@topy-ai/maggie 0.7.30 → 0.7.32

package/README-zh-TW.md

@@ -8,7 +8,7 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.30 init --agent all
+npx @topy-ai/maggie@0.7.32 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 
@@ -25,7 +25,7 @@ maggie doctor --project . --require-bootstrap --strict
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 release 是 `0.7.30`，補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 release 是 `0.7.32`，加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -60,19 +60,29 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 19 installable skills and a local-first MaggieDash foundation.
 
-The current release is `0.7.30`. It keeps the 0.7.29 feature set and adds the
-internal feedback issue closeout gate. The 0.7.29 release fixes npm
-metadata to render this English README as the package landing page. The 0.7.28
-release adds a versioned Gemini model policy with
-an explicit fallback and provenance, bundled-CLI version discovery, and a
-bundled-first dispatcher that avoids stale project wrappers. It also adds
-privacy-safe feedback batch review/duplicate detection, marketplace
-enrichment evidence, bounded booking worker/resolver reports, and read-only
-migration preflight contracts. The release retains the provider-neutral MaggieDash host
-adapter contract, idempotent PostgreSQL starter schema, type-only backend
-boundary, runtime endpoint conformance evidence, safe quota/error summaries,
-stale marketplace readiness revalidation, explicit VPS port/origin planning,
-first-release rollback evidence, and clean non-interactive bootstrap errors.
+The current release is `0.7.32`. It adds explicit one-based feedback batch
+index support, source/freshness/error evidence for MaggieDash measurement
+panels, Consent Mode and actual-write reconciliation contracts, reviewed SEO
+baseline recapture, requested-origin sitemap rebasing, explicit content-diff
+scope, migration-ledger reconciliation, canonical deployment credential
+preflight, unified release provenance, runtime preflight classification,
+design icon-release gating, opt-in blog auto-publish gating, and a
+least-privilege VPS deployer plan. It also restores top-level `maggie
+feedback` dispatch parity. The 0.7.31 release added bounded update diff
+evidence, atomic installer copies, subset-install manifest merge, and
+non-zero doctor failures for inventory drift. The 0.7.30 release added the
+internal feedback issue closeout gate. The 0.7.29 release fixed npm metadata
+to render this English README as the package landing page. The 0.7.28
+release added a versioned Gemini model policy with an explicit fallback and
+provenance, bundled-CLI version discovery, a bundled-first dispatcher that
+avoids stale project wrappers, privacy-safe feedback batch review/duplicate
+detection, marketplace enrichment evidence, bounded booking worker/resolver
+reports, and read-only migration preflight contracts. The release retains the
+provider-neutral MaggieDash host adapter contract, idempotent PostgreSQL
+starter schema, type-only backend boundary, runtime endpoint conformance
+evidence, safe quota/error summaries, stale marketplace readiness
+revalidation, explicit VPS port/origin planning, first-release rollback
+evidence, and clean non-interactive bootstrap errors.
 It retains the host-owned mobile app surface
 contract (`maggie design app-init`/`app-validate`), direct Astro route
 resolution, correlated feedback batches, and runtime package-version capture.
@@ -129,6 +139,16 @@ evidence proves that a dashboard screen mounted and executed its checks, so a
 static component scan cannot pass by itself. MaggieDash hosts may also expose
 the provider-neutral activity-log and managed-navigation contracts.
 
+Measurement panels must report their source, capture time/freshness, and
+independent warning/error state. Validate the host-produced report before
+using it in a release decision:
+
+```bash
+maggie dash panels-validate \
+  --report .maggie/measurement-panels.json \
+  --output docs/measurement-panels-validation.json
+```
+
 The current package also includes reusable safeguards from the latest feedback
 review: `maggie dash api-contract` checks declared request and 2xx response
 shapes; `maggie blog check-gate`/`approve` enforces review before publish;
@@ -249,10 +269,17 @@ maggie ops favicon-check ...      # served favicon behaviour check
 maggie deployment | migration | release | analytics | schedule
 maggie deployment readiness --project PATH
 maggie deployment parity --project PATH --evidence FILE --output FILE
+maggie deployment runtime-preflight --evidence FILE --output FILE
+maggie deployment release-manifest --evidence FILE --output FILE
+maggie deployment credential-preflight [--expected-host HOST]
 maggie migration identity --identity-file FILE [--expected-file FILE]
 maggie migration preflight --evidence FILE [--output FILE]
+maggie migration reconcile --evidence FILE --migration-dir DIR [--output FILE]
 maggie deployment canary --asset URL=SHA256 --render-report report.json
 maggie design icon-inventory --source-dir src --runtime assets/icons.css
+maggie design icon-release-gate --icon-report FILE --browser-report FILE --output FILE
+maggie dash panels-validate --report FILE [--output FILE]
+maggie blog auto-publish-gate --evidence FILE --output FILE
 maggie api lifecycle | site-audit | ops audit
 maggie marketplace enrichment-report --project PATH --input FILE [--output FILE]
 maggie service worker-health --project PATH --evidence FILE [--output FILE]
@@ -318,6 +345,16 @@ The adapter is an argv array, receives a versioned request on stdin, and must
 print only the three review-policy fields. Provider stderr is suppressed and a
 missing local store without an adapter fails closed.
 
+Automated blog publishing stays human-reviewed by default. If a host opts in,
+the gate requires explicit review bypass evidence plus locale, image-alt, SEO,
+sitemap, indexing-notification, and audit checks:
+
+```bash
+maggie blog auto-publish-gate \
+  --evidence .maggie/blog/auto-publish-evidence.json \
+  --output docs/blog-auto-publish-gate.json
+```
+
 ### Design and deployment release gates
 
 Check source-to-runtime icon coverage before shipping a design:
@@ -332,6 +369,17 @@ and is only static name coverage. Pair changed icon controls with a
 browser-runtime `icon-rendered` assertion so the host adapter proves that the
 glyph is visible, has positive dimensions, and has an accessible label.
 
+For a design release, compose the static inventory with browser-painted glyph
+evidence. Every tested icon must be visible, have positive dimensions, expose
+an accessible name, and load successfully:
+
+```bash
+maggie design icon-release-gate \
+  --icon-report docs/icon-inventory.json \
+  --browser-report .maggie/icon-browser-evidence.json \
+  --output docs/icon-release-gate.json
+```
+
 After deployment, compare an immutable asset fingerprint and validate the
 browser adapter's rendered report:
 
@@ -360,6 +408,37 @@ privileges, route API status, stale resident processes, source-job IDs, and
 browser/driver compatibility. Add the resulting report to readiness with
 `--runtime-parity`; a failed report blocks the gate.
 
+Use the runtime preflight to classify dependency, browser, worker, database,
+and route failures independently. A non-pass check must include remediation:
+
+```bash
+maggie deployment runtime-preflight \
+  --evidence .maggie/verification/runtime-preflight-input.json \
+  --output .maggie/verification/runtime-preflight.json
+```
+
+Before activation, reconcile the host's `maggie_schema_migrations` ledger with
+local SQL files. This is read-only and produces an ordered missing-migration
+plan. Deployment credential checks similarly verify only the presence of the
+canonical names, never their values:
+
+```bash
+maggie migration reconcile \
+  --evidence .maggie/migration/ledger.json \
+  --migration-dir migrations \
+  --output docs/migration-reconcile.json
+maggie deployment credential-preflight --expected-host example.com
+```
+
+Finally, combine route, migration, runtime, asset/icon, edge-cache,
+browser/render, and rollback evidence into one release provenance manifest:
+
+```bash
+maggie deployment release-manifest \
+  --evidence .maggie/verification/release-evidence.json \
+  --output docs/release-manifest.json
+```
+
 Unit regression does not establish runtime release readiness. Produce unit
 evidence and then validate all required release evidence slots; add
 `--runtime-parity` when the deployment uses the worker/browser surfaces above:
@@ -419,8 +498,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.30 update --project . --force
-npx @topy-ai/maggie@0.7.30 cleanup --project .
+npx @topy-ai/maggie@0.7.32 update --project . --force
+npx @topy-ai/maggie@0.7.32 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -586,10 +665,13 @@ For related observations, create 1–50 local drafts with shared correlation
 metadata and review them before submitting:
 
 ```bash
-maggie feedback batch --project . --batch-file ./feedback-batch.json
+maggie feedback batch --project . --batch-file ./feedback-batch.json \
+  --batch-base 0
 ```
 
-The batch command never submits automatically or writes active memory.
+The batch command never submits automatically or writes active memory. External
+one-based runners can pass `--batch-base 1`; Maggie stores canonical indexes
+zero-based and validates the final item boundary explicitly.
 
 Aggregate a correlated batch before reviewing individual drafts:
 

package/bin/maggie.js

@@ -1,10 +1,9 @@
 #!/usr/bin/env node
 
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { cp } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
@@ -92,6 +91,7 @@ Usage:
   maggie design app-init --project PATH --route /app/valuation --auth-mode email-password --confirm
   maggie design app-validate --project PATH --plan PATH --runtime-evidence FILE --rendered-dir PATH --confirm
   maggie design icon-inventory --project PATH --source-dir src --runtime assets/icons.css --output docs/icon-inventory.json
+  maggie design icon-release-gate --icon-report FILE --browser-report FILE --output FILE
   maggie design author --project PATH --route /about --purpose TEXT --audience TEXT --confirm
   maggie design in-place --project PATH --route /pricing [--content-source PATH]
   maggie design section --project PATH --route /pricing --section-id ID
@@ -118,6 +118,8 @@ Usage:
   maggie deployment readiness --project PATH
   maggie deployment parity --project PATH --evidence FILE --output FILE
   maggie deployment canary --project PATH --asset URL=SHA256 --render-report report.json --output docs/deployment-canary.json
+  maggie deployment release-manifest --evidence FILE --output FILE
+  maggie deployment runtime-preflight --evidence FILE --output FILE
   maggie migration preflight --evidence FILE --output FILE
   maggie migration --project PATH --environment staging
   maggie migration identity --identity-file FILE [--expected-file FILE]
@@ -169,6 +171,33 @@ function selectedSkills(args) {
   return unique;
 }
 
+function diskSkillNames(root) {
+  const installed = new Set();
+  for (const agentRoot of [join(root, ".agents"), join(root, ".claude")]) {
+    const skillsRoot = join(agentRoot, "skills");
+    if (!existsSync(skillsRoot)) continue;
+    for (const entry of readdirSync(skillsRoot, { withFileTypes: true })) {
+      if (entry.isDirectory() && existsSync(join(skillsRoot, entry.name, "SKILL.md"))) installed.add(entry.name);
+    }
+  }
+  return installed;
+}
+
+function mergedSkillNames(root, selected) {
+  const manifestPath = join(root, STATE_DIR, "install.json");
+  let manifestSkills = [];
+  try {
+    if (existsSync(manifestPath)) {
+      const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+      manifestSkills = Array.isArray(manifest.skills) ? manifest.skills : [];
+    }
+  } catch {
+    manifestSkills = [];
+  }
+  return [...new Set([...manifestSkills, ...diskSkillNames(root), ...selected])]
+    .filter((skill) => SKILL_NAMES.includes(skill)).sort();
+}
+
 function agentRoots(args, root) {
   const requested = option(args, "--agent", "auto");
   if (!["auto", "codex", "claude", "all"].includes(requested)) throw new Error(`unknown agent: ${requested}`);
@@ -184,7 +213,18 @@ function agentRoots(args, root) {
 function copyIfMissing(source, target, force = false) {
   if (existsSync(target) && !force) return "skipped";
   mkdirSync(dirname(target), { recursive: true });
-  cp(source, target, { recursive: true, force });
+  if (existsSync(target)) {
+    cpSync(source, target, { recursive: true, force });
+    return "installed";
+  }
+  const staging = join(dirname(target), `.${basename(target)}.maggie-copy-${process.pid}-${Date.now()}`);
+  try {
+    cpSync(source, staging, { recursive: true, force: true });
+    renameSync(staging, target);
+  } catch (error) {
+    rmSync(staging, { recursive: true, force: true });
+    throw error;
+  }
   return "installed";
 }
 
@@ -192,6 +232,56 @@ function digest(path) {
   return createHash("sha256").update(readFileSync(path)).digest("hex");
 }
 
+function diffSummary(source, target) {
+  const packageBuffer = readFileSync(source);
+  const localBuffer = readFileSync(target);
+  if (packageBuffer.includes(0) || localBuffer.includes(0)) return "binary content differs";
+  const packageLines = packageBuffer.toString("utf8").split(/\r?\n/);
+  const localLines = localBuffer.toString("utf8").split(/\r?\n/);
+  const limit = 2000;
+  if (packageLines.length > limit || localLines.length > limit) {
+    return `text differs (${localLines.length} local lines vs ${packageLines.length} package lines; diff bounded at ${limit} lines)`;
+  }
+  let packageIndex = 0;
+  let localIndex = 0;
+  let added = 0;
+  let removed = 0;
+  let blocks = 0;
+  while (packageIndex < packageLines.length || localIndex < localLines.length) {
+    if (packageIndex >= packageLines.length) {
+      added += localLines.length - localIndex;
+      blocks++;
+      break;
+    }
+    if (localIndex >= localLines.length) {
+      removed += packageLines.length - packageIndex;
+      blocks++;
+      break;
+    }
+    if (packageLines[packageIndex] === localLines[localIndex]) {
+      packageIndex++;
+      localIndex++;
+      continue;
+    }
+    const packageNext = packageLines.slice(packageIndex, packageIndex + 40).findIndex((line, offset) => line === localLines[localIndex]);
+    const localNext = localLines.slice(localIndex, localIndex + 40).findIndex((line, offset) => line === packageLines[packageIndex]);
+    if (packageNext >= 0 && (localNext < 0 || packageNext <= localNext)) {
+      removed += packageNext || 1;
+      packageIndex += packageNext || 1;
+    } else if (localNext >= 0) {
+      added += localNext || 1;
+      localIndex += localNext || 1;
+    } else {
+      removed++;
+      added++;
+      packageIndex++;
+      localIndex++;
+    }
+    blocks++;
+  }
+  return `${added} local additions, ${removed} package lines removed across ${blocks} changed blocks (${localLines.length} local lines vs ${packageLines.length} package lines)`;
+}
+
 function syncTree(source, target, force) {
   let changed = 0;
   for (const entry of readdirSync(source, { withFileTypes: true })) {
@@ -211,7 +301,7 @@ function syncTree(source, target, force) {
       console.log(`updated ${targetPath}`);
       changed++;
     } else {
-      console.log(`preserved ${targetPath} (local changes; use --force to replace)`);
+      console.log(`preserved ${targetPath} (local changes; ${diffSummary(sourcePath, targetPath)}; use --force to replace)`);
     }
   }
   return changed;
@@ -248,7 +338,7 @@ function install(args) {
   if (existsSync(join(TEMPLATES_ROOT, "maggiedash"))) copyIfMissing(join(TEMPLATES_ROOT, "maggiedash"), join(root, "templates", "maggiedash"));
   const stateDir = join(root, ".maggie");
   mkdirSync(stateDir, { recursive: true });
-  writeFileSync(join(stateDir, "install.json"), JSON.stringify({ version: PACKAGE_VERSION, agents: roots.map((item) => item.slice(root.length + 1)), skills, installed_at: new Date().toISOString() }, null, 2) + "\n");
+  writeFileSync(join(stateDir, "install.json"), JSON.stringify({ version: PACKAGE_VERSION, agents: roots.map((item) => item.slice(root.length + 1)), skills: mergedSkillNames(root, skills), installed_at: new Date().toISOString() }, null, 2) + "\n");
   console.log(`Maggie installed in ${root}`);
   console.log("Run `maggie doctor --project .` before using mutating workflows.");
 }
@@ -285,7 +375,7 @@ function update(args) {
   if (existsSync(join(TEMPLATES_ROOT, "maggiedash")) && existsSync(join(root, "templates", "maggiedash"))) updated += syncTree(join(TEMPLATES_ROOT, "maggiedash"), join(root, "templates", "maggiedash"), force);
   const stateDir = join(root, STATE_DIR);
   mkdirSync(stateDir, { recursive: true });
-  writeFileSync(join(stateDir, "install.json"), JSON.stringify({ version: PACKAGE_VERSION, agents: roots.map((item) => item.slice(root.length + 1)), skills, updated_at: new Date().toISOString() }, null, 2) + "\n");
+  writeFileSync(join(stateDir, "install.json"), JSON.stringify({ version: PACKAGE_VERSION, agents: roots.map((item) => item.slice(root.length + 1)), skills: mergedSkillNames(root, skills), updated_at: new Date().toISOString() }, null, 2) + "\n");
   console.log(`Maggie update complete: ${updated} files changed`);
   if (!force) console.log("Local files with changes were preserved. Review the output and rerun with --force only when replacement is intended.");
 }
@@ -359,19 +449,14 @@ function doctor(args) {
   let manifest = null;
   try { if (existsSync(manifestPath)) manifest = JSON.parse(readFileSync(manifestPath, "utf8")); } catch { manifest = null; }
   const expected = Array.isArray(manifest?.skills) ? [...new Set(manifest.skills)] : null;
-  const installed = [];
-  const installedNames = new Set();
-  for (const agentRoot of [join(root, ".agents"), join(root, ".claude")]) {
-    for (const skill of SKILL_NAMES) if (existsSync(join(agentRoot, "skills", skill, "SKILL.md"))) {
-      installed.push(`${agentRoot}/${skill}`);
-      installedNames.add(skill);
-    }
-  }
+  const installedNames = diskSkillNames(root);
   const missing = expected ? expected.filter((skill) => !installedNames.has(skill)) : [];
-  const inventoryState = expected && missing.length ? "INCOMPLETE" : "PASS";
-  console.log(`${inventoryState} skill-inventory manifest=${expected?.length ?? "unknown"} on-disk=${installedNames.size}${missing.length ? ` missing=${missing.join(",")}` : ""}`);
+  const extra = expected ? [...installedNames].filter((skill) => !expected.includes(skill)).sort() : [];
+  const inventoryState = expected && (missing.length || extra.length) ? "INCOMPLETE" : "PASS";
+  console.log(`${inventoryState} skill-inventory manifest=${expected?.length ?? "unknown"} on-disk=${installedNames.size}${missing.length ? ` missing=${missing.join(",")}` : ""}${extra.length ? ` extra=${extra.join(",")}` : ""}`);
   console.log(`INFO installed-skills=${installedNames.size}`);
   console.log("INFO doctor is diagnostic; bootstrap completion remains a project decision gate.");
+  if (inventoryState === "INCOMPLETE") process.exitCode = 1;
 }
 
 function remove(args) {
@@ -422,6 +507,7 @@ try {
   else if (command === "clone") workflowCli("maggie_clone.py", args);
   else if (command === "clone-to-template") workflowCli("maggie_clone_to_template.py", args);
   else if (command === "design" && args[0] === "icon-inventory") workflowCli("maggie_icon_inventory.py", args.slice(1));
+  else if (command === "design" && args[0] === "icon-release-gate") workflowCli("maggie_icon_release_gate.py", args.slice(1));
   else if (command === "design") workflowCli("maggie_design.py", args);
   else if (command === "auth") workflowCli("maggie_auth.py", args);
   else if (command === "blog") workflowCli("maggie_blog.py", args);
@@ -432,6 +518,8 @@ try {
   else if (command === "deployment" && args[0] === "canary") workflowCli("maggie_deployment_canary.py", args.slice(1));
   else if (command === "deployment" && args[0] === "readiness") workflowCli("maggie_deployment_readiness.py", args.slice(1));
   else if (command === "deployment" && args[0] === "parity") workflowCli("maggie_deployment_parity.py", args.slice(1));
+  else if (command === "deployment" && args[0] === "release-manifest") workflowCli("maggie_release_manifest.py", args.slice(1));
+  else if (command === "deployment" && args[0] === "runtime-preflight") workflowCli("maggie_runtime_preflight.py", args.slice(1));
   else if (command === "deployment") workflowCli("maggie_deployment.py", args);
   else if (command === "migration") workflowCli("maggie_migration.py", args);
   else if (command === "schedule") workflowCli("maggie_schedule.py", args);

package/bundled-references/google-integrations-runbook.md

@@ -52,6 +52,32 @@ The validator accepts the complete provider allowlist, but a capability is
 verified only when its corresponding required scope is present. Scope presence
 alone never proves product access.
 
+### GTM operation scope matrix
+
+Request the union of the rows needed by one operation; do not use a broad
+scope merely because a later operation might need it:
+
+| GTM operation | Minimum OAuth scope |
+|---|---|
+| List/read account, container, tag, trigger, or variable | `https://www.googleapis.com/auth/tagmanager.readonly` |
+| Edit container configuration | `https://www.googleapis.com/auth/tagmanager.edit.containers` |
+| Create or update a container version | `https://www.googleapis.com/auth/tagmanager.edit.containerversions` |
+| Publish a container version | `https://www.googleapis.com/auth/tagmanager.publish` |
+
+An operation that edits a container and creates a version must request both
+edit scopes; publishing additionally requires the publish scope. Record the
+operation name and exact scope union in the capability evidence so a successful
+read cannot be mistaken for edit or publish access.
+
+### Missing fields are unknown
+
+Google APIs can omit fields, especially when a proto3 field is absent from the
+response or was not selected by the request. An omitted boolean is not
+`false`, and an absent schema field is not evidence that the capability is
+disabled. Reports must use `unknown`/`not_observed` in the provider adapter's
+evidence and obtain a corroborating read or time-series observation before
+making a negative claim. Never silently coerce a missing field to `false`.
+
 ## Provider setup and read-only preflight
 
 1. Select one provider and one resource. Enable only that provider API in the

package/bundled-skills/maggie-blog/SKILL.md

@@ -54,7 +54,24 @@ explicit `approve` transition before `publish`. Stable `contentId` is the
 ingest identity and a published slug must not change during a rewrite.
 Search/sort views are not indexable; drafts never appear in public routes, RSS,
 or sitemap output. Provider keys remain server-side. Public publication and
-	migrations always require explicit confirmation.
+ migrations always require explicit confirmation.
+
+Automatic publication is an opt-in host policy, not the default. Keep human
+review enabled unless the owner explicitly chooses otherwise. If a host has
+that approval, validate its evidence before its scheduler calls the host's
+publish path:
+
+```bash
+maggie blog auto-publish-gate \
+  --evidence .maggie/blog-auto-publish-evidence.json \
+  --output .maggie/blog-auto-publish-gate.json
+```
+
+The `maggie-blog-auto-publish.v1` evidence must explicitly set `optIn: true`
+and `reviewDisabledExplicitly: true`, then pass locale variants, feature image
+and alt text, SEO fields, sitemap generation, indexing notification, and audit
+checks. The gate never publishes; missing evidence keeps content in human
+review and remains non-indexable.
 
 The adapter runs as an argv array without a shell, receives a versioned request
 on stdin, and must print only an object containing

package/bundled-skills/maggie-dash/SKILL.md

@@ -80,6 +80,14 @@ This is a runtime contract gate, not a source-only check; it fails when a
 declared endpoint is missing, uses the wrong route/method, returns a non-2xx
 status or omits required fields.
 
+For analytics panels and Consent Mode, keep the same evidence boundary: the
+default consent state must be written before the container loads, first-party
+storage behavior must be explicitly `stop` or `degrade`, and intentional form
+events must be declared separately as `record` or `omit`. A browser report must
+prove each decision; an absent field is unknown and must not be interpreted as
+false. Run the analytics release gate when the dashboard or host measurement
+contract changes.
+
 MaggieDash 0.2.4 adds two reusable operator workspaces. Activity is a read-only
 view backed by `/api/maggie/activity.json`; it supports actor/action filters,
 refresh, and a safe unavailable state. Navigation is an ordered,
@@ -255,6 +263,10 @@ maggie dash schema-audit --inventory .maggie/schema-inventory.json \
 # Prove a browser check mounted the screen and executed its data calls:
 maggie dash ui runtime-validate --evidence .maggie/dashboard-runtime.json
 
+# Validate independent dashboard measurement panels and freshness evidence:
+maggie dash panels-validate --report .maggie/measurement-panels.json \
+  --output .maggie/measurement-panels-result.json
+
 # Classify docs, show inbound references and completed progress trackers:
 maggie docs audit --project . --docs-dir docs \
   --output docs/documentation-audit.json
@@ -339,9 +351,12 @@ category, collection, or service reference; an unresolved binding is a publish
 failure, not an empty state.
 
 Repair scripts must select all candidates, compare every target field, write
-only changed rows, and report both changed and unchanged rows. Validate that
-contract with `idempotency-validate`; a query that selects only rows that look
-unconverted cannot repair its own bad output.
+only changed rows, and report both changed and unchanged rows. Each step must
+also return a boolean `wrote`; the summary's `writes` count is the number of
+true outcomes, not the number of executed steps. The shared section reconcile
+command exposes `writeCount`, `unchangedCount`, and `writeOutcome` for this
+purpose. Validate the repair contract with `idempotency-validate`; a query
+that selects only rows that look unconverted cannot repair its own bad output.
 
 After any script or direct adapter write to translation data, invalidate the
 running process before verification. Record the restart and run the rendering

package/bundled-skills/maggie-deployment/SKILL.md

@@ -88,6 +88,36 @@ not fabricate browser, rendered, or deployment evidence and does not deploy
 from this command. See
 [`readiness-v1.schema.json`](../../bundled-contracts/maggie-deployment/readiness-v1.schema.json).
 
+Classify host/runtime failures before a release can move:
+
+```bash
+maggie deployment runtime-preflight \
+  --evidence .maggie/verification/runtime-preflight-input.json \
+  --output .maggie/verification/runtime-preflight.json
+```
+
+The `maggie-runtime-preflight.v1` input has independent checks for
+dependencies, browser/driver compatibility, worker configuration, database
+privileges, and routes/API. Each non-pass status must include an actionable
+remediation. Missing checks are `unknown` and fail closed; the command never
+connects to a host or mutates runtime state.
+
+Before production approval, compose one cross-workflow manifest from the
+sanitized outputs of the route, migration, runtime, asset/icon, edge-cache,
+browser/render, and rollback checks:
+
+```bash
+maggie deployment release-manifest \
+  --evidence .maggie/release-evidence.json \
+  --output .maggie/release-manifest.json
+```
+
+The `maggie-release-evidence.v1` input links the release commit and Maggie
+version to every required evidence slot and release fingerprint. The validator
+fails if any slot is missing or not passed, keeps only normalized metadata, and
+records `mutation: "not executed"`; it does not deploy or claim that a check
+was run.
+
 ## Automatic memory hook
 
 Follow [Maggie Memory Hook](../../references/memory-hook.md) at invocation and completion.
@@ -115,6 +145,22 @@ This command never deploys. Production execution still requires the shared
 decision loop, explicit confirmation, migration/rollback details, and the
 provider-specific deploy command.
 
+For a VPS adapter, check the project `.env` by variable name before reporting
+credentials as unavailable:
+
+```bash
+maggie deployment credential-preflight \
+  --env-file .env --expected-host example-host \
+  --output .maggie/deployment/credentials.json
+```
+
+The preflight checks `DEPLOY_SERVER_IP`, `DEPLOY_SERVER_SSH_USER`,
+`DEPLOY_SERVER_SSH_PASSWORD`, and `DEPLOY_SERVER_SSH_SUDOER` by presence only.
+It never prints or stores values. `--expected-host` is optional, but should be
+used for production to prevent deploying to an unintended server. SSH-key
+adapters may use their own named secret contract; map it explicitly in their
+local plan.
+
 When deployment verification depends on Google properties or accounts, use
 the shared [Google integrations runbook](../../references/google-integrations-runbook.md).
 Keep provider auth and capability evidence separate from deployment health;
@@ -146,6 +192,15 @@ carries `.agents`/`.claude` state, restarts before verification, and prunes to
 the current release plus one rollback candidate. It never
 contains credentials and never SSHs, changes DNS, restarts systemd or deploys.
 
+VPS plans use a dedicated deployer account by default:
+`--deployer-user maggie-deploy`. The generated sudoers contract permits only
+the exact `/bin/systemctl restart <service>` and
+`/bin/systemctl is-active <service>` commands for the named service. Release
+files and the application remain separated (`maggie-deploy` versus
+`www-data`); no wildcard, shell, `sudo su`, or broad root command is generated.
+Install and review that narrow sudoers policy on the host before executing a
+runner.
+
 VPS plans include a bounded retention policy: keep two immutable releases,
 preserve the `current` target and rollback target, and review prune candidates
 before any operator executes cleanup. Generate a read-only candidate report:
@@ -186,6 +241,23 @@ The gate fails on a missing or mismatched target identity and never executes a
 migration. A successful connection alone is not proof that the intended
 database was selected.
 
+Before activation, reconcile the host's migration ledger rather than relying
+on a remembered local migration list:
+
+```bash
+maggie migration reconcile \
+  --evidence .maggie/migration/server-ledger.json \
+  --migration-dir migrations \
+  --output .maggie/migration/ledger-reconcile.json
+```
+
+The host adapter must query `maggie_schema_migrations` and emit only the
+version identifiers and environment. The read-only command orders local
+numbered SQL files, reports `missing`, and remains `mutation: "not executed"`.
+Apply every missing file through the host migration runner, re-read the ledger,
+and only then continue to the release switch; a missing version is a failed
+deployment preflight, not evidence that activation can proceed.
+
 If a release depends on existing rows or seeded data, set
 `dataDependencies: true` in `.maggie/migration-manifest.json` and provide
 `.maggie/deployment/data-release.json` before deployment. The checkpoint must

package/bundled-skills/maggie-deployment/references/vps.md

@@ -39,6 +39,19 @@ owner before any remote mutation.
 
 ### SSH and secret-source contract
 
+First run the shared credential presence check against the project `.env`:
+
+```bash
+maggie deployment credential-preflight --env-file .env \
+  --expected-host example-host
+```
+
+The canonical password-based names are `DEPLOY_SERVER_IP`,
+`DEPLOY_SERVER_SSH_USER`, `DEPLOY_SERVER_SSH_PASSWORD`, and
+`DEPLOY_SERVER_SSH_SUDOER`. The command reports only presence and an optional
+host match; it never prints a value. A provider may instead use an SSH key, but
+must state that alternate name and source in its plan.
+
 Use these canonical project variables when a VPS adapter is configured:
 
 | Variable | Meaning | Precedence |
@@ -86,6 +99,19 @@ The generated Nginx/Astro boundary keeps `checkOrigin` enabled and requires
 canonical HTTPS `allowedDomains` plus trusted `X-Forwarded-Host`/
 `X-Forwarded-Proto` handling when TLS terminates at the proxy.
 
+Use a dedicated least-privilege deployer when generating the plan:
+
+```bash
+python3 tools/clis/maggie_deployment.py . --vps-plan \
+  --domain example.co.uk --service example --node-port 4321 \
+  --deployer-user maggie-deploy
+```
+
+The plan separates the SSH/deploy account from the `www-data` application
+account and allowlists only the exact service restart and status commands.
+The runner uses non-interactive `sudo -n`; it never requires broad sudo or a
+shell escalation. Review/install the host sudoers entry separately.
+
 Review the generated systemd and Nginx files, then obtain explicit approval
 before installing them on a host.