@jstn-sdk/ma 0.14.0 → 0.14.1

package/COVERAGE.md

@@ -1,8 +1,8 @@
 # Meta-Architect Coverage Matrix
 
-Target release: `v0.14.0`
+Target release: `v0.14.1`
 Last verified: 2026-06-03
-Package: `@jstn-sdk/ma@0.14.0`
+Package: `@jstn-sdk/ma@0.14.1`
 
 This file is the canonical operator-facing coverage map for the current release line.
 It records what MA can prove today through repository tests, runtime artifacts, package dry-runs, and release gates.
@@ -21,7 +21,7 @@ It records what MA can prove today through repository tests, runtime artifacts,
 | Core skill surface | DONE | `skills/`, `skills/index.json`, `npm run skills:validate` |
 | Helper skill surface | DONE | `$align`, `$diagnose`, `$tdd`, `$cleanup` contracts in `skills/`, plugin mirror, and Helper Orchestration Core |
 | Build gate enforcement | DONE | `src/build-gate.js`, `test/build-gate.test.js`, `test/cli-smoke.test.js` |
-| Release issue gates | DONE | `src/release-issue-gates.js`, `docs/qa/release-issue-gates-0.14.0.json`, `test/release-issue-gates.test.js` |
+| Release issue gates | DONE | `src/release-issue-gates.js`, `docs/qa/release-issue-gates-0.14.1.json`, `test/release-issue-gates.test.js` |
 | Live GitMCP probe support | DONE | `src/mcp-live-client.js`, `src/skills.js`, `test/mcp-config.test.js` |
 | MCP policy and exposure control | DONE | `src/runtime/mcp-policy.js`, `src/runtime/exposure-catalog.js`, `test/mcp-policy.test.js`, `test/exposure-catalog.test.js` |
 | Plugin mirror discipline | DONE | `scripts/plugin-sync.js`, `npm run plugin:verify`, package dry-run |
@@ -105,7 +105,7 @@ Coverage state:
 - source skill contracts in `skills/`: DONE
 - generated manifest in `skills/index.json`: DONE
 - plugin-mirrored skill contracts in `plugins/meta-architect/skills/`: DONE
-- installable package skill surface via `postinstall`: DONE
+- installable package skill surface via first-launch host selection: DONE
 
 ## Test coverage actually present
 
@@ -130,7 +130,7 @@ Coverage state:
 | `test/obsidian-integration-core.test.js` | vault-context indexing and graph-link behavior |
 | `test/obsidian-plugin-bridge.test.js` | in-app plugin bridge, metadata, queue, frontmatter, attachments, protocol helpers |
 | `test/package-exports.test.js` | public package API exports core runtime capabilities |
-| `test/package-install-smoke.test.js` | packed npm install, postinstall skill installation, launcher behavior, helper flow |
+| `test/package-install-smoke.test.js` | packed npm install, first-launch skill installation, launcher behavior, helper flow |
 | `test/policy.test.js` | merge/release branch policy enforcement |
 | `test/prompt-strategy-core.test.js` | prompt strategy policy and high-risk preservation |
 | `test/quorum-review.test.js` | review vote confidence and minority reports |
@@ -154,7 +154,7 @@ Current automated verification count:
 
 | Surface | Status | Mechanism |
 | --- | --- | --- |
-| npm package identity | DONE | `@jstn-sdk/ma@0.14.0` |
+| npm package identity | DONE | `@jstn-sdk/ma@0.14.1` |
 | public scoped package config | DONE | `publishConfig.access = public` |
 | package files allowlist | DONE | `package.json > files` |
 | production ignore policy | DONE | `.npmignore` plus `npm pack --dry-run` |
@@ -176,8 +176,8 @@ Current automated verification count:
 | `docs/getting-started.md` onboarding | DONE | source checkout, helper path, gates, runtime artifacts |
 | `docs/skills.md` skill reference | DONE | trigger-by-trigger contract guide |
 | `docs/mcp-setup.md` evidence policy | DONE | GitMCP endpoint semantics and bridge guidance |
-| `docs/release-spec.md` release policy | DONE | `v0.14.0` aligned |
-| `docs/qa/release-readiness-0.14.0.md` | DONE | current QA evidence |
+| `docs/release-spec.md` release policy | DONE | `v0.14.1` aligned |
+| `docs/qa/release-readiness-0.14.1.md` | DONE | current QA evidence |
 | `scripts/release-verify.js` | DONE | checks install docs, demo doc, issue gates, package metadata, `.npmignore` |
 
 ## Known limits
@@ -192,7 +192,7 @@ These are explicit operating limits, not stale gaps:
 
 ## Current truth statement
 
-Meta-Architect currently covers the `v0.14.0` release bar for:
+Meta-Architect currently covers the `v0.14.1` release bar for:
 
 - canonical install and launch
 - Codex-hosted runtime entry

package/DEMO.md

@@ -1,7 +1,7 @@
 # Meta-Architect Demo Guide
 
 Last verified: 2026-06-03
-Release line: `v0.14.0`
+Release line: `v0.14.1`
 Package: `@jstn-sdk/ma`
 
 This demo uses a real existing project: this Meta-Architect repository.
@@ -96,7 +96,7 @@ Scenario: make this repository release-ready without bypassing architecture, evi
 Terminal helper path:
 
 ```bash
-ma idea "Prepare Meta-Architect v0.14.0 for a production package release with real install docs, Obsidian brain-context support, learning-loop reliability, and package proof artifacts."
+ma idea "Prepare Meta-Architect v0.14.1 for a production package release with real install docs, Obsidian brain-context support, learning-loop reliability, and package proof artifacts."
 ma run '$maestro'
 ma status --maestro-view
 ```
@@ -217,7 +217,7 @@ npm pack --dry-run --ignore-scripts --cache ./.npm-cache
 Expected package proof:
 
 - package name is `@jstn-sdk/ma`
-- version line is `0.14.0`
+- version line is `0.14.1`
 - `npm run demo:smoke` creates a realistic Northstar Logistics workspace and Obsidian vault under `/tmp/ma-real-demo-*`
 - the smoke writes `.ma/evidence/real-demo-smoke-proof.json` in that temporary workspace
 - `DEMO.md` is included
@@ -252,7 +252,7 @@ What it proves:
 
 | Surface | Current reality |
 | --- | --- |
-| Release line | `v0.14.0` |
+| Release line | `v0.14.1` |
 | Package | `@jstn-sdk/ma` |
 | Public skills | 11 (`maestro`, `arch`, `sage`, `flow`, `vet`, `vibe`, `build`, `align`, `diagnose`, `tdd`, `cleanup`) |
 | Runtime namespace | `.ma/` |

package/README.md

@@ -1,5 +1,5 @@
 <div align="center">
-  <img src="https://raw.githubusercontent.com/JustineDevs/meta-architect/v0.14.0/docs/assets/meta-architect-logo.svg" alt="Meta-Architect: quality gates and evidence verification for AI coding agents" width="1024" height="240">
+  <img src="./docs/assets/banner.png" alt="Meta-Architect: quality gates and evidence verification for AI coding agents" width="1000">
   <h1>Meta-Architect</h1>
   <p><strong>Quality gates and evidence verification for AI coding agents.</strong></p>
   <p>Your agent writes code fast. Meta-Architect makes it prove each stage first. Design, evidence, logic, security, experience, build. Each gate stays locked until the one before it passes.</p>
@@ -7,6 +7,12 @@
     <img src="https://img.shields.io/github/v/release/JustineDevs/meta-architect?display_name=tag&sort=semver" alt="GitHub release">
     <img src="https://img.shields.io/npm/v/%40jstn-sdk%2Fma" alt="npm version">
     <img src="https://img.shields.io/npm/dm/%40jstn-sdk%2Fma" alt="npm downloads">
+    <a href="https://badge.socket.dev/npm/package/@jstn-sdk/ma/0.14.1">
+      <img src="https://badge.socket.dev/npm/package/@jstn-sdk/ma/0.14.1" alt="Socket security">
+    </a>
+    <a href="https://security.snyk.io/package/npm/%252540jstn-sdk%25252Fma">
+      <img src="https://snyk.io/test/npm/%40jstn-sdk%2Fma/badge.svg" alt="Snyk security">
+    </a>
     <a href="https://www.buymeacoffee.com/justinedevs">
       <img src="https://img.shields.io/badge/Buy%20Me%20A%20Coffee-ffdd00?style=flat-square&logo=buy-me-a-coffee&logoColor=black" alt="Buy Me A Coffee">
     </a>
@@ -22,7 +28,73 @@
 > Meta-Architect does not replace your coding runtime.
 > It wraps that runtime with architecture, evidence, gate enforcement, and release-sensitive workflow control.
 
-<img src="https://raw.githubusercontent.com/JustineDevs/meta-architect/v0.14.0/docs/assets/DEMO_VIDEO.gif" alt="Meta-Architect demo video" width="800">
+<img src="https://raw.githubusercontent.com/JustineDevs/meta-architect/v0.14.1/docs/assets/DEMO_VIDEO.gif" alt="Meta-Architect demo video" width="800">
+
+## 🧩 Quick start
+
+| ✅ Recommended | 🧰 All available installation commands |
+| --- | --- |
+| Use the signed jsDelivr installer on macOS, Linux, WSL, or Git Bash.<br><br>`curl -fsSLo install.sh https://cdn.jsdelivr.net/gh/JustineDevs/meta-architect@latest/scripts/install.sh`<br><br>`curl -fsSLo install.sh.sha256 https://cdn.jsdelivr.net/gh/JustineDevs/meta-architect@latest/scripts/install.sh.sha256`<br><br>`sed 's#scripts/install.sh#install.sh#' install.sh.sha256 \| sha256sum -c -`<br><br>`sh install.sh`<br><br>`ma --madmax --high`<br><br>`$maestro I want to build: [your project idea]` | **npm global**<br><br>`npm i -g @openai/codex@latest @jstn-sdk/ma@latest`<br><br>**Meta-Architect only**<br><br>`npm i -g @jstn-sdk/ma@latest`<br><br>**Windows PowerShell**<br><br>`npm i -g @openai/codex@latest @jstn-sdk/ma@latest`<br><br>**Debian / Ubuntu**<br><br>`sudo apt install ./meta-architect_&lt;version&gt;_all.deb`<br><br>**Arch Linux**<br><br>`sudo pacman -U ./meta-architect-&lt;version&gt;-1-any.pkg.tar.xz`<br><br>**Fedora / openSUSE**<br><br>`sudo dnf install ./meta-architect-&lt;version&gt;-1.noarch.rpm` |
+
+### AI agent installation prompt
+
+Copy and paste this prompt into your AI coding agent:
+
+```text
+Install Meta-Architect for this project.
+
+1. Detect the current AI host and its native project configuration surface.
+2. Install or update `@jstn-sdk/ma@latest` using the host's supported package manager.
+3. Set `MA_AGENT` to the detected host ID when a host-specific surface is available.
+4. Run `ma setup` and accept the detected project scope and targets.
+5. Verify the generated `.ma/` state and native host artifacts.
+6. Report the installed version, selected host, generated files, and any unsupported capabilities.
+
+Do not overwrite user-owned files, modify unrelated configuration, or claim a host is supported without verification.
+```
+
+More install options: [docs/getting-started.md](./docs/getting-started.md)
+
+Uninstall Meta-Architect: `npm uninstall -g @jstn-sdk/ma`
+Uninstall Meta-Architect and Codex: `npm uninstall -g @jstn-sdk/ma @openai/codex`
+
+### Install into an AI vendor host
+
+Install Meta-Architect once, then select the host surface before launch. The
+pre-launch step detects installed hosts and writes the selected scope and
+targets to `.ma/prelaunch.json`.
+
+```bash
+# Codex (reference host)
+npm i -g @openai/codex@latest @jstn-sdk/ma@latest
+ma --madmax --high
+
+# Claude Code
+MA_AGENT=claude-code npm i -g @jstn-sdk/ma@latest
+MA_AGENT=claude-code ma --madmax --high
+
+# Cursor
+MA_AGENT=cursor npm i -g @jstn-sdk/ma@latest
+MA_AGENT=cursor ma --madmax --high
+
+# Any registered host surface
+MA_AGENT=<host-id> npm i -g @jstn-sdk/ma@latest
+MA_AGENT=<host-id> ma --madmax --high
+```
+
+MA installs or reuses the native skill/configuration surface for the selected
+host and keeps the canonical workflow unchanged. See the [host compatibility
+evidence](./docs/agent-compat-integration-report.md) for supported surfaces.
+
+### Claude Code marketplace
+
+The repository includes a hosted Claude Code marketplace for the existing
+`plugins/meta-architect` bundle:
+
+```text
+/plugin marketplace add JustineDevs/meta-architect
+/plugin install meta-architect@meta-architect
+```
 
 <details>
 <summary><strong>🔌 All 33 plugins & features</strong></summary>
@@ -30,7 +102,8 @@
 The plugin and feature inventory is maintained in the [support bundle manifest](./support-bundle.json) and [skills manifest](./skills/index.json), with verification in the [coverage documentation](./COVERAGE.md).
 </details>
 
-## Why do AI coding agents need gates?
+<details>
+<summary><strong>Why do AI coding agents need gates?</strong></summary>
 
 Your agent writes code faster than you review it. Studies and dev surveys keep finding the same failures:
 
@@ -95,7 +168,7 @@ Build stays LOCKED until every upstream gate passes. Red stays red.
 
 Four helpers support the lanes without moving gates: `$align`, `$diagnose`, `$tdd`, `$cleanup`.
 
-## How is it different from Spec Kit, BMAD, or Agent OS?
+### How is it different from Spec Kit, BMAD, or Agent OS?
 
 Spec-driven tools structure what your agent writes. Meta-Architect enforces what your agent proves.
 
@@ -109,71 +182,7 @@ Spec-driven tools structure what your agent writes. Meta-Architect enforces what
 
 Already using a spec tool? Keep it. Their specs become inputs. MA's gates verify the execution.
 
-## Quick start
-
-```bash
-# 1. Install (macOS, Linux, WSL, Git-Bash)
-curl -fsSLo install.sh https://cdn.jsdelivr.net/gh/JustineDevs/meta-architect@latest/scripts/install.sh && curl -fsSLo install.sh.sha256 https://cdn.jsdelivr.net/gh/JustineDevs/meta-architect@latest/scripts/install.sh.sha256 && sed 's#scripts/install.sh#install.sh#' install.sh.sha256 | sha256sum -c - && sh install.sh
-
-# 2. Launch Codex
-ma --madmax --high
-
-# 3. State your intent inside the session
-$maestro I want to build: [your project idea]
-```
-
-### AI agent installation prompt
-
-Copy and paste this prompt into your AI coding agent:
-
-```text
-Install Meta-Architect for this project.
-
-1. Detect the current AI host and its native project configuration surface.
-2. Install or update `@jstn-sdk/ma@latest` using the host's supported package manager.
-3. Set `MA_AGENT` to the detected host ID when a host-specific surface is available.
-4. Run `ma setup` and accept the detected project scope and targets.
-5. Verify the generated `.ma/` state and native host artifacts.
-6. Report the installed version, selected host, generated files, and any unsupported capabilities.
-
-Do not overwrite user-owned files, modify unrelated configuration, or claim a host is supported without verification.
-```
-
-Windows PowerShell: `npm i -g @openai/codex@latest @jstn-sdk/ma@latest`
-More install options: [docs/getting-started.md](./docs/getting-started.md)
-
-Uninstall Meta-Architect: `npm uninstall -g @jstn-sdk/ma`
-Uninstall Meta-Architect and Codex: `npm uninstall -g @jstn-sdk/ma @openai/codex`
-
-### Install into an AI vendor host
-
-Install Meta-Architect once, then select the host surface before launch. The
-pre-launch step detects installed hosts and writes the selected scope and
-targets to `.ma/prelaunch.json`.
-
-```bash
-# Codex (reference host)
-npm i -g @openai/codex@latest @jstn-sdk/ma@latest
-ma --madmax --high
-
-# Claude Code
-MA_AGENT=claude-code npm i -g @jstn-sdk/ma@latest
-MA_AGENT=claude-code ma --madmax --high
-
-# Cursor
-MA_AGENT=cursor npm i -g @jstn-sdk/ma@latest
-MA_AGENT=cursor ma --madmax --high
-
-# Any registered host surface
-MA_AGENT=<host-id> npm i -g @jstn-sdk/ma@latest
-MA_AGENT=<host-id> ma --madmax --high
-```
-
-MA installs or reuses the native skill/configuration surface for the selected
-host and keeps the canonical workflow unchanged. See the [host compatibility
-evidence](./docs/agent-compat-integration-report.md) and [skills publishing
-guide](./docs/skills-publishing.md) for the complete registry and distribution
-rules.
+</details>
 
 ## Who is it for?
 
@@ -185,7 +194,7 @@ rules.
 
 1. Open an issue before a PR. It saves rework.
 2. Start here: [issues labeled `triage`](https://github.com/JustineDevs/meta-architect/issues)
-3. Branch from `development`. `main` is protected and release-facing.
+3. Branch from `dev`. `main` is protected and release-facing.
 4. Run `npm test` before you submit. Follow [AGENTS.md](./AGENTS.md).
 5. AI-assisted PRs welcome. Explain every line you submit or expect a close.
 
@@ -198,6 +207,7 @@ rules.
 - [Release Spec](./docs/release-spec.md)
 - [Disk-Bounded Test and Review Runs](./docs/disk-optimization.md)
 - [MCP Setup](./docs/mcp-setup.md)
+- [ChatGPT Integration](./docs/chatgpt-integration.md): deployment requirements and publication boundary
 
 ## License
 

package/bin/ma.js

@@ -346,7 +346,7 @@ async function printStatus(releaseState, { json = false } = {}) {
     releaseState.merge_status !== "MERGED_TO_DEVELOPMENT"
   ) {
     console.log("Next allowed triggers:");
-    console.log("ma merge <feature/*> development");
+    console.log("ma merge <feature/*> dev");
     return;
   }
   console.log("Next allowed triggers:");
@@ -402,14 +402,14 @@ async function runBuild() {
   }
 
   console.log("Build gate completed the bounded execution substep.");
-  console.log("Next step: ma merge <feature/*> development");
+  console.log("Next step: ma merge <feature/*> dev");
 }
 
 async function runMerge(sourceBranch, targetBranch, mode = "approval") {
   const releaseState = await loadReleaseState();
 
   if (!validateMergeTarget(sourceBranch, targetBranch)) {
-    throw new Error("Merge policy violation: only feature/* -> development is allowed");
+    throw new Error("Merge policy violation: only feature/* -> dev is allowed");
   }
 
   if (!canMarkBuildDone(releaseState)) {
@@ -458,14 +458,12 @@ async function runMerge(sourceBranch, targetBranch, mode = "approval") {
 async function runRelease(originBranch, targetBranch, mode = "approval") {
   const releaseState = await loadReleaseState();
 
-  if (targetBranch !== "prod") {
-    throw new Error("Release policy violation: target branch must be prod");
+  if (targetBranch !== "main") {
+    throw new Error("Release policy violation: target branch must be main");
   }
 
   if (rejectsDirectProdPromotion(originBranch) || !validateReleaseOrigin(originBranch)) {
-    throw new Error(
-      "Release policy violation: only development or approved release/* can promote to prod",
-    );
+    throw new Error("Release policy violation: only dev or approved release/* can promote to main");
   }
 
   if (releaseState.merge_status !== "MERGED_TO_DEVELOPMENT") {

package/docs/README.md

@@ -28,8 +28,8 @@ Meta-Architect documentation is organized by operator task.
 
 ## QA and readiness
 
-- [Release Readiness 0.14.0](./qa/release-readiness-0.14.0.md)
-- [Release Issue Gates 0.14.0](./qa/release-issue-gates-0.14.0.json)
+- [Release Readiness 0.14.1](./qa/release-readiness-0.14.1.md)
+- [Release Issue Gates 0.14.1](./qa/release-issue-gates-0.14.1.json)
 
 ## Repo structure references
 

package/docs/getting-started.md

@@ -33,8 +33,8 @@ The jsDelivr installer runs `npm i -g @openai/codex@latest @jstn-sdk/ma@latest`,
 Use `sh install.sh --dry-run` to inspect the plan, `--no-setup` to skip local
 runtime writes, or `--no-skills` to skip skill/support-bundle writes. The
 installer prints Node/npm/Codex versions and an uninstall command after a real
-install. Package postinstall supports `MA_SKIP_AUTO_INSTALL=1`,
-`MA_SKIP_SKILLS=1`, and `MA_POSTINSTALL_DRY_RUN=1`.
+install. npm installation is side-effect free; host selection and skill
+installation happen explicitly during the first interactive `ma` launch.
 
 Debian-family install:
 
@@ -111,7 +111,7 @@ Required output:
 5. Data model and storage choices
 6. Auth/security considerations
 7. DX/UX considerations
-8. Delivery plan for v0.14.0
+8. Delivery plan for v0.14.1
 9. Risks and trade-offs
 10. Decision log
 11. Exact next trigger to run after this
@@ -310,7 +310,7 @@ See [docs/mcp-setup.md](./mcp-setup.md) for endpoint policy and evidence semanti
 ## 6. Secondary helper flow
 
 ```bash
-ma idea "Prepare Meta-Architect v0.14.0 for a production package release with real install docs, Obsidian brain-context support, learning-loop reliability, and package proof artifacts."
+ma idea "Prepare Meta-Architect v0.14.1 for a production package release with real install docs, Obsidian brain-context support, learning-loop reliability, and package proof artifacts."
 ```
 
 Expected effects:
@@ -495,7 +495,7 @@ If `$build` fails:
 
 ```bash
 ma setup
-ma idea "Prepare Meta-Architect v0.14.0 for a production package release with real install docs, Obsidian brain-context support, learning-loop reliability, and package proof artifacts."
+ma idea "Prepare Meta-Architect v0.14.1 for a production package release with real install docs, Obsidian brain-context support, learning-loop reliability, and package proof artifacts."
 ma run '$arch'
 ma run '$sage'
 ma run '$flow'
@@ -523,8 +523,8 @@ Canonical demo reference:
 After implementation work is complete:
 
 ```bash
-ma merge feature/ui development
-ma release development prod
+ma merge feature/ui dev
+ma release dev main
 ```
 
 These commands record approval by default; they do not execute Git. Use
@@ -533,8 +533,8 @@ state, or `--execute` to run the checked, explicit merge on the target branch.
 Both modes require a clean worktree and a valid source branch.
 
 Expected effects:
-- merge only succeeds for `feature/* -> development`
-- release only succeeds for `development|release/* -> prod`
+- merge only succeeds for `feature/* -> dev`
+- release only succeeds for `dev|release/* -> main`
 - final statuses advance to:
   - `build_status = DONE`
   - `merge_status = MERGED_TO_DEVELOPMENT`