@topy-ai/maggie 0.7.45 → 0.7.46

package/README-zh-TW.md

@@ -29,7 +29,12 @@ npx @topy-ai/maggie init --scope project --agent all
 npx @topy-ai/maggie doctor --scope project --project .
 ```
 
-目前 release 是 `0.7.45`。新增 Codex/Claude Code 的一次性 user-scope 安裝、bundled
+目前 release 是 `0.7.46`。新增 browser adapter capability preflight、privacy-safe
+feedback evidence references/relationships、bounded batch-review evidence graph、
+remediation suggestions，以及 root-level unittest import 支援。`browser-audit
+--check-browser` 會在導覽前拒絕 missing/incompatible adapter，包括解析成
+`xdg-open` 的系統 `browse`；feedback graph 不保存 raw payload、logs、credentials
+或本機路徑。另包含 0.7.45 的 Codex/Claude Code 一次性 user-scope 安裝、bundled
 workflow runner 與 user-scope maintenance commands；並完成 2026-09-24 booking feedback batch：MaggieDash
 Calendar availability grid/free-slot entry，以及 ORA modal focus restoration
 的驗證證據。另新增 secret-free Starter marketplace provisioning
@@ -100,7 +105,7 @@ structure drift 或重複 treatment product 時 fail closed。
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 source tree 的正式 release 是 `0.7.45`。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 source tree 的正式 release 是 `0.7.46`。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -89,7 +89,12 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 20 installable skills and a local-first MaggieDash foundation.
 
-The current release is `0.7.45`. It adds one-time user-scope installation for
+The current release is `0.7.46`. It adds browser-adapter capability preflight,
+privacy-safe feedback evidence references/relationships, bounded batch-review
+evidence graphs, remediation suggestions, and root-level unittest import
+support. `browser-audit --check-browser` rejects missing or incompatible
+adapters before navigation, including a system `browse`/`xdg-open` opener.
+It also includes the 0.7.45 one-time user-scope installation for
 Codex and Claude Code, a bundled workflow runner, and scoped maintenance
 commands. It also closes the 2026-09-24 booking feedback
 batch with the canonical MaggieDash Calendar availability grid/free-slot
@@ -490,6 +495,23 @@ maggie blog auto-publish-gate \
 
 ### Design and deployment release gates
 
+`maggie release` requires an explicit `.maggie/release-profile.json` capability
+manifest. This prevents a public Astro site from being evaluated against
+unrelated MaggieDash, Booking, migration, service-catalogue, or analytics
+artifacts. A minimal profile is:
+
+```json
+{
+  "schemaVersion": "maggie-release-profile.v1",
+  "profile": "public-astro",
+  "projectType": "astro",
+  "capabilities": ["deployment"]
+}
+```
+
+Declare optional capabilities only when the project owns their evidence. The
+release report records undeclared optional gates as `skipped`.
+
 Check source-to-runtime icon coverage before shipping a design:
 
 ```bash
@@ -588,6 +610,10 @@ maggie deployment readiness --project . \
   --output .maggie/deployment-readiness.json
 ```
 
+Individual suites can also be invoked from the repository root with
+`python3 -m unittest tools.tests.test_maggie_feedback_batch`. Use the
+regression runner for the complete discovered suite.
+
 The readiness report follows `maggie-deployment-readiness.v1`. It reports unit
 regression, package smoke, host browser evidence, rendered canary, and
 deployment preflight separately. Missing host adapter evidence is
@@ -631,8 +657,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.45 update --scope project --project . --force
-npx @topy-ai/maggie@0.7.45 cleanup --scope project --project .
+npx @topy-ai/maggie@0.7.46 update --scope project --project . --force
+npx @topy-ai/maggie@0.7.46 cleanup --scope project --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -930,6 +956,16 @@ The `maggie-feedback-batch-review.v1` report retains bounded observations,
 missing-index and duplicate checks, and privacy flags. It never contains raw
 responses, local paths, or secrets.
 
+Add safe relationships when a report must point to a test or related run:
+
+```bash
+maggie feedback collect --project . --summary "Adapter unavailable" \
+  --evidence-ref test:browser-capability:passed \
+  --relationship same-run=clone-001
+```
+
+Batch review also emits bounded `evidenceGraph` and remediation suggestions.
+
 The same evidence-first pattern is available for the other maintainer checks:
 
 ```bash
@@ -1179,6 +1215,12 @@ maggie browser-audit https://example.com \
 It captures scroll/geometry samples and screenshots, then fails on hidden
 required elements, horizontal overflow or invalid sticky positioning.
 
+Before navigation, the command writes a redacted
+`maggie-browser-capability.v1` report and rejects missing or incompatible
+adapters, including a system `browse`/`xdg-open` desktop opener. Add
+`--check-browser` to run only this preflight and receive bounded
+installation/fallback guidance.
+
 List every installed skill and command:
 
 ```bash

package/bin/maggie.js

@@ -153,7 +153,7 @@ Usage:
   maggie brand-kit --manifest FILE | --project PATH --design DESIGN.md [--write --confirm]
   maggie npm11 --project PATH [--smoke --confirm]
   maggie booking-delivery [--policy FILE]
-  maggie release PATH --environment staging --target vps-with-cloudflare-dns
+  maggie release PATH --profile .maggie/release-profile.json --environment staging --target vps-with-cloudflare-dns
   maggie api lifecycle --project PATH [--execute --allow-quota]
   maggie memory <init|list|search|context|add|record-error|transition|export> --project PATH
   maggie localization <extract|plan|generate|preview|validate|review|publish|stale|glossary> [options]
@@ -163,7 +163,7 @@ Usage:
   maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang] [--check-internal-links]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
   maggie site-audit URL --crawl --baseline FILE [--reason-all REASON]
-  maggie browser-audit URL --browse PATH --output DIR --required SELECTOR [--sticky SELECTOR] [--interactions FILE]
+  maggie browser-audit URL --browse PATH --output DIR [--required SELECTOR] [--sticky SELECTOR] [--interactions FILE] [--check-browser]
   maggie verification coverage --contract FILE --evidence FILE
   maggie ops audit|preflight|verify|lockfiles|seed-manifest|google-capabilities|favicon-check --project PATH
   maggie ops google-capabilities --project PATH --report FILE [--output FILE]

package/bundled-contracts/google-integrations/capability-report-v2.schema.json

@@ -0,0 +1,76 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/google-integrations/capability-report-v2.json",
+  "title": "Maggie Google integrations capability report v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "generatedAt", "providerResults", "passed", "mutationsAllowed"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-google-capability-report.v2"},
+    "generatedAt": {"type": "string", "minLength": 1},
+    "providerResults": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/providerResult"}},
+    "passed": {"type": "boolean"},
+    "mutationsAllowed": {"const": false}
+  },
+  "$defs": {
+    "providerResult": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["provider", "resource", "activeAccount", "target", "authMode", "scopes", "productRole", "evidence", "capabilities", "nextAction"],
+      "properties": {
+        "provider": {"enum": ["gsc", "ga4", "gtm", "google-ads", "firebase"]},
+        "resource": {"type": "string", "minLength": 1, "maxLength": 200},
+        "activeAccount": {"$ref": "#/$defs/verifiedRef"},
+        "target": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["id", "kind", "verified"],
+          "properties": {
+            "id": {"type": "string", "minLength": 1, "maxLength": 200},
+            "kind": {"enum": ["property", "container", "customer", "project", "site", "account"]},
+            "verified": {"const": true}
+          }
+        },
+        "authMode": {"enum": ["desktop-oauth", "service-account-impersonation", "none"]},
+        "scopes": {"type": "array", "items": {"type": "string", "minLength": 1}, "uniqueItems": true},
+        "productRole": {"type": "string", "minLength": 1, "maxLength": 200},
+        "evidence": {"$ref": "#/$defs/evidence"},
+        "capabilities": {"$ref": "#/$defs/capabilities"},
+        "nextAction": {"type": "string", "minLength": 1, "maxLength": 500}
+      }
+    },
+    "verifiedRef": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "verified"],
+      "properties": {
+        "id": {"type": "string", "pattern": "^[^@\\s]{1,200}$"},
+        "verified": {"const": true}
+      }
+    },
+    "evidence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["verified", "endpoint", "statusCode", "readOnly"],
+      "properties": {
+        "verified": {"type": "boolean"},
+        "endpoint": {"type": "string", "minLength": 1, "maxLength": 500},
+        "statusCode": {"type": "integer", "minimum": 100, "maximum": 599},
+        "readOnly": {"type": "boolean"},
+        "writeTest": {"type": "object"},
+        "adsPrerequisites": {"type": "object"}
+      }
+    },
+    "capabilities": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["read", "report", "edit", "publish"],
+      "properties": {
+        "read": {"enum": ["verified", "not_tested", "not_available", "blocked"]},
+        "report": {"enum": ["verified", "not_tested", "not_available", "blocked"]},
+        "edit": {"enum": ["verified", "not_tested", "not_available", "blocked"]},
+        "publish": {"enum": ["verified", "not_tested", "not_available", "blocked"]}
+      }
+    }
+  }
+}

package/bundled-contracts/google-integrations/external-write-readback-v1.schema.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/google-integrations/external-write-readback-v1.json",
+  "title": "Maggie external provider write readback evidence v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "generatedAt", "provider", "resource", "operation", "idempotencyKey", "retry", "mutation", "readback", "duplicates", "orphaned", "cleanup", "mutationExecuted"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-external-write-readback.v1"},
+    "generatedAt": {"type": "string", "minLength": 1},
+    "provider": {"enum": ["ga4", "gtm", "gsc", "google-ads", "firebase"]},
+    "resource": {"type": "string", "minLength": 1, "maxLength": 200},
+    "operation": {"type": "string", "pattern": "^[a-z][a-z0-9_.-]{1,63}$"},
+    "idempotencyKey": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{2,127}$"},
+    "retry": {
+      "type": "object", "additionalProperties": false, "required": ["attempt", "maxAttempts", "sameKeyOnRetry"],
+      "properties": {"attempt": {"type": "integer", "minimum": 1, "maximum": 3}, "maxAttempts": {"type": "integer", "minimum": 1, "maximum": 3}, "sameKeyOnRetry": {"const": true}}
+    },
+    "mutation": {
+      "type": "object", "additionalProperties": false, "required": ["status", "statusCode", "explicitConfirmation"],
+      "properties": {"status": {"enum": ["created", "updated", "no-op"]}, "statusCode": {"type": "integer", "minimum": 200, "maximum": 299}, "explicitConfirmation": {"const": true}}
+    },
+    "readback": {
+      "type": "object", "additionalProperties": false, "required": ["passed", "endpoint", "checks"],
+      "properties": {
+        "passed": {"const": true},
+        "endpoint": {"type": "string", "pattern": "^https://[^\\s?#]+$"},
+        "checks": {"type": "array", "minItems": 1, "items": {"type": "object"}}
+      }
+    },
+    "duplicates": {"type": "array", "maxItems": 0},
+    "orphaned": {"type": "array", "maxItems": 0},
+    "cleanup": {"type": "object", "additionalProperties": false, "required": ["status", "checked"], "properties": {"status": {"enum": ["not-needed", "passed"]}, "checked": {"const": true}}},
+    "mutationExecuted": {"const": true}
+  }
+}

package/bundled-contracts/maggie-deployment/deployer-delegation-v1.schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.noblox.app/contracts/deployer-delegation-v1.schema.json",
+  "title": "Maggie deployment deployer delegation evidence v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "host", "user", "releaseRoot", "service", "state", "passed", "checks", "mutation"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-deployment-delegation.v1"},
+    "host": {"type": "string", "minLength": 1},
+    "user": {"type": "string", "pattern": "^[a-z_][a-z0-9_-]{0,31}\\$?$"},
+    "releaseRoot": {"type": "string", "pattern": "^/[^\\r\\n]*$"},
+    "service": {"type": "string", "pattern": "^[A-Za-z0-9_.@-]+$"},
+    "state": {"enum": ["passed", "failed", "transient", "inconclusive"]},
+    "passed": {"type": "boolean"},
+    "checks": {"type": "object"},
+    "errors": {"type": "array", "items": {"type": "string"}},
+    "mutation": {"const": "not executed"}
+  }
+}

package/bundled-contracts/maggie-deployment/release-profile-v1.schema.json

@@ -0,0 +1,34 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.noblox.app/contracts/release-profile-v1.schema.json",
+  "title": "Maggie release profile v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "profile", "capabilities"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-release-profile.v1"},
+    "profile": {"type": "string", "pattern": "^[a-z][a-z0-9-]{1,63}$"},
+    "projectType": {"type": "string", "enum": ["astro", "nextjs", "sveltekit", "nuxt", "vite-react", "vite-vue", "other"]},
+    "capabilities": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "enum": [
+          "deployment",
+          "scenario-qa",
+          "social-card-audit",
+          "migration",
+          "maggiedash-health",
+          "schedule",
+          "analytics-contract",
+          "analytics-release-gate",
+          "service-facts",
+          "maggiedash-schema",
+          "editorial-review",
+          "durable-site-evidence"
+        ]
+      }
+    }
+  }
+}

package/bundled-contracts/maggie-design/browser-capability-v1.schema.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/browser-capability-v1.schema.json",
+  "title": "Maggie browser adapter capability report v1",
+  "type": "object",
+  "required": ["schemaVersion", "adapter", "status", "checks", "requiredCommands", "fallback"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-browser-capability.v1"},
+    "adapter": {
+      "type": "object",
+      "required": ["requested"],
+      "properties": {
+        "requested": {"type": "string", "minLength": 1, "maxLength": 160},
+        "name": {"type": "string", "maxLength": 160},
+        "requestedPathFingerprint": {"type": ["string", "null"], "pattern": "^(sha256:[a-f0-9]{64})?$"},
+        "resolvedPathFingerprint": {"type": ["string", "null"], "pattern": "^(sha256:[a-f0-9]{64})?$"}
+      },
+      "additionalProperties": false
+    },
+    "status": {"enum": ["ready", "missing", "incompatible"]},
+    "errorCode": {"type": "string", "maxLength": 80},
+    "message": {"type": "string", "maxLength": 240},
+    "checks": {
+      "type": "object",
+      "required": ["resolved", "regularFile", "executable", "help", "requiredCommands", "interactionCommands"],
+      "additionalProperties": {"type": "boolean"}
+    },
+    "requiredCommands": {"type": "array", "items": {"type": "string"}, "minItems": 1, "maxItems": 20},
+    "missingCommands": {"type": "array", "items": {"type": "string"}, "maxItems": 20},
+    "fallback": {"type": "array", "items": {"type": "string", "maxLength": 240}, "maxItems": 8}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-feedback/evidence-bundle-v1.schema.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/feedback-evidence-bundle-v1.schema.json",
+  "title": "Maggie privacy-safe feedback evidence bundle v1",
+  "type": "object",
+  "required": ["evidence", "relationships"],
+  "properties": {
+    "evidence": {
+      "type": "array",
+      "maxItems": 20,
+      "items": {
+        "type": "object",
+        "required": ["kind", "ref", "status"],
+        "properties": {
+          "kind": {"enum": ["test", "report", "screenshot", "command", "deployment", "issue", "commit", "artifact"]},
+          "ref": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/=-]{0,159}$"},
+          "status": {"enum": ["passed", "failed", "observed", "not-run", "unknown"]}
+        },
+        "additionalProperties": false
+      }
+    },
+    "relationships": {
+      "type": "array",
+      "maxItems": 20,
+      "items": {
+        "type": "object",
+        "required": ["kind", "target", "confidence"],
+        "properties": {
+          "kind": {"enum": ["related", "same-run", "same-fingerprint", "duplicates", "validates", "remediates", "caused-by"]},
+          "target": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/=-]{0,159}$"},
+          "confidence": {"enum": ["low", "medium", "high"]}
+        },
+        "additionalProperties": false
+      }
+    }
+  },
+  "additionalProperties": false
+}

package/bundled-references/browser-inspection.md

@@ -14,6 +14,23 @@ The browser capability must support:
 - slow scrolling, click, hover, keyboard focus, and back/forward navigation;
 - reading computed CSS, media sources, links, and visible accessibility labels.
 
+Before navigation, Maggie runs a capability preflight against the configured
+adapter. The report is `maggie-browser-capability.v1` and classifies the
+adapter as `ready`, `missing`, or `incompatible`. This prevents a system
+`browse`/`xdg-open` desktop opener from being mistaken for a browser adapter:
+
+```bash
+maggie browser-audit https://example.com \
+  --browse "$HOME/.codex/skills/gstack/browse/dist/browse" \
+  --output .maggie/browser-audit --required body --check-browser
+```
+
+The report contains only the adapter name, path fingerprints, capability
+checks, and bounded installation/fallback guidance. If it is `missing` or
+`incompatible`, install or enable an authorized Chrome/Playwright/gstack
+adapter and pass its executable path. Maggie does not silently install a
+browser runtime or use a desktop opener as a fallback.
+
 The minimum extraction result for a target is:
 
 ```text

package/bundled-references/google-integrations-runbook.md

@@ -111,8 +111,13 @@ maggie ops google-capabilities \
 ```
 
 The report contract is
-[`capability-report-v1.json`](../bundled-contracts/google-integrations/capability-report-v1.json).
+[`capability-report-v2.schema.json`](../bundled-contracts/google-integrations/capability-report-v2.schema.json).
 The CLI writes a normalized result and never copies arbitrary input fields.
+Every provider row must also identify the redacted active account and selected
+target resource, both with `verified: true`; the target ID must equal the
+selected `resource`. A report that only proves account discovery, or comes from
+the wrong browser account/property, is rejected before a write workflow can use
+it.
 
 ## Capability matrix
 
@@ -121,6 +126,8 @@ Every provider/resource row must expose this shape:
 | Field | Meaning |
 |---|---|
 | `provider` / `resource` | The Google product and scoped resource being checked |
+| `activeAccount` | Redacted account/principal reference confirmed by the current auth session |
+| `target` | Resource ID and kind confirmed in the current account; must match `resource` |
 | `authMode` | `desktop-oauth`, `service-account-impersonation`, or `none` |
 | `scopes` | Exact allowlisted OAuth scopes, never token values |
 | `productRole` | Role granted in the product, distinct from Cloud IAM |

package/bundled-skills/maggie-clone/SKILL.md

@@ -104,6 +104,13 @@ for the inspection contract and [`references/operational-model.md`](references/o
 for run artifacts and phase gates. If no browser tool is available, stop before
 editing and report the missing capability.
 
+When using the CLI adapter, run its capability preflight first. A command such
+as `/usr/bin/browse` that resolves to `xdg-open` is a desktop opener, not a
+browser adapter, and must be reported as incompatible. Use the report and its
+bounded fallback guidance to install or select an authorized adapter; do not
+silently substitute a desktop opener or install a browser runtime without the
+user's approval.
+
 ## Phase 0: Preflight and plan
 
 1. Parse and normalize all target URLs. Reject invalid, inaccessible, or

package/bundled-skills/maggie-deployment/SKILL.md

@@ -301,28 +301,41 @@ output/state artifact and must never be used as the provider source argument.
 When validating a project schedule, pass `--project` so the URL is compared
 exactly with `.maggie/booking/services.json` `sourceUrl`.
 
-For a single read-only staging release gate, run. This gate also requires
-explicit editorial approval for all launch category copy; rendered draft
-evidence is not publication approval:
+For a single read-only staging release gate, first declare the project's release
+surface in `.maggie/release-profile.json`. The manifest is the source of truth;
+Maggie does not infer Booking, MaggieDash, migration, analytics, service
+catalogue, or editorial gates from incidental files. A minimal public Astro
+site can use:
+
+```json
+{
+  "schemaVersion": "maggie-release-profile.v1",
+  "profile": "public-astro",
+  "projectType": "astro",
+  "capabilities": ["deployment"]
+}
+```
+
+Add `migration`, `maggiedash-health`, `schedule`, `analytics-contract`,
+`service-facts`, `editorial-review`, or `durable-site-evidence` only when that
+project actually owns the corresponding artifact. For a single read-only
+staging release gate, run:
 
 ```bash
 maggie tool maggie_release.py /path/to/project \
+  --profile /path/to/project/.maggie/release-profile.json \
   --environment staging --target vps-with-cloudflare-dns \
   --base-url https://staging.example.com
 ```
 
-If `.maggie/scenario-manifest.json` or `.maggie/qa-runs/` exists, the same
-preflight consumes the latest matching `maggie qa` run for the requested
-environment (and `--base-url`, when supplied). It blocks when a scenario is
-not passed, has no browser-adapter evidence, or the matching run is missing.
-Projects without scenario QA report `not-configured`; Maggie does not run the
-browser itself.
-
-This aggregates deployment, migration, provider-health, schedule, analytics,
-service-fact, editorial approval, durable SEO/route/category evidence,
-MaggieDash schema compatibility, and live runtime security-header checks. It writes
-`.maggie/release-preflight.json`; a failed gate blocks release. It never
-deploys, migrates, publishes, or sends provider requests.
+If `scenario-qa` is declared, the preflight consumes the latest matching
+`maggie qa` run for the requested environment (and `--base-url`, when
+supplied). It blocks when a scenario is not passed, has no browser-adapter
+evidence, or the matching run is missing. The report records every undeclared
+optional gate as `skipped`, so a public site is not blocked by Booking- or
+MaggieDash-only evidence. It writes `.maggie/release-preflight.json`; a failed
+gate blocks release. It never deploys, migrates, publishes, or sends provider
+requests.
 
 Generate a repeatable VPS runner as part of the plan. A deploy step that exists
 only in an operator's shell history is not a release contract:
@@ -338,6 +351,27 @@ Review the generated runner before execution. Its order is install → typecheck
 → migrate → build → carry agent state → switch → restart → verify → prune;
 retention keeps the current release and one rollback candidate.
 
+Before writing a VPS plan or running the release gate, validate the real
+least-privilege deploy account. This check is read-only: it verifies SSH access,
+write permission for both the release root and `releases/`, and the exact
+non-interactive systemd allowlist. A failed check does not create the plan or
+runner:
+
+```bash
+maggie deployment --verify-deployer \
+  --deployer-host "$DEPLOY_SERVER_IP" \
+  --deployer-user "$DEPLOY_SERVER_SSH_USER" \
+  --release-root /var/www/example \
+  --service example \
+  --output .maggie/deployment/deployer-delegation.json
+```
+
+For a VPS `maggie release`, this evidence is required at
+`.maggie/deployment/deployer-delegation.json` (or pass
+`--deployer-evidence`). The generated runner waits for bounded transient
+`000/502/503/504` startup responses after restart, while returning a clear
+failure immediately for permanent HTTP responses.
+
 Production additionally requires `docs/deployment-rollback-smoke.json` with
 `passed: true`, `environment: production`, and `testedAt`. For an upgrade it
 must include a non-empty `previousRelease`. For the first production release,

package/bundled-skills/maggie-feedback/SKILL.md

@@ -34,6 +34,23 @@ The draft is written to `.maggie/feedback/`. It contains the Maggie version,
 skill, run ID, phase, error fingerprint, expected/actual result, reproduction
 steps, resolution, validation, and metadata-only screenshot references.
 
+Attach bounded, privacy-safe evidence and relationships when a maintainer will
+need to connect a report to a test, deployment, issue, or related run. Only
+identifiers are stored; file contents, logs, credentials, and local paths are
+never copied:
+
+```bash
+maggie feedback collect --project . --summary "Adapter unavailable" \
+  --evidence-ref test:browser-capability:passed \
+  --evidence-ref report:browser-capability:v1 \
+  --relationship same-run=clone-001
+```
+
+Evidence references are bounded and normalized into the
+`maggie-feedback-evidence-bundle.v1` contract. The accepted kinds are
+`test`, `report`, `screenshot`, `command`, `deployment`, `issue`, `commit`,
+and `artifact`; relationships connect safe IDs such as feedback or run IDs.
+
 If a draft is marked fixed with `--fixed` (or the supplied run report says
 `fixed`), both `--resolution` and `--validation` are required. Feedback text
 also scrubs common POSIX/home/temp and Windows absolute paths by default while
@@ -78,6 +95,12 @@ This writes `.maggie/feedback/batches/<batch-id>-review.json` under the
 duplicate fingerprints/summaries, while retaining only redacted observations;
 review the aggregate and each draft before submitting.
 
+Batch review also emits a bounded `evidenceGraph` and
+`remediationSuggestions`. The graph links feedback IDs to evidence IDs and
+safe related references, while suggestions flag duplicate fingerprints,
+missing batch indexes, shared evidence, or a batch with no validation
+references. These are review aids, not automatic issue or memory writes.
+
 Example:
 
     {

package/bundled-skills/maggie-ops/SKILL.md

@@ -88,6 +88,14 @@ maggie ops google-capabilities --project . \
   --report .maggie/google-capability-input.json
 ```
 
+The input must use `maggie-google-capability-report.v2`: each row records the
+redacted active account, the selected target (`property`, `container`,
+`customer`, `project`, or `site`), and the exact scopes. Both account and target
+must be explicitly verified, and `target.id` must equal `resource`. The command
+prints these safe identifiers and scopes before any separate provider adapter
+is allowed to perform a write. A v1 report is rejected because it cannot prove
+that the browser/session is on the intended Google account and property.
+
 The result separates `read`, `report`, `edit`, and `publish` for each
 provider/resource. Write and publish remain `not_tested` until the operator
 explicitly confirms the exact mutation and a successful read-back is captured.
@@ -164,6 +172,20 @@ Every mutation must validate the session, role, resource ownership/project
 scope, input schema, legal state transition, and idempotency/correlation key.
 Record actor, timestamp, previous state, next state, reason, and result.
 
+For a GA4/GTM or other Google provider write, validate a hash-only
+write/readback bundle before treating the operation as complete:
+
+```bash
+maggie ops external-write-gate --project . \
+  --evidence .maggie/external-write-readback-input.json \
+  --output .maggie/external-write-readback.json
+```
+
+The bundle requires one stable idempotency key across bounded retries, explicit
+confirmation, successful readback fingerprints, an empty duplicate list, and
+an empty orphaned-workspace list. It never stores provider payloads; an
+incomplete or mismatched readback blocks the release gate.
+
 ### Operate
 
 Use the dashboard or API to perform an explicitly requested operation. Show an

package/bundled-skills/maggie-seo-geo/SKILL.md

@@ -125,7 +125,10 @@ maggie analytics release-gate --project . --environment staging \
 
 Use `contracts/maggie-seo/gsc-readiness-v1.schema.json` as the evidence
 boundary. Credentials and mutation scopes remain host-owned; a passing local
-contract is not proof of property ownership or live readback.
+contract is not proof of property ownership or live readback. If a GA4/GTM
+write is part of the workflow, also pass hash-only
+`.maggie/external-write-readback.json` evidence to the analytics release gate;
+duplicate or orphaned provider objects fail closed.
 
 ## Freeze and compare a reviewed site