [ ] If Worker/table not live → **blocked step**, not fake success
 
-### C7. Acceptance — Connor / newuser123
+### C7. Acceptance — Operator / newuser123
 
 Prove clean-user path; return SHA in/out, artifact paths, installer command, new-user + existing-IAM + OAuth results, signing state, blockers.
 
@@ -153,12 +153,12 @@ Non-goals this slice: agentsamd, bundled offline UI, updater redesign, new auth
 
 ### Acceptance (without a model)
 
-1. [ ] List every `apps/*` with calculated maturity + provenance + verify  
-2. [ ] `agentsam inspect` harvested site **and** serious app → **world-state** envelope  
-3. [ ] Answer what/where/contents/capabilities/reusable/missing/verified/next from receipts  
-4. [ ] Decision primitives + confidence-policy receipt on ≥1 path (extend existing `src/sam/decision/`)  
-5. [ ] `agentsam mini` still works  
-6. [ ] Docs state ladder + MINI/APP/WORLD — **scaffold done**; keep help copy aligned  
+1. [ ] List every `apps/*` with calculated maturity + provenance + verify
+2. [ ] `agentsam inspect` harvested site **and** serious app → **world-state** envelope
+3. [ ] Answer what/where/contents/capabilities/reusable/missing/verified/next from receipts
+4. [ ] Decision primitives + confidence-policy receipt on ≥1 path (extend existing `src/sam/decision/`)
+5. [ ] `agentsam mini` still works
+6. [ ] Docs state ladder + MINI/APP/WORLD — **scaffold done**; keep help copy aligned
 
 ### Batch order
 
@@ -194,28 +194,28 @@ Still **not** the shipped tabbed ANSI Project Control product. Primitives exist
 
 Tomorrow only if bandwidth after A–D:
 
-- [ ] `AgentSamProjectSnapshot` contract  
-- [ ] Persist `agentsam.activity.v1` (SQLite) — activity is **in-memory** today  
-- [ ] Local SQLite GOAP adapter (stop defaulting user GOAP to `inneranimalmedia-business`)  
-- [ ] CLI TUI tabs under `src/ui/cli/tui/` (picocolors; no Ink)  
+- [ ] `AgentSamProjectSnapshot` contract
+- [ ] Persist `agentsam.activity.v1` (SQLite) — activity is **in-memory** today
+- [ ] Local SQLite GOAP adapter (stop defaulting user GOAP to `inneranimalmedia-business`)
+- [ ] CLI TUI tabs under `src/ui/cli/tui/` (picocolors; no Ink)
 
 ---
 
 ## F. Hygiene / ops
 
-- [ ] Push/PR any leftover worktrees after review (`project-control`)  
-- [ ] Optional: clean stale `/Users/samprimeaux/agent-worktrees/*` clones  
-- [ ] Confirm published SDK version vs docs (`2.6.4` installables; bump notes if needed)  
-- [ ] Site: `npm run site:publish` uses `--remote` (fixed) for Learn/ASFB assets  
+- [ ] Push/PR any leftover worktrees after review (`project-control`)
+- [ ] Optional: clean stale `worktree://*` clones
+- [ ] Confirm published SDK version vs docs (`2.6.4` installables; bump notes if needed)
+- [ ] Site: `npm run site:publish` uses `--remote` (fixed) for Learn/ASFB assets
 
 ---
 
 ## Suggested tomorrow morning order
 
-1. Settings visual signoff (A) — 30–60m  
-2. Identity donor audit + signup UX (B5 + C3) — unblocks Connor  
-3. Machine-first Batch B discovery + stub maturity (D) — unlocks honest `agentsam apps`  
-4. Desktop rebuild cold-launch proof (C1) if installer is the day’s P0  
-5. Settings read-only adapters (B2) only after A signed off  
+1. Settings visual signoff (A) — 30–60m
+2. Identity donor audit + signup UX (B5 + C3) — unblocks Operator
+3. Machine-first Batch B discovery + stub maturity (D) — unlocks honest `agentsam apps`
+4. Desktop rebuild cold-launch proof (C1) if installer is the day’s P0
+5. Settings read-only adapters (B2) only after A signed off
 
 **Do not** start D1 vault migration and desktop notarization and world-state rewrite in the same PR.

package/docs/plans/TOMORROW-MACHINE-FIRST-BRIEFING.md

@@ -104,7 +104,7 @@ Shell interactive work is **separate** from Apps Clack catalog (`agentsam apps`)
 | `client-cms-editor` | product |
 | `ecommerce-cms-agentsam` | product |
 | `local-studio` | product |
-| `church-site` … `shinshu-site` (7) | harvested — `.agentsam/app.json` |
+| `cypress` … `summit` (7) | harvested — `.agentsam/app.json` |
 | `theme-gallery-preview`, `frontend`, `project-control`, `agentsam-go-worker`, `_incoming` | maturity TBD via calculated gates |
 
 ---

package/docs/plans/UNIVERSAL-INGEST-MACHINE-FIRST-2026-09-24.md

@@ -30,7 +30,7 @@ todos:
     content: "Batch D — Keep mini as instant zero-dep utility lane; demote from architectural poster framing in docs/help"
     status: pending
   - id: disk-clutter
-    content: "Optional hygiene — review leftover /Users/samprimeaux/agent-worktrees/* dirs (not linked worktrees; some 50–254MB clones)"
+    content: "Optional hygiene — review leftover worktree://* dirs (not linked worktrees; some 50–254MB clones)"
     status: pending
 isProject: false
 ---
@@ -41,7 +41,7 @@ isProject: false
 
 **Audit and strengthen the current system. Do not redesign the repo around package purity.**
 
-Home: [`/Users/samprimeaux/agentsam-sdk`](/Users/samprimeaux/agentsam-sdk) @ clean `main` (`c017da3` Brand Intelligence).
+Home: [`repo://agentsam-sdk`](repo://agentsam-sdk) @ clean `main` (`c017da3` Brand Intelligence).
 
 Preserve ownership:
 
@@ -101,7 +101,7 @@ Repo now: **local `main` only**, synced to `origin/main` @ `c017da3`. No linked
 
 ### Leftover disk (not git branches — optional hygiene)
 
-Under `/Users/samprimeaux/agent-worktrees/` (not registered with `git worktree list`):
+Under `worktree://` (not registered with `git worktree list`):
 
 | Dir | Approx | Note |
 |-----|--------|------|
@@ -147,7 +147,7 @@ No branch merge queue. All remaining work is **new implementation on clean main*
 | `client-cms-editor` | same |
 | `ecommerce-cms-agentsam` | same |
 | `local-studio` | same |
-| `church-site` … `shinshu-site` (7 harvested) | `.agentsam/app.json` (theme-refinery) |
+| `cypress` … `summit` (7 harvested) | `.agentsam/app.json` (theme-refinery) |
 | `theme-gallery-preview`, `frontend`, `_incoming` | maturity TBD via calculated gates |
 
 ### Batch C — Ingest feeds world-state

package/docs/prd/PRD-agentsam-analytics.md

@@ -0,0 +1,174 @@
+# AgentSam Analytics
+## Product Requirements Document
+
+**Status:** Experimental
+**Portfolio:** AgentSam
+**Primary package/app composition:** see Package composition below
+
+## Product vision
+
+Explain what happened across AgentSam operations and business activity using portable read models, evidence-backed metrics, and decision-ready analysis rather than disconnected dashboards.
+
+## Target users
+
+- operators
+- product teams
+- commerce teams
+- developers running AgentSam workflows
+
+## Core jobs to be done
+
+- understand operational performance
+- understand commerce performance
+- attribute AI/runtime cost
+- inspect failures/retries
+- compare trends and outcomes
+
+## Product promise
+
+> Explain what happened across AgentSam operations and business activity using portable read models, evidence-backed metrics, and decision-ready analysis rather than disconnected dashboards.
+
+## Why this should exist as a real offer
+
+- shared fact authority
+- portable analytics UI
+- commerce + agent operational visibility
+- decision support
+
+The offer is only valuable if users can complete these jobs end to end. Package publication, a demo screen, or an isolated API is not sufficient evidence of product value.
+
+## What this product is not
+
+- a raw log viewer
+- a fabricated attribution engine
+- a single-vendor analytics product
+
+## Package composition
+
+```text
+agentsam-analytics
+analytics-ui
+```
+
+Packages are implementation ingredients. The product boundary is the user outcome described in this PRD.
+
+## Product principles
+
+1. Prefer user-recognizable operations over infrastructure-shaped APIs.
+2. Preserve provider neutrality unless a provider-specific choice is the user's explicit goal.
+3. Distinguish observed facts, inferred judgments, proposed actions, and executed changes.
+4. Missing evidence reduces confidence instead of creating fabricated facts.
+5. Writes to external systems require clear authorization and bounded scope.
+6. The core workflow should remain usable without unnecessary custom UI.
+7. Local and hosted forms should share domain contracts where practical.
+8. Errors should preserve partial usefulness and explain recovery paths.
+
+## Initial user workflow
+
+```text
+intent
+  |
+  v
+context / evidence
+  |
+  v
+plan or draft
+  |
+  v
+inspect / evaluate
+  |
+  v
+user decision or approval
+  |
+  v
+optional action
+  |
+  v
+receipt / artifact / learning
+```
+
+The exact steps vary by product, but the workflow should remain explicit and inspectable.
+
+## Data and authority
+
+This product must document:
+
+- which records it owns;
+- which external systems remain authoritative;
+- provenance of consumed evidence;
+- freshness/staleness behavior;
+- authorization for writes;
+- how local and hosted state reconcile, where applicable.
+
+No product should silently claim authority over data owned by another domain.
+
+## Distribution
+
+- dashboard package
+- Local Studio surface
+- commerce/admin surface
+- future plugin
+
+Distribution may evolve, but every form should preserve the same core product promise.
+
+## Packaging / monetization hypotheses
+
+Potential real-world packaging may include:
+
+- free core package or local capability;
+- paid hosted convenience or managed runtime;
+- paid team/collaboration features;
+- premium packaged application;
+- domain plugin/app distribution;
+- support, implementation, or commercial deployment services;
+- usage-based infrastructure only where the underlying cost scales with usage.
+
+The final commercial model should follow observed adoption and cost structure rather than force every package into a subscription.
+
+## Definition of v1
+
+- canonical facts/read models
+- commerce and AgentSam surfaces
+- time-range/filter contracts
+- cost/failure metrics
+- explainable source provenance
+
+## Acceptance suite
+
+A v1 candidate should pass:
+
+### Direct
+A user explicitly asks for the product's primary job and reaches a useful outcome.
+
+### Indirect
+A user describes the underlying problem without using the product name; the workflow still activates appropriately.
+
+### Sparse context
+The product remains useful with minimal evidence and clearly states limitations.
+
+### Rich context
+Additional authorized evidence materially improves the result.
+
+### Failure
+A provider, source, or action fails and the product returns structured, recoverable behavior where possible.
+
+### Authorization
+A requested write exceeds current authority and is not silently executed.
+
+### Out of scope
+The product refuses or delegates work that belongs to another AgentSam domain instead of absorbing it.
+
+## Success signals
+
+Product quality should be measured by outcomes such as:
+
+- successful completion of the core workflow;
+- lower time/effort to reach the intended outcome;
+- repeat use for the same job;
+- successful recovery from missing data or provider failure;
+- low rate of unauthorized or incorrect actions;
+- evidence that users prefer the integrated offer over manually combining generic tools.
+
+## Graduation rule
+
+This product should not be called v1 until it satisfies `ADR-0005-offer-graduation-standard.md`.

package/docs/prd/PRD-agentsam-brand.md

@@ -0,0 +1,181 @@
+# AgentSam Brand
+## Product Requirements Document
+
+**Status:** Experimental
+**Portfolio:** AgentSam
+**Primary package/app composition:** see Package composition below
+
+## Product vision
+
+Understand, define, refine, organize, and protect a real brand using evidence from its assets, content, usage, and decisions.
+
+## Target users
+
+- founders
+- brand teams
+- designers
+- agencies
+- small businesses
+
+## Core jobs to be done
+
+- understand an existing brand
+- draft a durable BrandContract
+- review consistency
+- organize canonical assets
+- plan brand improvements
+- create governed extensions without losing identity
+
+## Product promise
+
+> Understand, define, refine, organize, and protect a real brand using evidence from its assets, content, usage, and decisions.
+
+## Why this should exist as a real offer
+
+- durable brand intelligence
+- consistency with explainable evidence
+- portable brand context for other AgentSam products
+- less repeated re-explanation to AI systems
+
+The offer is only valuable if users can complete these jobs end to end. Package publication, a demo screen, or an isolated API is not sufficient evidence of product value.
+
+## What this product is not
+
+- a logo generator
+- a generic image editor
+- Campaign strategy
+- a provider-specific asset manager
+
+## Package composition
+
+```text
+agentsam-brand
+agentsam-assets-core
+agentsam-content
+agentsam-content-studio
+```
+
+Packages are implementation ingredients. The product boundary is the user outcome described in this PRD.
+
+## Product principles
+
+1. Prefer user-recognizable operations over infrastructure-shaped APIs.
+2. Preserve provider neutrality unless a provider-specific choice is the user's explicit goal.
+3. Distinguish observed facts, inferred judgments, proposed actions, and executed changes.
+4. Missing evidence reduces confidence instead of creating fabricated facts.
+5. Writes to external systems require clear authorization and bounded scope.
+6. The core workflow should remain usable without unnecessary custom UI.
+7. Local and hosted forms should share domain contracts where practical.
+8. Errors should preserve partial usefulness and explain recovery paths.
+
+## Initial user workflow
+
+```text
+intent
+  |
+  v
+context / evidence
+  |
+  v
+plan or draft
+  |
+  v
+inspect / evaluate
+  |
+  v
+user decision or approval
+  |
+  v
+optional action
+  |
+  v
+receipt / artifact / learning
+```
+
+The exact steps vary by product, but the workflow should remain explicit and inspectable.
+
+## Data and authority
+
+This product must document:
+
+- which records it owns;
+- which external systems remain authoritative;
+- provenance of consumed evidence;
+- freshness/staleness behavior;
+- authorization for writes;
+- how local and hosted state reconcile, where applicable.
+
+No product should silently claim authority over data owned by another domain.
+
+## Distribution
+
+- ChatGPT plugin
+- Local Studio product
+- SDK package
+- embedded brand tools
+
+Distribution may evolve, but every form should preserve the same core product promise.
+
+## Packaging / monetization hypotheses
+
+Potential real-world packaging may include:
+
+- free core package or local capability;
+- paid hosted convenience or managed runtime;
+- paid team/collaboration features;
+- premium packaged application;
+- domain plugin/app distribution;
+- support, implementation, or commercial deployment services;
+- usage-based infrastructure only where the underlying cost scales with usage.
+
+The final commercial model should follow observed adoption and cost structure rather than force every package into a subscription.
+
+## Definition of v1
+
+- BrandContract
+- brand audit
+- asset inspection
+- consistency evaluation
+- usage discovery
+- remediation planning
+- direct/indirect acceptance suite
+
+## Acceptance suite
+
+A v1 candidate should pass:
+
+### Direct
+A user explicitly asks for the product's primary job and reaches a useful outcome.
+
+### Indirect
+A user describes the underlying problem without using the product name; the workflow still activates appropriately.
+
+### Sparse context
+The product remains useful with minimal evidence and clearly states limitations.
+
+### Rich context
+Additional authorized evidence materially improves the result.
+
+### Failure
+A provider, source, or action fails and the product returns structured, recoverable behavior where possible.
+
+### Authorization
+A requested write exceeds current authority and is not silently executed.
+
+### Out of scope
+The product refuses or delegates work that belongs to another AgentSam domain instead of absorbing it.
+
+## Success signals
+
+Product quality should be measured by outcomes such as:
+
+- successful completion of the core workflow;
+- lower time/effort to reach the intended outcome;
+- repeat use for the same job;
+- successful recovery from missing data or provider failure;
+- low rate of unauthorized or incorrect actions;
+- evidence that users prefer the integrated offer over manually combining generic tools.
+
+## Graduation rule
+
+This product should not be called v1 until it satisfies `ADR-0005-offer-graduation-standard.md`.