@topy-ai/maggie 0.7.16 → 0.7.18

package/README.md

@@ -80,9 +80,30 @@ The current package also includes reusable safeguards from the latest feedback
 review: `maggie dash api-contract` checks declared request and 2xx response
 shapes; `maggie blog check-gate`/`approve` enforces review before publish;
 sitemap validation flags suspiciously uniform `lastmod` dates; `maggie seo
-indexnow` plans only changed same-origin URLs and holds back URLs accepted in
-the last 24 hours; and dash inventory separates renderer kind from public page
-kind while reporting source coverage for code-rendered routes.
+indexnow` plans only changed same-origin URLs, verifies the deployed key route
+with an optional negative control, and holds back URLs accepted in the last 24
+hours. `maggie seo social-cards` checks per-page OG image dimensions and format;
+`maggie seo head-tags` reports metadata drift across rendered shells;
+`maggie ops favicon-check` verifies the served `/favicon.ico` and declared icon.
+Dash inventory separates renderer kind from public page kind while reporting
+source coverage for code-rendered routes.
+
+Service booking providers can be checked with a machine-readable,
+fixture-backed capability matrix:
+
+```bash
+maggie service capability-audit --project . \
+  --catalogue .maggie/booking/services.json \
+  --capabilities-file .maggie/booking/provider-capabilities.json \
+  --fixture .maggie/booking/fixtures/provider.json
+```
+
+The declaration records variant mode (`native`, `derived-offers`,
+`single-fallback`, or `blocked`), price semantics, and stable-ID confidence.
+The audit also records observed counts and fixture evidence. Localized service
+variants use market/locale-aware canonical routes and reciprocal hreflang.
+Release preflight consumes the latest matching scenario QA run when one is
+configured and blocks incomplete evidence.
 
 For Google integrations, validate a redacted provider matrix before reporting
 access. The command fails closed on unknown scopes, missing Ads prerequisites,
@@ -141,11 +162,14 @@ maggie memory ...                # confirmed preferences and lessons
 maggie feedback ...              # redact, preview, submit, list
 maggie qa ...                    # scenario browser QA, fix/retest, release gate
 maggie localization ...          # plan, validate, review, publish, stale
-maggie service ...               # import, sync, generate, validate
+maggie service ...               # import, sync, capability audit, validate
 maggie seo performance ...       # sampled PageSpeed/CWV report and baseline
 maggie seo images ...             # inventory, variants, confirmation, validate
 maggie seo sitemap ...            # typed/semantic plan, agent-files, apply, rollback
-maggie seo indexnow ...           # changed URLs, key check, retry-safe 24h guard
+maggie seo indexnow ...           # changed URLs, deployed key check, 24h guard
+maggie seo social-cards ...       # per-page og:image format/dimension audit
+maggie seo head-tags ...          # rendered-shell head metadata drift audit
+maggie ops favicon-check ...      # served favicon behaviour check
 maggie deployment | migration | release | analytics | schedule
 maggie migration identity --identity-file FILE [--expected-file FILE]
 maggie deployment canary --asset URL=SHA256 --render-report report.json
@@ -199,6 +223,19 @@ Read the [performance PRD](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/mai
 and [image/sitemap PRD](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/docs/image-sitemap-structure-prd.md)
 for adapter, privacy, apply, rollback, and release gates.
 
+For a database-backed blog, `maggie blog check-gate` accepts a sanitized host
+settings adapter so review policy can be checked without copying database
+credentials into a local store:
+
+```bash
+maggie blog check-gate --project . \
+  --adapter-command '["node", "scripts/read-blog-settings.mjs"]'
+```
+
+The adapter is an argv array, receives a versioned request on stdin, and must
+print only the three review-policy fields. Provider stderr is suppressed and a
+missing local store without an adapter fails closed.
+
 ### Design and deployment release gates
 
 Check source-to-runtime icon coverage before shipping a design:
@@ -247,8 +284,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.16 update --project . --force
-npx @topy-ai/maggie@0.7.16 cleanup --project .
+npx @topy-ai/maggie@0.7.18 update --project . --force
+npx @topy-ai/maggie@0.7.18 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -258,8 +295,14 @@ as a command-line argument:
 node scripts/publish-npm.mjs --maggie-env-file ../.env
 ```
 
-The 0.7.16 workflow tightens the review-gate exit code and adds retry-path
-regression coverage. The 0.7.15 workflow added API contracts, blog review gates, sitemap freshness,
+The 0.7.18 workflow adds staged/untracked changed-surface detection, scenario
+QA release integration, market/locale-aware service variant routes and
+reciprocal hreflang, provider capability matrices with fixture evidence, and
+feedback fixed-proof/path-privacy gates. The 0.7.17 workflow adds sanitized database-backed blog gate adapters, deployed
+IndexNow key verification, social-card and cross-shell head-tag audits, required
+Open Graph image coverage, and behavioural favicon verification. The 0.7.16
+workflow tightens the review-gate exit code and adds retry-path regression
+coverage. The 0.7.15 workflow added API contracts, blog review gates, sitemap freshness,
 change-driven IndexNow, and page-kind/source-coverage inventory. It also keeps
 the general `maggie-qa-workflow` skill and `maggie qa`
 CLI for scenario manifests, secret-free browser evidence metadata, test/fix/

package/README.zh-TW.md

@@ -8,7 +8,7 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.16 init --agent all
+npx @topy-ai/maggie@0.7.18 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 
@@ -25,7 +25,9 @@ maggie doctor --project . --require-bootstrap --strict
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-0.7.16 補強 review gate 的 CI exit code 與 IndexNow retry regression；
+0.7.18 加入 staged/untracked changed-surface release gate、QA run 與 release
+整合、market/locale-aware service variant route、provider capability matrix
+fixture evidence，以及 feedback fixed-proof/path privacy gate。0.7.16 補強 review gate 的 CI exit code 與 IndexNow retry regression；
 0.7.15 也加入 API schema contract、blog review gate、sitemap freshness
 warning、change-driven IndexNow 與 page-kind/source-coverage inventory。
 
@@ -59,6 +61,12 @@ maggie migration identity --identity-file .maggie/db-identity.json \
 maggie qa start --project . --scenario-file .maggie/scenario-manifest.json \
   --environment local --base-url http://localhost:4321
 maggie qa summary --project . --run <run-id>
+
+# Provider variant capability matrix
+maggie service capability-audit --project . \
+  --catalogue .maggie/booking/services.json \
+  --capabilities-file .maggie/booking/provider-capabilities.json \
+  --fixture .maggie/booking/fixtures/provider.json
 ```
 
 完整中文說明、19 個 skills 清單和 roadmap：

package/bin/maggie.js

@@ -98,6 +98,7 @@ Usage:
   maggie service import <provider-url> --project PATH
   maggie service sync <provider-url> --project PATH
   maggie service generate --project PATH
+  maggie service capability-audit --project PATH --catalogue FILE --capabilities-file FILE --fixture FILE
   maggie service validate --project PATH
   maggie service inspect --project PATH
   maggie service status --project PATH
@@ -113,7 +114,7 @@ Usage:
   maggie api lifecycle --project PATH [--execute --allow-quota]
   maggie memory <init|list|search|context|add|record-error|transition|export> --project PATH
   maggie localization <extract|plan|generate|preview|validate|review|publish|stale|glossary> [options]
-  maggie seo performance|images|sitemap|indexnow [options] (sitemap supports strict validate and agent-files)
+  maggie seo performance|images|sitemap|indexnow|social-cards|head-tags [options] (sitemap supports strict validate and agent-files)
   maggie feedback <collect|preview|submit|list> [options]
   maggie qa <start|record|summary|export> [options]
   maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang]
@@ -121,7 +122,7 @@ Usage:
   maggie site-audit URL --crawl --baseline FILE
   maggie browser-audit URL --browse PATH --output DIR --required SELECTOR [--sticky SELECTOR]
   maggie verification coverage --contract FILE --evidence FILE
-  maggie ops audit|preflight|verify|lockfiles|seed-manifest|google-capabilities --project PATH
+  maggie ops audit|preflight|verify|lockfiles|seed-manifest|google-capabilities|favicon-check --project PATH
   maggie ops google-capabilities --project PATH --report FILE [--output FILE]
   maggie ops preflight --project PATH --write
 
@@ -302,8 +303,8 @@ function service(args) {
 
 function seo(args) {
   const command = args[0];
-  const scripts = { performance: "maggie_performance.py", images: "maggie_images.py", sitemap: "maggie_sitemap.py", indexnow: "maggie_indexnow.py" };
-  if (!scripts[command]) throw new Error("seo command must be performance, images, sitemap, or indexnow");
+  const scripts = { performance: "maggie_performance.py", images: "maggie_images.py", sitemap: "maggie_sitemap.py", indexnow: "maggie_indexnow.py", "social-cards": "maggie_social_cards.py", "head-tags": "maggie_head_tags.py" };
+  if (!scripts[command]) throw new Error("seo command must be performance, images, sitemap, indexnow, social-cards, or head-tags");
   workflowCli(scripts[command], args.slice(1));
 }
 

package/bundled-references/universal-booking-adapter.md

@@ -25,8 +25,10 @@ when a title changes.
     "title": "Signature Scalp Ritual",
     "description": "Provider-supplied factual description.",
     "category": {"level1": "Head Spa", "level2": "Scalp Treatments"},
-    "variants": [{
+  "variants": [{
       "id": "service-123:60",
+      "idSource": "provider",
+      "variantSource": "native",
       "title": "60 minutes",
       "durationMinutes": 60,
       "price": {"amountMinor": 9500, "currency": "GBP", "display": "£95.00"}
@@ -147,3 +149,36 @@ Provider adapters may add `raw` evidence in a private local snapshot, but
 public page generation consumes only the canonical fields above. A sync must
 preserve removed records as `archived` with `removedAt` and must output a
 change report.
+
+## Provider variant capability matrix
+
+Before service pages are published, each provider declares its variant
+behavior in a project-owned JSON file. The declaration is validated against a
+sanitized fixture and emits `maggie-provider-variant-capabilities.v1`:
+
+```json
+{
+  "schemaVersion": "maggie-provider-capabilities.v1",
+  "providers": [{
+    "provider": "fresha",
+    "variantMode": "native",
+    "priceSemantics": "minor-unit-and-display",
+    "stableIdConfidence": "high"
+  }]
+}
+```
+
+`variantMode` is one of `native`, `derived-offers`, `single-fallback`, or
+`blocked`. `priceSemantics` records whether structured minor units and display
+prices are available. `stableIdConfidence` must be justified by provider or
+derived ID evidence. The audit records service/variant counts, observed source
+types, fixture name and hash, and validation errors without copying fixture
+rows or provider credentials. Run it with:
+
+```bash
+maggie service capability-audit \
+  --project . \
+  --catalogue .maggie/booking/services.json \
+  --capabilities-file .maggie/booking/provider-capabilities.json \
+  --fixture .maggie/booking/fixtures/provider.json
+```

package/bundled-skills/maggie-blog/SKILL.md

@@ -38,6 +38,9 @@ maggie blog init --project . --base-path /our-blogs --confirm
 	maggie blog ingest --project . --source local --input content/posts.json --confirm
 	maggie blog validate --project .
 	maggie blog check-gate --project .
+	# Database-backed hosts can supply a sanitized policy through an adapter.
+	maggie blog check-gate --project . \
+	  --adapter-command '["node", "scripts/read-blog-settings.mjs"]'
 	maggie blog approve --project . --slug example-post --actor reviewer --reason "reviewed" --confirm
 	maggie blog publish --project . --slug example-post --actor owner --reason "approved" --confirm
 maggie blog sitemap --project .
@@ -51,7 +54,14 @@ explicit `approve` transition before `publish`. Stable `contentId` is the
 ingest identity and a published slug must not change during a rewrite.
 Search/sort views are not indexable; drafts never appear in public routes, RSS,
 or sitemap output. Provider keys remain server-side. Public publication and
-migrations always require explicit confirmation.
+	migrations always require explicit confirmation.
+
+The adapter runs as an argv array without a shell, receives a versioned request
+on stdin, and must print only an object containing
+`defaultPostStatus`/`default_post_status`, `requireReview`/`require_review`,
+and `autoPublishEnabled`/`auto_publish`. Provider stderr is suppressed. Use
+`--settings-file` for a reviewed sanitized snapshot. A missing local store with
+neither input fails closed.
 
 To initialize native front-end pages from the approved local UI guideline,
 run `maggie-design`:

package/bundled-skills/maggie-dash/SKILL.md

@@ -219,6 +219,11 @@ ordinary, and blog routes, plus `sourceCoverage`. A host adapter must include
 code-rendered routes in the input or declare coverage incomplete; a zero
 database-row count is not evidence that no public routes exist.
 
+When a host renders multiple shells, export a normalized head manifest and run
+`maggie seo head-tags audit`. This is the reusable boundary for detecting icon
+MIME drift, OG-image fallback drift, and verification-tag coverage; MaggieDash
+does not infer these values from a route filename or from one sample page.
+
 The catalogue declares purpose, usage, placement, repeatability and layout
 limits, renderer-owned examples, and the shape of repeated entries. A repeat
 may contain an object (`title`, `body`, `href`, and so on), not just a count;

package/bundled-skills/maggie-deployment/SKILL.md

@@ -32,7 +32,8 @@ response bodies in it.
 
 When a release changes a visitor-facing HTML, CSS, component, or asset surface,
 the release preflight automatically requires both a passing icon inventory and
-rendered canary evidence. The canary must include screenshots, zero console or
+rendered canary evidence. It considers unstaged, staged, and untracked
+visitor-facing files. The canary must include screenshots, zero console or
 network errors, and zero placeholder matches. Query-driven routes belong in
 behavior/API checks, not static byte baselines.
 
@@ -161,6 +162,13 @@ python3 tools/clis/maggie_release.py /path/to/project \
   --base-url https://staging.example.com
 ```
 
+If `.maggie/scenario-manifest.json` or `.maggie/qa-runs/` exists, the same
+preflight consumes the latest matching `maggie qa` run for the requested
+environment (and `--base-url`, when supplied). It blocks when a scenario is
+not passed, has no browser-adapter evidence, or the matching run is missing.
+Projects without scenario QA report `not-configured`; Maggie does not run the
+browser itself.
+
 This aggregates deployment, migration, provider-health, schedule, analytics,
 service-fact, editorial approval, durable SEO/route/category evidence,
 MaggieDash schema compatibility, and live runtime security-header checks. It writes

package/bundled-skills/maggie-feedback/SKILL.md

@@ -34,6 +34,11 @@ The draft is written to `.maggie/feedback/`. It contains the Maggie version,
 skill, run ID, phase, error fingerprint, expected/actual result, reproduction
 steps, resolution, validation, and metadata-only screenshot references.
 
+If a draft is marked fixed with `--fixed` (or the supplied run report says
+`fixed`), both `--resolution` and `--validation` are required. Feedback text
+also scrubs common POSIX/home/temp and Windows absolute paths by default while
+preserving public URLs and route paths.
+
 ## Submit explicitly
 
 The CLI never submits automatically. After reviewing the draft:

package/bundled-skills/maggie-ops/SKILL.md

@@ -42,6 +42,8 @@ python3 tools/clis/maggie_ops.py --project . audit
 python3 tools/clis/maggie_ops.py --project . preflight --write
 python3 tools/clis/maggie_ops.py --project . status
 python3 tools/clis/maggie_ops.py --project . verify
+python3 tools/clis/maggie_ops.py --project . favicon-check \
+  --origin https://example.com
 python3 tools/clis/maggie_ops.py --project . record sitemap-match \
   --dry-run --quota-impact quota --idempotency-key match-2026-08-29-001
 ```
@@ -52,6 +54,12 @@ python3 tools/clis/maggie_ops.py --project . record sitemap-match \
 approved operation but does not call a remote provider; provider mutations
 remain behind the server-side API adapter and its execute gate.
 
+`favicon-check` is a deployed behavioural check. It fetches `/favicon.ico`
+and the declared `<link rel="icon">` (or an explicit `--declared-url`), then
+requires HTTP 200, a readable square image, and an engine-supported ICO, PNG,
+or GIF response. A logo-shaped source filename is only an unverified source
+candidate; it is never evidence that the public favicon route works.
+
 If the user does not name a mode, inspect the project and propose the smallest
 mode that satisfies the request. Do not rebuild the public blog or change its
 framework just to add Ops.

package/bundled-skills/maggie-qa-workflow/SKILL.md

@@ -69,6 +69,11 @@ maggie qa record --project . --run local-qa-001 \
 the test failed, a fix. After a fix, retest the original scenario and at least
 one adjacent scenario affected by the same surface.
 
+A passing `test` or `retest` requires at least one `--evidence` reference from
+the host browser adapter. The adapter owns console, network, authentication,
+URL, viewport, and screenshot capture; this skill stores only a relative path,
+URL reference, and hash when a local file exists.
+
 ## Gate and release evidence
 
 The run gate is `fail` when any scenario fails, `blocked` when there is no
@@ -88,6 +93,12 @@ Before calling a release Pass, also run the relevant build, accessibility,
 SEO, media, API, and deployment-canary checks. A green build, HTTP 200, source
 class, or one guest smoke is not browser QA evidence.
 
+`maggie release` consumes the latest matching run from `.maggie/qa-runs/` when
+the project has a scenario manifest or QA run directory. A matching run must
+have a passed summary, passing scenarios, a passing final test/retest event,
+and browser evidence for every scenario. No manifest or run reports an
+explicit `not-configured` state.
+
 ## Privacy and feedback
 
 Do not put passwords, tokens, cookies, full private URLs, personal data,

package/bundled-skills/maggie-seo-geo/SKILL.md

@@ -181,13 +181,23 @@ maggie seo sitemap rollback --backup-manifest .maggie-sitemap-backups/<plan>/bac
   --public-dir public --confirm
 
 # Change-driven IndexNow: only pass URLs whose rendered content changed.
-maggie seo indexnow key-check --public-dir public --key-file <key>.txt --key <key>
+maggie seo indexnow key-check --public-dir public --key-file <key>.txt --key <key> \
+  --key-url https://example.com/<key>.txt \
+  --wrong-key-url https://example.com/not-a-key.txt
 maggie seo indexnow plan --origin https://example.com \
   --changed-urls-file .maggie/changed-urls.json \
   --state-file .maggie/indexnow-state.json --key <key> \
   --output .maggie/indexnow-plan.json
 maggie seo indexnow submit --plan .maggie/indexnow-plan.json \
   --state-file .maggie/indexnow-state.json --confirm
+
+# Resolve each page's og:image and inspect its image contract.
+maggie seo social-cards audit --urls-file .maggie/public-urls.json \
+  --output .maggie/social-cards.json
+
+# Compare normalized head metadata emitted by every rendered shell.
+maggie seo head-tags audit --pages-file .maggie/rendered-head.json \
+  --output .maggie/head-tags.json
 ```
 
 Only confirmed image variants may enter `srcset`; `apply` requires an explicit
@@ -203,6 +213,24 @@ records accepted state only after HTTP 200/202. A 403/429/5xx or network error
 is retryable and must never make the editor save fail; do not retry unchanged
 URLs in a loop.
 
+The complete IndexNow key gate checks both the local public file and the
+deployed URL body. Add a wrong-key URL as a negative control when the host
+route is expected to return 404; response bodies are never printed.
+
+Social-card auditing uses a `300x157` minimum for a large summary card and
+accepts JPEG, PNG, GIF, and ICO responses. It reports missing, unreachable,
+undersized, unreadable, or unsupported images and warns when one source is
+used for at least 75% of a sample of three or more pages. Page-specific
+first-band images remain an editorial choice and should be declared by the
+host manifest.
+
+Head-tag auditing consumes a host-produced JSON manifest with `url`, `shell`,
+and normalized `tags`. It compares structural declarations for icons,
+`og:image`, image MIME type, verification presence, robots, and Twitter cards;
+route-specific title and canonical values are intentionally excluded from
+shell drift. It reports disagreements instead of guessing which shell is
+correct.
+
 For a deterministic technical smoke check, run:
 
 ```bash

package/bundled-skills/maggie-service-booking/SKILL.md

@@ -21,7 +21,8 @@ supporting relations for all suggested candidates. Inspect each service's
 `pages` after selection and validate the rendered links. The current selection
 path writes `canonical` for selected pages; multiple selections can violate
 the one-canonical invariant. Resolve roles and run validation before publishing.
-Variant role assignment and layout/URL conventions remain tracked in issue #27.
+Variant role assignment and layout/URL conventions are enforced by the shared
+market/locale route and reciprocal hreflang contract.
 
 ## Automatic memory hook
 
@@ -107,6 +108,14 @@ python3 tools/clis/maggie_service_booking.py category-audit \
   --project . --rendered-dir /tmp/category-rendered
 
 python3 tools/clis/maggie_service_booking.py category-context --project .
+
+# Declare provider behavior, then validate it against the imported catalogue
+# and a sanitized fixture before publishing service pages.
+python3 tools/clis/maggie_service_booking.py capability-audit \
+  --project . \
+  --catalogue .maggie/booking/services.json \
+  --capabilities-file .maggie/booking/provider-capabilities.json \
+  --fixture .maggie/booking/fixtures/provider.json
 ```
 
 `import` creates the first catalogue. `sync` compares the newly imported
@@ -265,6 +274,15 @@ amounts silently. Include `Service` and `Offer` JSON-LD only from validated
 catalogue fields. Do not emit `Review`, `AggregateRating`, or medical claims
 unless verified source data is present.
 
+Localized and market-specific variants use
+`/services/<market>/<locale>/<variant-slug>/` as their canonical route. A
+translation never reuses the source route. Published variants expose
+reciprocal hreflang links only to published counterparts. Before generation,
+each provider must declare `variantMode` (`native`, `derived-offers`,
+`single-fallback`, or `blocked`), `priceSemantics`, and `stableIdConfidence`
+in a machine-readable capability file. The capability audit requires a
+sanitized fixture and fails closed on missing or contradictory evidence.
+
 ## AI category/page copy contract
 
 Read [`references/ai-service-copy-contract.md`](../../references/ai-service-copy-contract.md)

package/bundled-tools/clis/maggie.py

@@ -206,7 +206,7 @@ def detect(root: Path) -> dict:
     asset_contract = {
         "redirects": found("present", "redirects file") if any(name in names for name in {"_redirects", "redirects.json", "redirects.csv"}) else missing("no redirects manifest detected"),
         "security_headers": found("present", name) if (name := next((name for name in {"_headers", "headers.json", "vercel.json", "netlify.toml"} if name in names), None)) else missing("no deployment/header policy detected"),
-        "favicon_or_brand": found("present", path) if (path := next((path for path in implementation_paths if any(token in path.lower() for token in {"favicon", "logo", "brand"}) and Path(path).suffix in {".svg", ".png", ".ico", ".webp"}), None)) else missing("no favicon or brand asset detected"),
+        "favicon_or_brand": {"status": "Unverified", "value": "source asset candidate found; verify the served icon with `maggie ops favicon-check`", "evidence": [path]} if (path := next((path for path in implementation_paths if any(token in path.lower() for token in {"favicon", "logo", "brand"}) and Path(path).suffix in {".svg", ".png", ".ico", ".webp"}), None)) else missing("no favicon or brand asset detected"),
         "social_image": found("present", path) if (path := next((path for path in implementation_paths if any(token in path.lower() for token in {"og", "social", "twitter"}) and Path(path).suffix in {".jpg", ".jpeg", ".png", ".webp"}), None)) else missing("no social image asset detected"),
     }
     content_model = {

package/bundled-tools/clis/maggie_blog.py

@@ -9,7 +9,7 @@ import sys
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "runtime"))
-from maggie_blog import BlogStore  # noqa: E402
+from maggie_blog import BlogStore, review_settings_from_adapter  # noqa: E402
 from localization_runner import process_adapter
 from integration_state import integration_state  # noqa: E402
 
@@ -27,7 +27,7 @@ def main() -> int:
     inspect = sub.add_parser("inspect"); inspect.add_argument("--project", type=Path, default=Path.cwd())
     ingest = sub.add_parser("ingest"); ingest.add_argument("--project", type=Path, default=Path.cwd()); ingest.add_argument("--input", type=Path, required=True); ingest.add_argument("--source", default="local"); ingest.add_argument("--confirm", action="store_true")
     validate = sub.add_parser("validate"); validate.add_argument("--project", type=Path, default=Path.cwd())
-    gate = sub.add_parser("check-gate", help="report whether generated content requires review before publication"); gate.add_argument("--project", type=Path, default=Path.cwd())
+    gate = sub.add_parser("check-gate", help="report whether generated content requires review before publication"); gate.add_argument("--project", type=Path, default=Path.cwd()); gate.add_argument("--settings-file", type=Path, help="sanitized host settings JSON"); gate.add_argument("--adapter-command", help="trusted provider JSON argv array that prints sanitized settings JSON"); gate.add_argument("--timeout", type=int, default=120)
     approve = sub.add_parser("approve"); approve.add_argument("--project", type=Path, default=Path.cwd()); approve.add_argument("--slug", required=True); approve.add_argument("--actor", required=True); approve.add_argument("--reason", required=True); approve.add_argument("--confirm", action="store_true")
     publish = sub.add_parser("publish"); publish.add_argument("--project", type=Path, default=Path.cwd()); publish.add_argument("--slug", required=True); publish.add_argument("--actor", required=True); publish.add_argument("--reason", required=True); publish.add_argument("--confirm", action="store_true")
     sitemap = sub.add_parser("sitemap"); sitemap.add_argument("--project", type=Path, default=Path.cwd())
@@ -39,6 +39,16 @@ def main() -> int:
         result = integration_state(configured=args.configured, consent_required=args.consent_required, consent=args.consent, authorized=args.authorized, error=args.error)
         print(json.dumps(result, indent=2, ensure_ascii=False))
         return 0 if result["status"] != "error" else 1
+    if args.command == "check-gate" and (args.settings_file or args.adapter_command):
+        try:
+            adapter_command = json.loads(args.adapter_command) if args.adapter_command else None
+            settings, source = review_settings_from_adapter(args.project.resolve(), args.settings_file.resolve() if args.settings_file else None, adapter_command, args.timeout)
+            result = BlogStore.review_gate(settings)
+            result["source"] = source
+        except (OSError, ValueError, json.JSONDecodeError) as error:
+            print(f"maggie-blog: {error}", file=sys.stderr); return 1
+        print(json.dumps(result, indent=2, ensure_ascii=False))
+        return 0 if result.get("passed") else 1
     store = BlogStore(args.project.resolve())
     if args.command in {"init", "ingest", "publish", "approve", "rollback", "translate-pending"} and not args.confirm:
         print("CONFIRMATION_REQUIRED: rerun with --confirm", file=sys.stderr); return 2

package/bundled-tools/clis/maggie_feedback.py

@@ -20,6 +20,12 @@ from urllib.request import Request, urlopen
 
 DEFAULT_ENDPOINT = "https://feedback.noblox.app/api/feedback"
 SECRET_RE = re.compile(r"(?i)(bearer\s+|(?:api[_-]?key|token|secret|password|npm_config[^=]*|authorization)\s*[=:]\s*)[^\s,;]+")
+LOCAL_PATH_RE = re.compile(
+    r"(?<![A-Za-z0-9])(?:~/(?:[^\s,;:)\]}]+/)*[^\s,;:)\]}]+|"
+    r"/(?:home|Users|private|tmp|var|mnt|opt|root|srv|workspace|workspaces)(?:/[^\s,;:)\]}]+)+|"
+    r"[A-Za-z]:[\\/]+(?:[^\\/\s,;:)\]}]+[\\/]+)*[^\\/\s,;:)\]}]+|"
+    r"\\\\[^\\/\s,;:)\]}]+(?:[\\/]+[^\\/\s,;:)\]}]+)+)"
+)
 VERSION_RE = re.compile(r"\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?")
 ACKNOWLEDGEMENT_KEYS = ("status", "feedbackId", "requestId")
 REPO_ROOT = Path(__file__).resolve().parents[2]
@@ -30,7 +36,8 @@ def now() -> str:
 
 
 def safe_text(value: object) -> str:
-    return SECRET_RE.sub(r"\1[REDACTED]", str(value or "")).strip()
+    value = SECRET_RE.sub(r"\1[REDACTED]", str(value or ""))
+    return LOCAL_PATH_RE.sub("[LOCAL_PATH_REDACTED]", value).strip()
 
 
 def project_fingerprint(project: Path) -> str:
@@ -90,6 +97,11 @@ def collect(args: argparse.Namespace) -> int:
     skill = args.skill or report.get("skill") or report.get("workflow") or "unknown"
     run_id = args.run_id or report.get("runId") or report.get("jobId") or ""
     actual = args.actual or report.get("actual") or report.get("error") or report.get("message") or ""
+    fixed = bool(args.fixed or report.get("fixed") is True or report.get("status") == "fixed")
+    resolution = safe_text(args.resolution or report.get("resolution"))
+    validation = safe_text(args.validation or report.get("validation"))
+    if fixed and (not resolution or not validation):
+        raise ValueError("fixed feedback requires non-empty --resolution and --validation")
     context = {"projectFingerprint": project_fingerprint(project)}
     if args.allow_project_context and args.context_note:
         context["note"] = safe_text(args.context_note)
@@ -103,15 +115,15 @@ def collect(args: argparse.Namespace) -> int:
         "skill": skill,
         "runId": run_id,
         "phase": args.phase or report.get("phase") or "",
-        "status": report.get("status") or ("fixed" if args.fixed else "reported"),
+        "status": report.get("status") or ("fixed" if fixed else "reported"),
         "summary": safe_text(args.summary),
         "expected": safe_text(args.expected),
         "actual": safe_text(actual),
         "errorFingerprint": safe_text(args.error_fingerprint or report.get("errorFingerprint") or ""),
         "stepsToReproduce": [safe_text(step) for step in args.reproduce],
-        "fixed": bool(args.fixed),
-        "resolution": safe_text(args.resolution),
-        "validation": safe_text(args.validation),
+        "fixed": fixed,
+        "resolution": resolution,
+        "validation": validation,
         "attachments": [attachment(value) for value in args.screenshot],
         "environment": {"os": platform.system().lower(), "python": platform.python_version()},
         "privacy": {"secretsRedacted": True, "projectContextAllowed": bool(args.allow_project_context)},

package/bundled-tools/clis/maggie_head_tags.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""Compare normalized rendered head tags across site shells."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "runtime"))
+from maggie_head_tags import audit_head_tags, read_pages  # noqa: E402
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(prog="maggie seo head-tags")
+    sub = parser.add_subparsers(dest="command", required=True)
+    audit = sub.add_parser("audit", help="report head-tag disagreements across rendered shells")
+    audit.add_argument("--pages-file", type=Path, required=True, help="JSON page manifest with url, shell, and tags")
+    audit.add_argument("--output")
+    args = parser.parse_args()
+    try:
+        result = audit_head_tags(read_pages(args.pages_file))
+        if args.output:
+            output = Path(args.output).resolve(); output.parent.mkdir(parents=True, exist_ok=True)
+            output.write_text(json.dumps(result, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+        print(json.dumps(result, indent=2, ensure_ascii=False))
+        return 0 if result["passed"] else 1
+    except (OSError, ValueError, json.JSONDecodeError) as error:
+        print(f"maggie-head-tags: {error}", file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/bundled-tools/clis/maggie_indexnow.py

@@ -9,7 +9,7 @@ from pathlib import Path
 import sys
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "runtime"))
-from maggie_indexnow import check_key_file, plan_indexnow, submit_plan  # noqa: E402
+from maggie_indexnow import check_key_file, check_key_http, plan_indexnow, submit_plan  # noqa: E402
 
 
 def read_json(path: Path, default: object) -> object:
@@ -26,8 +26,8 @@ def write_json(path: Path, value: object) -> None:
 def main() -> int:
     parser = argparse.ArgumentParser(prog="maggie seo indexnow")
     sub = parser.add_subparsers(dest="command", required=True)
-    key_check = sub.add_parser("key-check", help="verify the public ownership key file")
-    key_check.add_argument("--public-dir", required=True); key_check.add_argument("--key-file", required=True); key_check.add_argument("--key", required=True)
+    key_check = sub.add_parser("key-check", help="verify local and deployed public ownership key evidence")
+    key_check.add_argument("--public-dir", required=True); key_check.add_argument("--key-file", required=True); key_check.add_argument("--key", required=True); key_check.add_argument("--key-url", help="deployed key URL to fetch"); key_check.add_argument("--wrong-key-url", help="negative-control URL expected to return HTTP 404"); key_check.add_argument("--timeout", type=int, default=15)
     plan = sub.add_parser("plan", help="hold back recently accepted URLs and create a submission plan")
     plan.add_argument("--origin", required=True); plan.add_argument("--changed-urls-file", required=True); plan.add_argument("--state-file", required=True); plan.add_argument("--key", required=True); plan.add_argument("--key-location"); plan.add_argument("--guard-hours", type=int, default=24); plan.add_argument("--now"); plan.add_argument("--output", required=True)
     submit = sub.add_parser("submit", help="submit an approved plan; provider failure never updates accepted state")
@@ -36,6 +36,9 @@ def main() -> int:
     try:
         if args.command == "key-check":
             result = check_key_file(Path(args.public_dir).resolve(), args.key_file, args.key)
+            if args.key_url:
+                result["http"] = check_key_http(args.key_url, args.key, args.wrong_key_url, args.timeout)
+                if result["http"]["status"] != "pass": result["status"] = "fail"
             print(json.dumps(result, indent=2)); return 0 if result["status"] == "pass" else 1
         if args.command == "plan":
             changed = read_json(Path(args.changed_urls_file), [])

package/bundled-tools/clis/maggie_ops.py

@@ -15,6 +15,7 @@ from seed_evidence import validate_manifest
 from agent_runtime import preflight as agent_preflight
 from restart_gate import validate as validate_restart_gate
 from google_capabilities import validate_report as validate_google_capability_report
+from maggie_favicon import check_favicon
 
 
 REQUIRED_ROUTES = (
@@ -181,6 +182,12 @@ def command_google_capabilities(args: argparse.Namespace) -> int:
     return 0 if result["passed"] else 1
 
 
+def command_favicon_check(args: argparse.Namespace) -> int:
+    result = check_favicon(args.origin, args.declared_url, args.timeout)
+    print(json.dumps(result, indent=2, ensure_ascii=False))
+    return 0 if result["passed"] else 1
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--project", default=".")
@@ -203,6 +210,11 @@ def main() -> int:
     google.add_argument("--report", required=True)
     google.add_argument("--output")
     google.set_defaults(func=command_google_capabilities)
+    favicon = sub.add_parser("favicon-check", help="fetch /favicon.ico and the declared icon to verify behaviour")
+    favicon.add_argument("--origin", required=True)
+    favicon.add_argument("--declared-url")
+    favicon.add_argument("--timeout", type=int, default=15)
+    favicon.set_defaults(func=command_favicon_check)
     record = sub.add_parser("record", help="record an explicitly authorised operation")
     record.add_argument("operation", choices=("sync", "sitemap-match", "rewrite-queue", "rewrite-approve", "publish", "migration"))
     record.add_argument("--dry-run", action="store_true")