@jevitate/cli 0.9.0 → 0.11.0

package/dist/zip-store.js

@@ -0,0 +1,93 @@
+/**
+ * #471 — a minimal, deterministic ZIP writer for the Journeeze catalog bundle upload (journeeze-saas
+ * `docs/contract/catalog-bundle-upload-v1.md` §4.2: `application/zip`, `bundle.json` at the root
+ * and the media under `media/`). Entries are STORED (media is already compressed), in the given
+ * order, with a fixed timestamp (1980-01-01 00:00) and no extra fields, so the same bundle always
+ * gives the same bytes — a re-publish reuses its Idempotency-Key with the same body digest. No
+ * ZIP64: refused past 4 GiB or 65,535 entries (far above the contract's 256 MiB upload).
+ */
+const CRC_TABLE = (() => {
+    const t = new Uint32Array(256);
+    for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        t[n] = c >>> 0;
+    }
+    return t;
+})();
+export function crc32(data) {
+    let c = 0xffffffff;
+    for (let i = 0; i < data.length; i++)
+        c = CRC_TABLE[(c ^ data[i]) & 0xff] ^ (c >>> 8);
+    return (c ^ 0xffffffff) >>> 0;
+}
+const SAFE_NAME = /^(?!\/)(?!.*(?:^|\/)\.\.?(?:\/|$))[A-Za-z0-9._/-]{1,512}$/u;
+/** 1980-01-01 00:00:00 in MS-DOS date/time. */
+const DOS_TIME = 0;
+const DOS_DATE = (0 << 9) | (1 << 5) | 1;
+export function zipStore(entries) {
+    if (entries.length > 0xffff)
+        throw new Error("too many ZIP entries");
+    const seen = new Set();
+    const locals = [];
+    const centrals = [];
+    let offset = 0;
+    for (const e of entries) {
+        if (!SAFE_NAME.test(e.name))
+            throw new Error(`unsafe ZIP entry name ${JSON.stringify(e.name)}`);
+        if (seen.has(e.name))
+            throw new Error(`duplicate ZIP entry ${e.name}`);
+        seen.add(e.name);
+        const name = Buffer.from(e.name, "utf8");
+        const crc = crc32(e.data);
+        const size = e.data.byteLength;
+        if (offset + 30 + name.length + size > 0xffffffff)
+            throw new Error("ZIP too large");
+        const local = Buffer.alloc(30);
+        local.writeUInt32LE(0x04034b50, 0);
+        local.writeUInt16LE(20, 4); // version needed
+        local.writeUInt16LE(0x0800, 6); // flags: UTF-8 names
+        local.writeUInt16LE(0, 8); // stored
+        local.writeUInt16LE(DOS_TIME, 10);
+        local.writeUInt16LE(DOS_DATE, 12);
+        local.writeUInt32LE(crc, 14);
+        local.writeUInt32LE(size, 18);
+        local.writeUInt32LE(size, 22);
+        local.writeUInt16LE(name.length, 26);
+        local.writeUInt16LE(0, 28);
+        const central = Buffer.alloc(46);
+        central.writeUInt32LE(0x02014b50, 0);
+        central.writeUInt16LE(20, 4); // version made by
+        central.writeUInt16LE(20, 6);
+        central.writeUInt16LE(0x0800, 8);
+        central.writeUInt16LE(0, 10);
+        central.writeUInt16LE(DOS_TIME, 12);
+        central.writeUInt16LE(DOS_DATE, 14);
+        central.writeUInt32LE(crc, 16);
+        central.writeUInt32LE(size, 20);
+        central.writeUInt32LE(size, 24);
+        central.writeUInt16LE(name.length, 28);
+        central.writeUInt16LE(0, 30); // extra
+        central.writeUInt16LE(0, 32); // comment
+        central.writeUInt16LE(0, 34); // disk
+        central.writeUInt16LE(0, 36); // internal attrs
+        central.writeUInt32LE(0, 38); // external attrs
+        central.writeUInt32LE(offset, 42);
+        locals.push(local, name, Buffer.from(e.data.buffer, e.data.byteOffset, e.data.byteLength));
+        centrals.push(central, name);
+        offset += 30 + name.length + size;
+    }
+    const cd = Buffer.concat(centrals);
+    const end = Buffer.alloc(22);
+    end.writeUInt32LE(0x06054b50, 0);
+    end.writeUInt16LE(0, 4);
+    end.writeUInt16LE(0, 6);
+    end.writeUInt16LE(entries.length, 8);
+    end.writeUInt16LE(entries.length, 10);
+    end.writeUInt32LE(cd.length, 12);
+    end.writeUInt32LE(offset, 16);
+    end.writeUInt16LE(0, 20);
+    return Buffer.concat([...locals, cd, end]);
+}
+//# sourceMappingURL=zip-store.js.map

package/dist/zip-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zip-store.js","sourceRoot":"","sources":["../src/zip-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE;IACtB,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEL,MAAM,UAAU,KAAK,CAAC,IAAgB;IACpC,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,IAAI,CAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,SAAS,GAAG,4DAA4D,CAAC;AAC/E,+CAA+C;AAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAEzC,MAAM,UAAU,QAAQ,CAAC,OAA4B;IACnD,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/B,IAAI,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/B,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB;QAC7C,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,qBAAqB;QACrD,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACpC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7B,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9B,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9B,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB;QAChD,OAAO,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7B,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACjC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/B,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ;QACtC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU;QACxC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO;QACrC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB;QAC/C,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB;QAC/C,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3F,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACpC,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,GAAG,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACjC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9B,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jevitate/cli",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Autonomous browser testing that turns discovered bugs into deterministic regression tests: explore a web app in a real browser, confirm findings with evidence, and replay them as regressions in CI.",
   "type": "module",
   "license": "MIT",
@@ -30,7 +30,7 @@
     "jevitate"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "bin": {
     "jevitate": "dist/bin.js"
@@ -54,31 +54,33 @@
     "@openrouter/ai-sdk-provider": "^3.1.0",
     "@typesafe-ai/sdk": "^0.6.0",
     "ai": "^7.0.107",
-    "better-sqlite3": "^11.0.0",
+    "better-sqlite3": "^13.0.3",
     "commander": "^12.0.0",
     "playwright": "^1.49.0"
   },
   "devDependencies": {
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
     "esbuild": "^0.28.2",
     "@jevitate/ai-core": "0.1.0",
-    "@jevitate/daemon": "0.1.0",
-    "@jevitate/domain": "0.1.0",
     "@jevitate/example-site": "0.1.0",
-    "@jevitate/explore": "0.1.0",
-    "@jevitate/inbox": "0.1.0",
     "@jevitate/findings": "0.1.0",
-    "@jevitate/interpreter": "0.1.0",
+    "@jevitate/domain": "0.1.0",
+    "@jevitate/inbox": "0.1.0",
+    "@jevitate/explore": "0.1.0",
     "@jevitate/journey": "0.1.0",
+    "@jevitate/interpreter": "0.1.0",
     "@jevitate/mcp-facade": "0.1.0",
-    "@jevitate/missions": "0.1.0",
+    "@jevitate/daemon": "0.1.0",
     "@jevitate/playwright": "0.1.0",
+    "@jevitate/missions": "0.1.0",
     "@jevitate/recorder": "0.1.0",
     "@jevitate/recording": "0.1.0",
     "@jevitate/regression": "0.1.0",
     "@jevitate/runtime": "0.1.0",
     "@jevitate/screenplay": "0.1.0",
-    "@jevitate/skills": "0.1.0",
     "@jevitate/sources": "0.1.0",
+    "@jevitate/skills": "0.1.0",
     "@jevitate/ux": "0.1.0",
     "@jevitate/storage-sqlite": "0.1.0",
     "@jevitate/load": "0.1.0"

package/skills/jevitate-ci-check/SKILL.md

@@ -59,6 +59,22 @@ Relative paths resolve against the suite file.
   with a proposal in `.proposals/` for a person to `journey review` / `journey promote --proposal`;
   commit `.proposals/` with the PR. Without a change context the flag is refused (64).
 
+- Locator health (which selector rung each recorded step resolves by, and whether it meets the
+  project's `testIdAttributes` convention in `.jevitate/project.json`) is advisory: fixes appear as
+  SARIF warnings and in `check.json`. `--max-brittle-steps <n>` (MCP `run_check` `maxBrittleSteps`)
+  opts into a gate: a Journey item with more than n brittle steps is a gating finding (exit 1).
+  `jevitate locator-health [--journey <id>] [--baseline <file>] --json` (MCP `locator_health`)
+  reports it on its own and never gates.
+- `--require-approvals [--allow-channels tty,pr-review]` fails a missing or stale approval, or one
+  made over a channel not allowed. `pr-review` (an approval jevitate verified through a merged,
+  approved GitHub pull request) is re-verified through the GitHub API on every check (it needs
+  `GITHUB_TOKEN` and `pull-requests: read`); one that cannot be re-verified is an `unverified`
+  violation. No flag or tool argument sets `pr-review`. See the jevitate repo's `docs/ci.md`.
+- Publishing the catalog to Journeeze from CI: set the `JOURNEEZE_UPLOAD_KEY` secret and run
+  `jevitate publish journeeze --json` (MCP `publish_to_journeeze`; `--dry-run` sends nothing).
+  Refusals carry an `E_JOURNEEZE_*` code (64 when the key or connection is the problem, 2 when
+  Journeeze could not take it).
+
 ## Exit codes: gate on 1, and treat 2 and 64 as broken
 
 `0` pass · `1` at least one gating finding (a Journey assertion, an invariant, a goal check, a

package/skills/jevitate-demo/SKILL.md

@@ -13,7 +13,10 @@ something the app didn't do.
 - Demos and Journey replays run against a named environment from the committed
   `.jevitate/environments.json` (`jevitate init` writes an example with a `local` entry). Each
   entry has `baseUrl` (an origin), an optional `allow` list, `fixtures` and `hooks`. Mark a live
-  site with `"production": true`. `demo` refuses one (`E_DEMO_PRODUCTION_ENV`, exit 64).
+  site with `"production": true`. `demo` refuses one (`E_DEMO_PRODUCTION_ENV`, exit 64). Mark a
+  seeded, synthetic tenant with `"synthetic": true`: only a demo approved there ships masked media
+  (jz-mask-v1) to Journeeze with `catalog export` / `publish journeeze`. Set it only when the human
+  says the environment holds no real customer data.
 - The file never holds a secret or a session. Sessions and secret fields live in
   `~/.jevitate/targets.json`, keyed by the environment's origin, with `personas` for named
   sessions. Never write a session or password into the repo.

package/skills/jevitate-getting-started/SKILL.md

@@ -59,10 +59,14 @@ Then pick the matching skill:
   `find_capabilities`/`run_journey` = `journey find`/`journey run`, `author_journey` =
   `explore-author-journey`, `create_demo`/`demo_journey` = `demo`/`journey demo`, `verify_fix` =
   `verify-fix`, `regressions` = `regression capture|run`, `ledger` = `ledger …`, `run_check` =
-  `check`, `get_report` = `report`, `ux_review` = `ux`. The full table is in the jevitate repo's
+  `check`, `get_report` = `report`, `ux_review` = `ux`, `locator_health` = `locator-health`,
+  `draft_job_outcomes` = `job draft-outcomes`, `export_catalog_bundle` = `catalog export`,
+  `publish_to_journeeze` = `publish journeeze`. The full table is in the jevitate repo's
   `docs/agents.md`.
 - These are never available over MCP: `record` (a person clicks), `init`, `ai setup` (secret entry),
-  `ui`, `source trust` and `source add --accept-tou`. Operator settings are never tool arguments
+  `ui`, `source trust`, `source add --accept-tou`, `connect journeeze` (a person enters where the
+  Journeeze upload key is kept; `publish_to_journeeze` never sees the key) and `journey migrate`
+  (a one-time rewrite the operator commits). Operator settings are never tool arguments
   either: shell hooks, browser binaries, which environment variable a secret comes from, and
   log-command sources. Tell the human the CLI command instead.
 - Raw browser tools (click, fill, evaluate, get DOM or cookies) don't exist on purpose. Never
@@ -79,6 +83,7 @@ you do, show them what they are approving:
 - promoting a mission target: `jevitate mission target promote <id>`
 - trusting a third-party Journey or accepting a source's Terms of Use (CLI only)
 - approving a catalog persona or job, waiving an unvetted link, acknowledging findings: `jevitate persona approve <id>`, `jevitate job approve <id>`, `journey promote --accept-unvetted`, `--accept-findings` (approve and acknowledge are CLI only; MCP reads `review_persona` / `review_job` / `catalog_status` / `analyze_catalog`)
+- connecting the project to Journeeze: `jevitate connect journeeze` (CLI only, a person at a terminal). Drafting a job's desired outcomes (`job draft-outcomes` / `draft_job_outcomes`) is not an approval: it marks them `provenance: ai_draft`, and a person still reviews and runs `job approve`
 - approving or cancelling an inbox item: only in `jevitate ui`. The MCP tools `approve_action` and `cancel_command` always refuse.
 
 Every CLI approval (`journey promote`, `demo approve`, `persona approve`, `job approve`, and the

package/skills/jevitate-run-journey/SKILL.md

@@ -46,6 +46,10 @@ artifact; your job is to find the right one and run it with the right params.
 - Evidence: `--record-video` (listed as `videoPaths`), `--screenshots
   [screens|steps]` (`screenshotPaths` + an `index.md`), `--headed`/`--slow-mo <ms>`
   to watch it. `--viewport 375x812` / `--device "iPhone 13"` for mobile.
+- A step's `responseStatus` check waits up to 15 s for a request that was sent
+  but not yet answered (a cold start after a deploy); `--step-response-timeout
+  <ms>` (MCP `run_journey`'s `stepResponseTimeoutMs`) raises it for one run. A
+  late 2xx is an advisory `slowSteps` finding, not a failure.
 - For a narrated demo video or a step-by-step guide of a Journey, use
   `jevitate-demo` (`journey demo`, `journey annotate`).
 
@@ -112,6 +116,17 @@ artifact; your job is to find the right one and run it with the right params.
   proof, change since the last approval, and the content hash. Pass that hash
   as `--reviewed-hash` (MCP `reviewedHash`) so the approval is refused
   (`E_JOURNEY_REVIEW_STALE`) if the Journey changed after they read it.
+- A new Journey, or one whose content changed beyond step ids, must follow the
+  anchor rules to promote (lowercase anchor names, anchors carrying their
+  step's `stepId`, a job-linked Journey naming at least one anchor, valid
+  `serves`/`jobStep` references); otherwise promote is refused with
+  `E_JOURNEY_ANCHOR_RULES` and the fix for each problem. The sheet and
+  `journey lint` show the same problems as warnings first.
+- `jevitate journey review --stale --json` (MCP `review_journey` with
+  `stale: true`) lists every promoted Journey whose approval is stale;
+  `stepIdOnly: true` marks one whose only change is minted step ids (after
+  `jevitate journey migrate --step-ids`, which the operator runs and
+  commits). Re-approving those is still the person's act.
 - `jevitate journey promote <id>` promotes a local Journey — a person's
   approval, never automatic. It needs an interactive terminal: after the
   sheet, the person types the Journey id (or the first 8 characters of its

package/skills/jevitate-test-campaign/SKILL.md

@@ -44,6 +44,14 @@ never the click path; independent `--success` checks (page or network state); pr
 whether it mutates state; and a run order (jobs that create data run before jobs that use it).
 A job you can't write a checkable `--success` for is too vague. Split it or narrow it.
 
+Optionally give a job its steps and desired outcomes (`steps`, `desiredOutcomes` with a `metric`
+measured between anchors or the reserved `"job_start"` / `"job_end"`, a `target`, `guardrail: true`
+for what must never get worse; docs/catalog.md). `jevitate job draft-outcomes <id> --real --json`
+(MCP `draft_job_outcomes`) drafts 1-3 outcomes marked `provenance: ai_draft` for the human to
+review; it never approves, and an approved job becomes stale. On each job-linked Journey, mark
+where the job's steps start and end with anchors (`jobStep`, `boundary`), so its metrics are
+measurable; `catalog status` lists the reference problems (`refIssues`).
+
 ## 3. Discovery: one goal run per job
 
 For each job, as the right persona, with no scripted path:
@@ -70,6 +78,15 @@ mission takes over on the live page:
 
 ```bash
 jevitate journey anchors <journey-id> --json   # the named states worth exploring from, with suggested probes
+jevitate journey anchors <journey-id> --suggest --json   # advisory: where the flow changes state (writes nothing)
+jevitate journey anchor add <journey-id> --name <name> --step <n|stepId> --json   # a DRAFT Journey only
+```
+
+Over MCP: `journey_anchors` (`suggest: true`), `journey_anchor_add`, `journey_anchor_remove`, and
+`lint_journey` with `fix: true` (stamps number-only anchors with their step id). Anchor edits refuse a
+promoted Journey: its approval binds to the content hash, so edit a draft and a person re-promotes it.
+
+```bash
 jevitate explore --from-journey <journey-id> --at-step <anchor|n> --param <k=v> --env <env> --strategy adversarial --storage-state <persona-file> --max-actions 60 --evidence-video --real --json
 ```
 
@@ -105,6 +122,10 @@ Flags such as `--allow-destructive`, `--paid`, `--invariants`, `--log-source`/`-
 `--evidence-video` on `campaign run` are forwarded to every mission; `--hook-timeout-ms` bounds the
 spec's hooks. An invalid spec is refused with every problem listed (exit 64). Shell `before`/`after` restore
 hooks in the spec run only with `--allow-shell-hooks`, and only when the human asked for them.
+Before any mission, a preflight checks every start URL is reachable, every session is signed in and
+no app call slips outside the allow list, and refuses with the problems listed. Fix them;
+`--skip-preflight` (MCP `run_campaign` `skipPreflight`) only when the human asks, and it is recorded
+on the report.
 
 ## 5. A small untargeted pass, plus non-journey attacks
 
@@ -167,6 +188,11 @@ probability ≥ its `threshold` (Jev only advises). Then `jevitate catalog statu
 `fixed` by verify-fix (with a ledger entry or regression); the final round ran on the release
 build; and no `inconclusive` run was counted as a pass. Anything short of that, report it as open.
 
+To share the vetted catalog, `jevitate catalog export --format journeeze-bundle --out <dir>
+[--check <check.json>] --json` (MCP `export_catalog_bundle`) writes a Journeeze catalog bundle, and
+`jevitate publish journeeze --json` (MCP `publish_to_journeeze`) uploads it once a person has run
+`jevitate connect journeeze` (or CI sets `JOURNEEZE_UPLOAD_KEY`). Neither approves anything.
+
 ## Templates
 
 Job spec (one per job, `.jevitate/jobs.json`; the old `.jevitate/campaign/jobs.json` is still

package/skills/jevitate-verify-fix/SKILL.md

@@ -24,6 +24,11 @@ the evidence. No model decides any of these verdicts.
   target's session in `~/.jevitate/targets.json`. A finding recorded at a viewport or device
   replays at that emulation. `--viewport`/`--device` that differ are refused unless
   `--allow-emulation-override` is passed.
+- A finding replays under the allow list stored with its result. To prove an allow-list
+  config fix (e.g. `localhost` → `127.0.0.1`), pass `--allow <origin...>` or `--env <name>`
+  (that environment's CURRENT allow list), never both; MCP: `verify_fix`'s `env` only (an MCP caller never names origins).
+  The report then carries `allowlistOverride` (origins used, what was added and removed): say so
+  when you report the verdict.
 
 ## Evidence for a PR or an issue