@topy-ai/maggie 0.7.12 → 0.7.13

package/README.md

@@ -104,7 +104,8 @@ maggie bootstrap interview | phase ...
 maggie dash install | init | status | migrate | cms ...
 maggie dash transition ...      # explicit content approval transition
 maggie dash variant ...         # service variant create/review/preview/publish
-maggie dash sections ...        # validate/catalogue/identity keys
+maggie dash sections ...        # field fan-out, locale, binding, media, copy, identity keys
+maggie dash inventory ...        # disjoint published-page inventory
 maggie agent-content write ...  # host-authorized, origin-bound content bridge
 maggie verification coverage ... # changed surface/locale evidence gate
 maggie clone ...                 # authorized homepage capture
@@ -119,6 +120,7 @@ maggie seo performance ...       # sampled PageSpeed/CWV report and baseline
 maggie seo images ...             # inventory, variants, confirmation, validate
 maggie seo sitemap ...            # typed/semantic plan, agent-files, apply, rollback
 maggie deployment | migration | release | analytics | schedule
+maggie migration identity --identity-file FILE [--expected-file FILE]
 maggie deployment canary --asset URL=SHA256 --render-report report.json
 maggie design icon-inventory --source-dir src --runtime assets/icons.css
 maggie api lifecycle | site-audit | ops audit
@@ -218,8 +220,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.12 update --project . --force
-npx @topy-ai/maggie@0.7.12 cleanup --project .
+npx @topy-ai/maggie@0.7.13 update --project . --force
+npx @topy-ai/maggie@0.7.13 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -229,7 +231,11 @@ as a command-line argument:
 node scripts/publish-npm.mjs --maggie-env-file ../.env
 ```
 
-The 0.7.12 workflow adds served-content equivalence checks, query-route
+The 0.7.13 workflow adds field-aware section fan-out and locale coverage,
+sibling-copy/media checks, disjoint page inventory, binding validation,
+idempotency and database-target identity gates, full W3C sitemap lastmod
+validation, and the accepted `X-Robots-Tag: noindex` response contract. The
+0.7.12 workflow adds served-content equivalence checks, query-route
 baseline exclusions, changed-surface render evidence gates, generated skill
 catalogs, component-binding audits, and icon-family noise filtering. It also
 includes the 0.7.9 nested section-field contracts, renderer-backed examples,
@@ -514,9 +520,13 @@ maggie design section-validate --before before.json --after after.json \
 ```
 
 MaggieDash section contracts include a compact `pairs` band for factual
-label/value rows. Validate required values, registry fan-out, locale sidecars,
-and idempotent repairs with `maggie dash sections validate`,
-`fanout-validate`, `locale-validate`, and `reconcile`.
+label/value rows. Validate required values, field-aware registry fan-out,
+all locale copy fields, sibling copy/media, stored bindings, and idempotent
+repairs with `maggie dash sections validate`, `fanout-validate`,
+`locale-validate`, `variant-copy-validate`, `media-validate`,
+`bindings-validate`, `idempotency-validate`, and `reconcile`. Use
+`maggie dash inventory` to classify published pages once into disjoint kinds.
+See the [quality contract examples](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/contracts/maggiedash/quality-contracts.md).
 
 The package includes all 18 installable skills: `maggie-blog-bootstrap`,
 `maggie-dash`, `maggie-clone`, `maggie-clone-to-template`, `maggie-marketplace`,

package/README.zh-TW.md

@@ -8,7 +8,7 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.8 init --agent all
+npx @topy-ai/maggie@0.7.13 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 
@@ -39,6 +39,17 @@ maggie deployment canary --project . \
   --asset https://example.com/assets/app.js=<sha256> \
   --render-report .maggie/rendered-canary.json \
   --output docs/deployment-canary.json
+
+# MaggieDash section/page quality contracts
+maggie dash sections fanout-validate --registry templates/maggiedash/section-registry.json \
+  --fanout-file templates/maggiedash/section-fanout.json
+maggie dash sections variant-copy-validate --pages-file .maggie/variant-pages.json
+maggie dash sections media-validate --pages-file .maggie/variant-pages.json --across-siblings
+maggie dash inventory --pages-file .maggie/published-pages.json
+
+# Migration target identity (never prints or stores a database URL)
+maggie migration identity --identity-file .maggie/db-identity.json \
+  --expected-file .maggie/service-db-identity.json
 ```
 
 完整中文說明、18 個 skills 清單和 roadmap：

package/bin/maggie.js

@@ -58,7 +58,8 @@ Usage:
   maggie doctor [--project PATH]
   maggie bootstrap interview [project]
   maggie dash init|install|status|migrate|transition|variant|cms --project PATH [options]
-  maggie dash sections <validate|prompt|keys|remap-translations|fanout-validate|locale-validate|reconcile> [options]
+  maggie dash sections <validate|prompt|keys|remap-translations|fanout-validate|locale-validate|variant-copy-validate|media-validate|bindings-validate|idempotency-validate|reconcile> [options]
+  maggie dash inventory --pages-file FILE
   maggie dash components-audit --bindings-file FILE --sections-file FILE --pages-file FILE
   maggie dash status --project PATH
   maggie dash migrate --project PATH --confirm
@@ -104,6 +105,7 @@ Usage:
   maggie deployment --project PATH --target vps-with-cloudflare-dns
   maggie deployment canary --project PATH --asset URL=SHA256 --render-report report.json --output docs/deployment-canary.json
   maggie migration --project PATH --environment staging
+  maggie migration identity --identity-file FILE [--expected-file FILE]
   maggie schedule PATH/.maggie/schedule.json --project PATH
   maggie analytics [traffic-audit|release-gate] --project PATH --environment staging
   maggie release PATH --environment staging --target vps-with-cloudflare-dns

package/bundled-contracts/maggiedash/README.md

@@ -24,6 +24,9 @@ frontend framework.
   for translation keys and ordered migration;
 - [`translation-cache-policy-v1.json`](translation-cache-policy-v1.json):
   restart-after-out-of-band-write evidence.
+- [`quality-contracts.md`](quality-contracts.md): reviewable inputs for
+  disjoint page inventory, variant/media checks, binding resolution, repair
+  convergence, and database target identity.
 
 The section registry is an adapter input rather than a fixed six-band list.
 Each registry entry must describe its purpose and limits, include a

package/bundled-contracts/maggiedash/quality-contracts.md

@@ -0,0 +1,58 @@
+# MaggieDash quality contracts
+
+These inputs are reviewable JSON evidence. They do not write a database or
+publish content.
+
+## Page inventory
+
+```json
+{
+  "pages": [
+    {"path": "/", "sections": [{"type": "hero"}]},
+    {"path": "/about", "source": "src/pages/about.astro"}
+  ]
+}
+```
+
+Run `maggie dash inventory --pages-file .maggie/published-pages.json`. The
+result assigns each path exactly one kind and reports `bandCount` and
+`codeRenderedCount`; unknown or duplicate paths fail.
+
+## Variant and media checks
+
+Variant pages should provide `id`, `family`, `locale`, and either a `sections`
+array or direct fields. Run `variant-copy-validate` with one or more copy field
+names (the default is `faq`). Run `media-validate` for page duplicates and add
+`--across-siblings` to catch shared media in one variant family.
+
+## Bindings
+
+The sections file may contain a `binding` object or fields such as
+`categorySlug`, `collectionId`, or `serviceRef`. The references file maps each
+type to IDs, slugs, names, or values. `bindings-validate` fails when a stored
+reference cannot be resolved.
+
+## Repair idempotency
+
+```json
+{
+  "schemaVersion": "maggie-reconcile-contract.v1",
+  "candidateSelection": {"strategy": "all-candidates", "query": "SELECT all repair candidates"},
+  "compareFields": ["sections", "translations"],
+  "writesOnlyWhenChanged": true,
+  "report": {"changed": true, "unchanged": true},
+  "secondRun": {"convergent": true}
+}
+```
+
+`idempotency-validate` rejects a selection that only targets rows that look
+unconverted. The actual adapter must still use a transaction and report its
+real changed/unchanged counts.
+
+## Database identity
+
+`maggie migration identity` accepts a `maggie-database-identity.v1` report with
+environment, target/database name, server identity, service release identity,
+row counts, and a matching SHA-256 fingerprint. It can compare a second
+service-owned report. Reports must never contain a database URL, password, or
+credential.

package/bundled-skills/maggie-dash/SKILL.md

@@ -182,15 +182,26 @@ maggie dash sections remap-translations \
   --mapping-file .maggie/section-translation-map.json \
   --output .maggie/translations-v2.json --confirm
 
-# Validate locale sidecars for stored image alt text before publishing:
+# Validate every registry-declared translatable field for every locale before publishing:
 maggie dash sections locale-validate \
   --page-id <page-id> --sections-file .maggie/sections.json \
-  --translations-file .maggie/translations-by-locale.json --locale zh-Hant
+  --translations-file .maggie/translations-by-locale.json \
+  --registry templates/maggiedash/section-registry.json --locale zh-Hant
 
 # Check that a host wired every registry type through all implementation surfaces:
 maggie dash sections fanout-validate \
   --registry templates/maggiedash/section-registry.json \
   --fanout-file templates/maggiedash/section-fanout.json
+
+# Validate sibling copy, media uniqueness, references, and repair convergence:
+maggie dash sections variant-copy-validate --pages-file .maggie/variant-pages.json --field faq
+maggie dash sections media-validate --pages-file .maggie/variant-pages.json --across-siblings
+maggie dash sections bindings-validate --sections-file .maggie/sections.json \
+  --references-file .maggie/reference-inventory.json
+maggie dash sections idempotency-validate --contract-file .maggie/reconcile-contract.json
+
+# Classify every published page exactly once:
+maggie dash inventory --pages-file .maggie/published-pages.json
 ```
 
 The catalogue declares purpose, usage, placement, repeatability and layout
@@ -211,10 +222,13 @@ as a fixed number of bands.
 Required fields and repeated `pairs` values cannot be blank. The `pairs`
 starter band is intended for compact label/value facts such as opening hours;
 it is not a prose fallback. The registry fan-out manifest is a host integration
-contract: when a host adds a type, update its type union/schema, blank state,
-validation, readable-content extraction, renderer, and editor entry together,
-then run `fanout-validate`. `locale-validate` checks stored image-alt sidecars;
-the host adapter must write the section and all non-default locale rows in one
+contract: when a host adds a type or field, update its type union/schema, blank
+state, validation, readable-content extraction, renderer, and editor entry
+together, then run `fanout-validate`. The check is field-aware and requires two
+editor screens, so adding a field without wiring both editing surfaces fails
+closed. `locale-validate --registry` checks every declared translatable scalar
+and repeated item field; URLs and media sources can be marked non-translatable.
+The host adapter must write the section and all non-default locale rows in one
 transaction. The JSON report is evidence, not a database write.
 
 Translation keys use stable section IDs, with an array-index fallback only
@@ -233,8 +247,17 @@ is the reviewable output form, not a substitute for the adapter's transaction.
 Keep data-owned values out of page copy. For example, a pricing band should
 store a service identifier or slug and let the live service/booking adapter
 render current options and prices. Inventory reports must classify each
-published page once into disjoint groups; price options, arrangements, and
-other child records are counts, not pages.
+published page once into disjoint groups; `maggie dash inventory` reports band
+and code-rendered counts. Price options, arrangements, and other child records
+are counts, not pages. Run the variant-copy and media checks before publishing
+localized sibling pages, and the bindings check whenever a section stores a
+category, collection, or service reference; an unresolved binding is a publish
+failure, not an empty state.
+
+Repair scripts must select all candidates, compare every target field, write
+only changed rows, and report both changed and unchanged rows. Validate that
+contract with `idempotency-validate`; a query that selects only rows that look
+unconverted cannot repair its own bad output.
 
 After any script or direct adapter write to translation data, invalidate the
 running process before verification. Record the restart and run the rendering

package/bundled-skills/maggie-deployment/SKILL.md

@@ -111,6 +111,21 @@ The manifest must reference `DATABASE_URL` (not a literal URL), declare an
 advancing version, forward-only/idempotent policy, backup and restore commands,
 and a tested restore artifact. The validator never runs those commands.
 
+Before a write, prove that the migration target is the database used by the
+running service. The identity report is intentionally secret-free and includes
+the environment, target/database name, server identity, service release
+identity, row counts, and a SHA-256 fingerprint. Compare it with the deployment
+identity when available:
+
+```bash
+maggie migration identity --identity-file .maggie/db-identity.json \
+  --expected-file .maggie/service-db-identity.json
+```
+
+The gate fails on a missing or mismatched target identity and never executes a
+migration. A successful connection alone is not proof that the intended
+database was selected.
+
 If a release depends on existing rows or seeded data, set
 `dataDependencies: true` in `.maggie/migration-manifest.json` and provide
 `.maggie/deployment/data-release.json` before deployment. The checkpoint must

package/bundled-skills/maggie-seo-geo/SKILL.md

@@ -62,7 +62,7 @@ advertising it are separate decisions.
 Generated sitemap XML uses the conventional readable shape by default: one
 `<url>`/`<sitemap>` entry per block, UTF-8 XML, and date-only `lastmod` evidence
 rendered as a full UTC W3C datetime. The plan also exposes the response
-contract (`text/xml; charset=utf-8` and `X-Robots-Tag: all`) for the framework
+contract (`text/xml; charset=utf-8` and `X-Robots-Tag: noindex`) for the framework
 route or reverse proxy to apply; writing a file cannot set HTTP headers itself.
 When Search Console reports a valid sitemap as unfetched, probe success alone
 is not a diagnosis. Supply a sanitized local access log to distinguish

package/bundled-templates/maggiedash/section-fanout.json

@@ -1,11 +1,87 @@
 {
   "schemaVersion": "maggiedash-section-fanout.v1",
-  "description": "Starter host contract: every registry type must be wired through each implementation surface. Hosts extending the registry must regenerate this file.",
-  "typeUnion": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
-  "sectionSchema": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
-  "blank": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
-  "validation": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
-  "textExtraction": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
-  "renderer": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
-  "editor": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"]
+  "description": "Field-aware host contract: every registry type and declared field must be wired through each implementation surface and two editor screens.",
+  "typeUnion": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "sectionSchema": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "blank": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "validation": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "textExtraction": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "renderer": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "editor": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "editorScreens": {
+    "section-editor": {
+      "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+      "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+      "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+      "cards": ["heading", "items", "items.title", "items.body"],
+      "links": ["heading", "items", "items.label", "items.href", "items.body"],
+      "faq": ["heading", "items", "items.question", "items.answer"],
+      "cta": ["heading", "body", "label"]
+    },
+    "document-detail": {
+      "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+      "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+      "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+      "cards": ["heading", "items", "items.title", "items.body"],
+      "links": ["heading", "items", "items.label", "items.href", "items.body"],
+      "faq": ["heading", "items", "items.question", "items.answer"],
+      "cta": ["heading", "body", "label"]
+    }
+  }
 }

package/bundled-templates/maggiedash/section-registry.json

@@ -13,7 +13,7 @@
       "fields": [
         {"name": "title", "usage": "Plain words a visitor would search for.", "limit": 70, "required": true},
         {"name": "intro", "usage": "Who it is for and what it does.", "limit": 220},
-        {"name": "image", "usage": "The hero image rendered beside or behind the copy.", "limit": 500},
+        {"name": "image", "usage": "The hero image rendered beside or behind the copy.", "limit": 500, "translatable": false},
         {"name": "imageAlt", "usage": "What the hero image shows for a reader who cannot see it.", "limit": 160},
         {"name": "ctaLabel", "usage": "The action as a verb.", "limit": 30}
       ],
@@ -28,7 +28,7 @@
       "fields": [
         {"name": "heading", "usage": "The argument in a sentence.", "limit": 90},
         {"name": "paragraphs", "usage": "Standalone paragraphs.", "limit": 0, "repeats": {"min": 1, "max": 4, "of": [{"name": "paragraph", "usage": "One paragraph of plain prose.", "limit": 400}]}},
-        {"name": "image", "usage": "An optional supporting image.", "limit": 500},
+        {"name": "image", "usage": "An optional supporting image.", "limit": 500, "translatable": false},
         {"name": "imageAlt", "usage": "What the supporting image shows.", "limit": 160}
       ],
       "example": {"type": "prose", "heading": "Make the important part easier to understand", "paragraphs": ["Start with the decision your reader is trying to make.", "Then give them the context, evidence and next step in that order."]}
@@ -66,7 +66,7 @@
       "repeatable": true,
       "fields": [
         {"name": "heading", "usage": "What the links have in common.", "limit": 90},
-        {"name": "items", "usage": "Real related pages on this site.", "limit": 0, "repeats": {"min": 2, "max": 6, "of": [{"name": "label", "usage": "The destination page name.", "limit": 60, "required": true}, {"name": "href", "usage": "A real path on this site.", "limit": 200, "required": true}, {"name": "body", "usage": "One sentence on what is there.", "limit": 160}]}}
+        {"name": "items", "usage": "Real related pages on this site.", "limit": 0, "repeats": {"min": 2, "max": 6, "of": [{"name": "label", "usage": "The destination page name.", "limit": 60, "required": true}, {"name": "href", "usage": "A real path on this site.", "limit": 200, "required": true, "translatable": false}, {"name": "body", "usage": "One sentence on what is there.", "limit": 160}]}}
       ],
       "example": {"type": "links", "heading": "Keep exploring", "items": [{"label": "How it works", "href": "/how-it-works/", "body": "See the process from start to finish."}, {"label": "Frequently asked questions", "href": "/faq/", "body": "Find concise answers to common questions."}]}
     },

package/bundled-tools/clis/maggie_dash.py

@@ -24,6 +24,7 @@ from maggie_dash_store import MaggieDashStore  # noqa: E402
 from service_variants import ServiceVariantStore  # noqa: E402
 from maggie_dash_ui import load_and_validate  # noqa: E402
 from maggie_sections import catalogue, remap_translations, section_id_migration, validate_registry, copy_notes, validate_values, validate_fanout, reconcile_fields, validate_locale_coverage  # noqa: E402
+from maggie_quality import validate_variant_copy, validate_media_uniqueness, classify_inventory, validate_bindings, validate_reconcile_contract  # noqa: E402
 from route_imports import classify_bindings  # noqa: E402
 
 
@@ -358,7 +359,29 @@ def command_sections(args: argparse.Namespace) -> int:
     if args.sections_command == "locale-validate":
         sections = json.loads(Path(args.sections_file).resolve().read_text(encoding="utf-8"))
         translations = json.loads(Path(args.translations_file).resolve().read_text(encoding="utf-8"))
-        result = validate_locale_coverage(args.page_id, sections, translations, args.locale)
+        registry = json.loads(Path(args.registry).resolve().read_text(encoding="utf-8")) if args.registry else None
+        result = validate_locale_coverage(args.page_id, sections, translations, args.locale, registry=registry)
+        emit(result)
+        return 0 if result["passed"] else 1
+    if args.sections_command == "variant-copy-validate":
+        value = json.loads(Path(args.pages_file).resolve().read_text(encoding="utf-8"))
+        result = validate_variant_copy(value, args.field or ["faq"])
+        emit(result)
+        return 0 if result["passed"] else 1
+    if args.sections_command == "media-validate":
+        value = json.loads(Path(args.pages_file).resolve().read_text(encoding="utf-8"))
+        result = validate_media_uniqueness(value, across_siblings=args.across_siblings)
+        emit(result)
+        return 0 if result["passed"] else 1
+    if args.sections_command == "bindings-validate":
+        sections = json.loads(Path(args.sections_file).resolve().read_text(encoding="utf-8"))
+        references = json.loads(Path(args.references_file).resolve().read_text(encoding="utf-8"))
+        result = validate_bindings(sections, references)
+        emit(result)
+        return 0 if result["passed"] else 1
+    if args.sections_command == "idempotency-validate":
+        contract = json.loads(Path(args.contract_file).resolve().read_text(encoding="utf-8"))
+        result = validate_reconcile_contract(contract)
         emit(result)
         return 0 if result["passed"] else 1
     registry = json.loads(Path(args.registry).resolve().read_text(encoding="utf-8"))
@@ -396,6 +419,14 @@ def command_components_audit(args: argparse.Namespace) -> int:
     return 0 if result["passed"] else 1
 
 
+def command_inventory(args: argparse.Namespace) -> int:
+    """Classify each published page once, with no broad predicate overlap."""
+    value = json.loads(Path(args.pages_file).resolve().read_text(encoding="utf-8"))
+    result = classify_inventory(value)
+    emit(result)
+    return 0 if result["passed"] else 1
+
+
 def variant_store(args: argparse.Namespace) -> ServiceVariantStore:
     return ServiceVariantStore(project_root(args) / ".maggie" / "service-variants.json")
 
@@ -518,8 +549,20 @@ def parser() -> argparse.ArgumentParser:
     sections_reconcile.add_argument("--current-file", required=True); sections_reconcile.add_argument("--desired-file", required=True); sections_reconcile.add_argument("--output", required=True); sections_reconcile.add_argument("--force", action="store_true"); sections_reconcile.add_argument("--confirm", action="store_true")
     sections_reconcile.set_defaults(func=command_sections)
     sections_locale = sections_sub.add_parser("locale-validate", help="check locale sidecar coverage for stored image alt fields")
-    sections_locale.add_argument("--page-id", required=True); sections_locale.add_argument("--sections-file", required=True); sections_locale.add_argument("--translations-file", required=True); sections_locale.add_argument("--locale", action="append", required=True)
+    sections_locale.add_argument("--page-id", required=True); sections_locale.add_argument("--sections-file", required=True); sections_locale.add_argument("--translations-file", required=True); sections_locale.add_argument("--locale", action="append", required=True); sections_locale.add_argument("--registry", help="registry for all declared translatable fields")
     sections_locale.set_defaults(func=command_sections)
+    sections_variants = sections_sub.add_parser("variant-copy-validate", help="detect duplicated copy across sibling variants")
+    sections_variants.add_argument("--pages-file", required=True); sections_variants.add_argument("--field", action="append", default=[])
+    sections_variants.set_defaults(func=command_sections)
+    sections_media = sections_sub.add_parser("media-validate", help="detect duplicate media within pages or sibling families")
+    sections_media.add_argument("--pages-file", required=True); sections_media.add_argument("--across-siblings", action="store_true")
+    sections_media.set_defaults(func=command_sections)
+    sections_bindings = sections_sub.add_parser("bindings-validate", help="resolve stored section references against a reference inventory")
+    sections_bindings.add_argument("--sections-file", required=True); sections_bindings.add_argument("--references-file", required=True)
+    sections_bindings.set_defaults(func=command_sections)
+    sections_idempotency = sections_sub.add_parser("idempotency-validate", help="validate a migration repair selection and convergence contract")
+    sections_idempotency.add_argument("--contract-file", required=True)
+    sections_idempotency.set_defaults(func=command_sections)
     sections_keys.set_defaults(func=command_sections)
     components = sub.add_parser("components-audit", help="classify route component bindings against live section/page inventories")
     components.add_argument("--bindings-file", required=True)
@@ -527,6 +570,9 @@ def parser() -> argparse.ArgumentParser:
     components.add_argument("--pages-file", required=True, help="JSON array/object of live page paths")
     components.add_argument("--output")
     components.set_defaults(func=command_components_audit)
+    inventory = sub.add_parser("inventory", help="classify published pages into disjoint band/code-rendered kinds")
+    inventory.add_argument("--pages-file", required=True, help="JSON page inventory")
+    inventory.set_defaults(func=command_inventory)
     variant = sub.add_parser("variant", help="manage service variant lifecycle")
     variant_sub = variant.add_subparsers(dest="variant_command", required=True)
     create = variant_sub.add_parser("create"); create.add_argument("--project", default="."); create.add_argument("--service-id", required=True); create.add_argument("--variant-id", required=True); create.add_argument("--variant-type", required=True); create.add_argument("--locale", required=True); create.add_argument("--market", required=True); create.add_argument("--slug", required=True); create.add_argument("--title", required=True); create.add_argument("--facts", required=True); create.add_argument("--source-revision", required=True); create.add_argument("--canonical-variant-id"); create.add_argument("--cluster-link", action="append", default=[]); create.add_argument("--layout-family", default="service-default"); create.add_argument("--confirm", action="store_true")

package/bundled-tools/clis/maggie_migration.py

@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import argparse
+import hashlib
 import json
 import re
 import sys
@@ -54,7 +55,73 @@ def validate_project(project: Path, environment: str) -> dict:
     return result
 
 
+IDENTITY_SCHEMA = "maggie-database-identity.v1"
+
+
+def _identity_fingerprint(identity: dict) -> str:
+    material = {key: identity.get(key) for key in ("environment", "targetName", "databaseName", "serverIdentity", "serviceIdentity", "rowCounts")}
+    return hashlib.sha256(json.dumps(material, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode()).hexdigest()
+
+
+def validate_identity(identity: object, expected: object | None = None) -> dict:
+    """Gate a write against a non-secret database identity report.
+
+    The report intentionally contains names, server identity and row counts,
+    never a connection string. Comparing it with the service/deployment
+    identity catches the common case where staging and production credentials
+    resolve to different or unexpectedly identical databases.
+    """
+    errors: list[str] = []
+    if not isinstance(identity, dict):
+        return {"schemaVersion": IDENTITY_SCHEMA, "passed": False, "errors": ["identity report must be an object"], "mutation": "not executed"}
+    if identity.get("schemaVersion") != IDENTITY_SCHEMA:
+        errors.append(f"schemaVersion must be {IDENTITY_SCHEMA}")
+    for field in ("environment", "targetName", "databaseName", "serverIdentity", "serviceIdentity"):
+        if not str(identity.get(field) or "").strip():
+            errors.append(f"{field} is required")
+    if not isinstance(identity.get("rowCounts"), dict):
+        errors.append("rowCounts must be an object")
+    fingerprint = str(identity.get("fingerprint") or "")
+    if not re.fullmatch(r"[0-9a-f]{64}", fingerprint):
+        errors.append("fingerprint must be a SHA-256 hex digest")
+    elif fingerprint != _identity_fingerprint(identity):
+        errors.append("fingerprint does not match the reported identity")
+    compared: list[str] = []
+    if expected is not None:
+        if not isinstance(expected, dict):
+            errors.append("expected identity report must be an object")
+        else:
+            for field in ("environment", "targetName", "databaseName", "serverIdentity", "serviceIdentity"):
+                if str(identity.get(field)) != str(expected.get(field)):
+                    errors.append(f"target identity mismatch: {field}")
+                else:
+                    compared.append(field)
+    return {"schemaVersion": IDENTITY_SCHEMA, "passed": not errors, "errors": errors, "mutation": "not executed", "compared": compared, "target": {key: identity.get(key) for key in ("environment", "targetName", "databaseName", "serverIdentity", "serviceIdentity", "rowCounts")}}
+
+
+def identity_main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(description="Validate a secret-free database target identity before migration writes.")
+    parser.add_argument("--identity-file", required=True)
+    parser.add_argument("--expected-file")
+    parser.add_argument("--output")
+    args = parser.parse_args(argv)
+    try:
+        actual = json.loads(Path(args.identity_file).read_text(encoding="utf-8"))
+        expected = json.loads(Path(args.expected_file).read_text(encoding="utf-8")) if args.expected_file else None
+        result = validate_identity(actual, expected)
+    except (OSError, json.JSONDecodeError) as error:
+        result = {"schemaVersion": IDENTITY_SCHEMA, "passed": False, "errors": [f"cannot read identity report: {error}"], "mutation": "not executed"}
+    if args.output:
+        output = Path(args.output)
+        output.parent.mkdir(parents=True, exist_ok=True)
+        output.write_text(json.dumps(result, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+    print(json.dumps(result, indent=2, ensure_ascii=False))
+    return 0 if result["passed"] else 1
+
+
 def main() -> int:
+    if sys.argv[1:2] == ["identity"]:
+        return identity_main(sys.argv[2:])
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("manifest", nargs="?")
     parser.add_argument("--project")

package/bundled-tools/runtime/maggie_quality.py

@@ -0,0 +1,231 @@
+"""Provider-neutral quality contracts for variants, media, inventory, and bindings."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+from collections import Counter, defaultdict
+from typing import Any, Iterable
+
+
+VARIANT_SCHEMA = "maggie-variant-copy.v1"
+MEDIA_SCHEMA = "maggie-media-uniqueness.v1"
+INVENTORY_SCHEMA = "maggie-page-inventory.v1"
+BINDING_SCHEMA = "maggie-section-bindings.v1"
+IDEMPOTENCY_SCHEMA = "maggie-reconcile-contract.v1"
+
+
+def _items(value: object, *keys: str) -> list[dict[str, Any]]:
+    if isinstance(value, list):
+        return [item for item in value if isinstance(item, dict)]
+    if isinstance(value, dict):
+        for key in keys:
+            candidate = value.get(key)
+            if isinstance(candidate, list):
+                return [item for item in candidate if isinstance(item, dict)]
+    return []
+
+
+def _normalise(value: object) -> object:
+    if isinstance(value, dict):
+        return {str(key): _normalise(value[key]) for key in sorted(value)}
+    if isinstance(value, list):
+        values = [_normalise(item) for item in value]
+        return sorted(values, key=lambda item: json.dumps(item, sort_keys=True, ensure_ascii=False))
+    if isinstance(value, str):
+        return re.sub(r"\s+", " ", value).strip().casefold()
+    return value
+
+
+def _field_value(page: dict[str, Any], field: str) -> object:
+    if field in page:
+        return page[field]
+    for section in page.get("sections", []) if isinstance(page.get("sections"), list) else []:
+        if isinstance(section, dict) and (section.get("type") == field or section.get("id") == field):
+            copy = {key: value for key, value in section.items() if key not in {"id", "type"}}
+            return copy
+    return None
+
+
+def validate_variant_copy(value: object, fields: Iterable[str] = ("faq",)) -> dict[str, Any]:
+    pages = _items(value, "pages", "variants")
+    errors: list[str] = []
+    duplicate_groups: list[dict[str, Any]] = []
+    grouped: dict[tuple[str, str, str], list[dict[str, Any]]] = defaultdict(list)
+    field_list = [str(field) for field in fields if str(field)]
+    for index, page in enumerate(pages):
+        page_id = str(page.get("id") or page.get("variantId") or f"item-{index}")
+        family = str(page.get("family") or page.get("variantFamily") or page.get("sourceVariantKey") or page.get("canonicalVariantId") or "")
+        locale = str(page.get("locale") or "default")
+        if not family:
+            errors.append(f"{page_id}: variant family is required")
+            continue
+        for field in field_list:
+            selected = _field_value(page, field)
+            if selected is not None:
+                digest = hashlib.sha256(json.dumps(_normalise(selected), sort_keys=True, ensure_ascii=False).encode()).hexdigest()
+                grouped[(family, locale, field)].append({"id": page_id, "digest": digest})
+    for (family, locale, field), records in sorted(grouped.items()):
+        by_digest: dict[str, list[str]] = defaultdict(list)
+        for record in records:
+            by_digest[record["digest"]].append(record["id"])
+        for digest, ids in sorted(by_digest.items()):
+            if len(ids) > 1:
+                duplicate_groups.append({"family": family, "locale": locale, "field": field, "variantIds": sorted(ids), "digest": digest})
+    return {"schemaVersion": VARIANT_SCHEMA, "passed": not errors and not duplicate_groups, "errors": errors, "duplicates": duplicate_groups, "pages": len(pages), "fields": field_list}
+
+
+def _media_sources(value: object, path: str = "") -> list[dict[str, str]]:
+    media_keys = {"image", "imageurl", "image_url", "src", "srcset", "poster", "media", "mediaurl", "media_url"}
+    result: list[dict[str, str]] = []
+    if isinstance(value, dict):
+        for key, child in value.items():
+            child_path = f"{path}.{key}" if path else str(key)
+            if str(key).casefold() in media_keys and isinstance(child, str) and child.strip():
+                result.append({"source": child.strip(), "path": child_path})
+            else:
+                result.extend(_media_sources(child, child_path))
+    elif isinstance(value, list):
+        for index, child in enumerate(value):
+            result.extend(_media_sources(child, f"{path}.{index}"))
+    return result
+
+
+def validate_media_uniqueness(value: object, *, across_siblings: bool = False) -> dict[str, Any]:
+    pages = _items(value, "pages", "variants")
+    errors: list[dict[str, Any]] = []
+    cross: dict[tuple[str, str], list[str]] = defaultdict(list)
+    for index, page in enumerate(pages):
+        page_id = str(page.get("id") or page.get("variantId") or f"item-{index}")
+        sources = _media_sources(page.get("sections", page))
+        by_source: dict[str, list[str]] = defaultdict(list)
+        for item in sources:
+            by_source[item["source"]].append(item["path"])
+        for source, paths in sorted(by_source.items()):
+            if len(paths) > 1:
+                errors.append({"scope": "page", "pageId": page_id, "source": source, "paths": paths})
+        if across_siblings:
+            family = str(page.get("family") or page.get("variantFamily") or page.get("sourceVariantKey") or page_id)
+            for source in by_source:
+                cross[(family, source)].append(page_id)
+    if across_siblings:
+        for (family, source), ids in sorted(cross.items()):
+            if len(set(ids)) > 1:
+                errors.append({"scope": "siblings", "family": family, "source": source, "pageIds": sorted(set(ids))})
+    return {"schemaVersion": MEDIA_SCHEMA, "passed": not errors, "duplicates": errors, "pages": len(pages), "acrossSiblings": across_siblings}
+
+
+def classify_inventory(value: object) -> dict[str, Any]:
+    pages = _items(value, "pages", "items", "routes")
+    allowed = {"band", "code-rendered", "redirect", "asset", "unknown"}
+    records: list[dict[str, Any]] = []
+    errors: list[str] = []
+    seen: set[str] = set()
+    for index, page in enumerate(pages):
+        path = str(page.get("path") or page.get("url") or page.get("route") or f"item-{index}")
+        if path in seen:
+            errors.append(f"duplicate inventory path: {path}")
+        seen.add(path)
+        explicit = str(page.get("kind") or page.get("classification") or "").casefold()
+        if explicit in {"code", "code-rendered", "component", "source"}:
+            kind = "code-rendered"
+        elif explicit in {"band", "section", "sections"}:
+            kind = "band"
+        elif explicit in {"redirect", "asset"}:
+            kind = explicit
+        elif isinstance(page.get("sections"), list) or isinstance(page.get("sectionTypes"), list):
+            kind = "band"
+        elif page.get("renderedBy") or re.search(r"\.(astro|tsx|jsx|vue|svelte)$", str(page.get("source") or page.get("file") or path), re.I):
+            kind = "code-rendered"
+        else:
+            kind = "unknown"
+        records.append({"path": path, "kind": kind})
+        if kind not in allowed or kind == "unknown":
+            errors.append(f"{path}: cannot classify published page")
+    counts = dict(sorted(Counter(item["kind"] for item in records).items()))
+    return {"schemaVersion": INVENTORY_SCHEMA, "passed": not errors and len(records) == len(seen), "records": records, "counts": counts, "bandCount": counts.get("band", 0), "codeRenderedCount": counts.get("code-rendered", 0), "errors": errors, "disjoint": True}
+
+
+def _reference_values(references: object) -> dict[str, set[str]]:
+    source = references if isinstance(references, dict) else {}
+    result: dict[str, set[str]] = {}
+    for key, values in source.items():
+        entries = values if isinstance(values, list) else [values]
+        allowed: set[str] = set()
+        for item in entries:
+            if isinstance(item, dict):
+                for candidate in (item.get("id"), item.get("slug"), item.get("name"), item.get("title"), item.get("value")):
+                    if candidate is not None and str(candidate).strip():
+                        allowed.add(str(candidate).strip())
+            elif isinstance(item, (str, int)):
+                allowed.add(str(item).strip())
+        result[str(key).casefold()] = allowed
+    return result
+
+
+def validate_bindings(sections: object, references: object) -> dict[str, Any]:
+    allowed = _reference_values(references)
+    unresolved: list[dict[str, str]] = []
+    checked: list[dict[str, str]] = []
+    suffixes = ("id", "slug", "ref", "reference")
+    values = sections if isinstance(sections, list) else sections.get("sections", []) if isinstance(sections, dict) else []
+    for index, section in enumerate(values):
+        if not isinstance(section, dict):
+            continue
+        section_id = str(section.get("id") or index)
+        for key, value in section.items():
+            if not isinstance(value, (str, int)) or not str(value).strip():
+                continue
+            key_lower = str(key).casefold()
+            base = key_lower
+            for suffix in suffixes:
+                if base.endswith(suffix) and len(base) > len(suffix):
+                    base = base[: -len(suffix)]
+                    break
+            if base not in allowed:
+                continue
+            record = {"sectionId": section_id, "field": str(key), "value": str(value)}
+            checked.append(record)
+            if str(value) not in allowed[base]:
+                unresolved.append(record)
+        binding = section.get("binding")
+        if isinstance(binding, dict):
+            binding_type = str(binding.get("type") or "").casefold()
+            binding_value = binding.get("value", binding.get("slug", binding.get("id", binding.get("ref"))))
+            if binding_type and binding_value is not None and binding_type in allowed:
+                record = {"sectionId": section_id, "field": "binding", "value": str(binding_value)}
+                checked.append(record)
+                if str(binding_value) not in allowed[binding_type]:
+                    unresolved.append(record)
+    return {"schemaVersion": BINDING_SCHEMA, "passed": not unresolved, "checked": checked, "unresolved": unresolved, "referenceTypes": sorted(allowed)}
+
+
+def validate_reconcile_contract(contract: object) -> dict[str, Any]:
+    errors: list[str] = []
+    if not isinstance(contract, dict):
+        return {"schemaVersion": IDEMPOTENCY_SCHEMA, "passed": False, "errors": ["reconcile contract must be an object"]}
+    if contract.get("schemaVersion") not in {None, IDEMPOTENCY_SCHEMA}:
+        errors.append(f"schemaVersion must be {IDEMPOTENCY_SCHEMA}")
+    candidate = contract.get("candidateSelection") if isinstance(contract.get("candidateSelection"), dict) else {}
+    strategy = str(candidate.get("strategy") or "")
+    if strategy not in {"all-candidates", "all_rows", "all-rows"}:
+        errors.append("candidateSelection.strategy must select all candidates")
+    if candidate.get("filtersOnlyUnconverted") is True:
+        errors.append("candidate selection cannot filter only rows that look converted")
+    query = str(candidate.get("query") or "").casefold()
+    if query and re.search(r"(is\s+null|=\s*'?(empty|converted|none)|jsonb_array_length\s*\([^)]*\)\s*=\s*0)", query):
+        errors.append("candidate selection query looks limited to already-unconverted rows")
+    compare_fields = contract.get("compareFields")
+    if not isinstance(compare_fields, list) or not compare_fields:
+        errors.append("compareFields must list every repaired field")
+    if contract.get("writesOnlyWhenChanged") is not True:
+        errors.append("writesOnlyWhenChanged must be true")
+    report = contract.get("report") if isinstance(contract.get("report"), dict) else {}
+    for key in ("changed", "unchanged"):
+        if report.get(key) is not True:
+            errors.append(f"report.{key} evidence is required")
+    second = contract.get("secondRun") if isinstance(contract.get("secondRun"), dict) else {}
+    if second.get("convergent") is not True:
+        errors.append("secondRun.convergent must be true")
+    return {"schemaVersion": IDEMPOTENCY_SCHEMA, "passed": not errors, "errors": errors, "mutation": "not executed", "contract": {"candidateStrategy": strategy, "compareFields": compare_fields if isinstance(compare_fields, list) else [], "writesOnlyWhenChanged": contract.get("writesOnlyWhenChanged"), "report": report, "secondRun": second}}

package/bundled-tools/runtime/maggie_sections.py

@@ -193,31 +193,79 @@ def validate_values(registry: dict[str, Any], sections: object) -> dict[str, Any
     return {"passed": not errors, "errors": errors}
 
 
-def translation_key_paths(page_id: str, sections: object, field_names: tuple[str, ...] = ("imageAlt",)) -> list[str]:
-    """Find stored section fields that need a locale sidecar value."""
+def _registry_section_fields(registry: dict[str, Any] | None, section_type: str) -> list[dict[str, Any]]:
+    if not isinstance(registry, dict):
+        return []
+    for section in registry.get("sections", []):
+        if isinstance(section, dict) and str(section.get("type")) == section_type:
+            return [field for field in section.get("fields", []) if isinstance(field, dict)]
+    return []
+
+
+def _field_translatable(field: dict[str, Any]) -> bool:
+    """Return the explicit copy policy, defaulting to translatable for text."""
+    return field.get("translatable") is not False
+
+
+def translation_key_paths(page_id: str, sections: object, field_names: tuple[str, ...] | None = ("imageAlt",), registry: dict[str, Any] | None = None) -> list[str]:
+    """Find stored section fields that need a locale sidecar value.
+
+    Older callers can continue to pass ``field_names`` and receive the legacy
+    image-alt contract. New callers pass a registry, which makes every field
+    explicitly marked ``translatable`` part of the locale contract, including
+    repeated item fields.
+    """
     if not isinstance(sections, list):
         return []
     paths: list[str] = []
 
-    def walk(value: object, path: str) -> None:
+    def walk_legacy(value: object, path: str) -> None:
         if isinstance(value, dict):
             for key, child in value.items():
                 child_path = f"{path}.{key}"
-                if key in field_names and isinstance(child, str) and child.strip():
+                if field_names and key in field_names and isinstance(child, str) and child.strip():
                     paths.append(child_path)
-                walk(child, child_path)
+                walk_legacy(child, child_path)
         elif isinstance(value, list):
             for index, child in enumerate(value):
-                walk(child, f"{path}.{index}")
+                walk_legacy(child, f"{path}.{index}")
+
+    def walk_declared(value: object, fields: list[dict[str, Any]], path: str) -> None:
+        if not isinstance(value, dict):
+            return
+        for field in fields:
+            name = str(field.get("name") or "")
+            if not name:
+                continue
+            child = value.get(name)
+            child_path = f"{path}.{name}"
+            if _field_translatable(field) and isinstance(child, str) and child.strip():
+                paths.append(child_path)
+            repeats = field.get("repeats")
+            if not isinstance(repeats, dict) or not isinstance(child, list):
+                continue
+            nested = [item for item in repeats.get("of", []) if isinstance(item, dict)]
+            for index, item in enumerate(child):
+                item_path = f"{child_path}.{index}"
+                if isinstance(item, dict):
+                    walk_declared(item, nested, item_path)
+                elif len(nested) == 1 and _field_translatable(nested[0]) and isinstance(item, str) and item.strip():
+                    paths.append(item_path)
 
     for index, section in enumerate(sections):
-        walk(section, f"page.{page_id}.sections.{section_key(section, index)}")
+        path = f"page.{page_id}.sections.{section_key(section, index)}"
+        if registry and isinstance(section, dict):
+            declared = _registry_section_fields(registry, str(section.get("type") or ""))
+            if declared:
+                walk_declared(section, declared, path)
+                continue
+        walk_legacy(section, path)
     return paths
 
 
-def validate_locale_coverage(page_id: str, sections: object, translations: object, locales: Iterable[str]) -> dict[str, Any]:
+def validate_locale_coverage(page_id: str, sections: object, translations: object, locales: Iterable[str], registry: dict[str, Any] | None = None) -> dict[str, Any]:
     """Require non-default locale rows for every declared translatable field."""
-    paths = translation_key_paths(page_id, sections)
+    paths = translation_key_paths(page_id, sections, registry=registry)
     values = translations if isinstance(translations, dict) else {}
     missing = [{"locale": locale, "key": key} for locale in locales for key in paths if not isinstance(values.get(locale), dict) or not str(values[locale].get(key) or "").strip()]
     return {"schemaVersion": LOCALE_SCHEMA, "passed": not missing, "pageId": page_id, "requiredKeys": paths, "missing": missing, "writePolicy": "section row and locale rows must be committed in one transaction"}
@@ -309,12 +357,64 @@ def validate_fanout(registry: dict[str, Any], fanout: object) -> dict[str, Any]:
     types = {str(item.get("type")) for item in registry.get("sections", []) if isinstance(item, dict)}
     surfaces = ("typeUnion", "sectionSchema", "blank", "validation", "textExtraction", "renderer", "editor")
     missing: list[dict[str, str]] = []
+
+    def field_paths(section: dict[str, Any]) -> set[str]:
+        result: set[str] = set()
+        for field in section.get("fields", []):
+            if not isinstance(field, dict) or not field.get("name"):
+                continue
+            name = str(field["name"])
+            result.add(name)
+            repeats = field.get("repeats")
+            if isinstance(repeats, dict):
+                for nested in repeats.get("of", []):
+                    if isinstance(nested, dict) and nested.get("name"):
+                        result.add(f"{name}.{nested['name']}")
+        return result
+
+    required_fields = {
+        str(section.get("type")): field_paths(section)
+        for section in registry.get("sections", [])
+        if isinstance(section, dict) and section.get("type")
+    }
+
+    def declared(values: object) -> tuple[set[str], dict[str, set[str]]]:
+        if isinstance(values, list):
+            return set(map(str, values)), {}
+        if not isinstance(values, dict):
+            return set(), {}
+        types = set(map(str, values.keys()))
+        fields: dict[str, set[str]] = {}
+        for section_type, entry in values.items():
+            if isinstance(entry, list):
+                fields[str(section_type)] = set(map(str, entry))
+            elif isinstance(entry, dict):
+                candidate = entry.get("fields", [])
+                if isinstance(candidate, list):
+                    fields[str(section_type)] = set(map(str, candidate))
+        return types, fields
+
     for surface in surfaces:
         values = fanout.get(surface)
-        declared = set(values) if isinstance(values, list) else set(values.keys()) if isinstance(values, dict) else set()
-        for section_type in sorted(types - declared):
+        declared_types, declared_fields = declared(values)
+        for section_type in sorted(types - declared_types):
             missing.append({"type": section_type, "surface": surface})
-    return {"schemaVersion": FANOUT_SCHEMA, "passed": not missing, "errors": [f"{item['type']} missing {item['surface']} fan-out" for item in missing], "sectionTypes": sorted(types), "missing": missing}
+        for section_type in sorted(types & declared_types):
+            for field in sorted(required_fields.get(section_type, set()) - declared_fields.get(section_type, set())):
+                missing.append({"type": section_type, "surface": f"{surface}.{field}"})
+
+    editor_screens = fanout.get("editorScreens")
+    if not isinstance(editor_screens, dict) or len(editor_screens) < 2:
+        missing.append({"type": "editor", "surface": "editorScreens (at least two screens required)"})
+    elif isinstance(editor_screens, dict):
+        for screen, values in editor_screens.items():
+            screen_types, screen_fields = declared(values)
+            for section_type in sorted(types - screen_types):
+                missing.append({"type": section_type, "surface": f"editorScreens.{screen}"})
+            for section_type in sorted(types & screen_types):
+                for field in sorted(required_fields.get(section_type, set()) - screen_fields.get(section_type, set())):
+                    missing.append({"type": section_type, "surface": f"editorScreens.{screen}.{field}"})
+    return {"schemaVersion": FANOUT_SCHEMA, "passed": not missing, "errors": [f"{item['type']} missing {item['surface']} fan-out" for item in missing], "sectionTypes": sorted(types), "missing": missing, "fieldAware": True, "editorScreenCount": len(editor_screens) if isinstance(editor_screens, dict) else 0}
 
 
 def reconcile_fields(current: object, desired: object) -> dict[str, Any]:

package/bundled-tools/runtime/maggie_sitemap.py

@@ -14,6 +14,7 @@ HARD_URL_LIMIT = 50_000
 HARD_BYTES_LIMIT = 52_428_800
 DEFAULT_CHUNK_TARGET = 500
 EXCLUDED_PATHS = re.compile(r"/(search|find|login|draft|preview)(/|$)", re.I)
+W3C_UTC_DATETIME = re.compile(r"^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$")
 
 
 def absolute_url(url: str, origin: str) -> bool:
@@ -121,7 +122,7 @@ def build_plan(routes: list[dict[str, str]], origin: str, content_types: set[str
     current = set(sitemap_urls)
     old = set((previous or {}).get("sitemapUrls", []))
     redirects = [{"from": url, "to": origin.rstrip("/") + "/sitemap.xml", "reason": "previously advertised sitemap removed"} for url in sorted(old - current)]
-    plan = {"schemaVersion": "maggie-seo-sitemap-plan.v1", "planId": "sitemap-" + datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S"), "origin": origin.rstrip("/"), "groups": group_plans, "index": {"url": origin.rstrip("/") + "/sitemap.xml", "bytes": len(index_xml.encode()), "xml": index_xml, "sitemapUrls": sitemap_urls, "responseHeaders": {"content-type": "text/xml; charset=utf-8", "x-robots-tag": "all"}}, "redirects": redirects, "excluded": excluded}
+    plan = {"schemaVersion": "maggie-seo-sitemap-plan.v1", "planId": "sitemap-" + datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S"), "origin": origin.rstrip("/"), "groups": group_plans, "index": {"url": origin.rstrip("/") + "/sitemap.xml", "bytes": len(index_xml.encode()), "xml": index_xml, "sitemapUrls": sitemap_urls, "responseHeaders": {"content-type": "text/xml; charset=utf-8", "x-robots-tag": "noindex"}}, "redirects": redirects, "excluded": excluded}
     plan["validation"] = validate_plan_data(plan)
     return plan
 
@@ -163,9 +164,16 @@ def validate_plan_data(plan: dict, strict_semantic: bool = False) -> dict:
                 for link in root.iter():
                     if link.tag.endswith("link") and link.get("rel") == "alternate" and not absolute_url(link.get("href", ""), origin):
                         errors.append(f"chunk contains a relative or off-origin alternate: {chunk.get('filename')}")
+                    if link.tag.endswith("lastmod") and not W3C_UTC_DATETIME.fullmatch((link.text or "").strip()):
+                        errors.append(f"lastmod must be a full W3C UTC datetime: {chunk.get('filename')}")
             except ElementTree.ParseError:
                 errors.append(f"chunk is not valid XML: {chunk.get('filename')}")
     index = plan.get("index", {})
+    headers = index.get("responseHeaders") if isinstance(index.get("responseHeaders"), dict) else {}
+    if headers.get("content-type") != "text/xml; charset=utf-8":
+        errors.append("sitemap response content-type must be text/xml; charset=utf-8")
+    if str(headers.get("x-robots-tag") or "").casefold() != "noindex":
+        errors.append("sitemap response x-robots-tag must be noindex")
     if index.get("bytes", 0) > HARD_BYTES_LIMIT:
         errors.append("sitemap index exceeds byte limit")
     try:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.7.12",
+  "version": "0.7.13",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",