@noodleseed/agent-kit 0.50.0 → 0.52.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/agent-kit",
-  "version": "0.50.0",
+  "version": "0.52.0",
   "private": false,
   "description": "Self-checking, self-updating agent skills for the Noodle Seed CLI. Authored in this repo by @noodle-borg/agent-kit; this is the published, independently-versioned canonical skills artifact the CLI fetches and verifies.",
   "license": "Apache-2.0",

package/skills/claude-code/SKILL.md

@@ -3,7 +3,7 @@ name: noodle-seed
 description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:cd6ca0d915e6acb9 -->
+<!-- noodle-skill version:0.52.0 hash:18e16a8fa4c68b86 -->
 
 # Noodle Seed
 
@@ -13,7 +13,7 @@ Use this skill for project-local Noodle Seed authoring in the active coding host
 
 If the request is unrelated to the Noodle MCP surface, stop here: follow the project's normal instructions and run no Noodle lifecycle commands.
 
-**Installed-plugin execution.** When this skill is supplied by the Noodle Developer plugin, preserve the managed invocation path established by the plugin bootstrap and invoke every `noodle` command through that host bundle's managed launcher. Do not install or update a global CLI. Noodle guides and operates the lifecycle; you write and test the application source in the user's project.
+**Installed-plugin execution.** When this skill is supplied by the Noodle Developer plugin, you write and test the application source, then use its supported `noodle-readiness` tools for project setup, build gates, exact-target linking, variables, secret-from-environment transfer, gated deployment, and feedback. Treat the corresponding public `noodle ...` command as recovery text, never as permission to discover or expose an internal launcher. If a tool fails, report its structured error and public `noodle ...` command; do not ask the user to copy a private installation path or perform an operation the authorized tool can perform.
 
 ## Route the request
 
@@ -35,12 +35,14 @@ Negative routing examples: “Inspect hosted logs/status” → `inspect-hosted`
 | Deploy, configure, connect with writes, change access, or roll back a hosted MCP service when explicitly requested | `deploying-mcp-services` | `references/deploy-and-ops.md` (`references/cli-commands.md`) | The requested hosted state is evidenced without claiming unperformed host or production checks. |
 | Embed a Noodle assistant in an existing SaaS or web application | `embedding-mcp-assistants` | `references/embedded-assistant.md` (`references/authoring-workflow.md`) | The requested embed boundary works with verified identity and credential separation at the tested level. |
 | Prepare or submit an integration to a host directory | `publishing-mcp-integrations` | `references/publishing.md` (`references/app-directory-compliance.md`) | The requested submission evidence is complete and any host-review uncertainty is explicit. |
-| Report a Noodle Seed bug, documentation gap, or product improvement | `reporting-noodle-feedback` | `references/feedback.md` (None) | A sanitized dry-run preview and exact live command are shown, then one submission occurs only after explicit approval. |
+| Report a Noodle Seed bug, documentation gap, or product improvement | `reporting-noodle-feedback` | `references/feedback.md` (None) | A sanitized dry-run preview and exact proposal are shown, then one submission occurs only after explicit approval. |
 
 ## Common machine loop
 
 Every `--json` command speaks the canonical envelope on stdout. Parse machine state instead of scraping human prose; `references/agent-contract.md` owns the envelope, streaming records, and exit codes.
 
+Inside the installed plugin, perform mapped steps with `noodle-readiness` tools and use the public `noodle ...` spelling only when reporting the logical action or a fallback. Outside the plugin, run the public CLI directly. Never construct a hidden launcher command.
+
 1. **Discover** — use `noodle commands --json` when the required command or flags are uncertain; don't read CLI source.
 2. **Author** — for build routes, edit the configured TypeScript entrypoint, usually `src/server.ts`.
 3. **Validate** — run `noodle validate --json`; repair each `error.errors[]` item at its `path`, then re-run `noodle validate --json`.
@@ -76,11 +78,12 @@ This is a lookup catalog, not a discovery checklist. Return here only when the s
 
 ## Product feedback
 
-When you discover a bug, missing capability, misleading doc, or improvement idea, discover current fields with `noodle commands --json`, draft and sanitize one finding, then run `noodle feedback ... --dry-run --json`. Inspect and show the exact normalized submission, diagnostics, private destination, and POSIX-safely quoted live command. Ask for explicit approval of that exact proposal; do not submit it until approval. Then submit once without `--dry-run`. Follow `references/feedback.md`; never include customer code, secrets, personal data, or identifying project details, and never auto-login or retry-loop.
+When you discover a bug, missing capability, misleading doc, or improvement idea, draft and sanitize one finding, then preview it with `noodle-readiness.preview_product_feedback` in the installed plugin or `noodle feedback ... --dry-run --json` in the public CLI. Inspect and show the normalized submission, diagnostics, and private destination. Ask for explicit approval of that exact proposal; do not submit it until approval. Then call `noodle-readiness.submit_product_feedback` once with approval, or run the public CLI once without `--dry-run`. Follow `references/feedback.md`; pass structured arguments directly instead of composing a shell command, never include customer code, secrets, personal data, or identifying project details, and never auto-login or retry-loop.
 
 ## Safety
 
 - Keep secrets, bearer tokens, refresh tokens, static access keys, `.env.noodle` values, and `~/.noodle/config.json` out of prompts, logs, docs, tests, and generated files.
+- Never expose an internal launcher or private installation path, ask the user to paste a command the plugin can execute, or use an ad hoc shell/file-parsing pipeline to move a secret. Use the typed secret-from-environment tool or `noodle secrets set ... --from-env NAME`.
 - Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata.
 - Do not add static data-plane credential paths; hosted access is identity-based.
 - Hosted mutation is opt-in. Run `link`, hosted secret/variable/config/access changes, deploy, rollback, host configuration writes, or directory submission only when the current user request explicitly authorizes the exact mutation and target. An inspect, prepare, validate, test, or local-only request grants no such authority; stop and ask before crossing that boundary.

package/skills/claude-code/authoring-mcp-servers/SKILL.md

@@ -3,7 +3,7 @@ name: authoring-mcp-servers
 description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:0b2fd8c7e43fc69f -->
+<!-- noodle-skill version:0.52.0 hash:0b2fd8c7e43fc69f -->
 
 # authoring-mcp-servers
 

package/skills/claude-code/building-mcp-apps/SKILL.md

@@ -3,7 +3,7 @@ name: building-mcp-apps
 description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:f7fa54992c8d7692 -->
+<!-- noodle-skill version:0.52.0 hash:f7fa54992c8d7692 -->
 
 # building-mcp-apps
 

package/skills/claude-code/connecting-apis-to-mcp/SKILL.md

@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
 description: "Use when credentials, an API URL, an OpenAPI document, or an observed response must become real Noodle Seed MCP behavior."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:1e86b8704f407bd3 -->
+<!-- noodle-skill version:0.52.0 hash:1e86b8704f407bd3 -->
 
 # connecting-apis-to-mcp
 

package/skills/claude-code/debugging-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
 description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:aa715bae12041d7c -->
+<!-- noodle-skill version:0.52.0 hash:aa715bae12041d7c -->
 
 # debugging-mcp-delivery
 

package/skills/claude-code/deploying-mcp-services/SKILL.md

@@ -3,7 +3,7 @@ name: deploying-mcp-services
 description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:93e735b7ffb45df1 -->
+<!-- noodle-skill version:0.52.0 hash:93e735b7ffb45df1 -->
 
 # deploying-mcp-services
 

package/skills/claude-code/designing-mcp-products/SKILL.md

@@ -3,7 +3,7 @@ name: designing-mcp-products
 description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:76cce86729cffbee -->
+<!-- noodle-skill version:0.52.0 hash:76cce86729cffbee -->
 
 # designing-mcp-products
 

package/skills/claude-code/embedding-mcp-assistants/SKILL.md

@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
 description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:cc54a67f21c0ecdb -->
+<!-- noodle-skill version:0.52.0 hash:cc54a67f21c0ecdb -->
 
 # embedding-mcp-assistants
 

package/skills/claude-code/examples/hello/README.md

@@ -5,17 +5,18 @@ connectors, secrets, flows, widgets, or handoff policy. It still uses the curren
 so new authors see where server-level branding belongs. Use it to smoke the author loop
 (`noodle validate` / `noodle dev`) or a first deploy.
 
-When an installed Noodle Developer plugin drives this example, its skill runs these logical
-`noodle` commands through the plugin-managed, version-pinned launcher and isolated host profile.
-Do not install or update a global CLI: the coding agent writes and tests this source while Noodle
-guides and operates the validate, preview, deploy, inspect, and debug workflow.
+When an installed Noodle Developer plugin drives this example, its skill performs mapped lifecycle
+steps through the supported `noodle-readiness` tools and reports only stable public `noodle ...`
+commands as recovery text. Do not install or update a global CLI: the coding agent writes and tests
+this source while Noodle guides and operates the validate, preview, deploy, inspect, and debug workflow.
 For an approved implementation plan, the installed `executing-noodle-plans` skill owns the
 test-first task, review, recovery, and final-verification loop.
 If that agent discovers a Noodle Seed product gap while working, the installed skill prepares a
-sanitized `noodle feedback` proposal, discovers current fields from `noodle commands --json`, runs
-`--dry-run --json` to inspect the exact normalized submission, diagnostics, and private destination,
-then shows a POSIX-safely quoted live command. It submits once without `--dry-run` only after explicit
-user approval of that exact preview; it never auto-logs in or retry-loops.
+sanitized `noodle feedback` proposal, discovers current fields from `noodle commands --json`, and
+previews the exact normalized submission, diagnostics, and private destination through the typed
+plugin function or `--dry-run --json`. It includes its known `--agent` and `--model` identity without
+guessing unavailable values, keeps those fields structured, and submits once only after explicit user
+approval of that exact preview; it never composes a shell wrapper, auto-logs in, or retry-loops.
 Every `--json` command writes its canonical success or failure envelope to stdout and leaves stderr
 empty. One-shot commands write one envelope; streaming commands write NDJSON snapshot, event, and
 terminal-failure envelopes so agents can parse each line independently.

package/skills/claude-code/executing-noodle-plans/SKILL.md

@@ -3,7 +3,7 @@ name: executing-noodle-plans
 description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:6a9f132ddb79352e -->
+<!-- noodle-skill version:0.52.0 hash:6a9f132ddb79352e -->
 
 # Execute a Noodle Seed implementation plan
 

package/skills/claude-code/publishing-mcp-integrations/SKILL.md

@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
 description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:efffbf82007f935d -->
+<!-- noodle-skill version:0.52.0 hash:efffbf82007f935d -->
 
 # publishing-mcp-integrations
 

package/skills/claude-code/references/feedback.md

@@ -1,6 +1,6 @@
 # Send product feedback
 
-When you — the coding agent — discover a way Noodle Seed could be better, prepare one sanitized feedback proposal. Feedback crosses the customer project boundary and lands in the Noodle Seed private feedback tracker, so the user must make an informed choice. Preview the exact normalized submission locally, show it with the exact live command, and ask for explicit user approval. Do not submit it until approval is given.
+When you — the coding agent — discover a way Noodle Seed could be better, prepare one sanitized feedback proposal. Feedback crosses the customer project boundary and lands in the Noodle Seed private feedback tracker, so the user must make an informed choice. Preview the exact normalized submission locally, show its stable public `noodle feedback` action, and ask for explicit user approval. Do not submit it until approval is given.
 
 ## Contents
 
@@ -27,27 +27,30 @@ Do not batch several findings into one proposal, and do not re-propose the same
 ## Approval workflow
 
 1. Discover the current positional arguments, flags, choices, defaults, and limits from `noodle commands --json`; `noodle feedback --help` is the human-readable view. Do not guess or rely on a remembered catalog.
-2. Draft one finding, then sanitize its title and message using the rules below.
+2. Draft one finding, then sanitize its title and message using the rules below. When your coding-agent name is known, add `--agent`; add `--model` only when the exact model identifier is also known. These fields are client-reported provenance: never guess either value.
 3. Run the proposal with `--dry-run --json`. This local preview needs no login and sends nothing. Parse `{"ok":true,"data":{"mode":"preview","willSubmit":false,"destination":"Noodle Seed private feedback tracker","submission":{...}}}`.
-4. Inspect the complete `submission`, including its normalized defaults and automatically attached diagnostics. Show the user the exact previewed proposal, its `destination`, and a POSIX-safely quoted live command containing the same fields but without `--dry-run`.
+4. Inspect the complete `submission`, including its normalized defaults and automatically attached diagnostics. Show the user the exact previewed proposal, its `destination`, and the stable public `noodle feedback` action. Keep the proposal as structured fields instead of rebuilding it as shell text.
 5. Ask for explicit approval of that exact previewed proposal. If the user changes any field, preview the changed proposal again before asking.
-6. Only after approval, submit it once by running the disclosed live command without `--dry-run`. Never auto-login and never retry-loop. If authentication fails before the request or a rate limit denies it, report that nothing was sent. For `feedback_recording_failed`, report that no reference was returned and the outcome may be unknown; do not retry because the private issue might already exist.
+6. Only after approval, submit it once with `noodle-readiness.submit_product_feedback` when the installed plugin tool is available, or pass the same structured fields directly to the public CLI without `--dry-run`. Never auto-login and never retry-loop. If authentication fails before the request or a rate limit denies it, report that nothing was sent. For `feedback_recording_failed`, report that no reference was returned and the outcome may be unknown; do not retry because the private issue might already exist.
 
 ## The command
 
 ```sh
 noodle feedback 'resources list --json omits the truncated flag the docs promise' \
   --title 'resources list --json missing truncated flag' \
-  --type fix --severity P2 --area cli --dry-run --json
+  --type fix --severity P2 --area cli --agent 'coding-agent' --model 'model-id' \
+  --dry-run --json
 ```
 
-This is a preview example only. Build the exact command for the finding using current `noodle commands --json` metadata, POSIX-quote every user-controlled value, and inspect the returned submission instead of reconstructing it. The message is required (1–4000 chars). The CLI attaches only the disclosed light diagnostics automatically: CLI version, OS/platform, Node version. Nothing else is collected. After approval, the live success envelope is `{ok:true,data:{reference,labels}}`; a `429` means the per-user hourly budget (5) is spent — report that it was not sent and never retry-loop.
+This is a preview example only: replace `coding-agent` and `model-id` with your known coding-agent identity, or omit both when unavailable. Build structured arguments for the finding using current `noodle commands --json` metadata and inspect the returned submission instead of reconstructing it. Invoke the CLI with an argument array or the typed plugin function, never a shell wrapper or copy/paste request. The message is required (1–4000 chars). The CLI attaches only the disclosed light diagnostics automatically: CLI version, OS/platform, Node version. Agent/model provenance is included only through the explicit client-reported flags. Nothing else is collected. After approval, the live success envelope is `{ok:true,data:{reference,labels}}`; a `429` means the per-user hourly budget (5) is spent — report that it was not sent and never retry-loop.
 
 ## Choose the structured fields
 
 - `--type` — `fix` (bug/regression/wrong output), `feat` (missing capability), `docs` (misleading or absent docs/examples), `chore` (tooling/setup friction). Default `feat`.
 - `--severity` — `P0` only for a security-relevant defect; `P1` a workflow is blocked with no workaround; `P2` blocked but a workaround exists; `P3` (default) papercut or idea.
 - `--area` — one of `docs analytics connectors self-service conformance ci deploys distribution console dx plugins cli compiler multi-surface enterprise policy`. Use `cli` for command behavior, `dx` for authoring/agent ergonomics; omit when unsure.
+- `--agent` — your known coding-agent product name (1–64 chars). Omit when unavailable; the CLI does not auto-detect it.
+- `--model` — the exact known model identifier (1–64 chars). Requires `--agent`; omit rather than guessing.
 - `--title` — one line, ≤120 chars, stating the defect or idea (defaults to the message’s first line).
 
 ## Sanitization rules (hard requirements)

package/skills/claude-code/reporting-noodle-feedback/SKILL.md

@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
 description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:0f404109f4845683 -->
+<!-- noodle-skill version:0.52.0 hash:0f404109f4845683 -->
 
 # reporting-noodle-feedback
 

package/skills/claude-code/verifying-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
 description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:6ef6ef551e26b78e -->
+<!-- noodle-skill version:0.52.0 hash:6ef6ef551e26b78e -->
 
 # verifying-mcp-delivery
 

package/skills/codex/SKILL.md

@@ -3,7 +3,7 @@ name: noodle-seed
 description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:cd6ca0d915e6acb9 -->
+<!-- noodle-skill version:0.52.0 hash:18e16a8fa4c68b86 -->
 
 # Noodle Seed
 
@@ -13,7 +13,7 @@ Use this skill for project-local Noodle Seed authoring in the active coding host
 
 If the request is unrelated to the Noodle MCP surface, stop here: follow the project's normal instructions and run no Noodle lifecycle commands.
 
-**Installed-plugin execution.** When this skill is supplied by the Noodle Developer plugin, preserve the managed invocation path established by the plugin bootstrap and invoke every `noodle` command through that host bundle's managed launcher. Do not install or update a global CLI. Noodle guides and operates the lifecycle; you write and test the application source in the user's project.
+**Installed-plugin execution.** When this skill is supplied by the Noodle Developer plugin, you write and test the application source, then use its supported `noodle-readiness` tools for project setup, build gates, exact-target linking, variables, secret-from-environment transfer, gated deployment, and feedback. Treat the corresponding public `noodle ...` command as recovery text, never as permission to discover or expose an internal launcher. If a tool fails, report its structured error and public `noodle ...` command; do not ask the user to copy a private installation path or perform an operation the authorized tool can perform.
 
 ## Route the request
 
@@ -35,12 +35,14 @@ Negative routing examples: “Inspect hosted logs/status” → `inspect-hosted`
 | Deploy, configure, connect with writes, change access, or roll back a hosted MCP service when explicitly requested | `deploying-mcp-services` | `references/deploy-and-ops.md` (`references/cli-commands.md`) | The requested hosted state is evidenced without claiming unperformed host or production checks. |
 | Embed a Noodle assistant in an existing SaaS or web application | `embedding-mcp-assistants` | `references/embedded-assistant.md` (`references/authoring-workflow.md`) | The requested embed boundary works with verified identity and credential separation at the tested level. |
 | Prepare or submit an integration to a host directory | `publishing-mcp-integrations` | `references/publishing.md` (`references/app-directory-compliance.md`) | The requested submission evidence is complete and any host-review uncertainty is explicit. |
-| Report a Noodle Seed bug, documentation gap, or product improvement | `reporting-noodle-feedback` | `references/feedback.md` (None) | A sanitized dry-run preview and exact live command are shown, then one submission occurs only after explicit approval. |
+| Report a Noodle Seed bug, documentation gap, or product improvement | `reporting-noodle-feedback` | `references/feedback.md` (None) | A sanitized dry-run preview and exact proposal are shown, then one submission occurs only after explicit approval. |
 
 ## Common machine loop
 
 Every `--json` command speaks the canonical envelope on stdout. Parse machine state instead of scraping human prose; `references/agent-contract.md` owns the envelope, streaming records, and exit codes.
 
+Inside the installed plugin, perform mapped steps with `noodle-readiness` tools and use the public `noodle ...` spelling only when reporting the logical action or a fallback. Outside the plugin, run the public CLI directly. Never construct a hidden launcher command.
+
 1. **Discover** — use `noodle commands --json` when the required command or flags are uncertain; don't read CLI source.
 2. **Author** — for build routes, edit the configured TypeScript entrypoint, usually `src/server.ts`.
 3. **Validate** — run `noodle validate --json`; repair each `error.errors[]` item at its `path`, then re-run `noodle validate --json`.
@@ -76,11 +78,12 @@ This is a lookup catalog, not a discovery checklist. Return here only when the s
 
 ## Product feedback
 
-When you discover a bug, missing capability, misleading doc, or improvement idea, discover current fields with `noodle commands --json`, draft and sanitize one finding, then run `noodle feedback ... --dry-run --json`. Inspect and show the exact normalized submission, diagnostics, private destination, and POSIX-safely quoted live command. Ask for explicit approval of that exact proposal; do not submit it until approval. Then submit once without `--dry-run`. Follow `references/feedback.md`; never include customer code, secrets, personal data, or identifying project details, and never auto-login or retry-loop.
+When you discover a bug, missing capability, misleading doc, or improvement idea, draft and sanitize one finding, then preview it with `noodle-readiness.preview_product_feedback` in the installed plugin or `noodle feedback ... --dry-run --json` in the public CLI. Inspect and show the normalized submission, diagnostics, and private destination. Ask for explicit approval of that exact proposal; do not submit it until approval. Then call `noodle-readiness.submit_product_feedback` once with approval, or run the public CLI once without `--dry-run`. Follow `references/feedback.md`; pass structured arguments directly instead of composing a shell command, never include customer code, secrets, personal data, or identifying project details, and never auto-login or retry-loop.
 
 ## Safety
 
 - Keep secrets, bearer tokens, refresh tokens, static access keys, `.env.noodle` values, and `~/.noodle/config.json` out of prompts, logs, docs, tests, and generated files.
+- Never expose an internal launcher or private installation path, ask the user to paste a command the plugin can execute, or use an ad hoc shell/file-parsing pipeline to move a secret. Use the typed secret-from-environment tool or `noodle secrets set ... --from-env NAME`.
 - Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata.
 - Do not add static data-plane credential paths; hosted access is identity-based.
 - Hosted mutation is opt-in. Run `link`, hosted secret/variable/config/access changes, deploy, rollback, host configuration writes, or directory submission only when the current user request explicitly authorizes the exact mutation and target. An inspect, prepare, validate, test, or local-only request grants no such authority; stop and ask before crossing that boundary.

package/skills/codex/authoring-mcp-servers/SKILL.md

@@ -3,7 +3,7 @@ name: authoring-mcp-servers
 description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:0b2fd8c7e43fc69f -->
+<!-- noodle-skill version:0.52.0 hash:0b2fd8c7e43fc69f -->
 
 # authoring-mcp-servers
 

package/skills/codex/building-mcp-apps/SKILL.md

@@ -3,7 +3,7 @@ name: building-mcp-apps
 description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:f7fa54992c8d7692 -->
+<!-- noodle-skill version:0.52.0 hash:f7fa54992c8d7692 -->
 
 # building-mcp-apps
 

package/skills/codex/connecting-apis-to-mcp/SKILL.md

@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
 description: "Use when credentials, an API URL, an OpenAPI document, or an observed response must become real Noodle Seed MCP behavior."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:1e86b8704f407bd3 -->
+<!-- noodle-skill version:0.52.0 hash:1e86b8704f407bd3 -->
 
 # connecting-apis-to-mcp
 

package/skills/codex/debugging-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
 description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:aa715bae12041d7c -->
+<!-- noodle-skill version:0.52.0 hash:aa715bae12041d7c -->
 
 # debugging-mcp-delivery
 

package/skills/codex/deploying-mcp-services/SKILL.md

@@ -3,7 +3,7 @@ name: deploying-mcp-services
 description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:93e735b7ffb45df1 -->
+<!-- noodle-skill version:0.52.0 hash:93e735b7ffb45df1 -->
 
 # deploying-mcp-services
 

package/skills/codex/designing-mcp-products/SKILL.md

@@ -3,7 +3,7 @@ name: designing-mcp-products
 description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:76cce86729cffbee -->
+<!-- noodle-skill version:0.52.0 hash:76cce86729cffbee -->
 
 # designing-mcp-products
 

package/skills/codex/embedding-mcp-assistants/SKILL.md

@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
 description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:cc54a67f21c0ecdb -->
+<!-- noodle-skill version:0.52.0 hash:cc54a67f21c0ecdb -->
 
 # embedding-mcp-assistants
 

package/skills/codex/examples/hello/README.md

@@ -5,17 +5,18 @@ connectors, secrets, flows, widgets, or handoff policy. It still uses the curren
 so new authors see where server-level branding belongs. Use it to smoke the author loop
 (`noodle validate` / `noodle dev`) or a first deploy.
 
-When an installed Noodle Developer plugin drives this example, its skill runs these logical
-`noodle` commands through the plugin-managed, version-pinned launcher and isolated host profile.
-Do not install or update a global CLI: the coding agent writes and tests this source while Noodle
-guides and operates the validate, preview, deploy, inspect, and debug workflow.
+When an installed Noodle Developer plugin drives this example, its skill performs mapped lifecycle
+steps through the supported `noodle-readiness` tools and reports only stable public `noodle ...`
+commands as recovery text. Do not install or update a global CLI: the coding agent writes and tests
+this source while Noodle guides and operates the validate, preview, deploy, inspect, and debug workflow.
 For an approved implementation plan, the installed `executing-noodle-plans` skill owns the
 test-first task, review, recovery, and final-verification loop.
 If that agent discovers a Noodle Seed product gap while working, the installed skill prepares a
-sanitized `noodle feedback` proposal, discovers current fields from `noodle commands --json`, runs
-`--dry-run --json` to inspect the exact normalized submission, diagnostics, and private destination,
-then shows a POSIX-safely quoted live command. It submits once without `--dry-run` only after explicit
-user approval of that exact preview; it never auto-logs in or retry-loops.
+sanitized `noodle feedback` proposal, discovers current fields from `noodle commands --json`, and
+previews the exact normalized submission, diagnostics, and private destination through the typed
+plugin function or `--dry-run --json`. It includes its known `--agent` and `--model` identity without
+guessing unavailable values, keeps those fields structured, and submits once only after explicit user
+approval of that exact preview; it never composes a shell wrapper, auto-logs in, or retry-loops.
 Every `--json` command writes its canonical success or failure envelope to stdout and leaves stderr
 empty. One-shot commands write one envelope; streaming commands write NDJSON snapshot, event, and
 terminal-failure envelopes so agents can parse each line independently.

package/skills/codex/executing-noodle-plans/SKILL.md

@@ -3,7 +3,7 @@ name: executing-noodle-plans
 description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:6a9f132ddb79352e -->
+<!-- noodle-skill version:0.52.0 hash:6a9f132ddb79352e -->
 
 # Execute a Noodle Seed implementation plan
 

package/skills/codex/publishing-mcp-integrations/SKILL.md

@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
 description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:efffbf82007f935d -->
+<!-- noodle-skill version:0.52.0 hash:efffbf82007f935d -->
 
 # publishing-mcp-integrations
 

package/skills/codex/references/feedback.md

@@ -1,6 +1,6 @@
 # Send product feedback
 
-When you — the coding agent — discover a way Noodle Seed could be better, prepare one sanitized feedback proposal. Feedback crosses the customer project boundary and lands in the Noodle Seed private feedback tracker, so the user must make an informed choice. Preview the exact normalized submission locally, show it with the exact live command, and ask for explicit user approval. Do not submit it until approval is given.
+When you — the coding agent — discover a way Noodle Seed could be better, prepare one sanitized feedback proposal. Feedback crosses the customer project boundary and lands in the Noodle Seed private feedback tracker, so the user must make an informed choice. Preview the exact normalized submission locally, show its stable public `noodle feedback` action, and ask for explicit user approval. Do not submit it until approval is given.
 
 ## Contents
 
@@ -27,27 +27,30 @@ Do not batch several findings into one proposal, and do not re-propose the same
 ## Approval workflow
 
 1. Discover the current positional arguments, flags, choices, defaults, and limits from `noodle commands --json`; `noodle feedback --help` is the human-readable view. Do not guess or rely on a remembered catalog.
-2. Draft one finding, then sanitize its title and message using the rules below.
+2. Draft one finding, then sanitize its title and message using the rules below. When your coding-agent name is known, add `--agent`; add `--model` only when the exact model identifier is also known. These fields are client-reported provenance: never guess either value.
 3. Run the proposal with `--dry-run --json`. This local preview needs no login and sends nothing. Parse `{"ok":true,"data":{"mode":"preview","willSubmit":false,"destination":"Noodle Seed private feedback tracker","submission":{...}}}`.
-4. Inspect the complete `submission`, including its normalized defaults and automatically attached diagnostics. Show the user the exact previewed proposal, its `destination`, and a POSIX-safely quoted live command containing the same fields but without `--dry-run`.
+4. Inspect the complete `submission`, including its normalized defaults and automatically attached diagnostics. Show the user the exact previewed proposal, its `destination`, and the stable public `noodle feedback` action. Keep the proposal as structured fields instead of rebuilding it as shell text.
 5. Ask for explicit approval of that exact previewed proposal. If the user changes any field, preview the changed proposal again before asking.
-6. Only after approval, submit it once by running the disclosed live command without `--dry-run`. Never auto-login and never retry-loop. If authentication fails before the request or a rate limit denies it, report that nothing was sent. For `feedback_recording_failed`, report that no reference was returned and the outcome may be unknown; do not retry because the private issue might already exist.
+6. Only after approval, submit it once with `noodle-readiness.submit_product_feedback` when the installed plugin tool is available, or pass the same structured fields directly to the public CLI without `--dry-run`. Never auto-login and never retry-loop. If authentication fails before the request or a rate limit denies it, report that nothing was sent. For `feedback_recording_failed`, report that no reference was returned and the outcome may be unknown; do not retry because the private issue might already exist.
 
 ## The command
 
 ```sh
 noodle feedback 'resources list --json omits the truncated flag the docs promise' \
   --title 'resources list --json missing truncated flag' \
-  --type fix --severity P2 --area cli --dry-run --json
+  --type fix --severity P2 --area cli --agent 'coding-agent' --model 'model-id' \
+  --dry-run --json
 ```
 
-This is a preview example only. Build the exact command for the finding using current `noodle commands --json` metadata, POSIX-quote every user-controlled value, and inspect the returned submission instead of reconstructing it. The message is required (1–4000 chars). The CLI attaches only the disclosed light diagnostics automatically: CLI version, OS/platform, Node version. Nothing else is collected. After approval, the live success envelope is `{ok:true,data:{reference,labels}}`; a `429` means the per-user hourly budget (5) is spent — report that it was not sent and never retry-loop.
+This is a preview example only: replace `coding-agent` and `model-id` with your known coding-agent identity, or omit both when unavailable. Build structured arguments for the finding using current `noodle commands --json` metadata and inspect the returned submission instead of reconstructing it. Invoke the CLI with an argument array or the typed plugin function, never a shell wrapper or copy/paste request. The message is required (1–4000 chars). The CLI attaches only the disclosed light diagnostics automatically: CLI version, OS/platform, Node version. Agent/model provenance is included only through the explicit client-reported flags. Nothing else is collected. After approval, the live success envelope is `{ok:true,data:{reference,labels}}`; a `429` means the per-user hourly budget (5) is spent — report that it was not sent and never retry-loop.
 
 ## Choose the structured fields
 
 - `--type` — `fix` (bug/regression/wrong output), `feat` (missing capability), `docs` (misleading or absent docs/examples), `chore` (tooling/setup friction). Default `feat`.
 - `--severity` — `P0` only for a security-relevant defect; `P1` a workflow is blocked with no workaround; `P2` blocked but a workaround exists; `P3` (default) papercut or idea.
 - `--area` — one of `docs analytics connectors self-service conformance ci deploys distribution console dx plugins cli compiler multi-surface enterprise policy`. Use `cli` for command behavior, `dx` for authoring/agent ergonomics; omit when unsure.
+- `--agent` — your known coding-agent product name (1–64 chars). Omit when unavailable; the CLI does not auto-detect it.
+- `--model` — the exact known model identifier (1–64 chars). Requires `--agent`; omit rather than guessing.
 - `--title` — one line, ≤120 chars, stating the defect or idea (defaults to the message’s first line).
 
 ## Sanitization rules (hard requirements)

package/skills/codex/reporting-noodle-feedback/SKILL.md

@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
 description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:0f404109f4845683 -->
+<!-- noodle-skill version:0.52.0 hash:0f404109f4845683 -->
 
 # reporting-noodle-feedback
 

package/skills/codex/verifying-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
 description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
 ---
 
-<!-- noodle-skill version:0.50.0 hash:6ef6ef551e26b78e -->
+<!-- noodle-skill version:0.52.0 hash:6ef6ef551e26b78e -->
 
 # verifying-mcp-delivery