@topy-ai/maggie 0.7.31 → 0.7.33

package/README-zh-TW.md

@@ -8,7 +8,7 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.31 init --agent all
+npx @topy-ai/maggie@0.7.33 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 
@@ -25,7 +25,7 @@ maggie doctor --project . --require-bootstrap --strict
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 release 是 `0.7.31`，加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 release 是 `0.7.33`，記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -60,21 +60,31 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 19 installable skills and a local-first MaggieDash foundation.
 
-The current release is `0.7.31`. It keeps the 0.7.30 feature set and adds
-bounded update diff evidence, atomic installer copies, subset-install manifest
-merge, and non-zero doctor failures for inventory drift. The 0.7.30 release
-adds the internal feedback issue closeout gate. The 0.7.29 release fixes npm
-metadata to render this English README as the package landing page. The 0.7.28
-release adds a versioned Gemini model policy with
-an explicit fallback and provenance, bundled-CLI version discovery, and a
-bundled-first dispatcher that avoids stale project wrappers. It also adds
-privacy-safe feedback batch review/duplicate detection, marketplace
-enrichment evidence, bounded booking worker/resolver reports, and read-only
-migration preflight contracts. The release retains the provider-neutral MaggieDash host
-adapter contract, idempotent PostgreSQL starter schema, type-only backend
-boundary, runtime endpoint conformance evidence, safe quota/error summaries,
-stale marketplace readiness revalidation, explicit VPS port/origin planning,
-first-release rollback evidence, and clean non-interactive bootstrap errors.
+The current release is `0.7.33`. It records the reviewed correction for the
+batch-index feedback workflow while keeping the verified 0.7.32 behavior
+unchanged. The 0.7.32 release added explicit one-based feedback batch index
+support, source/freshness/error evidence for MaggieDash measurement
+panels, Consent Mode and actual-write reconciliation contracts, reviewed SEO
+baseline recapture, requested-origin sitemap rebasing, explicit content-diff
+scope, migration-ledger reconciliation, canonical deployment credential
+preflight, unified release provenance, runtime preflight classification,
+design icon-release gating, opt-in blog auto-publish gating, and a
+least-privilege VPS deployer plan. It also restores top-level `maggie
+feedback` dispatch parity. The 0.7.31 release added bounded update diff
+evidence, atomic installer copies, subset-install manifest merge, and
+non-zero doctor failures for inventory drift. The 0.7.30 release added the
+internal feedback issue closeout gate. The 0.7.29 release fixed npm metadata
+to render this English README as the package landing page. The 0.7.28
+release added a versioned Gemini model policy with an explicit fallback and
+provenance, bundled-CLI version discovery, a bundled-first dispatcher that
+avoids stale project wrappers, privacy-safe feedback batch review/duplicate
+detection, marketplace enrichment evidence, bounded booking worker/resolver
+reports, and read-only migration preflight contracts. The release retains the
+provider-neutral MaggieDash host adapter contract, idempotent PostgreSQL
+starter schema, type-only backend boundary, runtime endpoint conformance
+evidence, safe quota/error summaries, stale marketplace readiness
+revalidation, explicit VPS port/origin planning, first-release rollback
+evidence, and clean non-interactive bootstrap errors.
 It retains the host-owned mobile app surface
 contract (`maggie design app-init`/`app-validate`), direct Astro route
 resolution, correlated feedback batches, and runtime package-version capture.
@@ -131,6 +141,16 @@ evidence proves that a dashboard screen mounted and executed its checks, so a
 static component scan cannot pass by itself. MaggieDash hosts may also expose
 the provider-neutral activity-log and managed-navigation contracts.
 
+Measurement panels must report their source, capture time/freshness, and
+independent warning/error state. Validate the host-produced report before
+using it in a release decision:
+
+```bash
+maggie dash panels-validate \
+  --report .maggie/measurement-panels.json \
+  --output docs/measurement-panels-validation.json
+```
+
 The current package also includes reusable safeguards from the latest feedback
 review: `maggie dash api-contract` checks declared request and 2xx response
 shapes; `maggie blog check-gate`/`approve` enforces review before publish;
@@ -251,10 +271,17 @@ maggie ops favicon-check ...      # served favicon behaviour check
 maggie deployment | migration | release | analytics | schedule
 maggie deployment readiness --project PATH
 maggie deployment parity --project PATH --evidence FILE --output FILE
+maggie deployment runtime-preflight --evidence FILE --output FILE
+maggie deployment release-manifest --evidence FILE --output FILE
+maggie deployment credential-preflight [--expected-host HOST]
 maggie migration identity --identity-file FILE [--expected-file FILE]
 maggie migration preflight --evidence FILE [--output FILE]
+maggie migration reconcile --evidence FILE --migration-dir DIR [--output FILE]
 maggie deployment canary --asset URL=SHA256 --render-report report.json
 maggie design icon-inventory --source-dir src --runtime assets/icons.css
+maggie design icon-release-gate --icon-report FILE --browser-report FILE --output FILE
+maggie dash panels-validate --report FILE [--output FILE]
+maggie blog auto-publish-gate --evidence FILE --output FILE
 maggie api lifecycle | site-audit | ops audit
 maggie marketplace enrichment-report --project PATH --input FILE [--output FILE]
 maggie service worker-health --project PATH --evidence FILE [--output FILE]
@@ -320,6 +347,16 @@ The adapter is an argv array, receives a versioned request on stdin, and must
 print only the three review-policy fields. Provider stderr is suppressed and a
 missing local store without an adapter fails closed.
 
+Automated blog publishing stays human-reviewed by default. If a host opts in,
+the gate requires explicit review bypass evidence plus locale, image-alt, SEO,
+sitemap, indexing-notification, and audit checks:
+
+```bash
+maggie blog auto-publish-gate \
+  --evidence .maggie/blog/auto-publish-evidence.json \
+  --output docs/blog-auto-publish-gate.json
+```
+
 ### Design and deployment release gates
 
 Check source-to-runtime icon coverage before shipping a design:
@@ -334,6 +371,17 @@ and is only static name coverage. Pair changed icon controls with a
 browser-runtime `icon-rendered` assertion so the host adapter proves that the
 glyph is visible, has positive dimensions, and has an accessible label.
 
+For a design release, compose the static inventory with browser-painted glyph
+evidence. Every tested icon must be visible, have positive dimensions, expose
+an accessible name, and load successfully:
+
+```bash
+maggie design icon-release-gate \
+  --icon-report docs/icon-inventory.json \
+  --browser-report .maggie/icon-browser-evidence.json \
+  --output docs/icon-release-gate.json
+```
+
 After deployment, compare an immutable asset fingerprint and validate the
 browser adapter's rendered report:
 
@@ -362,6 +410,37 @@ privileges, route API status, stale resident processes, source-job IDs, and
 browser/driver compatibility. Add the resulting report to readiness with
 `--runtime-parity`; a failed report blocks the gate.
 
+Use the runtime preflight to classify dependency, browser, worker, database,
+and route failures independently. A non-pass check must include remediation:
+
+```bash
+maggie deployment runtime-preflight \
+  --evidence .maggie/verification/runtime-preflight-input.json \
+  --output .maggie/verification/runtime-preflight.json
+```
+
+Before activation, reconcile the host's `maggie_schema_migrations` ledger with
+local SQL files. This is read-only and produces an ordered missing-migration
+plan. Deployment credential checks similarly verify only the presence of the
+canonical names, never their values:
+
+```bash
+maggie migration reconcile \
+  --evidence .maggie/migration/ledger.json \
+  --migration-dir migrations \
+  --output docs/migration-reconcile.json
+maggie deployment credential-preflight --expected-host example.com
+```
+
+Finally, combine route, migration, runtime, asset/icon, edge-cache,
+browser/render, and rollback evidence into one release provenance manifest:
+
+```bash
+maggie deployment release-manifest \
+  --evidence .maggie/verification/release-evidence.json \
+  --output docs/release-manifest.json
+```
+
 Unit regression does not establish runtime release readiness. Produce unit
 evidence and then validate all required release evidence slots; add
 `--runtime-parity` when the deployment uses the worker/browser surfaces above:
@@ -421,8 +500,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.31 update --project . --force
-npx @topy-ai/maggie@0.7.31 cleanup --project .
+npx @topy-ai/maggie@0.7.33 update --project . --force
+npx @topy-ai/maggie@0.7.33 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -588,10 +667,13 @@ For related observations, create 1–50 local drafts with shared correlation
 metadata and review them before submitting:
 
 ```bash
-maggie feedback batch --project . --batch-file ./feedback-batch.json
+maggie feedback batch --project . --batch-file ./feedback-batch.json \
+  --batch-base 0
 ```
 
-The batch command never submits automatically or writes active memory.
+The batch command never submits automatically or writes active memory. External
+one-based runners can pass `--batch-base 1`; Maggie stores canonical indexes
+zero-based and validates the final item boundary explicitly.
 
 Aggregate a correlated batch before reviewing individual drafts:
 

package/bin/maggie.js

@@ -91,6 +91,7 @@ Usage:
   maggie design app-init --project PATH --route /app/valuation --auth-mode email-password --confirm
   maggie design app-validate --project PATH --plan PATH --runtime-evidence FILE --rendered-dir PATH --confirm
   maggie design icon-inventory --project PATH --source-dir src --runtime assets/icons.css --output docs/icon-inventory.json
+  maggie design icon-release-gate --icon-report FILE --browser-report FILE --output FILE
   maggie design author --project PATH --route /about --purpose TEXT --audience TEXT --confirm
   maggie design in-place --project PATH --route /pricing [--content-source PATH]
   maggie design section --project PATH --route /pricing --section-id ID
@@ -117,6 +118,8 @@ Usage:
   maggie deployment readiness --project PATH
   maggie deployment parity --project PATH --evidence FILE --output FILE
   maggie deployment canary --project PATH --asset URL=SHA256 --render-report report.json --output docs/deployment-canary.json
+  maggie deployment release-manifest --evidence FILE --output FILE
+  maggie deployment runtime-preflight --evidence FILE --output FILE
   maggie migration preflight --evidence FILE --output FILE
   maggie migration --project PATH --environment staging
   maggie migration identity --identity-file FILE [--expected-file FILE]
@@ -504,6 +507,7 @@ try {
   else if (command === "clone") workflowCli("maggie_clone.py", args);
   else if (command === "clone-to-template") workflowCli("maggie_clone_to_template.py", args);
   else if (command === "design" && args[0] === "icon-inventory") workflowCli("maggie_icon_inventory.py", args.slice(1));
+  else if (command === "design" && args[0] === "icon-release-gate") workflowCli("maggie_icon_release_gate.py", args.slice(1));
   else if (command === "design") workflowCli("maggie_design.py", args);
   else if (command === "auth") workflowCli("maggie_auth.py", args);
   else if (command === "blog") workflowCli("maggie_blog.py", args);
@@ -514,6 +518,8 @@ try {
   else if (command === "deployment" && args[0] === "canary") workflowCli("maggie_deployment_canary.py", args.slice(1));
   else if (command === "deployment" && args[0] === "readiness") workflowCli("maggie_deployment_readiness.py", args.slice(1));
   else if (command === "deployment" && args[0] === "parity") workflowCli("maggie_deployment_parity.py", args.slice(1));
+  else if (command === "deployment" && args[0] === "release-manifest") workflowCli("maggie_release_manifest.py", args.slice(1));
+  else if (command === "deployment" && args[0] === "runtime-preflight") workflowCli("maggie_runtime_preflight.py", args.slice(1));
   else if (command === "deployment") workflowCli("maggie_deployment.py", args);
   else if (command === "migration") workflowCli("maggie_migration.py", args);
   else if (command === "schedule") workflowCli("maggie_schedule.py", args);

package/bundled-references/google-integrations-runbook.md

@@ -52,6 +52,32 @@ The validator accepts the complete provider allowlist, but a capability is
 verified only when its corresponding required scope is present. Scope presence
 alone never proves product access.
 
+### GTM operation scope matrix
+
+Request the union of the rows needed by one operation; do not use a broad
+scope merely because a later operation might need it:
+
+| GTM operation | Minimum OAuth scope |
+|---|---|
+| List/read account, container, tag, trigger, or variable | `https://www.googleapis.com/auth/tagmanager.readonly` |
+| Edit container configuration | `https://www.googleapis.com/auth/tagmanager.edit.containers` |
+| Create or update a container version | `https://www.googleapis.com/auth/tagmanager.edit.containerversions` |
+| Publish a container version | `https://www.googleapis.com/auth/tagmanager.publish` |
+
+An operation that edits a container and creates a version must request both
+edit scopes; publishing additionally requires the publish scope. Record the
+operation name and exact scope union in the capability evidence so a successful
+read cannot be mistaken for edit or publish access.
+
+### Missing fields are unknown
+
+Google APIs can omit fields, especially when a proto3 field is absent from the
+response or was not selected by the request. An omitted boolean is not
+`false`, and an absent schema field is not evidence that the capability is
+disabled. Reports must use `unknown`/`not_observed` in the provider adapter's
+evidence and obtain a corroborating read or time-series observation before
+making a negative claim. Never silently coerce a missing field to `false`.
+
 ## Provider setup and read-only preflight
 
 1. Select one provider and one resource. Enable only that provider API in the

package/bundled-skills/maggie-blog/SKILL.md

@@ -54,7 +54,24 @@ explicit `approve` transition before `publish`. Stable `contentId` is the
 ingest identity and a published slug must not change during a rewrite.
 Search/sort views are not indexable; drafts never appear in public routes, RSS,
 or sitemap output. Provider keys remain server-side. Public publication and
-	migrations always require explicit confirmation.
+ migrations always require explicit confirmation.
+
+Automatic publication is an opt-in host policy, not the default. Keep human
+review enabled unless the owner explicitly chooses otherwise. If a host has
+that approval, validate its evidence before its scheduler calls the host's
+publish path:
+
+```bash
+maggie blog auto-publish-gate \
+  --evidence .maggie/blog-auto-publish-evidence.json \
+  --output .maggie/blog-auto-publish-gate.json
+```
+
+The `maggie-blog-auto-publish.v1` evidence must explicitly set `optIn: true`
+and `reviewDisabledExplicitly: true`, then pass locale variants, feature image
+and alt text, SEO fields, sitemap generation, indexing notification, and audit
+checks. The gate never publishes; missing evidence keeps content in human
+review and remains non-indexable.
 
 The adapter runs as an argv array without a shell, receives a versioned request
 on stdin, and must print only an object containing

package/bundled-skills/maggie-dash/SKILL.md

@@ -80,6 +80,14 @@ This is a runtime contract gate, not a source-only check; it fails when a
 declared endpoint is missing, uses the wrong route/method, returns a non-2xx
 status or omits required fields.
 
+For analytics panels and Consent Mode, keep the same evidence boundary: the
+default consent state must be written before the container loads, first-party
+storage behavior must be explicitly `stop` or `degrade`, and intentional form
+events must be declared separately as `record` or `omit`. A browser report must
+prove each decision; an absent field is unknown and must not be interpreted as
+false. Run the analytics release gate when the dashboard or host measurement
+contract changes.
+
 MaggieDash 0.2.4 adds two reusable operator workspaces. Activity is a read-only
 view backed by `/api/maggie/activity.json`; it supports actor/action filters,
 refresh, and a safe unavailable state. Navigation is an ordered,
@@ -255,6 +263,10 @@ maggie dash schema-audit --inventory .maggie/schema-inventory.json \
 # Prove a browser check mounted the screen and executed its data calls:
 maggie dash ui runtime-validate --evidence .maggie/dashboard-runtime.json
 
+# Validate independent dashboard measurement panels and freshness evidence:
+maggie dash panels-validate --report .maggie/measurement-panels.json \
+  --output .maggie/measurement-panels-result.json
+
 # Classify docs, show inbound references and completed progress trackers:
 maggie docs audit --project . --docs-dir docs \
   --output docs/documentation-audit.json
@@ -339,9 +351,12 @@ category, collection, or service reference; an unresolved binding is a publish
 failure, not an empty state.
 
 Repair scripts must select all candidates, compare every target field, write
-only changed rows, and report both changed and unchanged rows. Validate that
-contract with `idempotency-validate`; a query that selects only rows that look
-unconverted cannot repair its own bad output.
+only changed rows, and report both changed and unchanged rows. Each step must
+also return a boolean `wrote`; the summary's `writes` count is the number of
+true outcomes, not the number of executed steps. The shared section reconcile
+command exposes `writeCount`, `unchangedCount`, and `writeOutcome` for this
+purpose. Validate the repair contract with `idempotency-validate`; a query
+that selects only rows that look unconverted cannot repair its own bad output.
 
 After any script or direct adapter write to translation data, invalidate the
 running process before verification. Record the restart and run the rendering

package/bundled-skills/maggie-deployment/SKILL.md

@@ -88,6 +88,36 @@ not fabricate browser, rendered, or deployment evidence and does not deploy
 from this command. See
 [`readiness-v1.schema.json`](../../bundled-contracts/maggie-deployment/readiness-v1.schema.json).
 
+Classify host/runtime failures before a release can move:
+
+```bash
+maggie deployment runtime-preflight \
+  --evidence .maggie/verification/runtime-preflight-input.json \
+  --output .maggie/verification/runtime-preflight.json
+```
+
+The `maggie-runtime-preflight.v1` input has independent checks for
+dependencies, browser/driver compatibility, worker configuration, database
+privileges, and routes/API. Each non-pass status must include an actionable
+remediation. Missing checks are `unknown` and fail closed; the command never
+connects to a host or mutates runtime state.
+
+Before production approval, compose one cross-workflow manifest from the
+sanitized outputs of the route, migration, runtime, asset/icon, edge-cache,
+browser/render, and rollback checks:
+
+```bash
+maggie deployment release-manifest \
+  --evidence .maggie/release-evidence.json \
+  --output .maggie/release-manifest.json
+```
+
+The `maggie-release-evidence.v1` input links the release commit and Maggie
+version to every required evidence slot and release fingerprint. The validator
+fails if any slot is missing or not passed, keeps only normalized metadata, and
+records `mutation: "not executed"`; it does not deploy or claim that a check
+was run.
+
 ## Automatic memory hook
 
 Follow [Maggie Memory Hook](../../references/memory-hook.md) at invocation and completion.
@@ -115,6 +145,22 @@ This command never deploys. Production execution still requires the shared
 decision loop, explicit confirmation, migration/rollback details, and the
 provider-specific deploy command.
 
+For a VPS adapter, check the project `.env` by variable name before reporting
+credentials as unavailable:
+
+```bash
+maggie deployment credential-preflight \
+  --env-file .env --expected-host example-host \
+  --output .maggie/deployment/credentials.json
+```
+
+The preflight checks `DEPLOY_SERVER_IP`, `DEPLOY_SERVER_SSH_USER`,
+`DEPLOY_SERVER_SSH_PASSWORD`, and `DEPLOY_SERVER_SSH_SUDOER` by presence only.
+It never prints or stores values. `--expected-host` is optional, but should be
+used for production to prevent deploying to an unintended server. SSH-key
+adapters may use their own named secret contract; map it explicitly in their
+local plan.
+
 When deployment verification depends on Google properties or accounts, use
 the shared [Google integrations runbook](../../references/google-integrations-runbook.md).
 Keep provider auth and capability evidence separate from deployment health;
@@ -146,6 +192,15 @@ carries `.agents`/`.claude` state, restarts before verification, and prunes to
 the current release plus one rollback candidate. It never
 contains credentials and never SSHs, changes DNS, restarts systemd or deploys.
 
+VPS plans use a dedicated deployer account by default:
+`--deployer-user maggie-deploy`. The generated sudoers contract permits only
+the exact `/bin/systemctl restart <service>` and
+`/bin/systemctl is-active <service>` commands for the named service. Release
+files and the application remain separated (`maggie-deploy` versus
+`www-data`); no wildcard, shell, `sudo su`, or broad root command is generated.
+Install and review that narrow sudoers policy on the host before executing a
+runner.
+
 VPS plans include a bounded retention policy: keep two immutable releases,
 preserve the `current` target and rollback target, and review prune candidates
 before any operator executes cleanup. Generate a read-only candidate report:
@@ -186,6 +241,23 @@ The gate fails on a missing or mismatched target identity and never executes a
 migration. A successful connection alone is not proof that the intended
 database was selected.
 
+Before activation, reconcile the host's migration ledger rather than relying
+on a remembered local migration list:
+
+```bash
+maggie migration reconcile \
+  --evidence .maggie/migration/server-ledger.json \
+  --migration-dir migrations \
+  --output .maggie/migration/ledger-reconcile.json
+```
+
+The host adapter must query `maggie_schema_migrations` and emit only the
+version identifiers and environment. The read-only command orders local
+numbered SQL files, reports `missing`, and remains `mutation: "not executed"`.
+Apply every missing file through the host migration runner, re-read the ledger,
+and only then continue to the release switch; a missing version is a failed
+deployment preflight, not evidence that activation can proceed.
+
 If a release depends on existing rows or seeded data, set
 `dataDependencies: true` in `.maggie/migration-manifest.json` and provide
 `.maggie/deployment/data-release.json` before deployment. The checkpoint must

package/bundled-skills/maggie-deployment/references/vps.md

@@ -39,6 +39,19 @@ owner before any remote mutation.
 
 ### SSH and secret-source contract
 
+First run the shared credential presence check against the project `.env`:
+
+```bash
+maggie deployment credential-preflight --env-file .env \
+  --expected-host example-host
+```
+
+The canonical password-based names are `DEPLOY_SERVER_IP`,
+`DEPLOY_SERVER_SSH_USER`, `DEPLOY_SERVER_SSH_PASSWORD`, and
+`DEPLOY_SERVER_SSH_SUDOER`. The command reports only presence and an optional
+host match; it never prints a value. A provider may instead use an SSH key, but
+must state that alternate name and source in its plan.
+
 Use these canonical project variables when a VPS adapter is configured:
 
 | Variable | Meaning | Precedence |
@@ -86,6 +99,19 @@ The generated Nginx/Astro boundary keeps `checkOrigin` enabled and requires
 canonical HTTPS `allowedDomains` plus trusted `X-Forwarded-Host`/
 `X-Forwarded-Proto` handling when TLS terminates at the proxy.
 
+Use a dedicated least-privilege deployer when generating the plan:
+
+```bash
+python3 tools/clis/maggie_deployment.py . --vps-plan \
+  --domain example.co.uk --service example --node-port 4321 \
+  --deployer-user maggie-deploy
+```
+
+The plan separates the SSH/deploy account from the `www-data` application
+account and allowlists only the exact service restart and status commands.
+The runner uses non-interactive `sudo -n`; it never requires broad sudo or a
+shell escalation. Review/install the host sudoers entry separately.
+
 Review the generated systemd and Nginx files, then obtain explicit approval
 before installing them on a host.
 

package/bundled-skills/maggie-design/SKILL.md

@@ -68,6 +68,22 @@ cannot render the icon, add an approved runtime definition or inline SVG
 fallback and rerun both checks. Never release a source token solely because
 typecheck or build succeeded.
 
+Compose the static inventory with browser-painted evidence before declaring a
+design release complete:
+
+```bash
+maggie design icon-release-gate \
+  --icon-report docs/icon-inventory.json \
+  --browser-report .maggie/icon-browser-evidence.json \
+  --output docs/icon-release-gate.json
+```
+
+The browser evidence must use `maggie-icon-browser-evidence.v1`, include at
+least one route, and report each glyph as visible with positive dimensions,
+a successful `assetStatus` (2xx), and a non-empty accessible name. This
+gate is independent from typecheck/build and is read-only apart from its
+explicit output.
+
 ## Automatic memory hook
 
 Follow [Maggie Memory Hook](../../references/memory-hook.md) at invocation and completion.

package/bundled-skills/maggie-feedback/SKILL.md

@@ -57,8 +57,17 @@ fields and supplies the normal `type`, `summary`, `expected`, `actual`,
 `errorFingerprint`, reproduction, resolution, validation, and screenshot
 metadata fields. It may also provide bounded `routeIds` and
 `validationEvidence` identifiers. Each generated draft stores only the safe
-batch ID, zero-based index, and bounded size. The batch command still creates
-local drafts only.
+batch ID, canonical zero-based index, and bounded size. Direct `collect` calls
+use zero-based `--batch-index` by default. If an external runner reports
+one-based positions, pass `--batch-base 1`; the final item is then accepted and
+normalized before it is stored. The batch command still creates local drafts
+only.
+
+For example, the third item in a three-item, one-based batch is collected as:
+
+    maggie feedback collect --project . --batch-id run-review-001 \
+      --batch-index 3 --batch-size 3 --batch-base 1 \
+      --summary "Final item" --type bug
 
 Aggregate a batch before manual review:
 

package/bundled-skills/maggie-seo-geo/SKILL.md

@@ -118,6 +118,22 @@ with a reviewer. Commit the approved change and new contract together; never
 automatically replace the baseline following failure. Dynamic dates, class
 names and copy can produce legitimate differences requiring review.
 
+To approve an intentional drift, write a new file and require a reason for
+every changed, added, removed, or content-changed URL:
+
+```bash
+maggie site-audit https://example.com --crawl --json \
+  --baseline docs/seo-baseline-v1.json \
+  --recapture-baseline docs/seo-baseline-v2.json \
+  --baseline-id seo-v2 --reviewer maintainer \
+  --reason 'https://example.com/pricing=approved pricing refresh'
+```
+
+The command fails closed when the current crawl is incomplete, a drift has no
+reason, a reason names a URL without a reported drift, or the destination file
+already exists. The new contract records its `baselineId`, `supersedes` value,
+reviewer, and approved reasons; the old baseline is never overwritten.
+
 This covers server-rendered sitemap pages, not CSS rendering, JavaScript-only
 content, database translation keys or browser interactions. Query-string URLs
 are recorded as excluded from byte baselines because they often represent
@@ -256,7 +272,12 @@ metadata, valid entity JSON-LD, and image alt text. Non-HTML endpoints such as
 RSS must not be included in the HTML page sitemap. Sitemap `<loc>` values must
 be absolute HTTP(S) URLs; the audit reports relative values as a failure even
 when it can resolve them for continued crawling, so one malformed entry cannot
-hide a protocol violation.
+hide a protocol violation. Absolute sitemap locations are rebased to the
+origin passed to `site-audit` by default, so `--crawl` cannot silently audit
+production from a staging/local command. The JSON crawl evidence records
+`requestedOrigin` and `sitemapOriginPolicy: "requested-origin"`. Use
+`--preserve-sitemap-origin` only when an explicitly reviewed cross-origin crawl
+is intended; the report then says `"declared-origin"`.
 Use `--output <project>/docs/site-audit.json` to persist the evidence used by
 the release review.
 

package/bundled-tools/clis/maggie.py

@@ -933,6 +933,13 @@ def command_fixture(args: argparse.Namespace) -> int:
     return 0
 
 
+def command_feedback(args: argparse.Namespace) -> int:
+    """Dispatch feedback subcommands through the canonical feedback CLI."""
+    cli = Path(__file__).with_name("maggie_feedback.py")
+    completed = subprocess.run([sys.executable, str(cli), *args.feedback_args], cwd=Path.cwd(), check=False)
+    return completed.returncode
+
+
 def parser() -> argparse.ArgumentParser:
     p = argparse.ArgumentParser(prog="maggie", description=__doc__)
     sub = p.add_subparsers(dest="command", required=True)
@@ -984,6 +991,9 @@ def parser() -> argparse.ArgumentParser:
         item = fixture_sub.add_parser(fixture_name)
         item.add_argument("project", nargs="?", default=".")
         item.set_defaults(func=command_fixture)
+    feedback = sub.add_parser("feedback", help="collect, review, and submit privacy-safe feedback")
+    feedback.add_argument("feedback_args", nargs=argparse.REMAINDER, help="arguments for maggie_feedback.py")
+    feedback.set_defaults(func=command_feedback)
     doctor = sub.add_parser("doctor", help="check blog routes and SEO output invariants")
     doctor.add_argument("project", nargs="?", default=".")
     doctor.add_argument("--require-bootstrap", action="store_true")
@@ -1121,5 +1131,7 @@ def parser() -> argparse.ArgumentParser:
 
 
 if __name__ == "__main__":
+    if sys.argv[1:2] == ["feedback"]:
+        raise SystemExit(command_feedback(argparse.Namespace(feedback_args=sys.argv[2:])))
     arguments = parser().parse_args()
     raise SystemExit(arguments.func(arguments))

package/bundled-tools/clis/maggie_analytics.py

@@ -67,6 +67,18 @@ def release_gate(args: argparse.Namespace) -> int:
             check("referral-contract", set(contract["referralSources"]).issubset({"search", "partner", "social", "email", "direct", "unknown"}), "referral categories use the redacted taxonomy", checks)
         else:
             check("referral-contract", False, "contract must declare referralSources", checks)
+        consent = contract.get("consent")
+        valid_consent = (
+            isinstance(consent, dict)
+            and consent.get("defaultBeforeContainer") is True
+            and consent.get("firstPartyStorageMode") in {"stop", "degrade"}
+            and consent.get("intentionalFormMode") in {"record", "omit"}
+        )
+        check(
+            "consent-contract", valid_consent,
+            "consent defaults precede the container and first-party/form behavior is explicit",
+            checks,
+        )
     browser, browser_errors = load_json(Path(args.render_report).resolve(), "render-report")
     errors.extend(browser_errors)
     network, network_errors = load_json(Path(args.network_report).resolve(), "network-report")
@@ -79,6 +91,28 @@ def release_gate(args: argparse.Namespace) -> int:
         check("browser-schema", browser.get("schemaVersion") == "maggie-analytics-browser.v1", "versioned browser evidence", checks)
         check("browser-render", browser.get("passed") is True and isinstance(browser.get("routes"), list) and bool(browser["routes"]), "routes rendered without a browser failure", checks)
         check("browser-console", isinstance(browser.get("consoleErrors"), list) and not browser["consoleErrors"], "no browser console errors", checks)
+        consent = contract.get("consent") if contract else None
+        browser_consent = browser.get("consent")
+        check(
+            "consent-ordering", isinstance(consent, dict) and isinstance(browser_consent, dict)
+            and browser_consent.get("defaultBeforeContainer") is True
+            and browser_consent.get("containerLoadedAfterDefault") is True,
+            "browser evidence proves default consent precedes container loading",
+            checks,
+        )
+        check(
+            "first-party-scope", isinstance(consent, dict) and isinstance(browser_consent, dict)
+            and browser_consent.get("firstPartyStorageMode") == consent.get("firstPartyStorageMode")
+            and browser_consent.get("firstPartyStorageObserved") is True,
+            "browser evidence proves the declared first-party storage behavior",
+            checks,
+        )
+        check(
+            "intentional-form-scope", isinstance(consent, dict) and isinstance(browser_consent, dict)
+            and browser_consent.get("intentionalFormMode") == consent.get("intentionalFormMode"),
+            "browser evidence records the declared intentional-form behavior",
+            checks,
+        )
     if network:
         pre = network.get("preConsentRequests")
         check("pre-consent-network", isinstance(pre, list) and not pre, "no analytics requests before consent", checks)