@topy-ai/maggie 0.7.0 → 0.7.1

package/README.md

@@ -14,9 +14,9 @@ persistent project memory.
 
 ## Install
 
-Working-tree additions (not yet released): `site-audit --crawl --save-baseline
-FILE --reviewer NAME` records a reviewed site contract; `site-audit --crawl
---baseline FILE` fails on URL, metadata, HTML structure or copy changes.
+`site-audit --crawl --save-baseline FILE --reviewer NAME` records a reviewed
+site contract; `site-audit --crawl --baseline FILE` fails on URL, metadata,
+HTML structure or copy changes.
 Complete sitemap coverage is required and existing baselines cannot be
 overwritten. This does not verify browser layout or source-only changes.
 
@@ -88,7 +88,7 @@ The CLI provides the installer plus durable workflow commands:
 maggie init | install | update | remove | list | doctor
 maggie cleanup --project . [--confirm]
 maggie bootstrap interview | phase ...
-maggie dash init | status | migrate
+maggie dash init | status | migrate | cms ...
 maggie dash transition ...      # explicit content approval transition
 maggie dash variant ...         # service variant create/review/preview/publish
 maggie clone ...                 # authorized homepage capture
@@ -101,7 +101,7 @@ maggie localization ...          # plan, validate, review, publish, stale
 maggie service ...               # import, sync, generate, validate
 maggie seo performance ...       # sampled PageSpeed/CWV report and baseline
 maggie seo images ...             # inventory, variants, confirmation, validate
-maggie seo sitemap ...            # typed plan, validate, apply, rollback
+maggie seo sitemap ...            # typed/semantic plan, agent-files, apply, rollback
 maggie deployment | migration | release | analytics | schedule
 maggie deployment canary --asset URL=SHA256 --render-report report.json
 maggie design icon-inventory --source-dir src --runtime assets/icons.css
@@ -190,10 +190,25 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.0 update --project . --force
-npx @topy-ai/maggie@0.7.0 cleanup --project .
+npx @topy-ai/maggie@0.7.1 update --project . --force
+npx @topy-ai/maggie@0.7.1 cleanup --project .
 ```
 
+Maintainers should pass npm credentials through the repository helper, never
+as a command-line argument:
+
+```bash
+node scripts/publish-npm.mjs --maggie-env-file ../.env
+```
+
+The 0.7.1 workflow adds audited MaggieDash CMS operations (`cms revisions`,
+`trash`, `restore`, `schedule`, `duplicate`, `redirect`, and signed
+`preview`), import-authoritative service matching, shared translation indexes,
+sanitized seed manifests, lockfile/analytics traffic checks, semantic sitemap
+validation, locale-aware `llms.txt`/`sitemap.md`/`insights.md` generation,
+explicit integration states, and deployment Origin/infrastructure/data
+rollback gates.
+
 ## MaggieDash lifecycle
 
 For a new project, establish the local content and approval foundation before

package/bin/maggie.js

@@ -65,7 +65,7 @@ Usage:
   maggie list
   maggie doctor [--project PATH]
   maggie bootstrap interview [project]
-  maggie dash init|status|migrate|transition|variant --project PATH [options]
+  maggie dash init|status|migrate|transition|variant|cms --project PATH [options]
   maggie dash status --project PATH
   maggie dash migrate --project PATH --confirm
   maggie content FILE --source PROVIDER --project PATH --confirm
@@ -92,7 +92,7 @@ Usage:
   maggie design author --project PATH --route /about --purpose TEXT --audience TEXT --confirm
   maggie auth reference --project PATH --confirm
   maggie auth check --project PATH [--production]
-  maggie blog init|inspect|ingest|validate|publish|sitemap|settings|rollback --project PATH
+  maggie blog init|inspect|ingest|validate|publish|sitemap|settings|rollback|integration-state
   maggie design status <job-id>
   maggie service import <provider-url> --project PATH
   maggie service sync <provider-url> --project PATH
@@ -106,18 +106,18 @@ Usage:
   maggie deployment canary --project PATH --asset URL=SHA256 --render-report report.json --output docs/deployment-canary.json
   maggie migration --project PATH --environment staging
   maggie schedule PATH/.maggie/schedule.json --project PATH
-  maggie analytics --project PATH --environment staging
+  maggie analytics [traffic-audit|release-gate] --project PATH --environment staging
   maggie release PATH --environment staging --target vps-with-cloudflare-dns
   maggie api lifecycle --project PATH [--execute --allow-quota]
   maggie memory <init|list|search|context|add|record-error|transition|export> --project PATH
   maggie localization <extract|plan|generate|preview|validate|review|publish|stale|glossary> [options]
-  maggie seo performance|images|sitemap [options]
+  maggie seo performance|images|sitemap [options] (sitemap supports strict validate and agent-files)
   maggie feedback <collect|preview|submit|list> [options]
   maggie site-audit URL [--crawl] [--languages en-GB,es-MX,ja-JP] [--check-hreflang]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
   maggie site-audit URL --crawl --baseline FILE
   maggie browser-audit URL --browse PATH --output DIR --required SELECTOR [--sticky SELECTOR]
-  maggie ops audit --project PATH
+  maggie ops audit|preflight|verify|lockfiles|seed-manifest --project PATH
   maggie ops preflight --project PATH --write
 
 Examples:
@@ -290,7 +290,7 @@ function service(args) {
   const root = projectRoot(args);
   const script = join(root, "tools", "clis", "maggie_service_booking.py");
   if (!existsSync(script)) throw new Error(`service booking CLI is missing: ${script}`);
-  const result = spawnSync("python3", [script, ...args], { stdio: "inherit", cwd: root });
+  const result = spawnSync("python3", [script, ...args], { stdio: "inherit", cwd: root, env: { ...process.env, MAGGIE_VERSION: PACKAGE_VERSION } });
   if (result.error) throw result.error;
   process.exitCode = result.status ?? 1;
 }

package/bundled-references/maggiedash-dashboard-ui.md

@@ -0,0 +1,28 @@
+# MaggieDash dashboard UI contract
+
+MaggieDash workspaces use the lightweight contract in
+`templates/maggiedash/dashboard-ui-contract.json`. It is provider-neutral and
+describes the dashboard chrome, not a framework-specific component library.
+
+The reference is the users workspace: one `WorkspaceBar`, one sidebar/content
+navigation relationship, and one `ContentTabs` row. A route must not render a
+second horizontal navigation, duplicate its sidebar, or hide duplicate markup
+with CSS. `WorkspaceCard` owns card framing; page routes own content.
+
+`ContentTabs` accepts only the props it renders (`tabs`, `active`, `actions`,
+and `children`). It does not accept a page `title` or `description`. If a page
+needs a heading or description, render a dedicated page header or use
+`WorkspaceBar` explicitly. This keeps component APIs honest and prevents
+dead-copy drift.
+
+Validate a host implementation with:
+
+```bash
+maggie dash ui validate --contract templates/maggiedash/dashboard-ui-contract.json \
+  --source src/components/WorkspaceBar.tsx \
+  --source src/components/WorkspaceCard.tsx \
+  --source src/components/ContentTabs.tsx
+```
+
+The check is static evidence. It does not replace an authenticated browser
+review of the rendered dashboard at desktop and mobile sizes.

package/bundled-skills/maggie-blog/SKILL.md

@@ -60,3 +60,15 @@ maggie design init --project . --surface blog \
 
 The blog skill supplies route/data semantics; `maggie-design` supplies the
 host-native components and responsive visual review.
+
+Optional Search Console/AI visibility integrations must report state rather
+than returning an ambiguous empty success payload. Use:
+
+```bash
+maggie blog integration-state                 # not-configured
+maggie blog integration-state --configured --consent-required  # awaiting-consent
+maggie blog integration-state --configured --authorized  # ready
+```
+
+Provider adapters should preserve the same `not-configured`,
+`awaiting-consent`, `awaiting-authorization`, `ready`, and `error` semantics.

package/bundled-skills/maggie-content-localization/SKILL.md

@@ -116,3 +116,12 @@ styles, SVG, and dynamic expressions. Supplying source and render reports to
 remains backward-compatible without those artifacts. See
 [`docs/localization-extraction-render-prd.md`](../../docs/localization-extraction-render-prd.md)
 for the artifact contract and limitations.
+
+Use the shared translation index and route predicates from
+`tools/runtime/content_localization.py`. A host must not keep a second wording
+dictionary beside its translation registry: conflicting `(contentId, locale)`
+records fail closed. Use `is_translated_path()` for both exact routes and
+prefix routes, and do not let locale middleware capture root `.txt`, `.md`,
+`.xml`, or `.json` assets. If a framework rewrites a localized request,
+dedupe instrumentation with `rewrite_once(request_key, seen)` so one request
+does not count twice.

package/bundled-skills/maggie-dash/SKILL.md

@@ -74,3 +74,24 @@ not part of this skill.
 Before and after a meaningful run, load and record confirmed project
 preferences or repaired pitfalls with
 [the shared memory hook](../../references/memory-hook.md).
+
+CMS operations are explicit and auditable:
+
+```bash
+maggie dash cms revisions --project . --project-id local-project --document-id <id> --confirm
+maggie dash cms trash --project . --project-id local-project --document-id <id> --reason "remove from editor" --confirm
+maggie dash cms restore --project . --project-id local-project --document-id <id> --reason "restore" --confirm
+maggie dash cms schedule --project . --project-id local-project --document-id <id> \
+  --publish-at 2026-09-20T10:00:00Z --reason "approved release" --confirm
+maggie dash cms duplicate --project . --project-id local-project --document-id <id> \
+  --new-id <new-id> --new-slug <new-slug> --reason "create draft" --confirm
+maggie dash cms redirect --project . --project-id local-project --from-path /old --to-path /new \
+  --reason "canonical slug change" --confirm
+maggie dash cms preview --project . --project-id local-project --document-id <id> \
+  --secret "$MAGGIE_PREVIEW_SECRET" --confirm
+```
+
+Content writes create immutable revision snapshots. Trash is reversible and
+does not destroy the document. Scheduling is accepted only for approved
+content and requires a timezone. Preview tokens are short-lived HMAC-signed
+tokens; never place the secret in source control or generated reports.

package/bundled-skills/maggie-deployment/SKILL.md

@@ -210,3 +210,20 @@ Follow the shared [Maggie Decision Loop](../../references/decision-loop.md) for
 6. Require explicit final confirmation before any mutation or external write.
 
 If a decision is not relevant, record it as `skipped` with a reason. Do not silently assume a missing choice, and do not treat an existing output as permission to skip required work.
+
+For scheduled POST jobs, validate the request contract before installation:
+
+```bash
+maggie deployment --validate-request --method POST \
+  --origin https://example.test --has-auth
+maggie deployment --verify-infra --service fresha \
+  --units-dir .maggie/deployment/schedules
+```
+
+The deployment scheduler must send an explicit Origin and configured auth
+contract; a missing Origin must not be mistaken for an application auth
+failure. Infrastructure verification accepts a declared service/timer pair or
+both units being enabled in systemd. Data-dependent releases additionally
+require `rollback.backupId` and `rollback.restoreCommand` in
+`.maggie/deployment/data-release.json`, because switching code alone does not
+restore incompatible data.

package/bundled-skills/maggie-ops/SKILL.md

@@ -7,6 +7,19 @@ metadata:
 
 # Maggie Ops
 
+Before release, run the lockfile guard when a project has more than one package
+manager:
+
+```bash
+maggie ops lockfiles --project .
+```
+
+It compares direct package and optional dependency names in `package.json`
+with `package-lock.json`, reports the presence of `pnpm-lock.yaml`, and fails
+when npm CI cannot install a declared package. It does not rewrite either
+lockfile; regenerate and commit both through the project's chosen package
+manager workflow.
+
 ## Automatic memory hook
 
 Follow [Maggie Memory Hook](../../references/memory-hook.md) at invocation and completion.
@@ -195,3 +208,17 @@ Follow the shared [Maggie Decision Loop](../../references/decision-loop.md) for
 6. Require explicit final confirmation before any mutation or external write.
 
 If a decision is not relevant, record it as `skipped` with a reason. Do not silently assume a missing choice, and do not treat an existing output as permission to skip required work.
+
+Before data-dependent checks, validate an explicit sanitized fixture manifest:
+
+```bash
+maggie ops seed-manifest --project . --manifest .maggie/seed-manifest.json
+maggie ops lockfiles --project .
+```
+
+The seed manifest must be opt-in, sanitized, and contain non-empty fixtures;
+an empty dev database is not evidence that an operational check passed.
+Known Maggie/toolchain traffic can be measured without polluting first-party
+analytics using `maggie analytics traffic-audit --events events.json`. The
+classifier excludes only explicit tool/test markers and never infers identity
+from IP or private fields.

package/bundled-skills/maggie-seo-geo/SKILL.md

@@ -33,6 +33,11 @@ lastmod, optional JSON object mapping locale tags to alternate URLs, such as
 It emits `lastmod` and `xhtml:link rel="alternate"`. Supply truthful content
 change dates; omit unknown dates. Alternates must currently use the approved
 origin. Reciprocal locale coverage and date semantics require separate review.
+`lastmod` must come from a recorded content-change event or source revision;
+never derive it from `updated_at`, pull time, sync time, or deployment time.
+If the change date is unknown, omit `lastmod`. An empty content-type does not
+need a sitemap chunk in the sitemap index; serving an empty endpoint and
+advertising it are separate decisions.
 
 ## Freeze and compare a reviewed site
 
@@ -122,7 +127,7 @@ maggie seo sitemap rollback --backup-manifest .maggie-sitemap-backups/<plan>/bac
 
 Only confirmed image variants may enter `srcset`; `apply` requires an explicit
 confirmation and host adapter. Sitemap plans keep content types separate,
-emit chunk 1 for empty enabled types, enforce absolute same-origin URLs, and
+omit empty chunks from the sitemap index, enforce absolute same-origin URLs, and
 record redirects for removed sitemap files. Read the [image and sitemap PRD](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/docs/image-sitemap-structure-prd.md)
 for adapter and rollback rules.
 
@@ -207,3 +212,18 @@ Follow the shared [Maggie Decision Loop](../../references/decision-loop.md) for
 6. Require explicit final confirmation before any mutation or external write.
 
 If a decision is not relevant, record it as `skipped` with a reason. Do not silently assume a missing choice, and do not treat an existing output as permission to skip required work.
+
+Use semantic validation when route evidence is available:
+
+```bash
+maggie seo sitemap validate --plan .maggie/sitemap-plan.json --strict-semantic
+maggie seo sitemap agent-files --origin https://example.test \
+  --routes-file .maggie/routes.tsv --locale fr-FR --output-dir public/fr
+```
+
+Strict validation checks searchable content evidence, indexability, self
+canonical ownership and truthful `lastmod` provenance. `lastmod` may only be
+backed by a content-change/source-revision event; operational sync, pull,
+deploy, or `updated_at` timestamps are rejected. The agent-file command emits
+locale-aware `llms.txt`, `sitemap.md`, and `insights.md` from the same route
+inventory; non-indexable routes are omitted.

package/bundled-skills/maggie-service-booking/SKILL.md

@@ -7,6 +7,12 @@ metadata:
 
 # Maggie Service Booking
 
+Route matching evidence must come from the route source's actual import
+statements. The shared resolver in `tools/runtime/route_imports.py` resolves
+relative imports and records a component fingerprint; it never selects a
+same-basename sibling as a fallback. Missing imports are evidence requiring
+review, not permission to guess.
+
 ## Reviewed page relationships
 
 Reviewed page selection preserves existing `supporting` relations, including

package/bundled-templates/maggiedash/README.md

@@ -7,3 +7,7 @@ own framework conventions for rendering.
 The package includes only these lightweight contracts. Large marketplace
 previews and template media remain separately distributable through the
 marketplace repository.
+
+Dashboard routes should adopt `dashboard-ui-contract.json` and validate their
+actual host components with `maggie dash ui validate`. The contract provides
+the shared workspace chrome and rejects components that declare dead props.

package/bundled-templates/maggiedash/dashboard-ui-contract.json

@@ -0,0 +1,31 @@
+{
+  "schemaVersion": "maggiedash-dashboard-ui.v1",
+  "shell": {
+    "reference": "users-workspace",
+    "navigation": "sidebar-plus-content-tabs",
+    "rules": [
+      "render one workspace bar per route",
+      "render one content tab bar per route",
+      "do not duplicate sidebar navigation in page content",
+      "do not hide duplicate navigation with CSS"
+    ]
+  },
+  "components": [
+    {
+      "name": "WorkspaceBar",
+      "props": ["workspaceName", "activeSection", "actions", "children"],
+      "forbiddenProps": []
+    },
+    {
+      "name": "WorkspaceCard",
+      "props": ["title", "children"],
+      "forbiddenProps": []
+    },
+    {
+      "name": "ContentTabs",
+      "props": ["tabs", "active", "actions", "children"],
+      "forbiddenProps": ["title", "description"]
+    }
+  ],
+  "accessibility": ["active tab exposes aria-selected", "actions have accessible names", "workspace navigation has a landmark"]
+}

package/bundled-tools/clis/maggie_analytics.py

@@ -10,6 +10,9 @@ import re
 import subprocess
 from pathlib import Path
 from urllib.parse import urlsplit
+import sys
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "runtime"))
+from analytics_traffic import audit_events  # noqa: E402
 
 
 GA4_ID = re.compile(r"^G-[A-Z0-9]+$", re.I)
@@ -107,7 +110,7 @@ def release_gate(args: argparse.Namespace) -> int:
 
 def main() -> int:
     parser = argparse.ArgumentParser()
-    parser.add_argument("command", nargs="?", choices=("release-gate",))
+    parser.add_argument("command", nargs="?", choices=("release-gate", "traffic-audit"))
     parser.add_argument("--project", default=".")
     parser.add_argument("--environment", choices=("development", "staging", "production"), default="staging")
     parser.add_argument("--env-file", help="optional env file; values are never printed")
@@ -117,12 +120,22 @@ def main() -> int:
     parser.add_argument("--network-report", help="redacted network evidence for release-gate")
     parser.add_argument("--provider-report", help="read-only provider evidence for release-gate")
     parser.add_argument("--smoke-report", help="production smoke evidence for release-gate")
+    parser.add_argument("--events", help="redacted JSON array of analytics events for traffic-audit")
     args = parser.parse_args()
     if args.command == "release-gate":
         required = ("contract", "render_report", "network_report", "provider_report", "smoke_report")
         if any(not getattr(args, name) for name in required):
             parser.error("release-gate requires --contract, --render-report, --network-report, --provider-report, and --smoke-report")
         return release_gate(args)
+    if args.command == "traffic-audit":
+        if not args.events:
+            parser.error("traffic-audit requires --events")
+        value = json.loads(Path(args.events).read_text(encoding="utf-8"))
+        if not isinstance(value, list):
+            parser.error("--events must contain a JSON array")
+        result = audit_events(value)
+        print(json.dumps(result, indent=2, ensure_ascii=False))
+        return 0
     project = Path(args.project).resolve()
     env = parse_env(Path(args.env_file).resolve()) if args.env_file else parse_env(project / ".env.example")
     env.update({key: value for key, value in os.environ.items() if key in {"PUBLIC_GA4_MEASUREMENT_ID", "PUBLIC_ANALYTICS_ENABLED", "PUBLIC_ANALYTICS_CONSENT_REQUIRED", "GSC_SITE_URL", "GSC_VERIFICATION_TOKEN"}})

package/bundled-tools/clis/maggie_blog.py

@@ -11,6 +11,7 @@ from pathlib import Path
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "runtime"))
 from maggie_blog import BlogStore  # noqa: E402
 from localization_runner import process_adapter
+from integration_state import integration_state  # noqa: E402
 
 
 def main() -> int:
@@ -29,8 +30,13 @@ def main() -> int:
     publish = sub.add_parser("publish"); publish.add_argument("--project", type=Path, default=Path.cwd()); publish.add_argument("--slug", required=True); publish.add_argument("--actor", required=True); publish.add_argument("--reason", required=True); publish.add_argument("--confirm", action="store_true")
     sitemap = sub.add_parser("sitemap"); sitemap.add_argument("--project", type=Path, default=Path.cwd())
     settings = sub.add_parser("settings"); settings.add_argument("--project", type=Path, default=Path.cwd())
+    state = sub.add_parser("integration-state"); state.add_argument("--configured", action="store_true"); state.add_argument("--consent-required", action="store_true"); state.add_argument("--consent", action="store_true"); state.add_argument("--authorized", action="store_true"); state.add_argument("--error")
     rollback = sub.add_parser("rollback"); rollback.add_argument("--project", type=Path, default=Path.cwd()); rollback.add_argument("--backup"); rollback.add_argument("--confirm", action="store_true")
     args = parser.parse_args()
+    if args.command == "integration-state":
+        result = integration_state(configured=args.configured, consent_required=args.consent_required, consent=args.consent, authorized=args.authorized, error=args.error)
+        print(json.dumps(result, indent=2, ensure_ascii=False))
+        return 0 if result["status"] != "error" else 1
     store = BlogStore(args.project.resolve())
     if args.command in {"init", "ingest", "publish", "rollback", "translate-pending"} and not args.confirm:
         print("CONFIRMATION_REQUIRED: rerun with --confirm", file=sys.stderr); return 2

package/bundled-tools/clis/maggie_dash.py

@@ -17,6 +17,7 @@ from pathlib import Path
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "runtime"))
 from maggie_dash_store import MaggieDashStore  # noqa: E402
 from service_variants import ServiceVariantStore  # noqa: E402
+from maggie_dash_ui import load_and_validate  # noqa: E402
 
 
 def project_root(args: argparse.Namespace) -> Path:
@@ -93,6 +94,38 @@ def command_transition(args: argparse.Namespace) -> int:
         store.close()
 
 
+def command_cms(args: argparse.Namespace) -> int:
+    require_confirm(args)
+    store = store_for(project_root(args))
+    try:
+        if args.cms_command == "revisions":
+            result = store.list_revisions(args.project_id, args.document_id)
+        elif args.cms_command == "trash":
+            result = store.trash(args.project_id, args.document_id, args.actor, args.reason)
+        elif args.cms_command == "restore":
+            result = store.restore(args.project_id, args.document_id, args.actor, args.reason)
+        elif args.cms_command == "schedule":
+            result = store.schedule_publish(args.project_id, args.document_id, args.publish_at, args.actor, args.reason)
+        elif args.cms_command == "duplicate":
+            result = store.duplicate(args.project_id, args.document_id, args.new_id, args.new_slug, args.actor, args.reason)
+        elif args.cms_command == "redirect":
+            result = store.add_redirect(args.project_id, args.from_path, args.to_path, args.actor, args.reason, args.status_code)
+        elif args.cms_command == "preview":
+            result = store.issue_preview(args.project_id, args.document_id, args.secret, args.ttl)
+        else:
+            raise ValueError(f"unknown CMS command: {args.cms_command}")
+        emit(result)
+        return 0
+    finally:
+        store.close()
+
+
+def command_ui(args: argparse.Namespace) -> int:
+    result = load_and_validate(Path(args.contract).resolve(), [Path(value).resolve() for value in args.source])
+    emit(result)
+    return 0 if result["passed"] else 1
+
+
 def variant_store(args: argparse.Namespace) -> ServiceVariantStore:
     return ServiceVariantStore(project_root(args) / ".maggie" / "service-variants.json")
 
@@ -155,6 +188,27 @@ def parser() -> argparse.ArgumentParser:
     transition.add_argument("--reason", required=True)
     transition.add_argument("--confirm", action="store_true")
     transition.set_defaults(func=command_transition)
+    cms = sub.add_parser("cms", help="manage revisions, trash, scheduling, redirects and previews")
+    cms_sub = cms.add_subparsers(dest="cms_command", required=True)
+    for name in ("revisions", "trash", "restore"):
+        command = cms_sub.add_parser(name)
+        command.add_argument("--project", default="."); command.add_argument("--project-id", default="local-project")
+        command.add_argument("--document-id", required=True); command.add_argument("--actor", default="cli"); command.add_argument("--reason", default="CMS operation"); command.add_argument("--confirm", action="store_true")
+    schedule = cms_sub.add_parser("schedule")
+    schedule.add_argument("--project", default="."); schedule.add_argument("--project-id", default="local-project"); schedule.add_argument("--document-id", required=True); schedule.add_argument("--publish-at", required=True); schedule.add_argument("--actor", default="cli"); schedule.add_argument("--reason", required=True); schedule.add_argument("--confirm", action="store_true")
+    duplicate = cms_sub.add_parser("duplicate")
+    duplicate.add_argument("--project", default="."); duplicate.add_argument("--project-id", default="local-project"); duplicate.add_argument("--document-id", required=True); duplicate.add_argument("--new-id", required=True); duplicate.add_argument("--new-slug", required=True); duplicate.add_argument("--actor", default="cli"); duplicate.add_argument("--reason", required=True); duplicate.add_argument("--confirm", action="store_true")
+    redirect = cms_sub.add_parser("redirect")
+    redirect.add_argument("--project", default="."); redirect.add_argument("--project-id", default="local-project"); redirect.add_argument("--from-path", required=True); redirect.add_argument("--to-path", required=True); redirect.add_argument("--status-code", type=int, default=301); redirect.add_argument("--actor", default="cli"); redirect.add_argument("--reason", required=True); redirect.add_argument("--confirm", action="store_true")
+    preview = cms_sub.add_parser("preview")
+    preview.add_argument("--project", default="."); preview.add_argument("--project-id", default="local-project"); preview.add_argument("--document-id", required=True); preview.add_argument("--secret", required=True); preview.add_argument("--ttl", type=int, default=900); preview.add_argument("--confirm", action="store_true")
+    cms.set_defaults(func=command_cms)
+    ui = sub.add_parser("ui", help="validate MaggieDash dashboard chrome")
+    ui_sub = ui.add_subparsers(dest="ui_command", required=True)
+    ui_validate = ui_sub.add_parser("validate")
+    ui_validate.add_argument("--contract", required=True)
+    ui_validate.add_argument("--source", action="append", default=[])
+    ui_validate.set_defaults(func=command_ui)
     variant = sub.add_parser("variant", help="manage service variant lifecycle")
     variant_sub = variant.add_subparsers(dest="variant_command", required=True)
     create = variant_sub.add_parser("create"); create.add_argument("--project", default="."); create.add_argument("--service-id", required=True); create.add_argument("--variant-id", required=True); create.add_argument("--variant-type", required=True); create.add_argument("--locale", required=True); create.add_argument("--market", required=True); create.add_argument("--slug", required=True); create.add_argument("--title", required=True); create.add_argument("--facts", required=True); create.add_argument("--source-revision", required=True); create.add_argument("--canonical-variant-id"); create.add_argument("--cluster-link", action="append", default=[]); create.add_argument("--layout-family", default="service-default"); create.add_argument("--confirm", action="store_true")

package/bundled-tools/clis/maggie_deployment.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import argparse
 import json
 import re
+import subprocess
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -106,6 +107,7 @@ def vps_plan(domain: str, service: str, release_root: str, node_port: int) -> di
             "restart": f"systemctl restart {service}",
             "verify": f"systemctl is-active {service} && curl -fsS https://{domain}/robots.txt && curl -fsS https://{domain}/sitemap.xml",
             "rollback": f"ln -sfn {root}/releases/<previous-release> {current} && systemctl restart {service}",
+            "data_rollback": "restore the matching data checkpoint before restarting the previous code release",
         },
         "files": {
             "systemd": f"{service}.service",
@@ -130,10 +132,36 @@ def validate_data_checkpoint(path: Path) -> dict:
     if isinstance(required, list) and isinstance(current, dict):
         missing = [table for table in required if table not in current]
         if missing: errors.append("currentCounts is missing required tables")
+        empty = [table for table in required if table in current and (not isinstance(current[table], int) or current[table] <= 0)]
+        if empty: errors.append("currentCounts has empty required tables: " + ", ".join(empty))
     if not value.get("release") or not value.get("checkedAt"): errors.append("release and checkedAt are required")
+    rollback = value.get("rollback")
+    if not isinstance(rollback, dict) or not rollback.get("backupId") or not rollback.get("restoreCommand"):
+        errors.append("rollback.backupId and rollback.restoreCommand are required for data rollback")
     return {"passed": not errors, "declared": True, "errors": errors}
 
 
+def validate_scheduler_request(method: str, origin: str | None, has_auth: bool) -> dict:
+    errors = []
+    if method.upper() == "POST":
+        if not origin or not re.fullmatch(r"https?://[^/\s]+", origin): errors.append("POST scheduler requests require an explicit Origin header")
+        if not has_auth: errors.append("POST scheduler requests require the configured auth contract")
+    return {"schemaVersion": "maggie-deployment-request.v1", "method": method.upper(), "originPresent": bool(origin), "authPresent": bool(has_auth), "passed": not errors, "errors": errors}
+
+
+def verify_infrastructure(units_dir: Path | None, service: str, timer: str | None = None) -> dict:
+    timer_name = timer or f"maggie-{service}.timer"
+    service_name = f"maggie-{service}.service" if not service.endswith(".service") else service
+    declared = bool(units_dir and (units_dir / service_name).is_file() and (units_dir / timer_name).is_file())
+    systemd = {"service": False, "timer": False}
+    for unit, key in ((service_name, "service"), (timer_name, "timer")):
+        try:
+            systemd[key] = subprocess.run(["systemctl", "is-enabled", unit], capture_output=True, text=True, check=False, timeout=5).returncode == 0
+        except (OSError, subprocess.SubprocessError):
+            systemd[key] = False
+    return {"schemaVersion": "maggie-deployment-infra.v1", "service": service_name, "timer": timer_name, "declaredArtifacts": declared, "systemdEnabled": systemd, "passed": declared or all(systemd.values()), "errors": [] if declared or all(systemd.values()) else ["systemd service/timer are not declared or enabled"]}
+
+
 def retention_plan(release_root: str, current_link: str, keep: int) -> dict:
     if keep < 2 or keep > 5:
         raise ValueError("keep must be between 2 and 5")
@@ -206,6 +234,13 @@ def main() -> int:
     parser.add_argument("--retention-plan", action="store_true", help="create a read-only release prune candidate plan")
     parser.add_argument("--current-link", help="current symlink for --retention-plan")
     parser.add_argument("--keep-releases", type=int, default=2)
+    parser.add_argument("--verify-infra", action="store_true", help="verify declared or installed systemd service/timer")
+    parser.add_argument("--units-dir", help="directory containing generated .service and .timer units")
+    parser.add_argument("--timer", help="systemd timer unit name")
+    parser.add_argument("--validate-request", action="store_true", help="validate a scheduler request contract")
+    parser.add_argument("--method", default="POST")
+    parser.add_argument("--origin")
+    parser.add_argument("--has-auth", action="store_true")
     args = parser.parse_args()
     try:
         if args.vps_plan:
@@ -226,6 +261,14 @@ def main() -> int:
                 output.write_text(json.dumps(plan, indent=2) + "\n", encoding="utf-8")
             print(json.dumps(plan, indent=2, ensure_ascii=False))
             return 0
+        if args.validate_request:
+            result = validate_scheduler_request(args.method, args.origin, args.has_auth)
+            print(json.dumps(result, indent=2, ensure_ascii=False))
+            return 0 if result["passed"] else 1
+        if args.verify_infra:
+            result = verify_infrastructure(Path(args.units_dir).resolve() if args.units_dir else None, args.service, args.timer)
+            print(json.dumps(result, indent=2, ensure_ascii=False))
+            return 0 if result["passed"] else 1
         result = preflight(Path(args.project).resolve(), args.target, args.environment)
         if args.output:
             Path(args.output).parent.mkdir(parents=True, exist_ok=True)

package/bundled-tools/clis/maggie_feedback.py

@@ -34,6 +34,21 @@ def project_fingerprint(project: Path) -> str:
     return hashlib.sha256(str(project.resolve()).encode()).hexdigest()[:16]
 
 
+def installed_version(project: Path) -> str:
+    """Resolve the version from the runtime wrapper or project install state."""
+    if os.environ.get("MAGGIE_VERSION"):
+        return safe_text(os.environ["MAGGIE_VERSION"])
+    for path in (project / ".maggie" / "install.json", project / "VERSION"):
+        try:
+            value = json.loads(path.read_text(encoding="utf-8")) if path.suffix == ".json" else path.read_text(encoding="utf-8").strip()
+            if isinstance(value, dict): value = value.get("version", "")
+            if re.fullmatch(r"\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?", str(value)):
+                return str(value)
+        except (OSError, ValueError, json.JSONDecodeError):
+            continue
+    return "unknown"
+
+
 def feedback_id(project: Path) -> str:
     timestamp = datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S")
     return f"fb-{timestamp}-{project_fingerprint(project)[:6]}-{secrets.token_hex(3)}"
@@ -68,7 +83,7 @@ def collect(args: argparse.Namespace) -> int:
         "feedbackId": feedback_id(project),
         "createdAt": now(),
         "source": "maggie-cli",
-        "maggieVersion": os.environ.get("MAGGIE_VERSION", "unknown"),
+        "maggieVersion": installed_version(project),
         "type": args.type,
         "skill": skill,
         "runId": run_id,