@topy-ai/maggie 0.7.0 → 0.7.2

package/README.md

@@ -14,9 +14,9 @@ persistent project memory.
 
 ## Install
 
-Working-tree additions (not yet released): `site-audit --crawl --save-baseline
-FILE --reviewer NAME` records a reviewed site contract; `site-audit --crawl
---baseline FILE` fails on URL, metadata, HTML structure or copy changes.
+`site-audit --crawl --save-baseline FILE --reviewer NAME` records a reviewed
+site contract; `site-audit --crawl --baseline FILE` fails on URL, metadata,
+HTML structure or copy changes.
 Complete sitemap coverage is required and existing baselines cannot be
 overwritten. This does not verify browser layout or source-only changes.
 
@@ -66,8 +66,9 @@ Maggie in this order:
 ```bash
 python3 tools/clis/maggie.py analyze . --json --save
 python3 tools/clis/maggie.py bootstrap interview .
-python3 tools/clis/maggie_dash.py init --project . --confirm
-python3 tools/clis/maggie_dash.py migrate --project . --confirm
+maggie dash install --project . --confirm
+maggie dash init --project . --confirm
+maggie dash migrate --project . --confirm
 ```
 
 The normal daily loop is:
@@ -88,7 +89,7 @@ The CLI provides the installer plus durable workflow commands:
 maggie init | install | update | remove | list | doctor
 maggie cleanup --project . [--confirm]
 maggie bootstrap interview | phase ...
-maggie dash init | status | migrate
+maggie dash install | init | status | migrate | cms ...
 maggie dash transition ...      # explicit content approval transition
 maggie dash variant ...         # service variant create/review/preview/publish
 maggie clone ...                 # authorized homepage capture
@@ -101,7 +102,7 @@ maggie localization ...          # plan, validate, review, publish, stale
 maggie service ...               # import, sync, generate, validate
 maggie seo performance ...       # sampled PageSpeed/CWV report and baseline
 maggie seo images ...             # inventory, variants, confirmation, validate
-maggie seo sitemap ...            # typed plan, validate, apply, rollback
+maggie seo sitemap ...            # typed/semantic plan, agent-files, apply, rollback
 maggie deployment | migration | release | analytics | schedule
 maggie deployment canary --asset URL=SHA256 --render-report report.json
 maggie design icon-inventory --source-dir src --runtime assets/icons.css
@@ -190,21 +191,46 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.0 update --project . --force
-npx @topy-ai/maggie@0.7.0 cleanup --project .
+npx @topy-ai/maggie@0.7.2 update --project . --force
+npx @topy-ai/maggie@0.7.2 cleanup --project .
 ```
 
+Maintainers should pass npm credentials through the repository helper, never
+as a command-line argument:
+
+```bash
+node scripts/publish-npm.mjs --maggie-env-file ../.env
+```
+
+The 0.7.2 workflow adds the installable MaggieDash admin distribution and
+audited CMS operations (`cms revisions`,
+`trash`, `restore`, `schedule`, `duplicate`, `redirect`, and signed
+`preview`), import-authoritative service matching, shared translation indexes,
+sanitized seed manifests, lockfile/analytics traffic checks, semantic sitemap
+validation, locale-aware `llms.txt`/`sitemap.md`/`insights.md` generation,
+explicit integration states, and deployment Origin/infrastructure/data
+rollback gates.
+
 ## MaggieDash lifecycle
 
 For a new project, establish the local content and approval foundation before
 connecting providers or publishing:
 
 ```bash
+maggie dash install --project . --confirm
 maggie dash init --project . --confirm
 maggie dash status --project .
 maggie doctor --project .
 ```
 
+`maggie dash install` installs the first-party private MaggieDash dashboard
+source into `./_maggie/admin`, preserving local files unless `--force` is used.
+It records the resolved source revision in `.maggie/dash-install.json`. During
+bootstrap this is enabled by default; use `--dash-source /path/to/MaggieDash`
+for local development or a configured private Git URL. The host project keeps
+ownership of routes, email/password auth, database, provider credentials, and
+the `/api/maggie/*` adapter.
+
 Content remains draft-first and external writes remain explicit. Use the
 project-local memory workflow for confirmed preferences and reusable lessons;
 feedback drafts are never promoted to active memory automatically.

package/bin/maggie.js

@@ -65,7 +65,7 @@ Usage:
   maggie list
   maggie doctor [--project PATH]
   maggie bootstrap interview [project]
-  maggie dash init|status|migrate|transition|variant --project PATH [options]
+  maggie dash init|install|status|migrate|transition|variant|cms --project PATH [options]
   maggie dash status --project PATH
   maggie dash migrate --project PATH --confirm
   maggie content FILE --source PROVIDER --project PATH --confirm
@@ -92,7 +92,7 @@ Usage:
   maggie design author --project PATH --route /about --purpose TEXT --audience TEXT --confirm
   maggie auth reference --project PATH --confirm
   maggie auth check --project PATH [--production]
-  maggie blog init|inspect|ingest|validate|publish|sitemap|settings|rollback --project PATH
+  maggie blog init|inspect|ingest|validate|publish|sitemap|settings|rollback|integration-state
   maggie design status <job-id>
   maggie service import <provider-url> --project PATH
   maggie service sync <provider-url> --project PATH
@@ -106,18 +106,18 @@ Usage:
   maggie deployment canary --project PATH --asset URL=SHA256 --render-report report.json --output docs/deployment-canary.json
   maggie migration --project PATH --environment staging
   maggie schedule PATH/.maggie/schedule.json --project PATH
-  maggie analytics --project PATH --environment staging
+  maggie analytics [traffic-audit|release-gate] --project PATH --environment staging
   maggie release PATH --environment staging --target vps-with-cloudflare-dns
   maggie api lifecycle --project PATH [--execute --allow-quota]
   maggie memory <init|list|search|context|add|record-error|transition|export> --project PATH
   maggie localization <extract|plan|generate|preview|validate|review|publish|stale|glossary> [options]
-  maggie seo performance|images|sitemap [options]
+  maggie seo performance|images|sitemap [options] (sitemap supports strict validate and agent-files)
   maggie feedback <collect|preview|submit|list> [options]
   maggie site-audit URL [--crawl] [--languages en-GB,es-MX,ja-JP] [--check-hreflang]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
   maggie site-audit URL --crawl --baseline FILE
   maggie browser-audit URL --browse PATH --output DIR --required SELECTOR [--sticky SELECTOR]
-  maggie ops audit --project PATH
+  maggie ops audit|preflight|verify|lockfiles|seed-manifest --project PATH
   maggie ops preflight --project PATH --write
 
 Examples:
@@ -290,7 +290,7 @@ function service(args) {
   const root = projectRoot(args);
   const script = join(root, "tools", "clis", "maggie_service_booking.py");
   if (!existsSync(script)) throw new Error(`service booking CLI is missing: ${script}`);
-  const result = spawnSync("python3", [script, ...args], { stdio: "inherit", cwd: root });
+  const result = spawnSync("python3", [script, ...args], { stdio: "inherit", cwd: root, env: { ...process.env, MAGGIE_VERSION: PACKAGE_VERSION } });
   if (result.error) throw result.error;
   process.exitCode = result.status ?? 1;
 }

package/bundled-references/maggiedash-dashboard-ui.md

@@ -0,0 +1,28 @@
+# MaggieDash dashboard UI contract
+
+MaggieDash workspaces use the lightweight contract in
+`templates/maggiedash/dashboard-ui-contract.json`. It is provider-neutral and
+describes the dashboard chrome, not a framework-specific component library.
+
+The reference is the users workspace: one `WorkspaceBar`, one sidebar/content
+navigation relationship, and one `ContentTabs` row. A route must not render a
+second horizontal navigation, duplicate its sidebar, or hide duplicate markup
+with CSS. `WorkspaceCard` owns card framing; page routes own content.
+
+`ContentTabs` accepts only the props it renders (`tabs`, `active`, `actions`,
+and `children`). It does not accept a page `title` or `description`. If a page
+needs a heading or description, render a dedicated page header or use
+`WorkspaceBar` explicitly. This keeps component APIs honest and prevents
+dead-copy drift.
+
+Validate a host implementation with:
+
+```bash
+maggie dash ui validate --contract templates/maggiedash/dashboard-ui-contract.json \
+  --source src/components/WorkspaceBar.tsx \
+  --source src/components/WorkspaceCard.tsx \
+  --source src/components/ContentTabs.tsx
+```
+
+The check is static evidence. It does not replace an authenticated browser
+review of the rendered dashboard at desktop and mobile sizes.

package/bundled-skills/maggie-blog/SKILL.md

@@ -60,3 +60,15 @@ maggie design init --project . --surface blog \
 
 The blog skill supplies route/data semantics; `maggie-design` supplies the
 host-native components and responsive visual review.
+
+Optional Search Console/AI visibility integrations must report state rather
+than returning an ambiguous empty success payload. Use:
+
+```bash
+maggie blog integration-state                 # not-configured
+maggie blog integration-state --configured --consent-required  # awaiting-consent
+maggie blog integration-state --configured --authorized  # ready
+```
+
+Provider adapters should preserve the same `not-configured`,
+`awaiting-consent`, `awaiting-authorization`, `ready`, and `error` semantics.

package/bundled-skills/maggie-content-localization/SKILL.md

@@ -116,3 +116,12 @@ styles, SVG, and dynamic expressions. Supplying source and render reports to
 remains backward-compatible without those artifacts. See
 [`docs/localization-extraction-render-prd.md`](../../docs/localization-extraction-render-prd.md)
 for the artifact contract and limitations.
+
+Use the shared translation index and route predicates from
+`tools/runtime/content_localization.py`. A host must not keep a second wording
+dictionary beside its translation registry: conflicting `(contentId, locale)`
+records fail closed. Use `is_translated_path()` for both exact routes and
+prefix routes, and do not let locale middleware capture root `.txt`, `.md`,
+`.xml`, or `.json` assets. If a framework rewrites a localized request,
+dedupe instrumentation with `rewrite_once(request_key, seen)` so one request
+does not count twice.

package/bundled-skills/maggie-dash/SKILL.md

@@ -5,8 +5,30 @@ description: Manage the MaggieDash project foundation, local content store, and
 
 # MaggieDash
 
-Use the provider-neutral MaggieDash contracts and CLI for project setup and
-content operations.
+Use the provider-neutral MaggieDash contracts and CLI for project setup,
+installation of the first-party admin workspace, and content operations.
+
+## Install the admin workspace
+
+During bootstrap, the recommended decision is to install MaggieDash into
+`./_maggie/admin`. The dashboard source lives in the private first-party
+`TOPY-AI-LTD/MaggieDash` repository during the MVP phase; Git/gh credentials
+must already be configured for the project owner.
+
+```bash
+maggie dash install --project . --confirm
+```
+
+The command is idempotent, preserves existing files unless `--force` is
+explicitly supplied, and records the resolved revision in
+`.maggie/dash-install.json`. It never accepts or stores a GitHub token as a
+CLI argument. For local development or a pinned checkout, use
+`--source /path/to/MaggieDash` or `--source URL --ref REF`.
+
+The installed dashboard owns the React workspace UI. The host project still
+owns the framework route, email/password session middleware, database, media
+storage, provider credentials, and `/api/maggie/*` adapter endpoints. Read the
+MaggieDash host adapter contract before adding a new framework adapter.
 
 ## Workflow
 
@@ -74,3 +96,24 @@ not part of this skill.
 Before and after a meaningful run, load and record confirmed project
 preferences or repaired pitfalls with
 [the shared memory hook](../../references/memory-hook.md).
+
+CMS operations are explicit and auditable:
+
+```bash
+maggie dash cms revisions --project . --project-id local-project --document-id <id> --confirm
+maggie dash cms trash --project . --project-id local-project --document-id <id> --reason "remove from editor" --confirm
+maggie dash cms restore --project . --project-id local-project --document-id <id> --reason "restore" --confirm
+maggie dash cms schedule --project . --project-id local-project --document-id <id> \
+  --publish-at 2026-09-20T10:00:00Z --reason "approved release" --confirm
+maggie dash cms duplicate --project . --project-id local-project --document-id <id> \
+  --new-id <new-id> --new-slug <new-slug> --reason "create draft" --confirm
+maggie dash cms redirect --project . --project-id local-project --from-path /old --to-path /new \
+  --reason "canonical slug change" --confirm
+maggie dash cms preview --project . --project-id local-project --document-id <id> \
+  --secret "$MAGGIE_PREVIEW_SECRET" --confirm
+```
+
+Content writes create immutable revision snapshots. Trash is reversible and
+does not destroy the document. Scheduling is accepted only for approved
+content and requires a timezone. Preview tokens are short-lived HMAC-signed
+tokens; never place the secret in source control or generated reports.

package/bundled-skills/maggie-deployment/SKILL.md

@@ -210,3 +210,20 @@ Follow the shared [Maggie Decision Loop](../../references/decision-loop.md) for
 6. Require explicit final confirmation before any mutation or external write.
 
 If a decision is not relevant, record it as `skipped` with a reason. Do not silently assume a missing choice, and do not treat an existing output as permission to skip required work.
+
+For scheduled POST jobs, validate the request contract before installation:
+
+```bash
+maggie deployment --validate-request --method POST \
+  --origin https://example.test --has-auth
+maggie deployment --verify-infra --service fresha \
+  --units-dir .maggie/deployment/schedules
+```
+
+The deployment scheduler must send an explicit Origin and configured auth
+contract; a missing Origin must not be mistaken for an application auth
+failure. Infrastructure verification accepts a declared service/timer pair or
+both units being enabled in systemd. Data-dependent releases additionally
+require `rollback.backupId` and `rollback.restoreCommand` in
+`.maggie/deployment/data-release.json`, because switching code alone does not
+restore incompatible data.

package/bundled-skills/maggie-ops/SKILL.md

@@ -7,6 +7,19 @@ metadata:
 
 # Maggie Ops
 
+Before release, run the lockfile guard when a project has more than one package
+manager:
+
+```bash
+maggie ops lockfiles --project .
+```
+
+It compares direct package and optional dependency names in `package.json`
+with `package-lock.json`, reports the presence of `pnpm-lock.yaml`, and fails
+when npm CI cannot install a declared package. It does not rewrite either
+lockfile; regenerate and commit both through the project's chosen package
+manager workflow.
+
 ## Automatic memory hook
 
 Follow [Maggie Memory Hook](../../references/memory-hook.md) at invocation and completion.
@@ -195,3 +208,17 @@ Follow the shared [Maggie Decision Loop](../../references/decision-loop.md) for
 6. Require explicit final confirmation before any mutation or external write.
 
 If a decision is not relevant, record it as `skipped` with a reason. Do not silently assume a missing choice, and do not treat an existing output as permission to skip required work.
+
+Before data-dependent checks, validate an explicit sanitized fixture manifest:
+
+```bash
+maggie ops seed-manifest --project . --manifest .maggie/seed-manifest.json
+maggie ops lockfiles --project .
+```
+
+The seed manifest must be opt-in, sanitized, and contain non-empty fixtures;
+an empty dev database is not evidence that an operational check passed.
+Known Maggie/toolchain traffic can be measured without polluting first-party
+analytics using `maggie analytics traffic-audit --events events.json`. The
+classifier excludes only explicit tool/test markers and never infers identity
+from IP or private fields.

package/bundled-skills/maggie-seo-geo/SKILL.md

@@ -33,6 +33,11 @@ lastmod, optional JSON object mapping locale tags to alternate URLs, such as
 It emits `lastmod` and `xhtml:link rel="alternate"`. Supply truthful content
 change dates; omit unknown dates. Alternates must currently use the approved
 origin. Reciprocal locale coverage and date semantics require separate review.
+`lastmod` must come from a recorded content-change event or source revision;
+never derive it from `updated_at`, pull time, sync time, or deployment time.
+If the change date is unknown, omit `lastmod`. An empty content-type does not
+need a sitemap chunk in the sitemap index; serving an empty endpoint and
+advertising it are separate decisions.
 
 ## Freeze and compare a reviewed site
 
@@ -122,7 +127,7 @@ maggie seo sitemap rollback --backup-manifest .maggie-sitemap-backups/<plan>/bac
 
 Only confirmed image variants may enter `srcset`; `apply` requires an explicit
 confirmation and host adapter. Sitemap plans keep content types separate,
-emit chunk 1 for empty enabled types, enforce absolute same-origin URLs, and
+omit empty chunks from the sitemap index, enforce absolute same-origin URLs, and
 record redirects for removed sitemap files. Read the [image and sitemap PRD](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/docs/image-sitemap-structure-prd.md)
 for adapter and rollback rules.
 
@@ -207,3 +212,18 @@ Follow the shared [Maggie Decision Loop](../../references/decision-loop.md) for
 6. Require explicit final confirmation before any mutation or external write.
 
 If a decision is not relevant, record it as `skipped` with a reason. Do not silently assume a missing choice, and do not treat an existing output as permission to skip required work.
+
+Use semantic validation when route evidence is available:
+
+```bash
+maggie seo sitemap validate --plan .maggie/sitemap-plan.json --strict-semantic
+maggie seo sitemap agent-files --origin https://example.test \
+  --routes-file .maggie/routes.tsv --locale fr-FR --output-dir public/fr
+```
+
+Strict validation checks searchable content evidence, indexability, self
+canonical ownership and truthful `lastmod` provenance. `lastmod` may only be
+backed by a content-change/source-revision event; operational sync, pull,
+deploy, or `updated_at` timestamps are rejected. The agent-file command emits
+locale-aware `llms.txt`, `sitemap.md`, and `insights.md` from the same route
+inventory; non-indexable routes are omitted.

package/bundled-skills/maggie-service-booking/SKILL.md

@@ -7,6 +7,12 @@ metadata:
 
 # Maggie Service Booking
 
+Route matching evidence must come from the route source's actual import
+statements. The shared resolver in `tools/runtime/route_imports.py` resolves
+relative imports and records a component fingerprint; it never selects a
+same-basename sibling as a fallback. Missing imports are evidence requiring
+review, not permission to guess.
+
 ## Reviewed page relationships
 
 Reviewed page selection preserves existing `supporting` relations, including

package/bundled-templates/maggiedash/README.md

@@ -7,3 +7,18 @@ own framework conventions for rendering.
 The package includes only these lightweight contracts. Large marketplace
 previews and template media remain separately distributable through the
 marketplace repository.
+
+Dashboard routes should adopt `dashboard-ui-contract.json` and validate their
+actual host components with `maggie dash ui validate`. The contract provides
+the shared workspace chrome and rejects components that declare dead props.
+
+The first-party dashboard distribution is installed separately into
+`./_maggie/admin`:
+
+```bash
+maggie dash install --project . --confirm
+```
+
+It records the source revision at `.maggie/dash-install.json`; host routes,
+email/password authentication, and `/api/maggie/*` adapters remain owned by the
+website project.

package/bundled-templates/maggiedash/dashboard-ui-contract.json

@@ -0,0 +1,31 @@
+{
+  "schemaVersion": "maggiedash-dashboard-ui.v1",
+  "shell": {
+    "reference": "users-workspace",
+    "navigation": "sidebar-plus-content-tabs",
+    "rules": [
+      "render one workspace bar per route",
+      "render one content tab bar per route",
+      "do not duplicate sidebar navigation in page content",
+      "do not hide duplicate navigation with CSS"
+    ]
+  },
+  "components": [
+    {
+      "name": "WorkspaceBar",
+      "props": ["workspaceName", "activeSection", "actions", "children"],
+      "forbiddenProps": []
+    },
+    {
+      "name": "WorkspaceCard",
+      "props": ["title", "children"],
+      "forbiddenProps": []
+    },
+    {
+      "name": "ContentTabs",
+      "props": ["tabs", "active", "actions", "children"],
+      "forbiddenProps": ["title", "description"]
+    }
+  ],
+  "accessibility": ["active tab exposes aria-selected", "actions have accessible names", "workspace navigation has a landmark"]
+}

package/bundled-tools/clis/maggie.py

@@ -8,6 +8,7 @@ import hashlib
 import json
 import os
 import re
+import subprocess
 import sys
 import time
 from datetime import datetime, timezone
@@ -561,6 +562,11 @@ def command_bootstrap_phase(args: argparse.Namespace) -> int:
             if analysis.get("maggiedash", {}).get("status") not in {"Detected", "Planned"}:
                 print("GATE_BLOCKED: MaggieDash project contract is unavailable.", file=sys.stderr)
                 return 2
+            bootstrap = load_state(root) or {}
+            decisions = bootstrap.get("decisions", {})
+            if decisions.get("maggiedash_admin") and not (root / STATE_DIR / "dash-install.json").exists():
+                print("GATE_BLOCKED: MaggieDash admin is enabled but not installed; run `maggie dash install --project . --confirm`.", file=sys.stderr)
+                return 2
         phase["status"] = "passed"
         phase["validation"] = args.validation
         phase["validated_at"] = utc_now()
@@ -589,7 +595,7 @@ BOOTSTRAP_QUESTIONS = [
     ("content_source", "Where should posts be stored?", ["preserve", "local-content", "database", "api-pull"]),
     ("posts_per_page", "How many posts should appear on each blog page?", ["9", "12", "6", "custom"]),
     ("grid_columns", "How many columns should the default post grid use?", ["3", "2", "4", "custom"]),
-    ("ops_dashboard", "Should the project add the private Maggie Ops dashboard after bootstrap?", ["disabled", "enabled"]),
+    ("maggiedash_admin", "Should bootstrap install the private MaggieDash admin workspace into ./_maggie/admin?", ["enabled", "disabled"]),
 ]
 
 
@@ -604,7 +610,7 @@ def question_default(key: str, analysis: dict) -> str:
     detected = analysis.get(key, {}).get("value") if isinstance(analysis.get(key), dict) else None
     if key == "posts_per_page": return "9"
     if key == "grid_columns": return "3"
-    if key == "ops_dashboard": return "disabled"
+    if key == "maggiedash_admin": return "enabled"
     return detected or {"ui_system": "preserve-or-tailwind", "icon_set": "phosphor", "font": "preserve-or-system", "database": "preserve-or-sqlite"}.get(key, "detected")
 
 
@@ -641,6 +647,8 @@ def command_bootstrap_interview(args: argparse.Namespace) -> int:
             raise RuntimeError(f"invalid answers file: {args.answers_file}") from error
         if not isinstance(loaded, dict): raise RuntimeError("answers file must contain a JSON object")
         answers.update({str(key): str(value) for key, value in loaded.items()})
+    if "maggiedash_admin" not in answers and "ops_dashboard" in answers:
+        answers["maggiedash_admin"] = answers["ops_dashboard"]
     for key, question, choices in BOOTSTRAP_QUESTIONS:
         value = answers.get(key, question_default(key, analysis))
         if not args.non_interactive and key not in answers:
@@ -665,8 +673,10 @@ def command_bootstrap_interview(args: argparse.Namespace) -> int:
         project=str(root), confirm=["foundation", "experience", "data", "publishing"],
         framework=answers["framework"], language=answers["language"], content_language=answers["content_language"],
         ui_system=answers["ui_system"], icon_set=answers["icon_set"], font=answers["font"], database=answers["database"], content_source=answers["content_source"],
-        posts_per_page=int(answers["posts_per_page"]), grid_columns=int(answers["grid_columns"]), ops_dashboard=answers["ops_dashboard"] == "enabled",
+        posts_per_page=int(answers["posts_per_page"]), grid_columns=int(answers["grid_columns"]),
+        ops_dashboard=answers["maggiedash_admin"] == "enabled", maggiedash_admin=answers["maggiedash_admin"] == "enabled",
         site_domain=answers["site_domain"], api_key_present=answers["api_key_present"], foundation_source=answers["foundation_source"], maggiedash_path=None,
+        dash_source=getattr(args, "dash_source", None),
     )
     return command_complete(complete_args)
 
@@ -685,6 +695,17 @@ def command_complete(args: argparse.Namespace) -> int:
         if foundation_analysis.get("maggiedash", {}).get("status") != "Detected":
             print("FOUNDATION_REQUIRED: use-existing-maggiedash was selected but no MaggieDash contract was detected.", file=sys.stderr)
             return 2
+    install_admin = bool(getattr(args, "maggiedash_admin", False))
+    if install_admin:
+        root.mkdir(parents=True, exist_ok=True)
+        command = [sys.executable, str(Path(__file__).with_name("maggie_dash.py")), "install", "--project", str(root), "--confirm"]
+        dash_source = getattr(args, "dash_source", None)
+        if dash_source:
+            command.extend(["--source", dash_source])
+        result = subprocess.run(command, cwd=root, check=False)
+        if result.returncode:
+            print("MAGGIEDASH_INSTALL_FAILED: bootstrap was not completed; resolve the private MaggieDash source and retry.", file=sys.stderr)
+            return result.returncode
     state = {
         "schema_version": "1.1",
         "status": "completed",
@@ -707,6 +728,7 @@ def command_complete(args: argparse.Namespace) -> int:
             "posts_per_page": args.posts_per_page,
             "grid_columns": args.grid_columns,
             "ops_dashboard": args.ops_dashboard,
+            "maggiedash_admin": install_admin,
         },
     }
     path = state_path(root)
@@ -714,7 +736,7 @@ def command_complete(args: argparse.Namespace) -> int:
     path.write_text(json.dumps(state, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
     contracts = {
         "project.json": {"schema_version": "1.0", "framework": args.framework, "language": args.language, "database": args.database, "content_source": args.content_source, "site_domain": getattr(args, "site_domain", "none"), "context_source": state["decisions"]["context_source"], "foundation_source": foundation_source},
-        "maggiedash.json": {"schema_version": "1.0", "source": foundation_source, "path": getattr(args, "maggiedash_path", None), "scaffold_command": "maggie dash init --project ." if foundation_source == "create-maggiedash" else None, "capabilities": ["content", "admin", "auth", "media", "plugins", "api", "mcp"], "status": "detected" if foundation_source == "use-existing-maggiedash" else "planned" if foundation_source == "create-maggiedash" else "not-selected"},
+        "maggiedash.json": {"schema_version": "1.0", "source": foundation_source, "path": getattr(args, "maggiedash_path", None), "scaffold_command": "maggie dash init --project ." if foundation_source == "create-maggiedash" else None, "admin_install": {"enabled": install_admin, "target": "./_maggie/admin", "state": ".maggie/dash-install.json" if install_admin else None}, "capabilities": ["content", "admin", "auth", "media", "plugins", "api", "mcp"], "status": "detected" if foundation_source == "use-existing-maggiedash" else "planned" if foundation_source == "create-maggiedash" else "not-selected"},
         "decisions.json": state["decisions"],
         "schema.json": {"post_required": ["id", "slug", "title", "content", "status", "canonicalUrl", "publishedAt", "updatedAt", "author"], "public_status": "published", "posts_per_page": args.posts_per_page, "grid_columns": args.grid_columns, "grid_default": f"{args.grid_columns}x{args.posts_per_page // args.grid_columns}"},
         "routes.json": {"public": ["/about", "/blog", "/blog/page/[page]", "/blog/[slug]", "/topics", "/topics/[slug]", "/authors/[slug]", "/sitemap.xml", "/robots.txt"], "ops": ["/ops", "/ops/posts", "/ops/posts/new", "/ops/posts/[id]/edit", "/ops/posts/[id]/preview", "/ops/topics", "/ops/sitemap", "/ops/reports", "/ops/settings/site", "/ops/settings/integrations", "/ops/operations", "/ops/wordpress", "/api/ops/summary", "/api/ops/posts", "/api/ops/topics", "/api/ops/bulk", "/api/ops/agency", "/api/ops/entities", "/api/ops/migrations/import", "/api/ops/migrations/[id]/resume", "/api/ops/wordpress/migration-plan", "/api/ops/pull/project-context", "/api/ops/pull/sync", "/api/ops/pull/sync-updates", "/api/ops/sitemap/matching-history", "/api/ops/sitemap/match", "/api/ops/sitemap/auto-detect", "/api/ops/rewrite/queue", "/api/ops/rewrite/history", "/api/ops/rewrite/policy", "/api/ops/content-tracking/report-state", "/api/ops/content-tracking/report-state/batch", "/api/ops/reports", "/api/ops/playbooks/[id]/run"]},
@@ -903,6 +925,7 @@ def parser() -> argparse.ArgumentParser:
     interview.add_argument("--answers-file", help="JSON answers for headless/CI use")
     interview.add_argument("--non-interactive", action="store_true", help="do not prompt; requires --answers-file and --confirm")
     interview.add_argument("--confirm", action="store_true", help="apply the reviewed proposal")
+    interview.add_argument("--dash-source", help="local checkout or Git URL for the MaggieDash admin source")
     interview.set_defaults(func=command_bootstrap_interview)
     phase = bootstrap_sub.add_parser("phase", help="start/pass/fail one ordered workflow phase")
     phase.add_argument("action", choices=["status", "start", "pass", "fail"])
@@ -915,11 +938,13 @@ def parser() -> argparse.ArgumentParser:
     complete.add_argument("--api-key-present", choices=["yes", "no"], default="no")
     complete.add_argument("--foundation-source", choices=["use-existing-maggiedash", "create-maggiedash", "preserve-existing-project"], default="preserve-existing-project")
     complete.add_argument("--maggiedash-path", default=None, help="path to an existing MaggieDash project contract")
+    complete.add_argument("--dash-source", help="local checkout or Git URL for the MaggieDash admin source")
     for name, default in (("framework", "detected"), ("language", "detected"), ("content-language", "confirmed"), ("ui-system", "preserve-or-tailwind"), ("icon-set", "phosphor"), ("font", "preserve-or-system"), ("database", "preserve-or-sqlite"), ("content-source", "confirmed")):
         complete.add_argument("--" + name, dest=name.replace("-", "_"), default=default)
     complete.add_argument("--posts-per-page", type=int, default=9)
     complete.add_argument("--grid-columns", type=int, default=3)
     complete.add_argument("--ops-dashboard", action=argparse.BooleanOptionalAction, default=False)
+    complete.add_argument("--maggiedash-admin", action=argparse.BooleanOptionalAction, default=False)
     complete.set_defaults(func=command_complete)
     generate = sub.add_parser("generate", help="generate stable contract or fixture files")
     generate.add_argument("target", choices=["contract", "fixture", "post", "topic", "author", "migration", "seo", "ops-page"])

package/bundled-tools/clis/maggie_analytics.py

@@ -10,6 +10,9 @@ import re
 import subprocess
 from pathlib import Path
 from urllib.parse import urlsplit
+import sys
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "runtime"))
+from analytics_traffic import audit_events  # noqa: E402
 
 
 GA4_ID = re.compile(r"^G-[A-Z0-9]+$", re.I)
@@ -107,7 +110,7 @@ def release_gate(args: argparse.Namespace) -> int:
 
 def main() -> int:
     parser = argparse.ArgumentParser()
-    parser.add_argument("command", nargs="?", choices=("release-gate",))
+    parser.add_argument("command", nargs="?", choices=("release-gate", "traffic-audit"))
     parser.add_argument("--project", default=".")
     parser.add_argument("--environment", choices=("development", "staging", "production"), default="staging")
     parser.add_argument("--env-file", help="optional env file; values are never printed")
@@ -117,12 +120,22 @@ def main() -> int:
     parser.add_argument("--network-report", help="redacted network evidence for release-gate")
     parser.add_argument("--provider-report", help="read-only provider evidence for release-gate")
     parser.add_argument("--smoke-report", help="production smoke evidence for release-gate")
+    parser.add_argument("--events", help="redacted JSON array of analytics events for traffic-audit")
     args = parser.parse_args()
     if args.command == "release-gate":
         required = ("contract", "render_report", "network_report", "provider_report", "smoke_report")
         if any(not getattr(args, name) for name in required):
             parser.error("release-gate requires --contract, --render-report, --network-report, --provider-report, and --smoke-report")
         return release_gate(args)
+    if args.command == "traffic-audit":
+        if not args.events:
+            parser.error("traffic-audit requires --events")
+        value = json.loads(Path(args.events).read_text(encoding="utf-8"))
+        if not isinstance(value, list):
+            parser.error("--events must contain a JSON array")
+        result = audit_events(value)
+        print(json.dumps(result, indent=2, ensure_ascii=False))
+        return 0
     project = Path(args.project).resolve()
     env = parse_env(Path(args.env_file).resolve()) if args.env_file else parse_env(project / ".env.example")
     env.update({key: value for key, value in os.environ.items() if key in {"PUBLIC_GA4_MEASUREMENT_ID", "PUBLIC_ANALYTICS_ENABLED", "PUBLIC_ANALYTICS_CONSENT_REQUIRED", "GSC_SITE_URL", "GSC_VERIFICATION_TOKEN"}})

package/bundled-tools/clis/maggie_blog.py

@@ -11,6 +11,7 @@ from pathlib import Path
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "runtime"))
 from maggie_blog import BlogStore  # noqa: E402
 from localization_runner import process_adapter
+from integration_state import integration_state  # noqa: E402
 
 
 def main() -> int:
@@ -29,8 +30,13 @@ def main() -> int:
     publish = sub.add_parser("publish"); publish.add_argument("--project", type=Path, default=Path.cwd()); publish.add_argument("--slug", required=True); publish.add_argument("--actor", required=True); publish.add_argument("--reason", required=True); publish.add_argument("--confirm", action="store_true")
     sitemap = sub.add_parser("sitemap"); sitemap.add_argument("--project", type=Path, default=Path.cwd())
     settings = sub.add_parser("settings"); settings.add_argument("--project", type=Path, default=Path.cwd())
+    state = sub.add_parser("integration-state"); state.add_argument("--configured", action="store_true"); state.add_argument("--consent-required", action="store_true"); state.add_argument("--consent", action="store_true"); state.add_argument("--authorized", action="store_true"); state.add_argument("--error")
     rollback = sub.add_parser("rollback"); rollback.add_argument("--project", type=Path, default=Path.cwd()); rollback.add_argument("--backup"); rollback.add_argument("--confirm", action="store_true")
     args = parser.parse_args()
+    if args.command == "integration-state":
+        result = integration_state(configured=args.configured, consent_required=args.consent_required, consent=args.consent, authorized=args.authorized, error=args.error)
+        print(json.dumps(result, indent=2, ensure_ascii=False))
+        return 0 if result["status"] != "error" else 1
     store = BlogStore(args.project.resolve())
     if args.command in {"init", "ingest", "publish", "rollback", "translate-pending"} and not args.confirm:
         print("CONFIRMATION_REQUIRED: rerun with --confirm", file=sys.stderr); return 2