@topy-ai/maggie 0.7.12 → 0.7.14

package/README.md

@@ -58,7 +58,23 @@ Then invoke the installed skills from your coding agent, for example:
 
 Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
-package ships 18 installable skills and a local-first MaggieDash foundation.
+package ships 19 installable skills and a local-first MaggieDash foundation.
+
+For repeatable browser QA, create a project-owned scenario manifest and record
+the test, fix, and retest lifecycle:
+
+```bash
+maggie qa start --project . \
+  --scenario-file .maggie/scenario-manifest.json \
+  --environment local --base-url http://localhost:4321
+maggie qa record --project . --run <run-id> \
+  --scenario HOME-001 --phase test --status pass \
+  --summary "Homepage smoke passed" --evidence .maggie/qa/home.png
+maggie qa summary --project . --run <run-id>
+```
+
+The QA workflow stores secret-free run state under `.maggie/qa-runs/` and
+keeps project-specific scenarios and evidence outside the npm package.
 
 For Google integrations, validate a redacted provider matrix before reporting
 access. The command fails closed on unknown scopes, missing Ads prerequisites,
@@ -104,7 +120,8 @@ maggie bootstrap interview | phase ...
 maggie dash install | init | status | migrate | cms ...
 maggie dash transition ...      # explicit content approval transition
 maggie dash variant ...         # service variant create/review/preview/publish
-maggie dash sections ...        # validate/catalogue/identity keys
+maggie dash sections ...        # field fan-out, locale, binding, media, copy, identity keys
+maggie dash inventory ...        # disjoint published-page inventory
 maggie agent-content write ...  # host-authorized, origin-bound content bridge
 maggie verification coverage ... # changed surface/locale evidence gate
 maggie clone ...                 # authorized homepage capture
@@ -113,12 +130,14 @@ maggie clone-to-template ...     # URL → validated marketplace template
 maggie marketplace ...           # catalog and on-demand template workflow
 maggie memory ...                # confirmed preferences and lessons
 maggie feedback ...              # redact, preview, submit, list
+maggie qa ...                    # scenario browser QA, fix/retest, release gate
 maggie localization ...          # plan, validate, review, publish, stale
 maggie service ...               # import, sync, generate, validate
 maggie seo performance ...       # sampled PageSpeed/CWV report and baseline
 maggie seo images ...             # inventory, variants, confirmation, validate
 maggie seo sitemap ...            # typed/semantic plan, agent-files, apply, rollback
 maggie deployment | migration | release | analytics | schedule
+maggie migration identity --identity-file FILE [--expected-file FILE]
 maggie deployment canary --asset URL=SHA256 --render-report report.json
 maggie design icon-inventory --source-dir src --runtime assets/icons.css
 maggie api lifecycle | site-audit | ops audit
@@ -218,8 +237,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.12 update --project . --force
-npx @topy-ai/maggie@0.7.12 cleanup --project .
+npx @topy-ai/maggie@0.7.14 update --project . --force
+npx @topy-ai/maggie@0.7.14 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -229,7 +248,14 @@ as a command-line argument:
 node scripts/publish-npm.mjs --maggie-env-file ../.env
 ```
 
-The 0.7.12 workflow adds served-content equivalence checks, query-route
+The 0.7.14 workflow adds the general `maggie-qa-workflow` skill and `maggie qa`
+CLI for scenario manifests, secret-free browser evidence metadata, test/fix/
+retest lifecycle, adjacent regression checks, and explicit release gates. The
+0.7.13 workflow adds field-aware section fan-out and locale coverage,
+sibling-copy/media checks, disjoint page inventory, binding validation,
+idempotency and database-target identity gates, full W3C sitemap lastmod
+validation, and the accepted `X-Robots-Tag: noindex` response contract. The
+0.7.12 workflow adds served-content equivalence checks, query-route
 baseline exclusions, changed-surface render evidence gates, generated skill
 catalogs, component-binding audits, and icon-family noise filtering. It also
 includes the 0.7.9 nested section-field contracts, renderer-backed examples,
@@ -478,6 +504,7 @@ python3 tools/clis/maggie_design.py rebrand \
 | `maggie-memory` | Persist confirmed preferences, conventions, lessons, and errors |
 | `maggie-content-localization` | Manage locale-aware translation, review, provenance, stale state, and publication gates |
 | `maggie-feedback` | Collect redacted feedback drafts and explicitly submit them to the NoBlox feedback endpoint |
+| `maggie-qa-workflow` | Run scenario-based browser QA with evidence, fix/retest lifecycle, and release gates |
 | `maggie-auth-reference` | Generate and validate traditional email/password auth with secure server-side sessions |
 | `maggie-blog` | Run a provider-neutral blog lifecycle with stable identity, topics, feeds, settings, and rollback |
 
@@ -514,16 +541,21 @@ maggie design section-validate --before before.json --after after.json \
 ```
 
 MaggieDash section contracts include a compact `pairs` band for factual
-label/value rows. Validate required values, registry fan-out, locale sidecars,
-and idempotent repairs with `maggie dash sections validate`,
-`fanout-validate`, `locale-validate`, and `reconcile`.
-
-The package includes all 18 installable skills: `maggie-blog-bootstrap`,
+label/value rows. Validate required values, field-aware registry fan-out,
+all locale copy fields, sibling copy/media, stored bindings, and idempotent
+repairs with `maggie dash sections validate`, `fanout-validate`,
+`locale-validate`, `variant-copy-validate`, `media-validate`,
+`bindings-validate`, `idempotency-validate`, and `reconcile`. Use
+`maggie dash inventory` to classify published pages once into disjoint kinds.
+See the [quality contract examples](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/contracts/maggiedash/quality-contracts.md).
+
+The package includes all 19 installable skills: `maggie-blog-bootstrap`,
 `maggie-dash`, `maggie-clone`, `maggie-clone-to-template`, `maggie-marketplace`,
 `maggie-template`, `maggie-design`, `maggie-ops`, `maggie-deployment`,
 `maggie-project-context`, `maggie-seo-geo`, `maggie-social-share`,
 `maggie-service-booking`, `maggie-memory`, `maggie-content-localization`,
-`maggie-feedback`, `maggie-auth-reference`, and `maggie-blog`. Use the stable
+`maggie-feedback`, `maggie-qa-workflow`, `maggie-auth-reference`, and
+`maggie-blog`. Use the stable
 commands below after installation:
 
 ```bash

package/README.zh-TW.md

@@ -2,13 +2,13 @@
 
 [English README](README.md) · [完整繁體中文 README](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/README.zh-TW.md)
 
-`@topy-ai/maggie` 提供 18 個可安裝的 AI website workflow skills，支援
+`@topy-ai/maggie` 提供 19 個可安裝的 AI website workflow skills，支援
 Codex、Claude Code 與相容的 coding agents。
 
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.8 init --agent all
+npx @topy-ai/maggie@0.7.14 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 
@@ -39,8 +39,24 @@ maggie deployment canary --project . \
   --asset https://example.com/assets/app.js=<sha256> \
   --render-report .maggie/rendered-canary.json \
   --output docs/deployment-canary.json
+
+# MaggieDash section/page quality contracts
+maggie dash sections fanout-validate --registry templates/maggiedash/section-registry.json \
+  --fanout-file templates/maggiedash/section-fanout.json
+maggie dash sections variant-copy-validate --pages-file .maggie/variant-pages.json
+maggie dash sections media-validate --pages-file .maggie/variant-pages.json --across-siblings
+maggie dash inventory --pages-file .maggie/published-pages.json
+
+# Migration target identity (never prints or stores a database URL)
+maggie migration identity --identity-file .maggie/db-identity.json \
+  --expected-file .maggie/service-db-identity.json
+
+# Scenario browser QA
+maggie qa start --project . --scenario-file .maggie/scenario-manifest.json \
+  --environment local --base-url http://localhost:4321
+maggie qa summary --project . --run <run-id>
 ```
 
-完整中文說明、18 個 skills 清單和 roadmap：
+完整中文說明、19 個 skills 清單和 roadmap：
 [繁體中文 README](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/README.zh-TW.md)
 · [Roadmap](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/ROADMAP.md)

package/bin/maggie.js

@@ -58,7 +58,8 @@ Usage:
   maggie doctor [--project PATH]
   maggie bootstrap interview [project]
   maggie dash init|install|status|migrate|transition|variant|cms --project PATH [options]
-  maggie dash sections <validate|prompt|keys|remap-translations|fanout-validate|locale-validate|reconcile> [options]
+  maggie dash sections <validate|prompt|keys|remap-translations|fanout-validate|locale-validate|variant-copy-validate|media-validate|bindings-validate|idempotency-validate|reconcile> [options]
+  maggie dash inventory --pages-file FILE
   maggie dash components-audit --bindings-file FILE --sections-file FILE --pages-file FILE
   maggie dash status --project PATH
   maggie dash migrate --project PATH --confirm
@@ -104,6 +105,7 @@ Usage:
   maggie deployment --project PATH --target vps-with-cloudflare-dns
   maggie deployment canary --project PATH --asset URL=SHA256 --render-report report.json --output docs/deployment-canary.json
   maggie migration --project PATH --environment staging
+  maggie migration identity --identity-file FILE [--expected-file FILE]
   maggie schedule PATH/.maggie/schedule.json --project PATH
   maggie analytics [traffic-audit|release-gate] --project PATH --environment staging
   maggie release PATH --environment staging --target vps-with-cloudflare-dns
@@ -112,6 +114,7 @@ Usage:
   maggie localization <extract|plan|generate|preview|validate|review|publish|stale|glossary> [options]
   maggie seo performance|images|sitemap [options] (sitemap supports strict validate and agent-files)
   maggie feedback <collect|preview|submit|list> [options]
+  maggie qa <start|record|summary|export> [options]
   maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
   maggie site-audit URL --crawl --baseline FILE
@@ -404,6 +407,7 @@ try {
   else if (command === "memory") workflowCli("maggie_memory.py", args);
   else if (command === "localization") workflowCli("maggie_localization.py", args);
   else if (command === "feedback") workflowCli("maggie_feedback.py", args);
+  else if (command === "qa") workflowCli("maggie_qa_workflow.py", args);
   else if (command === "site-audit") workflowCli("site_audit.py", args);
   else if (command === "browser-audit") workflowCli("maggie_browser_audit.py", args);
   else if (command === "verification") workflowCli("maggie_verification.py", args);

package/bundled-contracts/maggiedash/README.md

@@ -24,6 +24,9 @@ frontend framework.
   for translation keys and ordered migration;
 - [`translation-cache-policy-v1.json`](translation-cache-policy-v1.json):
   restart-after-out-of-band-write evidence.
+- [`quality-contracts.md`](quality-contracts.md): reviewable inputs for
+  disjoint page inventory, variant/media checks, binding resolution, repair
+  convergence, and database target identity.
 
 The section registry is an adapter input rather than a fixed six-band list.
 Each registry entry must describe its purpose and limits, include a

package/bundled-contracts/maggiedash/quality-contracts.md

@@ -0,0 +1,58 @@
+# MaggieDash quality contracts
+
+These inputs are reviewable JSON evidence. They do not write a database or
+publish content.
+
+## Page inventory
+
+```json
+{
+  "pages": [
+    {"path": "/", "sections": [{"type": "hero"}]},
+    {"path": "/about", "source": "src/pages/about.astro"}
+  ]
+}
+```
+
+Run `maggie dash inventory --pages-file .maggie/published-pages.json`. The
+result assigns each path exactly one kind and reports `bandCount` and
+`codeRenderedCount`; unknown or duplicate paths fail.
+
+## Variant and media checks
+
+Variant pages should provide `id`, `family`, `locale`, and either a `sections`
+array or direct fields. Run `variant-copy-validate` with one or more copy field
+names (the default is `faq`). Run `media-validate` for page duplicates and add
+`--across-siblings` to catch shared media in one variant family.
+
+## Bindings
+
+The sections file may contain a `binding` object or fields such as
+`categorySlug`, `collectionId`, or `serviceRef`. The references file maps each
+type to IDs, slugs, names, or values. `bindings-validate` fails when a stored
+reference cannot be resolved.
+
+## Repair idempotency
+
+```json
+{
+  "schemaVersion": "maggie-reconcile-contract.v1",
+  "candidateSelection": {"strategy": "all-candidates", "query": "SELECT all repair candidates"},
+  "compareFields": ["sections", "translations"],
+  "writesOnlyWhenChanged": true,
+  "report": {"changed": true, "unchanged": true},
+  "secondRun": {"convergent": true}
+}
+```
+
+`idempotency-validate` rejects a selection that only targets rows that look
+unconverted. The actual adapter must still use a transaction and report its
+real changed/unchanged counts.
+
+## Database identity
+
+`maggie migration identity` accepts a `maggie-database-identity.v1` report with
+environment, target/database name, server identity, service release identity,
+row counts, and a matching SHA-256 fingerprint. It can compare a second
+service-owned report. Reports must never contain a database URL, password, or
+credential.

package/bundled-skills/README.md

@@ -20,6 +20,7 @@ Skills are the agent-facing workflows. They compose with the tools in
 | `maggie-memory` | Persist confirmed preferences, project conventions, lessons, and error history across skill runs | local `.maggie/memory/` state |
 | `maggie-content-localization` | Plan, validate, review, publish, and age localized content with market, locale, provenance, and translation safeguards | localization contract, locale CLI |
 | `maggie-feedback` | Collect, redact, review, and explicitly submit feedback from skill runs | feedback CLI, hosted endpoint, GitHub Issue Forms |
+| `maggie-qa-workflow` | Run scenario-based browser QA with evidence, fix/retest lifecycle, and release gates | browser adapter, QA workflow CLI, scenario manifest |
 
 Read only the selected skill and its linked references for a task. Do not load
 all skills as one undifferentiated prompt.

package/bundled-skills/catalog.json

@@ -58,6 +58,10 @@
       "name": "maggie-project-context",
       "description": "Sync a site's safe AI CMO Project, selected brand voice, site settings, and CTA context into a local generated context file. Use when connecting a vibe-coded blog or existing website to AI CMO, refreshing brand context, or diagnosing missing CTA/project data."
     },
+    {
+      "name": "maggie-qa-workflow",
+      "description": "Run scenario-based browser QA with explicit evidence, fix/retest lifecycle, and release-gate decisions for web projects."
+    },
     {
       "name": "maggie-seo-geo",
       "description": "Plan, audit, create, rewrite, and measure content for AI CMO's paid SEO and GEO workflow. Use for topic opportunities, AI visibility, technical SEO, extractable article structure, sitemap-based rewrites, GSC readback, or SEO/GEO client reports."

package/bundled-skills/maggie-dash/SKILL.md

@@ -182,15 +182,26 @@ maggie dash sections remap-translations \
   --mapping-file .maggie/section-translation-map.json \
   --output .maggie/translations-v2.json --confirm
 
-# Validate locale sidecars for stored image alt text before publishing:
+# Validate every registry-declared translatable field for every locale before publishing:
 maggie dash sections locale-validate \
   --page-id <page-id> --sections-file .maggie/sections.json \
-  --translations-file .maggie/translations-by-locale.json --locale zh-Hant
+  --translations-file .maggie/translations-by-locale.json \
+  --registry templates/maggiedash/section-registry.json --locale zh-Hant
 
 # Check that a host wired every registry type through all implementation surfaces:
 maggie dash sections fanout-validate \
   --registry templates/maggiedash/section-registry.json \
   --fanout-file templates/maggiedash/section-fanout.json
+
+# Validate sibling copy, media uniqueness, references, and repair convergence:
+maggie dash sections variant-copy-validate --pages-file .maggie/variant-pages.json --field faq
+maggie dash sections media-validate --pages-file .maggie/variant-pages.json --across-siblings
+maggie dash sections bindings-validate --sections-file .maggie/sections.json \
+  --references-file .maggie/reference-inventory.json
+maggie dash sections idempotency-validate --contract-file .maggie/reconcile-contract.json
+
+# Classify every published page exactly once:
+maggie dash inventory --pages-file .maggie/published-pages.json
 ```
 
 The catalogue declares purpose, usage, placement, repeatability and layout
@@ -211,10 +222,13 @@ as a fixed number of bands.
 Required fields and repeated `pairs` values cannot be blank. The `pairs`
 starter band is intended for compact label/value facts such as opening hours;
 it is not a prose fallback. The registry fan-out manifest is a host integration
-contract: when a host adds a type, update its type union/schema, blank state,
-validation, readable-content extraction, renderer, and editor entry together,
-then run `fanout-validate`. `locale-validate` checks stored image-alt sidecars;
-the host adapter must write the section and all non-default locale rows in one
+contract: when a host adds a type or field, update its type union/schema, blank
+state, validation, readable-content extraction, renderer, and editor entry
+together, then run `fanout-validate`. The check is field-aware and requires two
+editor screens, so adding a field without wiring both editing surfaces fails
+closed. `locale-validate --registry` checks every declared translatable scalar
+and repeated item field; URLs and media sources can be marked non-translatable.
+The host adapter must write the section and all non-default locale rows in one
 transaction. The JSON report is evidence, not a database write.
 
 Translation keys use stable section IDs, with an array-index fallback only
@@ -233,8 +247,17 @@ is the reviewable output form, not a substitute for the adapter's transaction.
 Keep data-owned values out of page copy. For example, a pricing band should
 store a service identifier or slug and let the live service/booking adapter
 render current options and prices. Inventory reports must classify each
-published page once into disjoint groups; price options, arrangements, and
-other child records are counts, not pages.
+published page once into disjoint groups; `maggie dash inventory` reports band
+and code-rendered counts. Price options, arrangements, and other child records
+are counts, not pages. Run the variant-copy and media checks before publishing
+localized sibling pages, and the bindings check whenever a section stores a
+category, collection, or service reference; an unresolved binding is a publish
+failure, not an empty state.
+
+Repair scripts must select all candidates, compare every target field, write
+only changed rows, and report both changed and unchanged rows. Validate that
+contract with `idempotency-validate`; a query that selects only rows that look
+unconverted cannot repair its own bad output.
 
 After any script or direct adapter write to translation data, invalidate the
 running process before verification. Record the restart and run the rendering

package/bundled-skills/maggie-deployment/SKILL.md

@@ -111,6 +111,21 @@ The manifest must reference `DATABASE_URL` (not a literal URL), declare an
 advancing version, forward-only/idempotent policy, backup and restore commands,
 and a tested restore artifact. The validator never runs those commands.
 
+Before a write, prove that the migration target is the database used by the
+running service. The identity report is intentionally secret-free and includes
+the environment, target/database name, server identity, service release
+identity, row counts, and a SHA-256 fingerprint. Compare it with the deployment
+identity when available:
+
+```bash
+maggie migration identity --identity-file .maggie/db-identity.json \
+  --expected-file .maggie/service-db-identity.json
+```
+
+The gate fails on a missing or mismatched target identity and never executes a
+migration. A successful connection alone is not proof that the intended
+database was selected.
+
 If a release depends on existing rows or seeded data, set
 `dataDependencies: true` in `.maggie/migration-manifest.json` and provide
 `.maggie/deployment/data-release.json` before deployment. The checkpoint must

package/bundled-skills/maggie-qa-workflow/SKILL.md

@@ -0,0 +1,102 @@
+---
+name: maggie-qa-workflow
+description: Run scenario-based browser QA with explicit evidence, fix/retest lifecycle, and release-gate decisions for web projects.
+metadata:
+  version: 1.0.0
+---
+
+# Maggie QA Workflow
+
+Use this skill when a web project needs repeatable user-scenario testing that
+connects browser evidence to a fix, a same-scenario retest, adjacent regression
+checks, and an explicit Pass/Blocked/Fail release decision. It is framework
+neutral and does not replace the project's browser-control or test tools.
+Follow the shared [memory hook](../../references/memory-hook.md) before and
+after the run; memory and feedback remain bounded by the privacy rules below.
+
+## Prepare a scenario manifest
+
+Create `.maggie/scenario-manifest.json` or pass another JSON file with a
+non-empty `scenarios` array. Each scenario needs a unique `id`; useful fields
+include `title`, `group`, `priority`, `routes`, `persona`, `auth`, `browser`,
+and `viewport`. Keep project-specific scenarios in the project; do not ship
+them in the Maggie package.
+
+## Start and record a run
+
+The CLI stores only secret-free run state under `.maggie/qa-runs/`. Screenshots
+and logs stay in the project and are represented by relative paths and hashes.
+Use a real browser adapter for visible interaction, computed layout,
+console/network evidence, final URLs, and response status:
+
+```bash
+maggie qa start --project . \
+  --scenario-file .maggie/scenario-manifest.json \
+  --run-id local-qa-001 --environment local \
+  --base-url http://localhost:4321 --browser chrome \
+  --commit "$(git rev-parse --short HEAD)"
+
+maggie qa record --project . --run local-qa-001 \
+  --scenario HOME-001 --phase test --status pass \
+  --summary "Homepage navigation and consent passed" \
+  --evidence .maggie/qa-runs/local-qa-001/home.png
+```
+
+For a failure, record expected behavior, actual behavior, and a stable error
+fingerprint. A failed scenario cannot be silently changed to Pass:
+
+```bash
+maggie qa record --project . --run local-qa-001 \
+  --scenario SEARCH-001 --phase test --status fail \
+  --summary "Search dialog did not open" \
+  --expected "Selecting a result opens its detail page" \
+  --actual "The click leaves the dialog open" \
+  --error-fingerprint search-dialog-click-stale \
+  --evidence .maggie/qa-runs/local-qa-001/search-console.txt
+
+maggie qa record --project . --run local-qa-001 \
+  --scenario SEARCH-001 --phase fix \
+  --resolution "Guarded the dialog transition after the selected result is resolved" \
+  --validation "focused browser check and project build passed"
+
+maggie qa record --project . --run local-qa-001 \
+  --scenario SEARCH-001 --phase retest --status pass \
+  --summary "Search result opens the detail page" \
+  --evidence .maggie/qa-runs/local-qa-001/search-retest.png
+```
+
+`fix` must follow a recorded failure. `retest` must follow a test and, when
+the test failed, a fix. After a fix, retest the original scenario and at least
+one adjacent scenario affected by the same surface.
+
+## Gate and release evidence
+
+The run gate is `fail` when any scenario fails, `blocked` when there is no
+failure but pending/blocked/inconclusive scenarios remain, and `pass` only
+when every scenario passes. Missing credentials, unsafe fixtures, a real
+mobile viewport, a payment sandbox, or a fault-injection environment are
+explicit blockers; never guess around them.
+
+```bash
+maggie qa summary --project . --run local-qa-001
+maggie qa summary --project . --run local-qa-001 --format markdown
+maggie qa export --project . --run local-qa-001 \
+  --output docs/qa-runs/local-qa-001.md
+```
+
+Before calling a release Pass, also run the relevant build, accessibility,
+SEO, media, API, and deployment-canary checks. A green build, HTTP 200, source
+class, or one guest smoke is not browser QA evidence.
+
+## Privacy and feedback
+
+Do not put passwords, tokens, cookies, full private URLs, personal data,
+provider response bodies, or secrets in run state, screenshots, or exported
+reports. When the same workflow defect is reusable across projects, create a
+privacy-safe draft through `maggie-feedback`; submitting it remains an explicit
+user-confirmed action. Do not promote a project-specific preference directly
+to active memory.
+
+The implementation is `tools/clis/maggie_qa_workflow.py`; it is intentionally
+small enough to run without a browser dependency and delegates browser
+interaction to the host agent/browser capability.

package/bundled-skills/maggie-seo-geo/SKILL.md

@@ -62,7 +62,7 @@ advertising it are separate decisions.
 Generated sitemap XML uses the conventional readable shape by default: one
 `<url>`/`<sitemap>` entry per block, UTF-8 XML, and date-only `lastmod` evidence
 rendered as a full UTC W3C datetime. The plan also exposes the response
-contract (`text/xml; charset=utf-8` and `X-Robots-Tag: all`) for the framework
+contract (`text/xml; charset=utf-8` and `X-Robots-Tag: noindex`) for the framework
 route or reverse proxy to apply; writing a file cannot set HTTP headers itself.
 When Search Console reports a valid sitemap as unfetched, probe success alone
 is not a diagnosis. Supply a sanitized local access log to distinguish

package/bundled-templates/maggiedash/section-fanout.json

@@ -1,11 +1,87 @@
 {
   "schemaVersion": "maggiedash-section-fanout.v1",
-  "description": "Starter host contract: every registry type must be wired through each implementation surface. Hosts extending the registry must regenerate this file.",
-  "typeUnion": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
-  "sectionSchema": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
-  "blank": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
-  "validation": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
-  "textExtraction": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
-  "renderer": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
-  "editor": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"]
+  "description": "Field-aware host contract: every registry type and declared field must be wired through each implementation surface and two editor screens.",
+  "typeUnion": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "sectionSchema": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "blank": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "validation": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "textExtraction": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "renderer": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "editor": {
+    "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+    "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+    "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+    "cards": ["heading", "items", "items.title", "items.body"],
+    "links": ["heading", "items", "items.label", "items.href", "items.body"],
+    "faq": ["heading", "items", "items.question", "items.answer"],
+    "cta": ["heading", "body", "label"]
+  },
+  "editorScreens": {
+    "section-editor": {
+      "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+      "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+      "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+      "cards": ["heading", "items", "items.title", "items.body"],
+      "links": ["heading", "items", "items.label", "items.href", "items.body"],
+      "faq": ["heading", "items", "items.question", "items.answer"],
+      "cta": ["heading", "body", "label"]
+    },
+    "document-detail": {
+      "hero": ["title", "intro", "image", "imageAlt", "ctaLabel"],
+      "prose": ["heading", "paragraphs", "paragraphs.paragraph", "image", "imageAlt"],
+      "pairs": ["heading", "rows", "rows.label", "rows.value", "note"],
+      "cards": ["heading", "items", "items.title", "items.body"],
+      "links": ["heading", "items", "items.label", "items.href", "items.body"],
+      "faq": ["heading", "items", "items.question", "items.answer"],
+      "cta": ["heading", "body", "label"]
+    }
+  }
 }

package/bundled-templates/maggiedash/section-registry.json

@@ -13,7 +13,7 @@
       "fields": [
         {"name": "title", "usage": "Plain words a visitor would search for.", "limit": 70, "required": true},
         {"name": "intro", "usage": "Who it is for and what it does.", "limit": 220},
-        {"name": "image", "usage": "The hero image rendered beside or behind the copy.", "limit": 500},
+        {"name": "image", "usage": "The hero image rendered beside or behind the copy.", "limit": 500, "translatable": false},
         {"name": "imageAlt", "usage": "What the hero image shows for a reader who cannot see it.", "limit": 160},
         {"name": "ctaLabel", "usage": "The action as a verb.", "limit": 30}
       ],
@@ -28,7 +28,7 @@
       "fields": [
         {"name": "heading", "usage": "The argument in a sentence.", "limit": 90},
         {"name": "paragraphs", "usage": "Standalone paragraphs.", "limit": 0, "repeats": {"min": 1, "max": 4, "of": [{"name": "paragraph", "usage": "One paragraph of plain prose.", "limit": 400}]}},
-        {"name": "image", "usage": "An optional supporting image.", "limit": 500},
+        {"name": "image", "usage": "An optional supporting image.", "limit": 500, "translatable": false},
         {"name": "imageAlt", "usage": "What the supporting image shows.", "limit": 160}
       ],
       "example": {"type": "prose", "heading": "Make the important part easier to understand", "paragraphs": ["Start with the decision your reader is trying to make.", "Then give them the context, evidence and next step in that order."]}
@@ -66,7 +66,7 @@
       "repeatable": true,
       "fields": [
         {"name": "heading", "usage": "What the links have in common.", "limit": 90},
-        {"name": "items", "usage": "Real related pages on this site.", "limit": 0, "repeats": {"min": 2, "max": 6, "of": [{"name": "label", "usage": "The destination page name.", "limit": 60, "required": true}, {"name": "href", "usage": "A real path on this site.", "limit": 200, "required": true}, {"name": "body", "usage": "One sentence on what is there.", "limit": 160}]}}
+        {"name": "items", "usage": "Real related pages on this site.", "limit": 0, "repeats": {"min": 2, "max": 6, "of": [{"name": "label", "usage": "The destination page name.", "limit": 60, "required": true}, {"name": "href", "usage": "A real path on this site.", "limit": 200, "required": true, "translatable": false}, {"name": "body", "usage": "One sentence on what is there.", "limit": 160}]}}
       ],
       "example": {"type": "links", "heading": "Keep exploring", "items": [{"label": "How it works", "href": "/how-it-works/", "body": "See the process from start to finish."}, {"label": "Frequently asked questions", "href": "/faq/", "body": "Find concise answers to common questions."}]}
     },