@topy-ai/maggie 0.7.3 → 0.7.5

package/README.md

@@ -92,6 +92,9 @@ maggie bootstrap interview | phase ...
 maggie dash install | init | status | migrate | cms ...
 maggie dash transition ...      # explicit content approval transition
 maggie dash variant ...         # service variant create/review/preview/publish
+maggie dash sections ...        # validate/catalogue/identity keys
+maggie agent-content write ...  # host-authorized content bridge
+maggie verification coverage ... # changed surface/locale evidence gate
 maggie clone ...                 # authorized homepage capture
 maggie design ...                # authorized interior-page design
 maggie clone-to-template ...     # URL → validated marketplace template
@@ -191,8 +194,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.3 update --project . --force
-npx @topy-ai/maggie@0.7.3 cleanup --project .
+npx @topy-ai/maggie@0.7.5 update --project . --force
+npx @topy-ai/maggie@0.7.5 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -202,14 +205,20 @@ as a command-line argument:
 node scripts/publish-npm.mjs --maggie-env-file ../.env
 ```
 
-The 0.7.2 workflow adds the installable MaggieDash admin distribution and
+The 0.7.5 workflow adds the installable MaggieDash admin distribution and
 audited CMS operations (`cms revisions`,
-`trash`, `restore`, `schedule`, `duplicate`, `redirect`, and signed
-`preview`), import-authoritative service matching, shared translation indexes,
-sanitized seed manifests, lockfile/analytics traffic checks, semantic sitemap
-validation, locale-aware `llms.txt`/`sitemap.md`/`insights.md` generation,
-explicit integration states, and deployment Origin/infrastructure/data
-rollback gates.
+`trash`, `restore`, `schedule`, `publish-due`, `duplicate`, `redirect`, and
+signed `preview`). It also adds a read-only MaggieDash `--diff`/`--dry-run`
+migration inventory, body-only dashboard prop validation, dialog accessibility
+contract checks, 404-only redirect policy, trash/scheduler/preview invariants,
+and a shared first-party traffic filter for every measurement channel. It also
+adds stable section identities and reusable section presets, a machine-readable
+MaggieDash section registry, a short-lived agent content bridge, restart gates
+for out-of-band translation writes, deployment release-runner generation,
+disk-versus-manifest skill inventory checks, and changed-surface/locale
+verification. The release retains the existing service matching,
+localization, seed-manifest, lockfile/analytics, sitemap, deployment and
+rollback workflows.
 
 ## MaggieDash lifecycle
 
@@ -231,6 +240,17 @@ for local development or a configured private Git URL. The host project keeps
 ownership of routes, email/password auth, database, provider credentials, and
 the `/api/maggie/*` adapter.
 
+Compare an existing dashboard before replacing it:
+
+```bash
+maggie dash install --project . --diff \
+  --existing-dir src/plugins/maggie-studio/src
+maggie dash install --project . --dry-run
+```
+
+These commands do not write files or installation state. Review the report and
+map host-owned files before using `--force`.
+
 Content remains draft-first and external writes remain explicit. Use the
 project-local memory workflow for confirmed preferences and reusable lessons;
 feedback drafts are never promoted to active memory automatically.

package/README.zh-TW.md

@@ -8,7 +8,7 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.6.9 init --agent all
+npx @topy-ai/maggie@0.7.5 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 
@@ -25,6 +25,10 @@ maggie doctor --project . --require-bootstrap --strict
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
+MaggieDash 也提供穩定 section identity、可重用 section arrangement、機器可讀
+section registry、短期 agent content bridge，以及 translation out-of-band write
+後的 restart gate。`maggie doctor` 會比較 install manifest 與磁碟上的實際 skills。
+
 新版 release gates：
 
 ```bash

package/bin/maggie.js

@@ -66,9 +66,11 @@ Usage:
   maggie doctor [--project PATH]
   maggie bootstrap interview [project]
   maggie dash init|install|status|migrate|transition|variant|cms --project PATH [options]
+  maggie dash sections <validate|prompt|keys> [options]
   maggie dash status --project PATH
   maggie dash migrate --project PATH --confirm
   maggie content FILE --source PROVIDER --project PATH --confirm
+  maggie agent-content write --url URL --token-env ENV --payload FILE
   maggie bootstrap phase <start|pass|fail|status> <phase> [project]
   maggie remove [SKILL ...] [--project PATH] [--agent codex|claude|all]
   maggie cleanup --project PATH [--confirm]
@@ -117,6 +119,7 @@ Usage:
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
   maggie site-audit URL --crawl --baseline FILE
   maggie browser-audit URL --browse PATH --output DIR --required SELECTOR [--sticky SELECTOR]
+  maggie verification coverage --contract FILE --evidence FILE
   maggie ops audit|preflight|verify|lockfiles|seed-manifest --project PATH
   maggie ops preflight --project PATH --write
 
@@ -320,11 +323,22 @@ function doctor(args) {
     ["claude-skills", existsSync(join(root, ".claude", "skills"))],
   ];
   for (const [name, passed] of checks) console.log(`${passed ? "PASS" : "INFO"} ${name}`);
+  const manifestPath = join(root, STATE_DIR, "install.json");
+  let manifest = null;
+  try { if (existsSync(manifestPath)) manifest = JSON.parse(readFileSync(manifestPath, "utf8")); } catch { manifest = null; }
+  const expected = Array.isArray(manifest?.skills) ? [...new Set(manifest.skills)] : null;
   const installed = [];
+  const installedNames = new Set();
   for (const agentRoot of [join(root, ".agents"), join(root, ".claude")]) {
-    for (const skill of SKILL_NAMES) if (existsSync(join(agentRoot, "skills", skill, "SKILL.md"))) installed.push(`${agentRoot}/${skill}`);
+    for (const skill of SKILL_NAMES) if (existsSync(join(agentRoot, "skills", skill, "SKILL.md"))) {
+      installed.push(`${agentRoot}/${skill}`);
+      installedNames.add(skill);
+    }
   }
-  console.log(`INFO installed-skills=${installed.length}`);
+  const missing = expected ? expected.filter((skill) => !installedNames.has(skill)) : [];
+  const inventoryState = expected && missing.length ? "INCOMPLETE" : "PASS";
+  console.log(`${inventoryState} skill-inventory manifest=${expected?.length ?? "unknown"} on-disk=${installedNames.size}${missing.length ? ` missing=${missing.join(",")}` : ""}`);
+  console.log(`INFO installed-skills=${installedNames.size}`);
   console.log("INFO doctor is diagnostic; bootstrap completion remains a project decision gate.");
 }
 
@@ -394,7 +408,9 @@ try {
   else if (command === "feedback") workflowCli("maggie_feedback.py", args);
   else if (command === "site-audit") workflowCli("site_audit.py", args);
   else if (command === "browser-audit") workflowCli("maggie_browser_audit.py", args);
+  else if (command === "verification") workflowCli("maggie_verification.py", args);
   else if (command === "dash") workflowCli("maggie_dash.py", args);
+  else if (command === "agent-content") workflowCli("maggie_agent_content.py", args);
   else if (command === "content") workflowCli("maggie_content.py", args);
   else if (command === "init" || command === "install") install(args);
   else if (command === "update") update(args);

package/bundled-contracts/maggie-deployment/release-runner-v1.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.noblox.app/contracts/release-runner-v1.schema.json",
+  "title": "Maggie deployment release runner v1",
+  "type": "object",
+  "required": ["schemaVersion", "orderedSteps", "retention"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-release-runner.v1"},
+    "orderedSteps": {"const": ["install", "typecheck", "migrate", "build", "carry-agent-state", "switch", "restart", "verify", "prune"]},
+    "retention": {"const": "exactly-current-plus-one-rollback"},
+    "mutation": {"enum": ["reviewable-script", "executed-after-confirmation"]}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggiedash/README.md

@@ -14,6 +14,16 @@ frontend framework.
   dry-run, backup, checksum, cutover, and rollback evidence;
 - [`storage-model.md`](storage-model.md): SQLite/PostgreSQL table ownership and
   adapter rules.
+- [`redirect-policy-v1.json`](redirect-policy-v1.json): 404-only lookup and
+  self/chain safety for canonical route redirects;
+- [`telemetry-policy-v1.json`](telemetry-policy-v1.json): first-party/toolchain
+  traffic exclusion for every measurement channel.
+- [`agent-content-v1.json`](agent-content-v1.json): short-lived host bridge for
+  validated agent content writes without database credentials;
+- [`section-identity-v1.json`](section-identity-v1.json): stable section IDs
+  for translation keys and ordered migration;
+- [`translation-cache-policy-v1.json`](translation-cache-policy-v1.json):
+  restart-after-out-of-band-write evidence.
 
 MaggieDash owns these contracts. Provider adapters may add namespaced metadata,
 but they may not change the required identity, status, provenance, or approval
@@ -32,3 +42,15 @@ published → archived
 
 No import, AI generation, rewrite, or adapter sync may publish content without
 an approval record and an auditable actor/correlation ID.
+
+## CMS invariants
+
+- `trashed` is a status. Public readers exclude it; trash is reversible.
+- A no-op save creates no revision, and the first update of an imported row
+  snapshots the existing state before replacing it.
+- Scheduled content with a past timestamp is published on the next scheduler
+  tick. A trashed row is never selected by the due query.
+- Preview responses are real preview routes protected by HMAC tokens and
+  advertise `noindex`, `X-Robots-Tag: noindex`, and `Cache-Control: no-store`.
+- Redirect lookup happens after the route has returned 404. Self-redirects and
+  redirect chains are rejected at write time.

package/bundled-contracts/maggiedash/agent-content-v1.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.noblox.app/contracts/agent-content-v1.schema.json",
+  "title": "MaggieDash agent content bridge v1",
+  "type": "object",
+  "required": ["method", "authorization", "tokenLifetime", "databaseCredentials"],
+  "properties": {
+    "method": {"const": "POST"},
+    "authorization": {"const": "Bearer short-lived session token"},
+    "tokenLifetime": {"const": "terminal session"},
+    "databaseCredentials": {"const": "never exposed to agent"},
+    "writes": {"type": "array", "items": {"enum": ["validated content operation", "revision", "audit event"]}}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggiedash/redirect-policy-v1.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.noblox.app/contracts/redirect-policy-v1.schema.json",
+  "title": "MaggieDash redirect policy v1",
+  "type": "object",
+  "required": ["schemaVersion", "lookupAfterStatus", "rejectSelf", "rejectChains"],
+  "properties": {
+    "schemaVersion": {"const": "maggiedash-redirect-policy.v1"},
+    "lookupAfterStatus": {"const": 404},
+    "rejectSelf": {"const": true},
+    "rejectChains": {"const": true},
+    "allowedStatusCodes": {"type": "array", "items": {"enum": [301, 302, 307, 308]}}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggiedash/section-identity-v1.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.noblox.app/contracts/section-identity-v1.schema.json",
+  "title": "MaggieDash stable section identity v1",
+  "type": "object",
+  "required": ["schemaVersion", "keyPattern", "fallback", "migrationOrder"],
+  "properties": {
+    "schemaVersion": {"const": "maggiedash-section-identity.v1"},
+    "keyPattern": {"const": "page.<id>.sections.<section-id>.<field>"},
+    "fallback": {"const": "array-index-until-migrated"},
+    "migrationOrder": {"const": "longest-old-prefix-first"}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggiedash/telemetry-policy-v1.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.noblox.app/contracts/telemetry-policy-v1.schema.json",
+  "title": "MaggieDash telemetry policy v1",
+  "type": "object",
+  "required": ["schemaVersion", "filterBeforeMeasurement", "channels"],
+  "properties": {
+    "schemaVersion": {"const": "maggiedash-telemetry-policy.v1"},
+    "filterBeforeMeasurement": {"const": true},
+    "channels": {
+      "type": "array",
+      "items": {"enum": ["page_view", "not_found", "redirect_hit", "booking_click", "analytics", "audit"]},
+      "minItems": 1
+    },
+    "identityInference": {"const": "forbidden"}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggiedash/translation-cache-policy-v1.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.noblox.app/contracts/translation-cache-policy-v1.schema.json",
+  "title": "MaggieDash translation cache policy v1",
+  "type": "object",
+  "required": ["schemaVersion", "outOfBandWrite", "restartRequired", "restartCommand", "verificationAfterRestart"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-restart-gate.v1"},
+    "outOfBandWrite": {"const": true},
+    "restartRequired": {"const": true},
+    "restartCommand": {"type": "string", "minLength": 1},
+    "verificationAfterRestart": {"const": true}
+  },
+  "additionalProperties": false
+}

package/bundled-references/maggiedash-telemetry-contract.md

@@ -0,0 +1,12 @@
+# MaggieDash telemetry contract
+
+Every measurement path must call the shared first-party traffic filter before
+incrementing a counter or writing a measurement event. This includes page
+views, 404/not-found rows, redirect hits, booking clicks, analytics events and
+operational audit counters. Filtering only page views leaves synthetic sweeps
+in the other totals.
+
+Use `should_record_measurement(event)` from
+`tools/runtime/analytics_traffic.py`. The filter accepts explicit Maggie/test
+markers and known toolchain user agents; it never guesses identity from IP
+addresses or private user fields.

package/bundled-skills/maggie-dash/SKILL.md

@@ -25,11 +25,42 @@ explicitly supplied, and records the resolved revision in
 CLI argument. For local development or a pinned checkout, use
 `--source /path/to/MaggieDash` or `--source URL --ref REF`.
 
+Before replacing an existing hand-written dashboard, create a read-only
+migration report. It compares the first-party manifest with the existing
+workspace and labels additions, unchanged files, updates that would be
+preserved, and unmanaged files:
+
+```bash
+maggie dash install --project . --diff \
+  --existing-dir src/plugins/maggie-studio/src
+maggie dash install --project . --dry-run
+```
+
+These modes do not require `--confirm` and do not write dashboard files or
+`.maggie/dash-install.json`. Review the report and explicitly map or back up
+hand-written files before using `--force`; an idempotent installer is not a
+schema migration.
+
 The installed dashboard owns the React workspace UI. The host project still
 owns the framework route, email/password session middleware, database, media
 storage, provider credentials, and `/api/maggie/*` adapter endpoints. Read the
 MaggieDash host adapter contract before adding a new framework adapter.
 
+For a built/deployed host, an agent must use the host's validated content
+bridge rather than editing release files or receiving database credentials:
+
+```bash
+maggie agent-content write \
+  --url https://example.test/api/maggie/agent-content.json \
+  --token-env MAGGIE_CONTENT_TOKEN --payload .maggie/content-operation.json
+```
+
+The host mints a short-lived session token. The bridge uses `POST` with
+`Authorization: Bearer`, delegates to the ordinary save/revision/audit path,
+and returns 401/422 for invalid authority or content. Never put database
+credentials or the short-lived token in the payload or generated reports. See
+the [agent content contract](../../contracts/maggiedash/agent-content-v1.json).
+
 ## Workflow
 
 1. Inspect the project with `maggie dash status --project PATH`.
@@ -105,8 +136,15 @@ maggie dash cms trash --project . --project-id local-project --document-id <id>
 maggie dash cms restore --project . --project-id local-project --document-id <id> --reason "restore" --confirm
 maggie dash cms schedule --project . --project-id local-project --document-id <id> \
   --publish-at 2026-09-20T10:00:00Z --reason "approved release" --confirm
+maggie dash cms publish-due --project . --project-id local-project \
+  --reason "scheduled publish tick" --confirm
 maggie dash cms duplicate --project . --project-id local-project --document-id <id> \
   --new-id <new-id> --new-slug <new-slug> --reason "create draft" --confirm
+maggie dash cms preset-save --project . --project-id local-project \
+  --preset-id treatment-page --name "Treatment page" \
+  --sections-file .maggie/sections.json --confirm
+maggie dash cms preset-insert --project . --project-id local-project \
+  --preset-id treatment-page --existing-id hero-1 --reason "add arrangement" --confirm
 maggie dash cms redirect --project . --project-id local-project --from-path /old --to-path /new \
   --reason "canonical slug change" --confirm
 maggie dash cms preview --project . --project-id local-project --document-id <id> \
@@ -114,6 +152,41 @@ maggie dash cms preview --project . --project-id local-project --document-id <id
 ```
 
 Content writes create immutable revision snapshots. Trash is reversible and
-does not destroy the document. Scheduling is accepted only for approved
-content and requires a timezone. Preview tokens are short-lived HMAC-signed
-tokens; never place the secret in source control or generated reports.
+does not destroy the document; public readers must filter `status=trashed`.
+Scheduling is accepted only for approved content and requires a timezone; a
+past timestamp is published on the next scheduler tick, while trashed rows
+are never eligible. A no-op save creates no revision, and the first update of
+an imported row snapshots its prior state. Redirects are consulted only after
+the route returns 404 and self/chain redirects are rejected. Preview tokens
+are short-lived HMAC-signed tokens; preview responses must use a real preview
+URL with `noindex`, `X-Robots-Tag: noindex`, and `Cache-Control: no-store`.
+Never place the secret in source control or generated reports. See the
+provider-neutral [MaggieDash contract set](../../contracts/maggiedash/README.md).
+
+Reusable arrangements are stored without page-specific section IDs and expand
+into ordinary editable sections with fresh IDs on every insert. Use the
+machine-readable section catalogue before asking a model to plan copy:
+
+```bash
+maggie dash sections validate --registry templates/maggiedash/section-registry.json \
+  --sections-file .maggie/sections.json
+maggie dash sections prompt --registry templates/maggiedash/section-registry.json
+maggie dash sections keys --registry templates/maggiedash/section-registry.json \
+  --page-id <page-id> --sections-file .maggie/sections.json
+```
+
+The catalogue declares purpose, usage, placement, repeatability and layout
+limits. Over-limit copy is an editor note; unknown types fail validation.
+Translation keys use stable section IDs, with an array-index fallback only
+until the ordered migration is complete.
+
+After any script or direct adapter write to translation data, invalidate the
+running process before verification. Record the restart and run the rendering
+check afterward:
+
+```bash
+maggie ops restart-gate --manifest .maggie/translation-restart.json
+```
+
+This prevents an in-process cache window from turning correct database state
+into temporarily stale pages and false verification failures.

package/bundled-skills/maggie-deployment/SKILL.md

@@ -63,11 +63,15 @@ Generate a reviewable VPS plan and configuration artifacts locally:
 python3 tools/clis/maggie_deployment.py /path/to/project \
   --vps-plan --domain example.co.uk --service example \
   --release-root /var/www/example \
-  --plan-dir .maggie/deployment/vps-staging
+  --plan-dir .maggie/deployment/vps-staging \
+  --runner-output .maggie/deployment/vps-staging/release-runner.sh
 ```
 
 The output contains only the immutable release/current layout, systemd unit,
-Nginx reverse-proxy config, health commands and rollback command. It never
+Nginx reverse-proxy config, health commands, rollback command, and an ordered
+reviewable release runner. The runner keeps migrations before the symlink flip,
+carries `.agents`/`.claude` state, restarts before verification, and prunes to
+the current release plus one rollback candidate. It never
 contains credentials and never SSHs, changes DNS, restarts systemd or deploys.
 
 VPS plans include a bounded retention policy: keep two immutable releases,
@@ -136,6 +140,20 @@ MaggieDash schema compatibility, and live runtime security-header checks. It wri
 `.maggie/release-preflight.json`; a failed gate blocks release. It never
 deploys, migrates, publishes, or sends provider requests.
 
+Generate a repeatable VPS runner as part of the plan. A deploy step that exists
+only in an operator's shell history is not a release contract:
+
+```bash
+python3 tools/clis/maggie_deployment.py /path/to/project \
+  --vps-plan --domain example.co.uk --service example \
+  --release-root /var/www/example \
+  --runner-output .maggie/deployment/release-runner.sh
+```
+
+Review the generated runner before execution. Its order is install → typecheck
+→ migrate → build → carry agent state → switch → restart → verify → prune;
+retention keeps the current release and one rollback candidate.
+
 Production additionally requires `docs/deployment-rollback-smoke.json` with
 `passed: true`, `environment: production`, a non-empty `previousRelease`, and
 `testedAt`. A rollback command in a plan is not proof that the rollback was

package/bundled-skills/maggie-ops/SKILL.md

@@ -220,5 +220,26 @@ The seed manifest must be opt-in, sanitized, and contain non-empty fixtures;
 an empty dev database is not evidence that an operational check passed.
 Known Maggie/toolchain traffic can be measured without polluting first-party
 analytics using `maggie analytics traffic-audit --events events.json`. The
-classifier excludes only explicit tool/test markers and never infers identity
-from IP or private fields.
+classifier must run before every measurement channel, including page views,
+404/not-found rows, redirect hits, booking clicks and audit counters. The
+shared contract is in
+[references/maggiedash-telemetry-contract.md](../../references/maggiedash-telemetry-contract.md);
+it excludes only explicit tool/test markers and never infers identity from IP
+or private fields.
+
+## Agent runtime preflight
+
+Before starting an agent from a dashboard, run the runtime preflight and show
+its warnings to the operator. Terminal output must be stripped of ANSI escape
+sequences before URL/code parsing. Headless hosts should use device auth and
+state the account prerequisite before starting. Release installs and agent
+conversation state must be carried outside the immutable release directory.
+When continuing a conversation, pass the agent's resume subcommand before
+other arguments; otherwise the CLI may interpret it as a new prompt.
+
+```bash
+maggie ops agent-preflight --output .maggie/agent-runtime-preflight.json
+```
+
+The preflight is advisory about the host environment but its warnings are
+load-bearing operational evidence, not a claim that an agent login succeeded.

package/bundled-skills/maggie-seo-geo/SKILL.md

@@ -19,6 +19,22 @@ Static audit success
 does not establish Google indexing, scroll behavior, responsive visibility,
 or translation quality. Record those as unverified without separate evidence.
 
+Choose verification from the changed surface. An admin-only change still needs
+the admin routes; an API change needs the API responses; a localized change
+needs every affected locale. Declare the matrix and validate explicit evidence
+before release:
+
+```bash
+maggie verification coverage \
+  --contract contracts/maggie-verification/surface-coverage-v1.json \
+  --evidence .maggie/surface-coverage.json
+```
+
+The evidence must contain one observation for every declared surface/locale
+pair with a status and `passed: true`. Public-page checks alone cannot close an
+admin or API change, and one source-language rendering cannot close a
+localized change.
+
 Crawl reports include `summary.byLocaleTemplate` with total, passed, failed
 and failed URLs per declared locale and template. Regions/scripts remain
 distinct (for example en-GB versus en-US). A template is identified only when

package/bundled-templates/maggiedash/dashboard-ui-contract.json

@@ -13,19 +13,20 @@
   "components": [
     {
       "name": "WorkspaceBar",
-      "props": ["workspaceName", "activeSection", "actions", "children"],
+      "props": ["tabs", "active", "onSelect", "lead", "actions"],
       "forbiddenProps": []
     },
     {
       "name": "WorkspaceCard",
-      "props": ["title", "children"],
+      "props": ["children", "className"],
       "forbiddenProps": []
-    },
-    {
-      "name": "ContentTabs",
-      "props": ["tabs", "active", "actions", "children"],
-      "forbiddenProps": ["title", "description"]
     }
   ],
+  "dialogs": {
+    "primitive": "Modal",
+    "overlayPrimitive": "Overlay",
+    "forbiddenSourcePatterns": ["window.confirm(", "window.prompt("],
+    "requiredLiterals": ["role=\"dialog\"", "aria-modal", "Escape", "opener.current"]
+  },
   "accessibility": ["active tab exposes aria-selected", "actions have accessible names", "workspace navigation has a landmark"]
 }

package/bundled-templates/maggiedash/section-registry.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": "maggiedash-section-registry.v1",
+  "description": "The machine-readable section vocabulary used by page planners and editors.",
+  "sections": [
+    {"type": "hero", "purpose": "Says what the page is about and offers the one important action.", "usage": "First on the page; once.", "position": "opening", "repeatable": false, "fields": [{"name": "title", "usage": "Plain words a visitor would search for.", "limit": 70, "required": true}, {"name": "intro", "usage": "Who it is for and what it does.", "limit": 220}, {"name": "ctaLabel", "usage": "The action as a verb.", "limit": 30}]},
+    {"type": "prose", "purpose": "Explains a topic at length, optionally beside an image.", "usage": "Use in the body for explanation.", "position": "body", "repeatable": true, "fields": [{"name": "heading", "usage": "The argument in a sentence.", "limit": 90}, {"name": "paragraphs", "usage": "Two or three standalone paragraphs.", "limit": 400, "repeats": {"min": 1, "max": 4}}]},
+    {"type": "cards", "purpose": "Presents parallel points side by side.", "usage": "Use for steps or genuinely parallel points.", "position": "body", "repeatable": true, "fields": [{"name": "heading", "usage": "What the cards share.", "limit": 90}, {"name": "items", "usage": "The parallel points.", "limit": 220, "repeats": {"min": 3, "max": 3}}]},
+    {"type": "links", "purpose": "Sends the reader to related pages.", "usage": "Near the end after the page has done its job.", "position": "closing", "repeatable": true, "fields": [{"name": "heading", "usage": "What the links have in common.", "limit": 90}, {"name": "items", "usage": "Real related pages on this site.", "limit": 160, "repeats": {"min": 2, "max": 6}}]},
+    {"type": "faq", "purpose": "Answers questions a visitor would otherwise ask.", "usage": "Once near the end; use real visitor questions.", "position": "closing", "repeatable": false, "fields": [{"name": "heading", "usage": "The question topic.", "limit": 90}, {"name": "items", "usage": "Direct questions and answers.", "limit": 600, "repeats": {"min": 2, "max": 8}}]},
+    {"type": "cta", "purpose": "Makes the closing ask.", "usage": "Last on the page; once.", "position": "closing", "repeatable": false, "fields": [{"name": "heading", "usage": "The invitation in a sentence.", "limit": 90, "required": true}, {"name": "body", "usage": "What happens next.", "limit": 220}, {"name": "label", "usage": "The action as a verb.", "limit": 30, "required": true}]}
+  ]
+}

package/bundled-tools/clis/maggie_agent_content.py

@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+"""Use a short-lived MaggieDash host token for validated content writes."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+from pathlib import Path
+from urllib.error import HTTPError, URLError
+from urllib.request import Request, urlopen
+
+
+SENSITIVE_KEYS = {"databaseUrl", "databaseURL", "password", "secret", "token", "apiKey"}
+
+
+def validate_payload(value: object) -> dict:
+    if not isinstance(value, dict):
+        raise ValueError("payload must be a JSON object")
+    forbidden = sorted(SENSITIVE_KEYS.intersection(value))
+    if forbidden:
+        raise ValueError("payload must not contain credentials; use the short-lived token environment variable")
+    if not value.get("op"):
+        raise ValueError("payload.op is required")
+    return value
+
+
+def write(url: str, token_env: str, payload: dict, timeout: int = 30) -> dict:
+    token = os.environ.get(token_env, "")
+    if not token:
+        raise ValueError(f"{token_env} is not set")
+    request = Request(url, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), method="POST", headers={
+        "Accept": "application/json", "Content-Type": "application/json", "Authorization": f"Bearer {token}",
+    })
+    try:
+        with urlopen(request, timeout=timeout) as response:
+            raw = response.read().decode("utf-8", errors="replace")
+            status = response.status
+    except HTTPError as error:
+        raw = error.read().decode("utf-8", errors="replace")
+        status = error.code
+    except URLError as error:
+        raise RuntimeError("content host could not be reached") from error
+    try:
+        body = json.loads(raw) if raw else {}
+    except json.JSONDecodeError:
+        body = {"error": "host returned non-JSON"}
+    if isinstance(body, dict):
+        for key in SENSITIVE_KEYS:
+            body.pop(key, None)
+    return {"status": status, "passed": 200 <= status < 300, "response": body}
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    sub = parser.add_subparsers(dest="command", required=True)
+    command = sub.add_parser("write", help="POST a validated content operation")
+    command.add_argument("--url", required=True)
+    command.add_argument("--token-env", default="MAGGIE_CONTENT_TOKEN")
+    command.add_argument("--payload", type=Path, required=True)
+    command.add_argument("--timeout", type=int, default=30)
+    args = parser.parse_args()
+    try:
+        payload = validate_payload(json.loads(args.payload.read_text(encoding="utf-8")))
+        result = write(args.url, args.token_env, payload, args.timeout)
+        print(json.dumps(result, ensure_ascii=False, indent=2))
+        return 0 if result["passed"] else 1
+    except (OSError, ValueError, RuntimeError) as error:
+        print(f"agent-content: {error}", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())