@topy-ai/maggie 0.7.27 → 0.7.28

package/README.md

@@ -60,7 +60,12 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 19 installable skills and a local-first MaggieDash foundation.
 
-The current release is `0.7.27`. It adds a provider-neutral MaggieDash host
+The current release is `0.7.28`. It adds a versioned Gemini model policy with
+an explicit fallback and provenance, bundled-CLI version discovery, and a
+bundled-first dispatcher that avoids stale project wrappers. It also adds
+privacy-safe feedback batch review/duplicate detection, marketplace
+enrichment evidence, bounded booking worker/resolver reports, and read-only
+migration preflight contracts. The release retains the provider-neutral MaggieDash host
 adapter contract, idempotent PostgreSQL starter schema, type-only backend
 boundary, runtime endpoint conformance evidence, safe quota/error summaries,
 stale marketplace readiness revalidation, explicit VPS port/origin planning,
@@ -206,6 +211,7 @@ redacted and explicit; it is never promoted to active memory automatically.
 The CLI provides the installer plus durable workflow commands:
 
 ```text
+maggie --version | version
 maggie init | install | update | remove | list | doctor
 maggie cleanup --project . [--confirm]
 maggie bootstrap interview | phase ...
@@ -226,6 +232,7 @@ maggie clone-to-template ...     # URL → validated marketplace template
 maggie marketplace ...           # catalog and on-demand template workflow
 maggie memory ...                # confirmed preferences and lessons
 maggie feedback ...              # redact, preview, batch, submit, list
+maggie feedback batch-review ... # aggregate bounded drafts and detect duplicates
 maggie qa ...                    # scenario browser QA, fix/retest, release gate
 maggie localization ...          # plan, validate, review, publish, stale
 maggie service ...                # import, sync/report, catalogue, lifecycle, validate
@@ -240,9 +247,13 @@ maggie deployment | migration | release | analytics | schedule
 maggie deployment readiness --project PATH
 maggie deployment parity --project PATH --evidence FILE --output FILE
 maggie migration identity --identity-file FILE [--expected-file FILE]
+maggie migration preflight --evidence FILE [--output FILE]
 maggie deployment canary --asset URL=SHA256 --render-report report.json
 maggie design icon-inventory --source-dir src --runtime assets/icons.css
 maggie api lifecycle | site-audit | ops audit
+maggie marketplace enrichment-report --project PATH --input FILE [--output FILE]
+maggie service worker-health --project PATH --evidence FILE [--output FILE]
+maggie service resolver-audit --project PATH --evidence FILE [--output FILE]
 ```
 
 Agent content writes must declare the exact host origin that minted the
@@ -405,8 +416,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.27 update --project . --force
-npx @topy-ai/maggie@0.7.27 cleanup --project .
+npx @topy-ai/maggie@0.7.28 update --project . --force
+npx @topy-ai/maggie@0.7.28 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -577,6 +588,34 @@ maggie feedback batch --project . --batch-file ./feedback-batch.json
 
 The batch command never submits automatically or writes active memory.
 
+Aggregate a correlated batch before reviewing individual drafts:
+
+```bash
+maggie feedback batch-review --project . --batch-id run-review-001
+```
+
+The `maggie-feedback-batch-review.v1` report retains bounded observations,
+missing-index and duplicate checks, and privacy flags. It never contains raw
+responses, local paths, or secrets.
+
+The same evidence-first pattern is available for the other maintainer checks:
+
+```bash
+maggie marketplace enrichment-report --project . \
+  --input .maggie/marketplace/enrichment-input.json
+maggie service worker-health --project . \
+  --evidence .maggie/booking/worker-health-input.json
+maggie service resolver-audit --project . \
+  --evidence .maggie/booking/resolver-input.json
+maggie migration preflight \
+  --evidence .maggie/migration/preflight-input.json
+```
+
+Each command validates a versioned, bounded evidence contract and writes only
+sanitized status data. The deployment parity report also records the active
+release revision, runtime configuration hash, migration version, worker
+revision, asset fingerprints, and rollback target.
+
 Submission is never implicit. Project paths, source files, logs, and secrets
 are excluded by default. The hosted endpoint stores the normalized feedback in
 NoBlox for maintainer review; it does not automatically create a GitHub Issue.

package/README.zh-TW.md

@@ -8,7 +8,7 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.26 init --agent all
+npx @topy-ai/maggie@0.7.28 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 
@@ -25,7 +25,9 @@ maggie doctor --project . --require-bootstrap --strict
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 release 是 `0.7.26`，修正 top-level feedback help 並包含 host-owned mobile app surface contract、signed-in
+目前 release 是 `0.7.28`，加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
+worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及
 runtime package version capture。
 

package/bin/maggie.js

@@ -51,6 +51,7 @@ function usage() {
   console.log(`Maggie Skills installer
 
 Usage:
+  maggie --version | version
   maggie init [--project PATH] [--agent auto|codex|claude|all] [--skills LIST]
   maggie install [SKILL ...] [--project PATH] [--agent auto|codex|claude|all]
   maggie update [SKILL ...] [--project PATH] [--agent auto|codex|claude|all] [--force]
@@ -117,6 +118,7 @@ Usage:
   maggie deployment readiness --project PATH
   maggie deployment parity --project PATH --evidence FILE --output FILE
   maggie deployment canary --project PATH --asset URL=SHA256 --render-report report.json --output docs/deployment-canary.json
+  maggie migration preflight --evidence FILE --output FILE
   maggie migration --project PATH --environment staging
   maggie migration identity --identity-file FILE [--expected-file FILE]
   maggie schedule PATH/.maggie/schedule.json --project PATH
@@ -126,7 +128,7 @@ Usage:
   maggie memory <init|list|search|context|add|record-error|transition|export> --project PATH
   maggie localization <extract|plan|generate|preview|validate|review|publish|stale|glossary> [options]
   maggie seo performance|images|sitemap|indexnow|social-cards|head-tags [options] (sitemap supports strict validate and agent-files)
-  maggie feedback <collect|preview|batch|submit|list> [options]
+  maggie feedback <collect|preview|batch|batch-review|submit|list> [options]
   maggie qa <start|record|summary|export|assertion-audit> [options]
   maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
@@ -294,7 +296,7 @@ function list() {
 
 function marketplace(args) {
   const root = projectRoot(args);
-  const script = join(root, "tools", "clis", "maggie_marketplace.py");
+  const script = toolScript("maggie_marketplace.py", root);
   if (!existsSync(script)) throw new Error(`marketplace CLI is missing: ${script}`);
   const command = args[0] || "list";
   const forwarded = args.slice(1);
@@ -306,7 +308,7 @@ function marketplace(args) {
 function service(args) {
   const root = projectRoot(args);
   const scriptName = args[0] === "orchestration-validate" ? "maggie_service_onboarding.py" : "maggie_service_booking.py";
-  const script = join(root, "tools", "clis", scriptName);
+  const script = toolScript(scriptName, root);
   if (!existsSync(script)) throw new Error(`service booking CLI is missing: ${script}`);
   const result = spawnSync("python3", [script, ...args], { stdio: "inherit", cwd: root, env: { ...process.env, MAGGIE_VERSION: PACKAGE_VERSION } });
   if (result.error) throw result.error;
@@ -327,7 +329,7 @@ function seo(args) {
 
 function workflowCli(name, args) {
   const root = projectRoot(args);
-  const script = join(root, "tools", "clis", name);
+  const script = toolScript(name, root);
   if (!existsSync(script)) throw new Error(`${name} is missing: ${script}`);
   const env = name === "maggie_feedback.py" ? { ...process.env, MAGGIE_VERSION: PACKAGE_VERSION } : process.env;
   const result = spawnSync("python3", [script, ...args], { stdio: "inherit", cwd: root, env });
@@ -335,6 +337,15 @@ function workflowCli(name, args) {
   process.exitCode = result.status ?? 1;
 }
 
+function toolScript(name, root) {
+  const bundled = join(TOOLS_ROOT, "clis", name);
+  return existsSync(bundled) ? bundled : join(root, "tools", "clis", name);
+}
+
+function version() {
+  console.log(PACKAGE_VERSION);
+}
+
 function doctor(args) {
   const root = projectRoot(args);
   const checks = [
@@ -404,7 +415,8 @@ function cleanup(args) {
 
 const [command = "help", ...args] = process.argv.slice(2);
 try {
-  if (["help", "--help", "-h"].includes(command)) usage();
+  if (["--version", "-v", "version"].includes(command)) version();
+  else if (["help", "--help", "-h"].includes(command)) usage();
   else if (command === "list") list();
   else if (command === "marketplace") marketplace(args);
   else if (command === "clone") workflowCli("maggie_clone.py", args);

package/bundled-contracts/maggie-deployment/runtime-parity-v1.schema.json

@@ -3,17 +3,35 @@
   "$id": "https://maggie.noblox.app/contracts/deployment-runtime-parity-v1.json",
   "title": "Maggie deployment worker and browser runtime parity evidence",
   "type": "object",
-  "required": ["schemaVersion", "environment", "passed", "worker", "browser"],
+  "required": ["schemaVersion", "environment", "passed", "release", "worker", "browser"],
   "properties": {
     "schemaVersion": {"const": "maggie-deployment-runtime-parity.v1"},
     "environment": {"enum": ["development", "staging", "production"]},
     "passed": {"const": true},
+    "release": {
+      "type": "object",
+      "required": ["activeRevision", "expectedRevision", "rollbackRevision", "environment", "runtimeConfigHash", "expectedConfigHash", "migrationVersion", "expectedMigrationVersion", "workerRevision", "assetVersions"],
+      "properties": {
+        "activeRevision": {"type": "string", "minLength": 1},
+        "expectedRevision": {"type": "string", "minLength": 1},
+        "rollbackRevision": {"type": "string", "minLength": 1},
+        "environment": {"enum": ["development", "staging", "production"]},
+        "runtimeConfigHash": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "expectedConfigHash": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "migrationVersion": {"type": "string", "minLength": 1},
+        "expectedMigrationVersion": {"type": "string", "minLength": 1},
+        "workerRevision": {"type": "string", "minLength": 1},
+        "assetVersions": {"type": "array", "minItems": 1, "items": {"type": "object", "required": ["name", "sha256"], "properties": {"name": {"type": "string"}, "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}, "additionalProperties": false}}
+      },
+      "additionalProperties": true
+    },
     "worker": {
       "type": "object",
       "required": ["config", "migration", "routeApis", "residentProcesses", "sourceJobs"],
       "properties": {
         "config": {"$ref": "#/$defs/config"},
         "migration": {"type": "object", "required": ["privilegeCheck"], "properties": {"privilegeCheck": {"$ref": "#/$defs/passed"}}},
+        "revision": {"type": "string", "minLength": 1},
         "routeApis": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/route"}},
         "residentProcesses": {"$ref": "#/$defs/processes"},
         "sourceJobs": {"type": "array", "items": {"$ref": "#/$defs/job"}}
@@ -30,7 +48,7 @@
   "$defs": {
     "passed": {"type": "object", "required": ["passed"], "properties": {"passed": {"const": true}}, "additionalProperties": true},
     "config": {"type": "object", "required": ["required", "missing", "passed"], "properties": {"required": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}}, "missing": {"type": "array", "maxItems": 0}, "passed": {"const": true}}, "additionalProperties": true},
-    "route": {"type": "object", "required": ["method", "path", "status", "passed"], "properties": {"method": {"type": "string"}, "path": {"type": "string", "pattern": "^/"}, "status": {"type": "integer", "minimum": 200, "maximum": 399}, "passed": {"const": true}}, "additionalProperties": true},
+    "route": {"type": "object", "required": ["method", "path", "status", "passed", "releaseRevision"], "properties": {"method": {"type": "string"}, "path": {"type": "string", "pattern": "^/"}, "status": {"type": "integer", "minimum": 200, "maximum": 399}, "passed": {"const": true}, "releaseRevision": {"type": "string", "minLength": 1}}, "additionalProperties": true},
     "processes": {"type": "object", "required": ["checked", "unexpected", "stale", "passed"], "properties": {"checked": {"const": true}, "unexpected": {"type": "array", "maxItems": 0}, "stale": {"type": "array", "maxItems": 0}, "passed": {"const": true}}, "additionalProperties": true},
     "job": {"type": "object", "required": ["jobId", "passed"], "properties": {"jobId": {"type": "string", "minLength": 1}, "passed": {"const": true}}, "additionalProperties": true}
   },

package/bundled-contracts/maggie-seo/model-policy-v1.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-seo/model-policy-v1.schema.json",
+  "title": "Maggie Gemini model policy v1",
+  "type": "object",
+  "required": ["policyVersion", "model", "fallbackModel", "promptVersion", "schemaVersion", "locale", "sourceRevision"],
+  "properties": {
+    "policyVersion": {"const": "maggie-gemini-model-policy.v1"},
+    "model": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{1,99}$"},
+    "fallbackModel": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{1,99}$"},
+    "promptVersion": {"type": "string", "minLength": 1},
+    "schemaVersion": {"type": "string", "minLength": 1},
+    "locale": {"type": ["string", "null"]},
+    "sourceRevision": {"type": ["string", "null"]}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-service-booking/resolver-v1.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/resolver-v1.schema.json",
+  "title": "Maggie booking URL resolver outcomes v1",
+  "type": "object",
+  "required": ["schemaVersion", "status", "passed", "errors", "counts", "observations", "privacy"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-booking-resolver.v1"},
+    "status": {"enum": ["passed", "failed"]},
+    "passed": {"type": "boolean"},
+    "errors": {"type": "array", "items": {"type": "string"}},
+    "counts": {"type": "object", "additionalProperties": {"type": "integer", "minimum": 0}},
+    "observations": {"type": "array", "maxItems": 200, "items": {"type": "object"}},
+    "privacy": {"type": "object", "required": ["rawResponsesIncluded", "credentialsIncluded"]}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-service-booking/worker-health-v1.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/worker-health-v1.schema.json",
+  "title": "Maggie service booking worker health v1",
+  "type": "object",
+  "required": ["schemaVersion", "environment", "workerId", "status", "passed", "errors", "checks"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-booking-worker-health.v1"},
+    "environment": {"enum": ["development", "staging", "production"]},
+    "workerId": {"type": "string", "minLength": 1},
+    "status": {"enum": ["passed", "failed"]},
+    "passed": {"type": "boolean"},
+    "errors": {"type": "array", "items": {"type": "string"}},
+    "checks": {"type": "object", "additionalProperties": {"type": "boolean"}}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggiedash/migration-preflight-v1.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.noblox.app/contracts/migration-preflight-v1.schema.json",
+  "title": "MaggieDash Migration Preflight v1",
+  "type": "object",
+  "required": ["schemaVersion", "environment", "status", "passed", "errors", "checks", "mutation"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-migration-preflight.v1"},
+    "environment": {"enum": ["development", "staging", "production"]},
+    "status": {"enum": ["passed", "failed"]}, "passed": {"type": "boolean"},
+    "errors": {"type": "array", "items": {"type": "string"}},
+    "checks": {"type": "object", "additionalProperties": {"type": "boolean"}},
+    "mutation": {"const": "not executed"}
+  },
+  "additionalProperties": false
+}

package/bundled-skills/maggie-dash/SKILL.md

@@ -5,6 +5,18 @@ description: Manage the MaggieDash project foundation, local content store, and
 
 # MaggieDash
 
+Run the read-only migration preflight before any schema write:
+
+```bash
+maggie migration preflight \
+  --evidence .maggie/migration/preflight-input.json \
+  --output .maggie/migration/preflight.json
+```
+
+It checks database privileges, required columns, unique constraints used by
+`ON CONFLICT`, idempotency, and version advancement. Evidence is secret-free
+and the command never executes a migration; a failed report blocks the write.
+
 Use the provider-neutral MaggieDash contracts and CLI for project setup,
 installation of the first-party admin workspace, and content operations.
 

package/bundled-skills/maggie-deployment/SKILL.md

@@ -52,10 +52,14 @@ maggie deployment parity --project . \
 The `maggie-deployment-runtime-parity.v1` contract checks required worker
 configuration and missing bindings, migration privileges, route API status,
 stale/unexpected resident import processes, non-empty source-job IDs, and
-browser/driver compatibility. It is provider-neutral: the host adapter runs
-the environment checks and supplies only safe facts; Maggie validates the
-evidence and never receives credentials, cookies, or response bodies. A failed
-parity report blocks the readiness command and therefore the canary.
+browser/driver compatibility. It also requires the active release revision to
+match the expected revision, an equal runtime configuration hash, the expected
+migration and worker revisions, non-empty asset fingerprints, route release
+revisions, and a valid rollback target. It is provider-neutral: the host
+adapter runs the environment checks and supplies only safe facts; Maggie
+validates the evidence and never receives credentials, cookies, or response
+bodies. A failed parity report blocks the readiness command and therefore the
+canary.
 
 ## Release readiness evidence
 

package/bundled-skills/maggie-feedback/SKILL.md

@@ -55,9 +55,19 @@ The batch file contains 1–50 items and may provide shared `skill`, `runId`,
 `phase`, `priority`, and `affectedCli` values. An item can override those
 fields and supplies the normal `type`, `summary`, `expected`, `actual`,
 `errorFingerprint`, reproduction, resolution, validation, and screenshot
-metadata fields. Each generated draft stores only the safe batch ID, zero-based
-index, and bounded size. The batch command still creates local drafts only;
-review each draft and submit explicitly.
+metadata fields. It may also provide bounded `routeIds` and
+`validationEvidence` identifiers. Each generated draft stores only the safe
+batch ID, zero-based index, and bounded size. The batch command still creates
+local drafts only.
+
+Aggregate a batch before manual review:
+
+    maggie feedback batch-review --project . --batch-id run-review-001
+
+This writes `.maggie/feedback/batches/<batch-id>-review.json` under the
+`maggie-feedback-batch-review.v1` contract. It reports missing indexes and
+duplicate fingerprints/summaries, while retaining only redacted observations;
+review the aggregate and each draft before submitting.
 
 Example:
 

package/bundled-skills/maggie-marketplace/SKILL.md

@@ -7,6 +7,22 @@ metadata:
 
 # Maggie Marketplace
 
+## Enrichment evidence
+
+Candidate discovery must preserve enough structured evidence to debug a
+missing Google candidate, crawl, audit, snapshot, or SEO backfill without
+storing provider HTML or credentials:
+
+```bash
+maggie marketplace enrichment-report --project . \
+  --input .maggie/marketplace/enrichment-input.json
+```
+
+The output follows `maggie-marketplace-enrichment.v1`, records safe status and
+error codes for each stage, and makes retry eligibility explicit. Null/error
+reasons remain visible for a maintainer; raw response bodies, local paths, and
+secrets are excluded.
+
 ## Automatic memory hook
 
 Follow [Maggie Memory Hook](../../references/memory-hook.md) at invocation and completion.

package/bundled-skills/maggie-seo-geo/SKILL.md

@@ -7,6 +7,17 @@ metadata:
 
 # Maggie SEO and GEO
 
+## Versioned Gemini policy
+
+AI-assisted SEO, localization, and content generation must resolve models
+through one explicit policy: `maggie-gemini-model-policy.v1`. Pin the primary
+model, declare a separate fallback, and record the policy version, exact
+prompt/schema versions, locale, and source revision with generated evidence.
+Only model availability failures (retired model, quota, timeout, or provider
+5xx) may roll forward to the declared fallback; authentication failures and
+invalid output remain errors. Do not scatter retired model defaults across
+routes.
+
 ## Static audit and sitemap evidence
 
 Run `maggie site-audit https://example.com --crawl --json` for sitemap-listed

package/bundled-skills/maggie-service-booking/SKILL.md

@@ -7,6 +7,25 @@ metadata:
 
 # Maggie Service Booking
 
+## Bounded worker and resolver evidence
+
+Before enabling provider crawling or URL resolution, validate sanitized host
+evidence. These checks keep queue depth, leases, concurrency, timeouts,
+retries, cancellation cleanup, and worker health explicit:
+
+```bash
+maggie service worker-health --project . \
+  --evidence .maggie/booking/worker-health-input.json
+maggie service resolver-audit --project . \
+  --evidence .maggie/booking/resolver-input.json
+```
+
+The worker report uses `maggie-booking-worker-health.v1`. Resolver outcomes are
+limited to `resolved`, `resolved-no-menu`, `not-found`, `blocked`, `timeout`,
+and `unavailable`; resolved outcomes require a public canonical HTTPS URL and
+safe evidence IDs. Raw provider responses, credentials, logs, and request
+bodies are never copied into the reports.
+
 Route matching evidence must come from the route source's actual import
 statements. The shared resolver in `tools/runtime/route_imports.py` resolves
 relative imports and records a component fingerprint; it never selects a

package/bundled-tools/clis/maggie_deployment_parity.py

@@ -14,6 +14,7 @@ from typing import Any
 SCHEMA = "maggie-deployment-runtime-parity.v1"
 ENVIRONMENTS = {"development", "staging", "production"}
 SAFE_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$")
+SHA256 = re.compile(r"^[0-9a-f]{64}$")
 
 
 def load(path: Path) -> dict[str, Any]:
@@ -42,6 +43,38 @@ def validate(payload: dict[str, Any]) -> list[str]:
     if payload.get("passed") is not True:
         errors.append("parity evidence is not marked passed")
 
+    release = payload.get("release")
+    if not isinstance(release, dict):
+        errors.append("release evidence must be an object")
+        release = {}
+    for field in ("activeRevision", "expectedRevision", "rollbackRevision"):
+        if not isinstance(release.get(field), str) or not SAFE_ID.fullmatch(release[field]):
+            errors.append(f"release.{field} must be a safe identifier")
+    if release.get("activeRevision") != release.get("expectedRevision"):
+        errors.append("active release revision does not match expected revision")
+    if release.get("rollbackRevision") == release.get("activeRevision"):
+        errors.append("rollback revision must differ from the active revision")
+    if release.get("environment") != payload.get("environment"):
+        errors.append("release environment does not match parity environment")
+    for field in ("runtimeConfigHash", "expectedConfigHash"):
+        if not isinstance(release.get(field), str) or not SHA256.fullmatch(release[field]):
+            errors.append(f"release.{field} must be a SHA-256 hex digest")
+    if release.get("runtimeConfigHash") != release.get("expectedConfigHash"):
+        errors.append("active runtime configuration does not match expected configuration")
+    for field in ("migrationVersion", "expectedMigrationVersion", "workerRevision"):
+        if not isinstance(release.get(field), str) or not SAFE_ID.fullmatch(release[field]):
+            errors.append(f"release.{field} must be a safe identifier")
+    if release.get("migrationVersion") != release.get("expectedMigrationVersion"):
+        errors.append("active migration version does not match expected migration version")
+    assets = release.get("assetVersions")
+    if not isinstance(assets, list) or not assets:
+        errors.append("release.assetVersions must contain at least one asset hash")
+    for index, asset in enumerate(assets if isinstance(assets, list) else []):
+        if not isinstance(asset, dict) or not SAFE_ID.fullmatch(str(asset.get("name") or "")):
+            errors.append(f"release.assetVersions[{index}].name must be a safe identifier")
+        if not isinstance(asset, dict) or not SHA256.fullmatch(str(asset.get("sha256") or "")):
+            errors.append(f"release.assetVersions[{index}].sha256 must be a SHA-256 hex digest")
+
     worker = payload.get("worker")
     if not isinstance(worker, dict):
         errors.append("worker evidence must be an object")
@@ -58,6 +91,8 @@ def validate(payload: dict[str, Any]) -> list[str]:
         errors.append("worker.config has missing requirements")
     if config.get("passed") is not True:
         errors.append("worker.config did not pass")
+    if worker.get("revision") != release.get("activeRevision"):
+        errors.append("worker revision does not match the active release")
 
     migration = worker.get("migration")
     privilege = migration.get("privilegeCheck") if isinstance(migration, dict) else None
@@ -84,6 +119,8 @@ def validate(payload: dict[str, Any]) -> list[str]:
             errors.append(f"{prefix}.status must be a successful HTTP status")
         if route.get("passed") is not True:
             errors.append(f"{prefix} did not pass")
+        if route.get("releaseRevision") != release.get("activeRevision"):
+            errors.append(f"{prefix}.releaseRevision does not match the active release")
 
     processes = worker.get("residentProcesses")
     if not isinstance(processes, dict):
@@ -135,6 +172,11 @@ def parity(evidence: Path, output: Path) -> int:
         "status": "passed" if not errors else "failed",
         "passed": not errors,
         "checks": {
+            "activeRelease": "validated",
+            "runtimeConfiguration": "validated",
+            "migrationVersion": "validated",
+            "assetVersions": "validated",
+            "rollbackTarget": "validated",
             "workerConfig": "validated",
             "migrationPrivileges": "validated",
             "routeApis": "validated",

package/bundled-tools/clis/maggie_feedback.py

@@ -28,6 +28,10 @@ LOCAL_PATH_RE = re.compile(
 )
 VERSION_RE = re.compile(r"\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?")
 SAFE_BATCH_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$")
+SAFE_ROUTE_RE = re.compile(r"^/[A-Za-z0-9._~!$&'()*+,;=:@%/?#-]{1,240}$")
+SAFE_EVIDENCE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:/=-]{0,159}$")
+MAX_ROUTE_IDS = 20
+MAX_VALIDATION_EVIDENCE = 20
 ACKNOWLEDGEMENT_KEYS = ("status", "feedbackId", "requestId")
 REPO_ROOT = Path(__file__).resolve().parents[2]
 
@@ -107,6 +111,29 @@ def load_json(path: Path) -> dict:
     return value
 
 
+def safe_route_ids(values: object) -> list[str]:
+    """Keep bounded route identifiers, never request bodies or local paths."""
+    if not isinstance(values, list):
+        return []
+    result = []
+    for value in values[:MAX_ROUTE_IDS]:
+        item = safe_text(value)
+        if SAFE_ROUTE_RE.fullmatch(item):
+            result.append(item)
+    return sorted(set(result))
+
+
+def safe_validation_evidence(values: object) -> list[str]:
+    if not isinstance(values, list):
+        return []
+    result = []
+    for value in values[:MAX_VALIDATION_EVIDENCE]:
+        item = safe_text(value)
+        if SAFE_EVIDENCE_RE.fullmatch(item):
+            result.append(item)
+    return sorted(set(result))
+
+
 def collect(args: argparse.Namespace) -> int:
     project = Path(args.project).resolve()
     report = load_json(Path(args.run_report)) if args.run_report else {}
@@ -132,6 +159,8 @@ def collect(args: argparse.Namespace) -> int:
     if priority not in {"low", "normal", "high", "critical"}:
         raise ValueError("priority must be low, normal, high, or critical")
     affected_cli = safe_text(getattr(args, "affected_cli", ""))
+    route_ids = safe_route_ids(getattr(args, "route_ids", []))
+    validation_evidence = safe_validation_evidence(getattr(args, "validation_evidence", []))
     context = {"projectFingerprint": project_fingerprint(project)}
     if args.allow_project_context and args.context_note:
         context["note"] = safe_text(args.context_note)
@@ -156,6 +185,8 @@ def collect(args: argparse.Namespace) -> int:
         "validation": validation,
         "priority": priority,
         "affectedCli": affected_cli,
+        "routeIds": route_ids,
+        "validationEvidence": validation_evidence,
         "attachments": [attachment(value) for value in args.screenshot],
         "environment": {"os": platform.system().lower(), "python": platform.python_version()},
         "privacy": {"secretsRedacted": True, "projectContextAllowed": bool(args.allow_project_context)},
@@ -264,6 +295,8 @@ def collect_batch(args: argparse.Namespace) -> int:
         "phase": safe_text(manifest.get("phase")),
         "priority": safe_text(manifest.get("priority") or "normal"),
         "affected_cli": safe_text(manifest.get("affectedCli")),
+        "route_ids": safe_route_ids(manifest.get("routeIds", [])),
+        "validation_evidence": safe_validation_evidence(manifest.get("validationEvidence", [])),
     }
     paths = []
     for index, item in enumerate(items):
@@ -292,14 +325,82 @@ def collect_batch(args: argparse.Namespace) -> int:
             "batch_size": len(items),
             "priority": item.get("priority") or shared["priority"],
             "affected_cli": item.get("affectedCli") or shared["affected_cli"],
+            "route_ids": item.get("routeIds", shared["route_ids"]),
+            "validation_evidence": item.get("validationEvidence", shared["validation_evidence"]),
         }
         if not isinstance(values["reproduce"], list): values["reproduce"] = []
         if not isinstance(values["screenshot"], list): values["screenshot"] = []
+        values["route_ids"] = safe_route_ids(values["route_ids"])
+        values["validation_evidence"] = safe_validation_evidence(values["validation_evidence"])
         paths.append(collect(argparse.Namespace(**values)))
     print(json.dumps({"batchId": batch_id, "count": len(paths), "status": "drafts-created"}, ensure_ascii=False))
     return 0
 
 
+def batch_review(args: argparse.Namespace) -> int:
+    """Aggregate one bounded batch without exposing raw payloads or paths."""
+    project = Path(args.project).resolve()
+    batch_id = safe_text(args.batch_id)
+    if not SAFE_BATCH_ID_RE.fullmatch(batch_id):
+        raise ValueError("batch ID is invalid")
+    records = []
+    expected_sizes = []
+    for path in sorted((project / ".maggie" / "feedback").glob("*.json")):
+        try:
+            data = read_feedback(path)
+        except (OSError, ValueError, json.JSONDecodeError):
+            continue
+        batch = data.get("batch") if isinstance(data.get("batch"), dict) else {}
+        if batch.get("batchId") != batch_id:
+            continue
+        if isinstance(batch.get("size"), int):
+            expected_sizes.append(batch["size"])
+        records.append({
+            "feedbackId": safe_text(data.get("feedbackId")),
+            "index": batch.get("index"),
+            "type": safe_text(data.get("type")),
+            "skill": safe_text(data.get("skill")),
+            "phase": safe_text(data.get("phase")),
+            "summary": safe_text(data.get("summary")),
+            "expected": safe_text(data.get("expected")),
+            "actual": safe_text(data.get("actual")),
+            "errorFingerprint": safe_text(data.get("errorFingerprint")),
+            "fixed": data.get("fixed") is True,
+            "resolution": safe_text(data.get("resolution")),
+            "validation": safe_text(data.get("validation")),
+            "routeIds": safe_route_ids(data.get("routeIds", [])),
+            "validationEvidence": safe_validation_evidence(data.get("validationEvidence", [])),
+        })
+    records.sort(key=lambda item: (item["index"] is None, item["index"] if isinstance(item["index"], int) else 0, item["feedbackId"]))
+    expected_count = max(expected_sizes, default=len(records))
+    seen_indexes = {item["index"] for item in records if isinstance(item["index"], int)}
+    duplicate_groups = {}
+    for item in records:
+        key = item["errorFingerprint"] or re.sub(r"\s+", " ", item["summary"].lower()).strip()
+        if key:
+            duplicate_groups.setdefault(key, []).append(item["feedbackId"])
+    duplicates = [{"key": safe_text(key), "feedbackIds": ids} for key, ids in duplicate_groups.items() if len(ids) > 1]
+    output = Path(args.output) if args.output else project / ".maggie" / "feedback" / "batches" / f"{batch_id}-review.json"
+    if not output.is_absolute(): output = project / output
+    report = {
+        "schemaVersion": "maggie-feedback-batch-review.v1",
+        "batchId": batch_id,
+        "status": "passed" if records and not duplicates and len(records) == expected_count else "needs-review",
+        "expectedCount": expected_count,
+        "draftCount": len(records),
+        "missingIndexes": sorted(set(range(expected_count)) - seen_indexes),
+        "skills": sorted({item["skill"] for item in records if item["skill"]}),
+        "phases": sorted({item["phase"] for item in records if item["phase"]}),
+        "observations": records,
+        "duplicates": duplicates,
+        "privacy": {"rawPayloadsIncluded": False, "localPathsIncluded": False, "secretsRedacted": True},
+    }
+    output.parent.mkdir(parents=True, exist_ok=True)
+    output.write_text(json.dumps(report, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+    print(json.dumps({"status": report["status"], "batchId": batch_id, "draftCount": len(records), "expectedCount": expected_count, "duplicates": len(duplicates), "report": str(output.resolve())}, ensure_ascii=False))
+    return 0 if report["status"] == "passed" else 1
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--project", default=".")
@@ -329,9 +430,15 @@ def main() -> int:
     collect_parser.add_argument("--batch-size", type=int)
     collect_parser.add_argument("--priority", choices=("low", "normal", "high", "critical"), default="normal")
     collect_parser.add_argument("--affected-cli", default="")
+    collect_parser.add_argument("--route-id", dest="route_ids", action="append", default=[])
+    collect_parser.add_argument("--validation-evidence", dest="validation_evidence", action="append", default=[])
     batch_parser = sub.add_parser("batch")
     batch_parser.add_argument("--project", default=argparse.SUPPRESS)
     batch_parser.add_argument("--batch-file", required=True)
+    review_parser = sub.add_parser("batch-review")
+    review_parser.add_argument("--project", default=argparse.SUPPRESS)
+    review_parser.add_argument("--batch-id", required=True)
+    review_parser.add_argument("--output")
     preview_parser = sub.add_parser("preview")
     preview_parser.add_argument("feedback")
     preview_parser.add_argument("--format", choices=("json", "markdown"), default="json")
@@ -344,6 +451,7 @@ def main() -> int:
     try:
         if args.command == "collect": return collect(args)
         if args.command == "batch": return collect_batch(args)
+        if args.command == "batch-review": return batch_review(args)
         if args.command == "preview": return preview(args)
         if args.command == "submit": return submit(args)
         return list_feedback(args)

package/bundled-tools/clis/maggie_localization.py

@@ -216,7 +216,15 @@ def plan_job(args: argparse.Namespace) -> int:
         "translationGroupId": identity.get("translationGroupId", f"tg-{content_id}"),
         "sourceRevision": args.source_revision or (source_artifact or {}).get("sourceRevision") or content.get("sourceRevision", "unknown"),
         "status": "draft",
-        "translation": {"translationStatus": "draft", "isIndexable": False},
+        "translation": {
+            "translationStatus": "draft", "isIndexable": False,
+            "provenance": {
+                "operation": args.operation, "sourceRevision": args.source_revision or (source_artifact or {}).get("sourceRevision") or content.get("sourceRevision", "unknown"),
+                "sourceLanguage": args.source_lang, "targetLanguage": args.target_lang,
+                "targetLocale": args.locale, "market": args.market,
+                "evidenceIds": [f"content:{content_id}"], "createdAt": now(),
+            },
+        },
         "createdAt": now(),
     }
     if source_artifact:
@@ -246,6 +254,15 @@ def validate_job(path: Path, source_path: Path | None = None, render_path: Path
         errors.append("targetLocale must be a supported tag matching targetLanguage")
     translation = job.get("translation", {})
     generation = job.get("generationContract", {})
+    provenance = translation.get("provenance", {}) if isinstance(translation, dict) else {}
+    if not isinstance(provenance, dict):
+        errors.append("translation.provenance must be an object")
+        provenance = {}
+    for field in ("sourceLanguage", "targetLanguage", "targetLocale", "market"):
+        if provenance.get(field) != job.get({"sourceLanguage": "sourceLanguage", "targetLanguage": "targetLanguage", "targetLocale": "targetLocale", "market": "market"}[field]):
+            errors.append(f"translation.provenance.{field} does not match the job")
+    if provenance.get("sourceRevision") != job.get("sourceRevision"):
+        errors.append("translation.provenance.sourceRevision does not match the job")
     if generation.get("mode") and generation.get("mode") != job.get("operation"):
         errors.append("generationContract mode must match operation")
     if job.get("operation") == "rewrite" and not generation.get("allowStructuralRewrite"):

package/bundled-tools/clis/maggie_marketplace.py

@@ -2061,6 +2061,47 @@ def apply_template(args: argparse.Namespace) -> int:
     return 0
 
 
+def enrichment_report(args: argparse.Namespace) -> int:
+    """Normalize privacy-safe enrichment evidence for a marketplace candidate."""
+    try:
+        payload = read_json(args.input.resolve())
+    except (OSError, ValueError, json.JSONDecodeError) as error:
+        print(json.dumps({"status": "failed", "errors": [f"cannot read enrichment evidence: {error}"]})); return 1
+    errors = []
+    if payload.get("schemaVersion") != "maggie-marketplace-enrichment-input.v1": errors.append("schemaVersion is unsupported")
+    candidate = payload.get("candidate") if isinstance(payload.get("candidate"), dict) else {}
+    candidate_id = str(candidate.get("candidateId") or "")
+    if not ID_PATTERN.fullmatch(candidate_id): errors.append("candidate.candidateId must be marketplace-safe")
+    crawl = payload.get("crawl") if isinstance(payload.get("crawl"), dict) else {}
+    audit = payload.get("audit") if isinstance(payload.get("audit"), dict) else {}
+    snapshot = payload.get("snapshot") if isinstance(payload.get("snapshot"), dict) else {}
+    for field, item in (("crawl", crawl), ("audit", audit), ("snapshot", snapshot)):
+        if not item: errors.append(f"{field} evidence is required")
+        if item.get("status") not in {"passed", "failed", "not-found", "blocked", "unavailable"}: errors.append(f"{field}.status is unsupported")
+        if item.get("error") and not re.fullmatch(r"[a-z0-9][a-z0-9._:-]{0,119}", str(item["error"])): errors.append(f"{field}.error must be a safe error code")
+    fields = payload.get("rawAuditFields", {})
+    if not isinstance(fields, dict): errors.append("rawAuditFields must be an object")
+    safe_fields = {}
+    for key, value in (fields.items() if isinstance(fields, dict) else []):
+        if re.fullmatch(r"[A-Za-z][A-Za-z0-9_.:-]{0,79}", str(key)) and not re.search(r"path|secret|token|password|cookie|header|body|html", str(key), re.I) and isinstance(value, (str, int, float, bool)) and not (isinstance(value, str) and re.search(r"(?:^|/)(?:home|Users|tmp|var|private)/", value)):
+            safe_fields[str(key)] = str(value)[:240] if isinstance(value, str) else value
+    backfill = payload.get("seoBackfill") if isinstance(payload.get("seoBackfill"), dict) else {}
+    report = {
+        "schemaVersion": "maggie-marketplace-enrichment.v1", "candidateId": candidate_id,
+        "status": "passed" if not errors else "failed", "passed": not errors, "errors": errors,
+        "candidate": {"source": str(candidate.get("source") or "")[:120], "market": str(candidate.get("market") or "global")[:20], "locale": str(candidate.get("locale") or "en")[:20]},
+        "crawl": {"status": crawl.get("status"), "pages": crawl.get("pages", 0) if isinstance(crawl.get("pages", 0), int) else 0, "error": crawl.get("error")},
+        "audit": {"status": audit.get("status"), "fields": safe_fields, "error": audit.get("error")},
+        "snapshot": {"status": snapshot.get("status"), "revision": str(snapshot.get("revision") or "")[:120], "error": snapshot.get("error")},
+        "seoBackfill": {"status": backfill.get("status"), "updated": backfill.get("updated", 0) if isinstance(backfill.get("updated", 0), int) else 0, "error": backfill.get("error")},
+        "retry": {"allowed": bool(errors), "reason": ";".join(errors)[:240] if errors else None},
+        "privacy": {"rawHtmlIncluded": False, "responseBodiesIncluded": False, "localPathsIncluded": False, "secretsRedacted": True},
+    }
+    output = args.output.resolve() if args.output else args.project.resolve() / "docs" / "marketplace-enrichment.json"
+    output.parent.mkdir(parents=True, exist_ok=True); output.write_text(json.dumps(report, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+    print(json.dumps({"status": report["status"], "candidateId": candidate_id, "report": str(output), "retry": report["retry"]}, ensure_ascii=False)); return 0 if not errors else 1
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--marketplace", type=Path, default=Path("marketplace"))
@@ -2130,6 +2171,11 @@ def main() -> int:
     apply.add_argument("--project", type=Path, default=Path.cwd())
     apply.add_argument("--allow-draft", action="store_true")
     apply.set_defaults(func=apply_template)
+    enrichment = sub.add_parser("enrichment-report", help="normalize safe candidate crawl and audit evidence")
+    enrichment.add_argument("--project", type=Path, default=Path.cwd())
+    enrichment.add_argument("--input", type=Path, required=True)
+    enrichment.add_argument("--output", type=Path)
+    enrichment.set_defaults(func=enrichment_report)
     args = parser.parse_args()
     try:
         return int(args.func(args) or 0)

package/bundled-tools/clis/maggie_migration.py

@@ -56,6 +56,8 @@ def validate_project(project: Path, environment: str) -> dict:
 
 
 IDENTITY_SCHEMA = "maggie-database-identity.v1"
+PREFLIGHT_SCHEMA = "maggie-migration-preflight.v1"
+SAFE_NAME = re.compile(r"^[A-Za-z][A-Za-z0-9_.:-]{0,119}$")
 
 
 def _identity_fingerprint(identity: dict) -> str:
@@ -119,7 +121,48 @@ def identity_main(argv: list[str]) -> int:
     return 0 if result["passed"] else 1
 
 
+def preflight_main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(description="Validate secret-free migration privilege, column, and constraint evidence.")
+    parser.add_argument("--evidence", required=True)
+    parser.add_argument("--output")
+    args = parser.parse_args(argv)
+    errors: list[str] = []
+    try:
+        payload = json.loads(Path(args.evidence).read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as error:
+        payload = {}; errors.append(f"cannot read migration preflight evidence: {error}")
+    if not isinstance(payload, dict): payload = {}; errors.append("preflight evidence must be an object")
+    if payload.get("schemaVersion") != PREFLIGHT_SCHEMA: errors.append(f"schemaVersion must be {PREFLIGHT_SCHEMA}")
+    if payload.get("environment") not in {"development", "staging", "production"}: errors.append("environment is invalid")
+    privileges = payload.get("privileges") if isinstance(payload.get("privileges"), dict) else {}
+    for field in ("canCreateTable", "canAlterTable", "canCreateIndex", "passed"):
+        if privileges.get(field) is not True: errors.append(f"privileges.{field} must be true")
+    columns = payload.get("requiredColumns")
+    if not isinstance(columns, list) or not columns: errors.append("requiredColumns must not be empty")
+    for index, item in enumerate(columns if isinstance(columns, list) else []):
+        if not isinstance(item, dict) or not SAFE_NAME.fullmatch(str(item.get("table") or "")) or not SAFE_NAME.fullmatch(str(item.get("column") or "")) or item.get("present") is not True:
+            errors.append(f"requiredColumns[{index}] must identify a present table column")
+    constraints = payload.get("uniqueConstraints")
+    if not isinstance(constraints, list) or not constraints: errors.append("uniqueConstraints must not be empty")
+    for index, item in enumerate(constraints if isinstance(constraints, list) else []):
+        if not isinstance(item, dict) or not SAFE_NAME.fullmatch(str(item.get("table") or "")) or not isinstance(item.get("columns"), list) or not item["columns"] or any(not SAFE_NAME.fullmatch(str(value)) for value in item["columns"]) or item.get("present") is not True:
+            errors.append(f"uniqueConstraints[{index}] must identify a present unique constraint")
+    idempotency = payload.get("idempotency") if isinstance(payload.get("idempotency"), dict) else {}
+    if idempotency.get("safe") is not True or idempotency.get("onConflictHandled") is not True: errors.append("idempotency must be safe and handle conflicts")
+    migration = payload.get("migration") if isinstance(payload.get("migration"), dict) else {}
+    for field in ("currentVersion", "targetVersion"):
+        if not SAFE_NAME.fullmatch(str(migration.get(field) or "")): errors.append(f"migration.{field} must be a safe identifier")
+    if migration.get("currentVersion") == migration.get("targetVersion"): errors.append("migration targetVersion must advance")
+    if migration.get("passed") is not True: errors.append("migration evidence did not pass")
+    result = {"schemaVersion": PREFLIGHT_SCHEMA, "environment": payload.get("environment"), "status": "passed" if not errors else "failed", "passed": not errors, "errors": errors, "checks": {"privileges": True, "requiredColumns": True, "uniqueConstraints": True, "idempotency": True, "migration": True}, "mutation": "not executed"}
+    if args.output:
+        output = Path(args.output); output.parent.mkdir(parents=True, exist_ok=True); output.write_text(json.dumps(result, indent=2) + "\n", encoding="utf-8")
+    print(json.dumps(result, indent=2)); return 0 if not errors else 1
+
+
 def main() -> int:
+    if sys.argv[1:2] == ["preflight"]:
+        return preflight_main(sys.argv[2:])
     if sys.argv[1:2] == ["identity"]:
         return identity_main(sys.argv[2:])
     parser = argparse.ArgumentParser(description=__doc__)

package/bundled-tools/clis/maggie_service_booking.py

@@ -7,7 +7,7 @@ import xml.etree.ElementTree as ET
 from datetime import datetime, timezone
 from html.parser import HTMLParser
 from pathlib import Path
-from urllib.parse import quote, urljoin, urlsplit
+from urllib.parse import quote, urljoin, urlsplit, urlparse
 from urllib.request import Request, urlopen
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "runtime"))
@@ -1148,6 +1148,85 @@ def cmd_variant_render_audit(args):
     result={"schemaVersion":"1.0","generatedAt":NOW(),"environment":args.environment,"status":"passed" if not errors else "failed","variants":results,"errors":errors,"passed":not errors}
     out=project/"docs"/"service-variant-render-audit.json"; out.parent.mkdir(parents=True,exist_ok=True); out.write_text(json.dumps(result,indent=2)+"\n",encoding="utf-8")
     print(json.dumps({**result,"report":str(out)},indent=2)); return 0 if not errors else 1
+SAFE_WORKER_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$")
+SAFE_EVIDENCE_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:/=-]{0,159}$")
+RESOLVER_OUTCOMES = {"resolved", "resolved-no-menu", "not-found", "blocked", "timeout", "unavailable"}
+
+
+def cmd_worker_health(args):
+    """Validate bounded queue, lease, retry, timeout, and cancellation evidence."""
+    try:
+        payload = json.loads(Path(args.evidence).resolve().read_text(encoding="utf-8"))
+    except (OSError, ValueError, json.JSONDecodeError) as exc:
+        print(json.dumps({"status": "failed", "errors": [f"cannot read worker evidence: {exc}"]}, indent=2))
+        return 1
+    errors = []
+    if payload.get("schemaVersion") != "maggie-booking-worker-health-input.v1": errors.append("schemaVersion is unsupported")
+    if payload.get("environment") not in {"development", "staging", "production"}: errors.append("environment is invalid")
+    worker_id = str(payload.get("workerId") or "")
+    if not SAFE_WORKER_ID.fullmatch(worker_id): errors.append("workerId must be a safe identifier")
+    queue = payload.get("queue") if isinstance(payload.get("queue"), dict) else {}
+    for field in ("maxDepth", "maxConcurrency"):
+        if not isinstance(queue.get(field), int) or isinstance(queue.get(field), bool) or queue[field] < 1: errors.append(f"queue.{field} must be a positive integer")
+    if queue.get("bounded") is not True: errors.append("queue must be bounded")
+    leases = payload.get("leases") if isinstance(payload.get("leases"), dict) else {}
+    if leases.get("enabled") is not True or not isinstance(leases.get("ttlSeconds"), int) or leases.get("ttlSeconds", 0) < 1: errors.append("leases must have a positive TTL")
+    if leases.get("staleReclaimed") is not True: errors.append("stale leases must be reclaimed")
+    timeouts = payload.get("timeouts") if isinstance(payload.get("timeouts"), dict) else {}
+    for field in ("jobSeconds", "providerSeconds"):
+        if not isinstance(timeouts.get(field), int) or isinstance(timeouts.get(field), bool) or timeouts[field] < 1: errors.append(f"timeouts.{field} must be positive")
+    retry = payload.get("retry") if isinstance(payload.get("retry"), dict) else {}
+    if not isinstance(retry.get("maxAttempts"), int) or isinstance(retry.get("maxAttempts"), bool) or retry["maxAttempts"] < 0: errors.append("retry.maxAttempts must be non-negative")
+    if retry.get("backoff") not in {"fixed", "exponential", "exponential-jitter"}: errors.append("retry.backoff must be an approved strategy")
+    cancellation = payload.get("cancellation") if isinstance(payload.get("cancellation"), dict) else {}
+    if cancellation.get("supported") is not True or cancellation.get("cleanupVerified") is not True: errors.append("cancellation cleanup is not verified")
+    health = payload.get("health") if isinstance(payload.get("health"), dict) else {}
+    if not isinstance(health.get("path"), str) or not health["path"].startswith("/") or health.get("passed") is not True: errors.append("health endpoint did not pass")
+    if payload.get("orphanedJobs", 0) != 0: errors.append("orphanedJobs must be zero")
+    report = {"schemaVersion": "maggie-booking-worker-health.v1", "environment": payload.get("environment"), "workerId": worker_id, "status": "passed" if not errors else "failed", "passed": not errors, "errors": errors, "checks": {"boundedQueue": True, "leases": True, "timeouts": True, "retryBackoff": True, "cancellationCleanup": True, "healthEndpoint": True}}
+    project = root(args)
+    output = Path(args.output) if args.output else project / "docs/booking-worker-health.json"
+    if not output.is_absolute(): output = project / output
+    output = output.resolve()
+    output.parent.mkdir(parents=True, exist_ok=True); output.write_text(json.dumps(report, indent=2) + "\n", encoding="utf-8")
+    print(json.dumps({"status": report["status"], "report": str(output), "errors": errors}, indent=2)); return 0 if not errors else 1
+
+
+def cmd_resolver_audit(args):
+    """Classify booking URL outcomes using safe canonical URL evidence."""
+    try:
+        payload = json.loads(Path(args.evidence).resolve().read_text(encoding="utf-8"))
+    except (OSError, ValueError, json.JSONDecodeError) as exc:
+        print(json.dumps({"status": "failed", "errors": [f"cannot read resolver evidence: {exc}"]}, indent=2)); return 1
+    errors = []
+    if payload.get("schemaVersion") != "maggie-booking-resolver-input.v1": errors.append("schemaVersion is unsupported")
+    observations = payload.get("observations")
+    if not isinstance(observations, list) or not observations or len(observations) > 200: errors.append("observations must contain 1–200 items")
+    safe = []
+    for index, item in enumerate(observations if isinstance(observations, list) else []):
+        prefix = f"observations[{index}]"
+        if not isinstance(item, dict): errors.append(f"{prefix} must be an object"); continue
+        service_id = str(item.get("serviceId") or ""); outcome = item.get("outcome")
+        if not SAFE_WORKER_ID.fullmatch(service_id): errors.append(f"{prefix}.serviceId must be a safe identifier")
+        if outcome not in RESOLVER_OUTCOMES: errors.append(f"{prefix}.outcome is unsupported")
+        canonical = item.get("canonicalUrl")
+        if outcome in {"resolved", "resolved-no-menu"}:
+            parsed = urlparse(str(canonical or ""))
+            if parsed.scheme != "https" or not parsed.netloc or parsed.username or parsed.password: errors.append(f"{prefix}.canonicalUrl must be a public HTTPS URL")
+        elif canonical: errors.append(f"{prefix}.canonicalUrl is only allowed for resolved outcomes")
+        evidence = item.get("evidenceIds")
+        if not isinstance(evidence, list) or not evidence or any(not SAFE_EVIDENCE_ID.fullmatch(str(value)) for value in evidence[:20]): errors.append(f"{prefix}.evidenceIds must contain safe identifiers")
+        if not isinstance(item.get("durationMs"), int) or isinstance(item.get("durationMs"), bool) or item["durationMs"] < 0: errors.append(f"{prefix}.durationMs must be non-negative")
+        safe.append({"serviceId": service_id, "outcome": outcome, "canonicalUrl": canonical if outcome in {"resolved", "resolved-no-menu"} else None, "evidenceIds": [str(value) for value in evidence[:20]] if isinstance(evidence, list) else [], "durationMs": item.get("durationMs")})
+    counts = {outcome: sum(item.get("outcome") == outcome for item in safe) for outcome in sorted(RESOLVER_OUTCOMES)}
+    report = {"schemaVersion": "maggie-booking-resolver.v1", "status": "passed" if not errors else "failed", "passed": not errors, "errors": errors, "counts": counts, "observations": safe, "privacy": {"rawResponsesIncluded": False, "credentialsIncluded": False}}
+    project = root(args)
+    output = Path(args.output) if args.output else project / "docs/booking-resolver-audit.json"
+    if not output.is_absolute(): output = project / output
+    output = output.resolve(); output.parent.mkdir(parents=True, exist_ok=True); output.write_text(json.dumps(report, indent=2) + "\n", encoding="utf-8")
+    print(json.dumps({"status": report["status"], "report": str(output), "counts": counts, "errors": errors}, indent=2)); return 0 if not errors else 1
+
+
 def main():
     p=argparse.ArgumentParser(); sub=p.add_subparsers(dest="command",required=True)
     for name in ("import","sync","run"):
@@ -1173,6 +1252,8 @@ def main():
     q=sub.add_parser("variant-audit"); q.add_argument("--project",default="."); q.add_argument("--variants",required=True,help="draft service-page variant JSON"); q.add_argument("--as-of",help="ISO timestamp for expiry checks"); q.add_argument("--environment",choices=("development","staging","production"),default="staging")
     q=sub.add_parser("category-visual-audit"); q.add_argument("--project",default="."); q.add_argument("--screenshot-dir",required=True); q.add_argument("--min-bytes",type=int,default=5000); q.add_argument("--environment",choices=("development","staging","production"),default="staging")
     q=sub.add_parser("variant-render-audit"); q.add_argument("--project",default="."); q.add_argument("--variants",required=True); q.add_argument("--rendered-dir",required=True); q.add_argument("--environment",choices=("development","staging","production"),default="staging")
+    q=sub.add_parser("worker-health"); q.add_argument("--project",default="."); q.add_argument("--evidence",required=True); q.add_argument("--output")
+    q=sub.add_parser("resolver-audit"); q.add_argument("--project",default="."); q.add_argument("--evidence",required=True); q.add_argument("--output")
     for name in ("validate","inspect","status"):
         q=sub.add_parser(name); q.add_argument("--project",default=".")
     a=p.parse_args(); project=root(a)
@@ -1198,6 +1279,8 @@ def main():
     if a.command=="variant-audit": return cmd_variant_audit(a)
     if a.command=="category-visual-audit": return cmd_category_visual_audit(a)
     if a.command=="variant-render-audit": return cmd_variant_render_audit(a)
+    if a.command=="worker-health": return cmd_worker_health(a)
+    if a.command=="resolver-audit": return cmd_resolver_audit(a)
     if a.command=="inspect": return cmd_inspect(a)
     if a.command=="status": return cmd_status(a)
     data=load(project) if path(project).exists() else {}; errors=validate(data); print(json.dumps({"status":"passed" if not errors else "failed","errors":errors,"services":len(data.get("services",[]))},indent=2)); return 0 if not errors else 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.7.27",
+  "version": "0.7.28",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",