@topy-ai/maggie 0.7.47 → 0.7.49

package/README-zh-TW.md

@@ -29,7 +29,7 @@ npx @topy-ai/maggie init --scope project --agent all
 npx @topy-ai/maggie doctor --scope project --project .
 ```
 
-目前 release 是 `0.7.47`。本版處理 2026-09-26 五條新 feedback：project-scope
+目前 npm 版本為 `0.7.49`，完成 batch 27：33 條 2026-09-09 至 09-16 建立但從未提交的本機 feedback drafts，已逐條對照目前程式碼（其中兩條已被既有功能滿足）。新增離線 `maggie ops notifications`（通知 catalogue 合約、consent/retention/durable lead delivery 規則、provider template drift、只檢查變數名稱的 Resend preflight、queue health 門檻與 operator alerts、dry-run retention plan）；`maggie localization email-matrix` 與 `maggie localization lifecycle`（locale 優先順序、未翻譯/缺漏 locale、變數與 HTML/text 一致、market CTA route、consent-aware 行銷 email 預設不發送）；Deployment 的 `--keep-releases` 統一 retention policy、`auth-canary`、資料庫 owner 無法讀取 release 路徑時的 streamed migration、`collect` 單一 readiness report；Google failure remediation（`maggie ops google-diagnose`）與唯讀 `google-ads-preflight`/`google-ads-keyword-ideas`；Social Share `reconcile`（timeout 後不重複發文）、`maggie-marketing-run-v1` 合約、命名排程層與只管制對外發布的 regulated-content review；`maggie design icon-glyph-check`、`maggie design verify`、`maggie service import-stages-validate`/`import-readiness`/`fact-provenance`；以及 `--release-metadata` 版本一致性檢查、`maggie docs rollout-status` 與 stdin batch 輸入。前一版 `0.7.48` 處理 2026-10-10 的 27 條 hosted feedback（batch 26）：Social Share 新增 `adapters`（每個 provider 一組 canonical OAuth scope，LinkedIn 不同 scope 會撤銷舊 token；共用 OAuth client 警告）、`connections`（撤銷或無法解密的 token 標為 `needs_reconnect`，偵測會過期的簽名頭像 URL）、`queue`（slot-based 排程：not-before、最新優先、campaign 輪流與每日上限、DST-safe）與 `campaigns`（idea stage Start gate）；Deployment 新增 hash-only `secret-fingerprint`/`secret-parity`、`env-isolation`（本機 `.env` 指向 production database 時警告）、release retention 與 worker-before-enqueue 發布順序；QA 在未明確同意時阻擋對 production API 的寫入情境，並以 `maggie qa cors-preflight` 只用 OPTIONS 檢查每個 HTTP method；Design 新增 `pressable-check`、`layer-check`（Tailwind v4 unlayered CSS）、onboarding wizard/picker 模式與 `maggie-palette-roles-v1` palette generate/validate；Marketplace 加入 screenshot 完整性與像素預算、從 CSS 量測 palette、asset provenance、中性 `displayName`（全部模板已補齊）、template studio、`maggie-template-content-v1` 合約與圖片生成成本/無文字審查 gate；Booking 新增唯讀 Stripe live setup runbook 與 gift voucher lifecycle 合約（`maggie booking voucher-contract --ledger`）；Feedback 新增 `improvement` 類型與 `maggie feedback session-summary`。MaggieDash 0.2.11 會保留尚未部署 template 的 outbox email 而不是 dead-letter，並從 ORA host 上游通用修正。本版也包含 Booking 十個 email events 合約與 CLI validator 同步及安全輸出的 `arrivalNote`。前一版 `0.7.47` 處理 2026-09-26 五條新 feedback：project-scope
 `maggie init` 會建立本地 memory store；context 預設只讀取本 project scope；memory hook
 在 local Python adapter 不存在時 fallback 到已安裝 CLI；重複 init 保留既有檔案與時間戳；
 `maggie feedback list` 的 `--project` 可放在子命令前或後。Generated VPS runner 現在記錄
@@ -113,7 +113,7 @@ structure drift 或重複 treatment product 時 fail closed。
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 source tree 的正式 release 是 `0.7.47`。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 npm 版本為 `0.7.49`，包含 batch 26、27 feedback 修正與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -89,14 +89,75 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 20 installable skills and a local-first MaggieDash foundation.
 
-The current release is `0.7.47`. Project initialization creates a local Maggie
-Memory store, memory contexts default to project scope, and the shared hook
-falls back to the installed CLI if project Python tools are absent. Repeated
-memory initialization preserves existing files and timestamps. Feedback list
-accepts `--project` before or after its subcommand. Generated VPS runners record
-their Maggie version and template fingerprint; deployment preflight warns on
-stale or unmarked runners, with `maggie deployment --check-runner PATH` for
-other locations.
+This package is `0.7.49`. It closes batch 27: 33 local feedback
+drafts from 2026-09-09 to 09-16 that were never submitted, reconciled against
+the current code (two were already satisfied):
+
+- Notifications: offline `maggie ops notifications` — catalogue contract with
+  consent, retention and durable lead-delivery rules, template drift against
+  paginated provider exports, Resend preflight by variable name, queue health
+  thresholds with operator alerts, and a dry-run retention plan.
+- Email localization: `maggie localization email-matrix` (locale precedence,
+  untranslated/missing locales, variable and HTML/text parity, market CTA
+  routes) and `maggie localization lifecycle` (consent-aware marketing email
+  with a no-send default until approved).
+- Deployment: one `--keep-releases` retention policy shared by plan, runner,
+  preflight and rollback evidence; `auth-canary` for role-scoped
+  authenticated API probes; streamed migrations for a database owner that
+  cannot read the release path; `collect` for one readiness report.
+- Google: failure remediation (`maggie ops google-diagnose`) and read-only
+  `google-ads-preflight` / `google-ads-keyword-ideas`.
+- Marketing: Social Share `reconcile` (no duplicate post after a timeout), the
+  `maggie-marketing-run-v1` contract, named schedule layers, and opt-in
+  regulated-content review that gates only external publication.
+- Design and imports: `maggie design icon-glyph-check`, `maggie design
+  verify`, and `maggie service import-stages-validate`, `import-readiness`
+  and `fact-provenance`.
+- Feedback and release: `validate_docs_freshness.py --release-metadata`,
+  `maggie docs rollout-status`, and stdin batch input.
+
+The 0.7.48 release remains included: it processed the 27 hosted feedback
+records of 2026-10-10 (batch 26) and added the Booking email-template
+contract/CLI sync with escaped `arrivalNote` rendering:
+
+- Social Share: `adapters` enforces one canonical OAuth scope set per provider
+  (LinkedIn revokes earlier tokens on a different scope set) and warns about
+  shared OAuth clients; `connections` marks revoked/undecryptable tokens
+  `needs_reconnect` and flags expiring signed avatar URLs; `queue` is a
+  deterministic slot-based planner (not-before times, newest-first queue,
+  campaign round-robin with daily limits, DST-safe); `campaigns` gates the
+  idea stage before Start.
+- Deployment: hash-only `secret-fingerprint`/`secret-parity` across hosts,
+  `env-isolation` plus a preflight warning when local `.env` points at the
+  production database, documented release retention, and worker-before-enqueue
+  release ordering.
+- QA: mutating scenarios are blocked against a production API without
+  explicit consent, and `maggie qa cors-preflight` checks every HTTP method with
+  OPTIONS only.
+- Design: `pressable-check` (nested pressables on React Native Web),
+  `layer-check` (unlayered CSS overriding Tailwind v4 utilities), onboarding
+  wizard/picker patterns, and the `maggie-palette-roles-v1` contract with
+  `maggie design palette generate|validate`.
+- Marketplace/template: package audits for screenshot integrity and pixel
+  budget, palettes measured from template CSS, asset provenance, and neutral
+  `displayName`s (all catalogue templates backfilled); a template studio
+  (viewport × palette with overflow check); the `maggie-template-content-v1`
+  contract; and image-generation cost reports with a no-text review gate.
+- Booking: a read-only Stripe live-setup runbook and the provider-neutral gift
+  voucher lifecycle contract with `maggie booking voucher-contract --ledger`.
+- Feedback: an `improvement` type (hosted as `feature` + `subtype`) and
+  `maggie feedback session-summary`.
+- MaggieDash 0.2.11 holds outbox emails whose template is not yet deployed
+  instead of dead-lettering them, and upstreams generic fixes from the ORA host.
+
+The 0.7.47 release remains included: project
+initialization creates the repository's Maggie Memory store, memory context
+uses project-scope entries by default, the shared memory hook falls back to
+the installed CLI, repeated memory initialization preserves unchanged
+files, and `maggie feedback list` accepts `--project` before or after the
+subcommand. Generated VPS release runners also record their Maggie version and
+template fingerprint; deployment preflight warns about stale or unmarked
+runners, with `maggie deployment --check-runner PATH` for other locations.
 
 The 0.7.46 feedback batch remains included: capability-aware release profiles,
 bounded deployment-readiness retries, verified Google account/target evidence,
@@ -667,8 +728,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.47 update --scope project --project . --force
-npx @topy-ai/maggie@0.7.47 cleanup --scope project --project .
+npx @topy-ai/maggie@0.7.49 update --scope project --project . --force
+npx @topy-ai/maggie@0.7.49 cleanup --scope project --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -873,11 +934,11 @@ delivery outbox. It shows redacted delivery state and sanitized errors through
 manages Maggie's server-side transactional delivery queue and audit trail; it
 does not replace Resend's own domain, audience, campaign, or analytics console.
 
-The Booking browser-evidence gate covers all 15 manager routes at mobile,
-tablet, and desktop viewports (45 required screens), including waitlist,
-locations, notifications, reports, and audit. A production release still
-requires an authenticated HTTPS capture with zero console, request, and
-layout errors.
+The Booking browser-evidence gate covers all 17 manager routes at mobile,
+tablet, and desktop viewports (51 required screens), including waitlist,
+locations, notifications, email templates, reports, settings, and audit. A
+production release still requires an authenticated HTTPS capture with zero
+console, request, and layout errors.
 
 Compare an existing dashboard before replacing it:
 

package/bin/maggie.js

@@ -99,6 +99,8 @@ Usage:
   maggie dash structure-validate --model FILE --evidence FILE
   maggie design progressive-check|css-check|css-cascade-check|style-check --evidence FILE
   maggie design dash-init|dash-validate|sample-init|sample-validate [options]
+  maggie design pressable-check|layer-check --project PATH
+  maggie design palette generate --canvas HEX --text HEX --accent HEX | palette validate --palette FILE
   maggie seo privacy-check --evidence FILE
   maggie content FILE --source PROVIDER --project PATH --confirm
   maggie agent-content write --url URL --allowed-origin ORIGIN --token-env ENV --payload FILE
@@ -128,6 +130,8 @@ Usage:
   maggie design app-validate --project PATH --plan PATH --runtime-evidence FILE --rendered-dir PATH --confirm
   maggie design icon-inventory --project PATH --source-dir src --runtime assets/icons.css --output docs/icon-inventory.json
   maggie design icon-release-gate --icon-report FILE --browser-report FILE --output FILE
+  maggie design icon-glyph-check (--base-url URL | --dist DIR) --route / --output FILE
+  maggie design verify JOB_ID (--base-url URL | --dist DIR) [--stage before|after] [--build-command CMD]
   maggie design author --project PATH --route /about --purpose TEXT --audience TEXT --confirm
   maggie design markup-check --html FILE [--require-content-keys]
   maggie design in-place --project PATH --route /pricing [--content-source PATH]
@@ -149,11 +153,18 @@ Usage:
   maggie service inspect --project PATH
   maggie service status --project PATH
   maggie service orchestration-validate --project PATH --manifest FILE
+  maggie service import-stages-validate --project PATH --manifest FILE
+  maggie service import-readiness --project PATH [--python-module M] [--browser] [--webdriver] [--env NAME] [--country LABEL]
+  maggie service fact-provenance --project PATH --facts FILE [--output FILE]
   maggie service convert-page <page-path> --project PATH
   maggie service match-pages --project PATH --pages-dir src/pages
   maggie deployment --project PATH --target vps-with-cloudflare-dns
   maggie deployment worker-secrets --project PATH --environment staging --required RESEND_API_KEY
+  maggie deployment secret-parity --manifest api-1.json --manifest api-2.json --required KEY
+  maggie deployment env-isolation --project PATH --production-env .env.production
   maggie deployment readiness --project PATH
+  maggie deployment collect --project PATH --config .maggie/deployment/collector.json
+  maggie deployment auth-canary --plan auth-canary-plan.json [--allow-mutations] --output FILE
   maggie deployment parity --project PATH --evidence FILE --output FILE
   maggie deployment canary --project PATH --asset URL=SHA256 --render-report report.json --output docs/deployment-canary.json
   maggie deployment release-manifest --evidence FILE --output FILE
@@ -173,10 +184,10 @@ Usage:
   maggie release PATH --profile .maggie/release-profile.json --environment staging --target vps-with-cloudflare-dns
   maggie api lifecycle --project PATH [--execute --allow-quota]
   maggie memory <init|list|search|context|add|record-error|transition|export> --project PATH
-  maggie localization <extract|plan|generate|preview|validate|review|publish|stale|glossary> [options]
+  maggie localization <extract|plan|generate|preview|validate|review|publish|stale|glossary|email-matrix|lifecycle> [options]
   maggie seo performance|images|sitemap|indexnow|social-cards|head-tags [options] (sitemap supports strict validate and agent-files)
-  maggie feedback <collect|preview|batch|batch-review|submit|list> [options]
-  maggie qa <start|record|summary|export|assertion-audit> [options]
+  maggie feedback <collect|preview|batch|batch-review|session-summary|submit|list> [options]
+  maggie qa <start|record|summary|export|assertion-audit|cors-preflight> [options]
   maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang] [--check-internal-links]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
   maggie site-audit URL --crawl --baseline FILE [--reason-all REASON]
@@ -184,6 +195,9 @@ Usage:
   maggie verification coverage --contract FILE --evidence FILE
   maggie ops audit|preflight|verify|lockfiles|seed-manifest|google-capabilities|favicon-check --project PATH
   maggie ops google-capabilities --project PATH --report FILE [--output FILE]
+  maggie ops google-diagnose --code CODE [--reason TEXT] [--http-status N] [--provider P]
+  maggie ops google-ads-preflight|google-ads-keyword-ideas --customer-id ID [--login-customer-id ID]
+  maggie ops notifications catalogue|templates|preflight|health|retention|alerts --project PATH ...
   maggie ops preflight --project PATH --write
 
 Examples:
@@ -584,16 +598,17 @@ function marketplace(args) {
 
 function service(args) {
   const root = projectRoot(args);
-  const scriptName = args[0] === "orchestration-validate" ? "maggie_service_onboarding.py" : "maggie_service_booking.py";
+  const importCommands = ["import-stages-validate", "import-readiness", "fact-provenance"];
+  const scriptName = args[0] === "orchestration-validate" ? "maggie_service_onboarding.py" : importCommands.includes(args[0]) ? "maggie_service_import.py" : "maggie_service_booking.py";
   const script = toolScript(scriptName, root);
   if (!existsSync(script)) throw new Error(`service booking CLI is missing: ${script}`);
-  const result = spawnSync("python3", [script, ...args], { stdio: "inherit", cwd: root, env: { ...process.env, MAGGIE_VERSION: PACKAGE_VERSION } });
+  const result = spawnSync("python3", [script, ...(scriptName === "maggie_service_onboarding.py" ? args.slice(1) : args)], { stdio: "inherit", cwd: root, env: { ...process.env, MAGGIE_VERSION: PACKAGE_VERSION } });
   if (result.error) throw result.error;
   process.exitCode = result.status ?? 1;
 }
 
 function docs(args) {
-  if (args[0] && args[0] !== "audit") throw new Error("docs command must be audit");
+  if (args[0] && !["audit", "rollout-status"].includes(args[0])) throw new Error("docs command must be audit or rollout-status");
   workflowCli("maggie_docs.py", args);
 }
 
@@ -763,6 +778,8 @@ try {
   else if (command === "ops") workflowCli("maggie_ops.py", args);
   else if (command === "deployment" && args[0] === "canary") workflowCli("maggie_deployment_canary.py", args.slice(1));
   else if (command === "deployment" && args[0] === "readiness") workflowCli("maggie_deployment_readiness.py", args.slice(1));
+  else if (command === "deployment" && args[0] === "auth-canary") workflowCli("maggie_deployment_auth_canary.py", args.slice(1));
+  else if (command === "deployment" && args[0] === "collect") workflowCli("maggie_deployment_collect.py", args.slice(1));
   else if (command === "deployment" && args[0] === "parity") workflowCli("maggie_deployment_parity.py", args.slice(1));
   else if (command === "deployment" && args[0] === "release-manifest") workflowCli("maggie_release_manifest.py", args.slice(1));
   else if (command === "deployment" && args[0] === "runtime-preflight") workflowCli("maggie_runtime_preflight.py", args.slice(1));

package/bundled-contracts/google-integrations/capability-report-v2.schema.json

@@ -36,7 +36,8 @@
         "productRole": {"type": "string", "minLength": 1, "maxLength": 200},
         "evidence": {"$ref": "#/$defs/evidence"},
         "capabilities": {"$ref": "#/$defs/capabilities"},
-        "nextAction": {"type": "string", "minLength": 1, "maxLength": 500}
+        "nextAction": {"type": "string", "minLength": 1, "maxLength": 500},
+        "failure": {"description": "Optional redacted provider failure: error code/reason and HTTP status only. The validator maps it to one prerequisite and safe next action and never echoes it.", "type": "object", "additionalProperties": false, "minProperties": 1, "properties": {"code": {"type": "string", "maxLength": 300}, "reason": {"type": "string", "maxLength": 300}, "httpStatus": {"type": "integer", "minimum": 100, "maximum": 599}}}
       }
     },
     "verifiedRef": {

package/bundled-contracts/maggie-content/email-localization-v1.schema.json

@@ -0,0 +1,89 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-content/email-localization-v1.schema.json",
+  "title": "Maggie localized email template manifest v1",
+  "description": "Template matrix checked by `maggie localization email-matrix`. Structural shape only; the CLI enforces locale precedence, variable preservation, HTML/plain-text parity, market routes, untranslated values and approval.",
+  "type": "object",
+  "required": ["schemaVersion", "sourceLocale", "locales", "templates"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-email-localization.v1"},
+    "sourceLocale": {"type": "string", "minLength": 2},
+    "locales": {"type": "array", "items": {"type": "string"}, "minItems": 1, "uniqueItems": true},
+    "markets": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "object",
+        "properties": {
+          "locales": {"type": "array", "items": {"type": "string"}},
+          "routePrefix": {"type": "string", "pattern": "^/"}
+        }
+      }
+    },
+    "glossary": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["term", "locale", "translation"],
+        "properties": {"term": {"type": "string"}, "locale": {"type": "string"}, "translation": {"type": "string"}}
+      }
+    },
+    "templates": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["id", "category", "variables", "localeResolution", "locales"],
+        "properties": {
+          "id": {"type": "string", "minLength": 1},
+          "category": {"enum": ["transactional", "support", "marketing"]},
+          "variables": {"type": "array", "items": {"type": "string"}, "uniqueItems": true},
+          "localeResolution": {
+            "type": "array",
+            "items": {"enum": ["user", "market", "account", "fallback"]},
+            "minItems": 1,
+            "uniqueItems": true
+          },
+          "requiredLocales": {"type": "array", "items": {"type": "string"}},
+          "cta": {"type": "object", "properties": {"route": {"type": "string"}}},
+          "fixtures": {"type": "object", "description": "Synthetic preview values only; never customer data."},
+          "locales": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "object",
+              "required": ["subject", "html", "text"],
+              "properties": {
+                "subject": {"type": "string"},
+                "html": {"type": "string"},
+                "text": {"type": "string"},
+                "ctaRoute": {"type": "string"},
+                "market": {"type": "string"},
+                "approval": {
+                  "type": "object",
+                  "properties": {
+                    "status": {"enum": ["pending", "approved", "rejected"]},
+                    "reviewer": {"type": "string"},
+                    "approvedAt": {"type": "string", "format": "date-time"}
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "callSites": {
+      "type": "array",
+      "description": "Where the host sends each template and how it resolves the locale.",
+      "items": {
+        "type": "object",
+        "required": ["template", "localeSource"],
+        "properties": {
+          "id": {"type": "string"},
+          "template": {"type": "string"},
+          "path": {"enum": ["fulfilment", "outbox", "direct", "preview"]},
+          "localeSource": {"enum": ["resolved", "user", "market", "account", "fallback", "accept-language", "hard-coded"]}
+        }
+      }
+    }
+  }
+}

package/bundled-contracts/maggie-content/lifecycle-email-v1.schema.json

@@ -0,0 +1,76 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-content/lifecycle-email-v1.schema.json",
+  "title": "Maggie consent-aware lifecycle email plan v1",
+  "description": "Plan validated by `maggie localization lifecycle`. Nothing is sendable until approved; the host owns audience data, consent records, delivery and reporting. Maggie never sends.",
+  "type": "object",
+  "required": ["schemaVersion", "stages", "defaults", "templates"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-lifecycle-email.v1"},
+    "stages": {"const": ["plan", "segment", "consent-check", "preview", "approve", "schedule", "send", "report"]},
+    "defaults": {"type": "object", "required": ["send"], "properties": {"send": {"const": "disabled"}}},
+    "templates": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "kind", "category", "frequency", "sendable"],
+        "properties": {
+          "id": {"type": "string", "minLength": 1},
+          "kind": {"enum": ["opt-in-confirmation", "welcome", "digest", "recommendation", "gift-follow-up", "voucher-follow-up", "waitlist-follow-up", "merchant-lead-digest", "campaign-announcement", "re-engagement"]},
+          "category": {"enum": ["transactional", "support", "marketing"]},
+          "consent": {
+            "type": "object",
+            "properties": {
+              "basis": {"enum": ["opt-in", "double-opt-in", "soft-opt-in", "legitimate-interest-b2b"]},
+              "category": {"type": "string"}
+            }
+          },
+          "unsubscribe": {"type": "object", "properties": {"path": {"type": "string"}}},
+          "preferenceCentre": {"type": "string"},
+          "frequency": {
+            "type": "object",
+            "required": ["maxPerWindow", "window"],
+            "properties": {"maxPerWindow": {"type": "integer", "minimum": 1}, "window": {"type": "string", "description": "ISO 8601 duration, e.g. P7D"}}
+          },
+          "attribution": {"type": "object", "properties": {"fields": {"type": "array", "items": {"type": "string"}}}},
+          "approval": {"$ref": "#/$defs/approval"},
+          "sendable": {"type": "boolean"}
+        }
+      }
+    },
+    "campaigns": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "templates", "audience", "sendable"],
+        "properties": {
+          "id": {"type": "string"},
+          "templates": {"type": "array", "items": {"type": "string"}},
+          "audience": {
+            "type": "object",
+            "properties": {
+              "segment": {"type": "string"},
+              "requiresConsent": {"type": "boolean"},
+              "suppression": {"type": "boolean"},
+              "dedupe": {"type": "string"}
+            }
+          },
+          "schedule": {"type": "object"},
+          "approval": {"$ref": "#/$defs/approval"},
+          "sendable": {"type": "boolean"},
+          "report": {"type": "object", "properties": {"metrics": {"type": "array", "items": {"type": "string"}}}}
+        }
+      }
+    }
+  },
+  "$defs": {
+    "approval": {
+      "type": "object",
+      "properties": {
+        "status": {"enum": ["pending", "approved", "rejected"]},
+        "reviewer": {"type": "string"},
+        "approvedAt": {"type": "string", "format": "date-time"}
+      }
+    }
+  }
+}

package/bundled-contracts/maggie-deployment/readiness-v1.schema.json

@@ -7,6 +7,7 @@
   "properties": {
     "schemaVersion": {"const": "maggie-deployment-readiness.v1"},
     "status": {"enum": ["passed", "failed", "inconclusive"]},
+    "collector": {"type": "object", "description": "present when produced by maggie deployment collect: config fingerprint, release, and per-adapter run metadata"},
     "checks": {
       "type": "object",
       "required": ["unitRegression", "packageSmoke", "browserEvidence", "renderedCanary", "deploymentPreflight"],
@@ -17,7 +18,11 @@
         "browserEvidence": {"$ref": "#/$defs/check"},
         "renderedCanary": {"$ref": "#/$defs/check"},
         "deploymentPreflight": {"$ref": "#/$defs/check"},
-        "runtimeParity": {"$ref": "#/$defs/check"}
+        "runtimeParity": {"$ref": "#/$defs/check"},
+        "hostHealth": {"$ref": "#/$defs/check"},
+        "releaseIdentity": {"$ref": "#/$defs/check"},
+        "rollbackEvidence": {"$ref": "#/$defs/check"},
+        "authenticatedCanary": {"$ref": "#/$defs/check"}
       }
     }
   },

package/bundled-contracts/maggie-design/palette-roles-v1.schema.json

@@ -0,0 +1,47 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/contracts/maggie-design/palette-roles-v1.schema.json",
+  "title": "Maggie template palette role contract",
+  "description": "Semantic colour roles for one template: its signature palette plus derived, contrast-safe variants. Generated and validated by `maggie design palette`. Contrast rules (text, accentText and onAccent at 4.5:1) and the variant accent saturation cap are enforced by `maggie design palette validate`, not by this schema.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "template", "signature", "variants"],
+  "properties": {
+    "schemaVersion": { "const": "maggie-palette-roles-v1" },
+    "template": { "type": ["string", "null"] },
+    "signature": {
+      "allOf": [
+        { "$ref": "#/$defs/palette" },
+        { "properties": { "id": { "const": "signature" } } }
+      ]
+    },
+    "variants": { "type": "array", "items": { "$ref": "#/$defs/palette" } }
+  },
+  "$defs": {
+    "hex": { "type": "string", "pattern": "^#[0-9A-Fa-f]{6}$" },
+    "palette": {
+      "type": "object",
+      "required": ["id", "name", "roles"],
+      "properties": {
+        "id": { "type": "string", "minLength": 1 },
+        "name": { "type": "string", "minLength": 1 },
+        "roles": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["canvas", "panel", "soft", "text", "accent", "accentText", "onAccent", "dark", "deep"],
+          "properties": {
+            "canvas": { "$ref": "#/$defs/hex", "description": "Page background." },
+            "panel": { "$ref": "#/$defs/hex", "description": "Cards and raised surfaces; body text must pass on it." },
+            "soft": { "$ref": "#/$defs/hex", "description": "Tinted band or chip background; not for long body copy." },
+            "text": { "$ref": "#/$defs/hex", "description": "Body text on canvas and panel." },
+            "accent": { "$ref": "#/$defs/hex", "description": "Buttons and highlights (fills)." },
+            "accentText": { "$ref": "#/$defs/hex", "description": "Accent-coloured text and links on canvas." },
+            "onAccent": { "$ref": "#/$defs/hex", "description": "Text placed on an accent fill." },
+            "dark": { "$ref": "#/$defs/hex", "description": "Dark band background." },
+            "deep": { "$ref": "#/$defs/hex", "description": "Deepest band, footer or overlay." }
+          }
+        }
+      }
+    }
+  }
+}

package/bundled-contracts/maggie-marketplace/template-content-v1.schema.json

@@ -0,0 +1,103 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/contracts/maggie-marketplace/template-content-v1.schema.json",
+  "title": "Maggie template content contract",
+  "description": "Neutral business content a marketplace template renders when exported as a data-driven component, so one design serves many businesses from their own data. Palette roles come from maggie-palette-roles-v1 and are emitted as --maggie-<role> CSS variables. Business rules (sample paths resolve, reviews carry a source or sample=true, hours are HH:MM) are enforced by `maggie_marketplace.py content-validate`.",
+  "type": "object",
+  "required": ["schemaVersion", "brand", "contact", "hero", "categories", "about", "gallery", "reviews", "hours", "faqs"],
+  "properties": {
+    "schemaVersion": { "const": "maggie-template-content-v1" },
+    "brand": {
+      "type": "object",
+      "required": ["name"],
+      "properties": {
+        "name": { "type": "string", "minLength": 1 },
+        "tagline": { "type": ["string", "null"] },
+        "logo": { "$ref": "#/$defs/image" }
+      }
+    },
+    "contact": {
+      "type": "object",
+      "properties": {
+        "phone": { "type": ["string", "null"] },
+        "email": { "type": ["string", "null"] },
+        "address": { "type": ["string", "null"] },
+        "bookingUrl": { "type": ["string", "null"] }
+      }
+    },
+    "hero": {
+      "type": "object",
+      "required": ["headline"],
+      "properties": {
+        "headline": { "type": "string", "minLength": 1 },
+        "subheadline": { "type": ["string", "null"] },
+        "image": { "$ref": "#/$defs/image" },
+        "cta": { "type": "object", "properties": { "label": { "type": "string" }, "href": { "type": "string" } } }
+      }
+    },
+    "categories": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["name", "services"],
+        "properties": {
+          "name": { "type": "string", "minLength": 1 },
+          "description": { "type": ["string", "null"] },
+          "services": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": ["name"],
+              "properties": {
+                "name": { "type": "string", "minLength": 1 },
+                "description": { "type": ["string", "null"] },
+                "price": { "type": ["number", "null"], "minimum": 0 },
+                "currency": { "type": "string", "default": "GBP" },
+                "durationMinutes": { "type": ["integer", "null"], "minimum": 1 },
+                "bookingRef": { "type": ["string", "null"], "description": "Host booking/catalogue identifier, e.g. a MaggieDash Booking service id." }
+              }
+            }
+          }
+        }
+      }
+    },
+    "about": { "type": "object", "properties": { "heading": { "type": ["string", "null"] }, "body": { "type": ["string", "null"] }, "image": { "$ref": "#/$defs/image" } } },
+    "gallery": { "type": "array", "items": { "$ref": "#/$defs/image" } },
+    "reviews": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["quote"],
+        "properties": {
+          "quote": { "type": "string" },
+          "author": { "type": ["string", "null"] },
+          "rating": { "type": ["number", "null"], "minimum": 0, "maximum": 5 },
+          "source": { "type": ["string", "null"], "description": "Where the real review came from; required unless sample is true." },
+          "sample": { "type": "boolean" }
+        }
+      }
+    },
+    "hours": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["day"],
+        "properties": {
+          "day": { "enum": ["mon", "tue", "wed", "thu", "fri", "sat", "sun"] },
+          "opens": { "type": "string", "pattern": "^\\d{2}:\\d{2}$" },
+          "closes": { "type": "string", "pattern": "^\\d{2}:\\d{2}$" },
+          "closed": { "type": "boolean" }
+        }
+      }
+    },
+    "faqs": { "type": "array", "items": { "type": "object", "required": ["question", "answer"], "properties": { "question": { "type": "string" }, "answer": { "type": "string" } } } },
+    "samples": { "type": "array", "items": { "type": "string" }, "description": "Dotted content paths that still hold template sample copy the owner must replace (e.g. hero.headline, reviews.0)." },
+    "palette": { "type": "object", "description": "One maggie-palette-roles-v1 palette (id, name, roles)." }
+  },
+  "$defs": {
+    "image": {
+      "type": ["object", "null"],
+      "properties": { "src": { "type": "string" }, "alt": { "type": "string" } }
+    }
+  }
+}