apt-mcp-agent-setup 3.5.16 → 3.5.18

package/docs/technical-sources.md

@@ -1,139 +1,149 @@
-# APT technical sources
-
-This is the human-reviewed registry for APT upstreams and internal technical branches. Add every new imported, adapted or referenced technique here before integration. A newer upstream is a review candidate, never an automatic upgrade.
-
-Schema: source-table-v1. The fixed column headers below are parsed by sources:validate. Do not put an unescaped table separator inside a cell. Dates mean local evidence reviewed, not a claim that upstream latest was checked.
-
-Resource digest is SHA-256 of pinned vendor provenance or the reviewed local skill snapshot. none means external installation, no imported bytes, or historical provenance unavailable as described in Notes. Skill snapshots normalize CRLF to LF; vendor files are byte-exact. skills-lock computedHash describes the imported upstream skill and may differ from APT adaptations.
-
-Integrated sources include shipped adaptations awaiting provenance. needs-pinning is a visible review backlog, not verified upstream pinning. References cannot be promoted to managed sources without license, provenance and compatibility review. Existing manifests govern individual artifacts; this registry does not replace them.
-
-## Integrated sources
-
-| ID | Repository | Role | Consumer | Ref type | Pinned ref | Resource digest | License / notice | Last reviewed | Refresh policy | Compatibility gate | Status | Notes |
-| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| apt-index-3515-interrupted | https://github.com/alphatechs-ai/apt-mcp-agent | adapted-reference | src/core/recovery-proof.js; src/installer/index-interruption-recovery.js; src/core/interrupted-transport-proof.js; src/core/interrupted-operation-audit.js | version | 3.5.15; signed digests listed below | none | APT repository LICENSE | 2026-10-08 | Explicit signed producer review only | sources:validate; signed manifest and producer hashes; cache and scope anchors; boot/process observation; crash/resume; isolated native backend proof; exact transport envelope and missing catalog acknowledgement | reference-only | Historical signed runtime data only. Exact supported runtime digests and containment hash are recorded below. No historical JavaScript execution or dependency upgrade. |
-| codegraph | https://github.com/colbymchenry/codegraph | managed-backend | src/backends/profiles.js; src/backends/source-discovery.js; src/backends/index-store.js | commit | dfccdf62547fcd76d343344d823a0e1998d3a89f; version=1.6.0 | none | MIT @ .agents/NOTICES.md | 2026-10-07 | Explicit before each APT release | sources:validate; source/dist/package tests; native discovery/config gates; read-only native complete-state, engine-version and error-free source-hash coverage; full build required while sync lock failure is ambiguous | active | npm=@colbymchenry/codegraph; Pinned tool contract and platform-isolated cache; External package or adapted history, no vendored bytes digest. |
-| code-review-graph | https://github.com/tirth8205/code-review-graph | managed-backend | src/backends/profiles.js; src/backends/source-discovery.js; src/backends/review_graph.py | commit | fa04ea21e701d9feb748199dbb0b4cf4f365f8f9; version=2.3.9 | none | MIT @ .agents/NOTICES.md | 2026-10-08 | Explicit before each APT release | sources:validate; source/dist/package tests; native discovery/version/config gates; strict single-command porcelain status extraction; full-build untracked source coverage; non-Git full/update/discovery recovery-backup exclusion through version-pinned process-local default patterns; healthy complete graph and matching contract for incremental build | active | Versioned Python environment, registry and workspace cache; External package or adapted history, no vendored bytes digest. |
-| mcp-memory | https://github.com/modelcontextprotocol/servers | managed-backend | src/backends/profiles.js | commit | 153cc26a3b3796a17b693277b5e0e1232a76940e; version=2026.8.31 | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=@modelcontextprotocol/server-memory; Pinned npm package and workspace memory migration; External package or adapted history, no vendored bytes digest. |
-| ag-kit | https://github.com/vudovn/ag-kit | adapted-reference | .agents/agent; .agents/skills | commit | f017f41054775a8ec91f54e93acc9ba6a9430070; version=2026.8.31 | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Specialist routing and dependency checks adapted to the APT catalog; no wholesale import; External package or adapted history, no vendored bytes digest. |
-| matt-pocock | https://github.com/mattpocock/skills | adapted-reference | skills-lock.json | commit | c55ee46073ed923f86ce59a5eb3b6d895095d1b7 | 7aa7c92621f6ee56c2ebdfd7a673d62216ba4f1c770f230eba36dabe12dd6265 | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Keep APT canonical skill IDs and execution rules; Hash is reviewed local snapshot, not unmodified upstream bytes. |
-| taste-skill | https://github.com/leonxlnx/taste-skill | adapted-reference | skills-lock.json | commit | c184364c58658b2f131b4ae8bd3d206cabb3deee | 2ad21943b66f1674670a681fe370cf854a6978abd14323dedc5d9910171f16ed | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Landing and redesign routing only; experimental changes are not the default; Hash is reviewed local snapshot, not unmodified upstream bytes. |
-| web-interface-guidelines | https://github.com/vercel-labs/web-interface-guidelines | adapted-reference | .agents/skills/web-design-guidelines/SKILL.md | commit | e3d624baaf29dc1fc645aff3e38f03e564d2d6b1 | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Use at UI review; preserve the packaged skill version for active runs; External package or adapted history, no vendored bytes digest. |
-| marketing-skills | https://github.com/coreyhaines31/marketingskills | managed-bundle | .agents/marketing-manifest.json | commit | dda3841f0b294e01e93b1541486beefbfab0915e; version=2.11.17 | 71ad0f392c3505b7837436130e099c6a40a52621a32af3db5c05b2adc6d17fa5 | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Package only pinned Markdown and static reference data. Exclude plugin manifests, CLI tools, integrations, partner registries, credentials and network setup. APT SEO/GEO/ASO routing remains authoritative.; Hash is reviewed local snapshot, not unmodified upstream bytes. |
-| ui-ux-pro-max | https://github.com/nextlevelbuilder/ui-ux-pro-max-skill | packaged-vendor | .agents/skills/ui-ux-pro-max/provenance.json | commit | 4d140cf8ff6842de13213c7214eff3810371beb2; version=v2.13.0 | e0988f6a63d757c73d034c95d84814a480e91bd162045bbbaf47c44b5fba3de3 | MIT @ .agents/skills/ui-ux-pro-max/vendor/LICENSE | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Pinned vendor bytes; upstream tag differs from embedded metadata when reported in provenance. |
-| archify | https://github.com/tt-a1i/archify | packaged-vendor | .agents/skills/archify/provenance.json | commit | 2ab3cae7ac2c2a55d7386ca789d03c4fcd31816c; version=v3.0.1 | 962f27d14cb81c41c34afe1623e357087262d0faf11ce7a4c7c74e8072737c42 | MIT @ .agents/skills/archify/vendor/LICENSE | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Pinned vendor bytes; upstream tag differs from embedded metadata when reported in provenance. |
-| flutter-skills | https://github.com/flutter/skills | managed-bundle | skills-lock.json | unpinned | unknown | 9a8ddb42c1795c6b1757ec9511eeb27edbce902752979e36fa2e04b9923a1a84 | BSD-3-Clause @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Local skill hashes only. Upstream URL redirects to flutter/agent-plugins; review rename before changing locks. |
-| aso-skills | https://github.com/Eronred/aso-skills | adapted-reference | scripts/fetch-aso-skills.js | unpinned | unknown | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Fetch script currently reads main; not a release pin. |
-| superpowers | https://github.com/obra/superpowers | adapted-reference | .agents/skills/plan-writing/SKILL.md; .agents/skills/subagent-driven-development/SKILL.md | unpinned | unknown | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Adapted workflow; no original commit has been recorded. |
-| ponytail | https://github.com/DietrichGebert/ponytail | adapted-reference | .agents/skills/ponytail-lazy-dev/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Inspired workflow via AG Kit; verify original license and commit before importing additional bytes. |
-| ppt-master | https://github.com/hugohe3/ppt-master | addon | src/installer/presentations.js | commit | a50758ac29ec027e85966db33e2ae80031446756; version=6.6.0 | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Installed addon validates commit. License review required; external install, no local vendor digest. |
-| playwright-mcp | https://github.com/microsoft/playwright-mcp | managed-backend | src/backends/profiles.js | version | 0.0.82 | none | Apache-2.0 @ https://github.com/microsoft/playwright-mcp/blob/main/LICENSE | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=@playwright/mcp; Browser profile separately pins core and Chromium. |
-| fastmcp | https://github.com/jlowin/fastmcp | addon | src/backends/profiles.js | version | 3.4.2 | none | Apache-2.0 | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Python review dependency; pip=fastmcp. External install, no vendor digest. |
-| mcp-python | https://github.com/modelcontextprotocol/python-sdk | addon | src/backends/profiles.js | version | 1.28.1 | none | MIT | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Python review dependency; pip=mcp. External install, no vendor digest. |
-| stitch-mcp | https://github.com/davideast/stitch-mcp | addon | src/installer/project-setup.js | version | 0.9.0 | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | npm=@_davideast/stitch-mcp; optional connector. External install, no vendor digest. |
-| mcp-atlassian | https://github.com/sooperset/mcp-atlassian | addon | src/installer/project-setup.js | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Installer uses pip without a version pin. External install, no vendor digest. |
-| context7 | https://github.com/upstash/context7 | addon | .agents/mcp_config.json | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Optional documentation connector template; not installed automatically by registry. External install, no vendor digest. |
-| docx | https://github.com/dolanmiu/docx | addon | package-lock.json | version | 9.7.1 | none | MIT @ https://github.com/dolanmiu/docx | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=docx; Lockfile integrity governs installed package. No vendored bytes. |
-| javascript-obfuscator | https://github.com/javascript-obfuscator/javascript-obfuscator | addon | package-lock.json | version | 5.4.3 | none | BSD-2-Clause @ https://github.com/javascript-obfuscator/javascript-obfuscator | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=javascript-obfuscator; Lockfile integrity governs installed package. No vendored bytes. |
-| ssh2 | https://github.com/mscdex/ssh2 | addon | package-lock.json | version | 1.17.0 | none | MIT @ https://github.com/mscdex/ssh2 | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=ssh2; Lockfile integrity governs installed package. No vendored bytes. |
-
-| figma-context | https://github.com/figma-developer/figma-context-mcp | addon | src/proxy/backends.js | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; connector/schema/native gates | needs-pinning | Backend command currently references GitHub latest. Verify repository resolution and license before pinning; no vendor bytes. |
-
-## Reviewed references
-
-Design systems, font notices, marketing citations and host protocol references are grouped by consumer. These rows do not describe installed APT backends.
-
-| ID | Repository | Role | Consumer | Ref type | Pinned ref | Resource digest | License / notice | Last reviewed | Refresh policy | Compatibility gate | Status | Notes |
-| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| git-repository-layout | https://git-scm.com/docs/gitrepository-layout | citation-only | src/core/git-context.js | version | 2.49.0 | none | GPL-2.0 @ https://github.com/git/git/blob/master/COPYING | 2026-10-04 | Explicit review when repository discovery changes | sources:validate; repository/worktree/bare/invalid metadata regression; source/dist/package gates | reference-only | Original filesystem resolver based on documented gitdir/commondir layout. No upstream code imported; Git operations remain explicit. |
-| kernel-proc-lock-reference | https://www.kernel.org/doc/html/v6.8/filesystems/proc.html | citation-only | src/core/owned-lock.js | tag | v6.8 | none | unknown | 2026-10-06 | Explicit review when Linux ownership observation changes | sources:validate; missing/hidden/permission PID lock regressions; source/dist/package gates | reference-only | Linux ownership observation reference for hidepid and invisible live process entries. Versioned documentation URL; license and content digest not recorded. No code or documentation bytes imported; no installed dependency. |
-| material-web | https://github.com/material-components/material-web | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| fluent-ui | https://github.com/microsoft/fluentui | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| carbon | https://github.com/carbon-design-system/carbon | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| polaris | https://github.com/Shopify/polaris-react | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| primer-css | https://github.com/primer/css | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| primer-brand | https://github.com/primer/brand | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| govuk | https://github.com/alphagov/govuk-frontend | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| uswds | https://github.com/uswds/uswds | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| radix | https://github.com/radix-ui/themes | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| shadcn | https://github.com/shadcn-ui/ui | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| bootstrap | https://github.com/twbs/bootstrap | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| tailwind | https://github.com/tailwindlabs/tailwindcss | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| atlassian-design | https://atlassian.design | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| mdn | https://developer.mozilla.org | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| humanizer | https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing | citation-only | .agents/skills/humanizer/references/patterns.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
-| simple-icons | https://github.com/simple-icons/simple-icons | citation-only | .agents/skills/archify/vendor/THIRD_PARTY_NOTICES.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Third-party notice/design source. Archify font bytes remain governed by its provenance and SIL OFL notice; no separate backend. |
-| jetbrains-mono | https://github.com/JetBrains/JetBrainsMono | citation-only | .agents/skills/archify/vendor/THIRD_PARTY_NOTICES.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Third-party notice/design source. Archify font bytes remain governed by its provenance and SIL OFL notice; no separate backend. |
-| dotnet-brand | https://github.com/dotnet/brand | citation-only | .agents/skills/archify/vendor/THIRD_PARTY_NOTICES.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Third-party notice/design source. Archify font bytes remain governed by its provenance and SIL OFL notice; no separate backend. |
-| javascript-logo | https://github.com/voodootikigod/logo.js | citation-only | .agents/skills/archify/vendor/THIRD_PARTY_NOTICES.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Third-party notice/design source. Archify font bytes remain governed by its provenance and SIL OFL notice; no separate backend. |
-| vue-art | https://github.com/vuejs/art | citation-only | .agents/skills/archify/vendor/THIRD_PARTY_NOTICES.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Third-party notice/design source. Archify font bytes remain governed by its provenance and SIL OFL notice; no separate backend. |
-| claude-ads | https://github.com/AgriciDaniel/claude-ads | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
-| gooseworks-ads | https://github.com/gooseworks-ai/gooseworks-ads-skills | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
-| super-video-maker | https://github.com/Bomx/super-video-maker-skill | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
-| ai-visibility | https://github.com/Knowatoa/ai-visibility-skills | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
-| knowledge-catalog | https://github.com/GoogleCloudPlatform/knowledge-catalog | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
-| x-algorithm | https://github.com/xai-org/x-algorithm | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
-| voicebox | https://github.com/jamiepine/voicebox | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
-| better-all | https://github.com/shuding/better-all | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
-| lru-cache | https://github.com/isaacs/node-lru-cache | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
-| mcp-registry | https://github.com/modelcontextprotocol/registry | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
-| posthog | https://github.com/PostHog/posthog-js | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
-| codex-host | https://developers.openai.com/codex | citation-only | src/core/host-adapters.js | unpinned | unknown | none | Documentation terms | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Native protocol reference; runtime capability still needs host evidence. |
-| claude-host | https://code.claude.com/docs/en/hooks | citation-only | src/core/host-adapters.js; src/core/readonly-skill.js; src/core/claude-invocation.js; src/installer/hook-dispatcher.js | unpinned | unknown | none | Documentation terms | 2026-10-07 | Explicit before each APT release | sources:validate; source/dist/package tests; delayed transcript, hook deadline and native grant handoff regressions; native gate if runtime changes | reference-only | PreToolUse updatedInput replaces the entire input. Command hook timeout discards output and is not a blocking decision. Transcript path is a locator, never caller authority. Native protocol and skills resolution reference at https://code.claude.com/docs/en/skills; runtime capability still needs host evidence. |
-| windows-job-objects | https://learn.microsoft.com/en-us/windows/win32/procthread/job-objects | citation-only | src/core/windows-job.ps1; src/core/windows-job.js | unpinned | unknown | none | Microsoft documentation terms @ https://learn.microsoft.com/en-us/legal/termsofuse | 2026-10-04 | Explicit before each process lifecycle change | sources:validate; Windows owned tree regression; signed package and native shutdown gates | reference-only | Original APT implementation uses Windows APIs. No Microsoft sample code, package, service or MCP registration is imported. Job assignment happens at a controlled launch barrier; no breakaway permissions. |
-| node-runtime | https://github.com/nodejs/node | citation-only | package.json; isolated minimum-version test fixtures | version | 18.20.8 | none | MIT @ https://github.com/nodejs/node/blob/main/LICENSE | 2026-10-04 | Check announced minimum before each runtime release | source/dist/package tests on declared minimum; verified official archive checksum | reference-only | Test toolchain only. No Node binary is bundled or installed into client runtime by this registry. |
-| openpyxl | https://foss.heptapod.net/openpyxl/openpyxl | citation-only | spreadsheet skill test prerequisites; isolated WSL test environment | version | 3.1.5 | none | MIT/Expat @ https://openpyxl.readthedocs.io/en/stable/ | 2026-10-04 | Review with spreadsheet skill changes | sources:validate; spreadsheet source/dist regression on Windows and WSL | reference-only | External test prerequisite. APT does not vendor or provision this library. Maintainer fixture uses 3.1.5; this entry does not claim a managed client dependency or a pinned release hash. |
-| antigravity-host | https://www.antigravity.google/docs/hooks | citation-only | src/core/host-adapters.js | unpinned | unknown | none | Documentation terms | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Native protocol reference; runtime capability still needs host evidence. |
-
-| windows-legacy-query | https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-queryfullprocessimagenamew | citation-only | src/core/windows-legacy-query.ps1; src/core/legacy-retirement-proof.js | unpinned | unknown | none | Microsoft documentation terms @ https://learn.microsoft.com/en-us/legal/termsofuse | 2026-10-06 | Explicit before process recovery changes | sources:validate; helper integrity/UAC/identity regressions; signed local acceptance | reference-only | Original APT read-only implementation. Also reviewed GetProcessTimes, GetExitCodeProcess (https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-getexitcodeprocess), WINTRUST_CATALOG_INFO, CryptCATAdminCalcHashFromFileHandle2, CertVerifyCertificateChainPolicy, QueryServiceStatusEx and SHELLEXECUTEINFOW on Microsoft Learn. No samples, services, dependencies or registrations imported. Trusted Windows/System32/SCM exclusion, not loaded-image-byte attestation; helper has no process control or workspace writes. |
-| apt-legacy-direct-node-330 | https://gitlab.com/anhdh/base_mcp_ai_agent | citation-only | src/core/legacy-retirement-proof.js; src/core/backend-lease-recovery.js | version | 3.3.0 | a657c8822f83c1a66a6f25c3f8a8b5eff918599e0ebd467be4a3c58875b454ba | APT proprietary license @ LICENSE | 2026-10-07 | Explicit review before adding producer contracts | production signature; direct receipt/workspace binding; pinned index producer hash; exact lease/cache scope; Windows service identity; retirement regressions | reference-only | Digest identifies the verified signed runtime manifest, not imported vendor bytes. Proxy uses the Node process as its direct owner. Historical src/backends/index-store.js SHA-256=8d343544ceb1fa3f024f9503492c9a02958266654ccc13f53c65788609e908d0 defines the four-field Node cache lease semantics, without attesting a particular lease's historical writer. PolicyAgent cache recovery is separate from HvHost connection recovery. Older JavaScript is never executed for recovery and no service PID is controlled. Windows APIs use the existing windows-legacy-query reference. |
-| windows-cim-time | https://learn.microsoft.com/en-us/windows/win32/wmisdk/cim-datetime | citation-only | src/core/windows-legacy-query.ps1; legacy receipt and backend lease providers | unpinned | unknown | none | Microsoft documentation terms @ https://learn.microsoft.com/en-us/legal/termsofuse | 2026-10-07 | Explicit before process identity changes | sources:validate; native Windows handle/CIM precision regression; signed helper integrity and local acceptance | reference-only | CIM DATETIME carries microseconds; GetProcessTimes uses 100-nanosecond FILETIME units. Original APT code tags the CIM anchor, captures the exact native start from the held handle and rechecks that exact value. Time alone does not authorize retirement; signed producer, image, service, bytes and membership checks remain mandatory. No samples, dependencies or registrations imported. |
-| windows-service-observation | https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service | citation-only | src/core/owned-process.js; legacy receipt and backend lease providers | unpinned | unknown | none | Microsoft documentation terms @ https://learn.microsoft.com/en-us/legal/termsofuse | 2026-10-07 | Explicit before retirement changes | sources:validate; service reassignment and archive-race regressions; native read-only service observation; signed local acceptance | reference-only | Original APT code reads SCM-backed State and ProcessId through Win32_Service using fixed System32 PowerShell. Only HvHost and PolicyAgent are queried; no service methods, process signals, samples, dependencies or registrations are imported. Fresh mapping is required before proof reuse and retirement after helper exit. |
-
-| windows-os-boot-time | https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-operatingsystem | citation-only | src/core/boot-evidence.js | unpinned | unknown | none | Microsoft documentation terms @ https://learn.microsoft.com/en-us/legal/termsofuse | 2026-10-08 | Explicit before boot evidence changes | sources:validate; boot and process identity regressions; native read-only Windows capture and repeated capture stability | reference-only | LastBootUpTime is the CIM boot anchor, converted to UTC FILETIME by original APT code. Documentation has no recorded commit pin; no source bytes, samples, dependencies or registrations imported. A reboot observation cannot authorize mutation without caller verification of signed producer, scope, cache and bytes, plus fresh evidence before archive. |
-| windows-boot-uptime | https://learn.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-gettickcount64 | citation-only | src/core/boot-evidence.js | unpinned | unknown | none | Microsoft documentation terms @ https://learn.microsoft.com/en-us/legal/termsofuse | 2026-10-08 | Explicit before boot evidence changes | sources:validate; monotonic uptime and clock conflict regressions; native read-only Windows capture and repeated capture stability | reference-only | GetTickCount64 supplies milliseconds since system start to check the independent CIM anchor against observed UTC time. Original APT code calls fixed System32 kernel32 through an in-memory P/Invoke definition. Documentation has no recorded commit pin; no source bytes, samples, dependencies or registrations imported. No UAC, process signals, runtime state writes or backend startup. |
-
-## Update workflow
-
-1. Before every APT release/update, run npm run sources:validate offline. Errors block packaging; needs-pinning warnings stay visible in release decisions.
-2. Explicitly run npm run sources:refresh, optionally -- --source ID or -- --json. Only this command performs network discovery. It prints a report and does not change this file, pins, lockfiles, bundles or runtime.
-3. Review changed tags, branch head, license, paths and compare URLs. Compatibility remains unverified until focused tests and any affected native gates pass. Registry failures, API rate limits and missing license metadata are not evidence of up-to-date sources.
-4. Approve a source upgrade separately. Update its existing pin, per-file provenance, notices, lockfile and registry together. Keep APT wrappers and local policies; do not wholesale-import upstream plugins, CLIs or integrations.
-5. Run the compatibility gates and record release findings. Refresh results never confirm worker models or native IDE activation. No new MCP registration is created by source tracking.
-
-Commands: npm run sources:validate; npm run sources:refresh; npm run sources:refresh -- --source ui-ux-pro-max --json. Exit 0 means local validation/discovery succeeded, not that upstream changes were approved. Exit 1 means invalid local metadata or incomplete discovery.
-
-For JSON-only stdout, use npm run --silent sources:refresh -- --json (or node scripts/technical-sources.js refresh --json). Without --silent, npm prints its own lifecycle banner before the CLI report. The CLI itself emits one JSON document.
-
+# APT technical sources
+
+This is the human-reviewed registry for APT upstreams and internal technical branches. Add every new imported, adapted or referenced technique here before integration. A newer upstream is a review candidate, never an automatic upgrade.
+
+Schema: source-table-v1. The fixed column headers below are parsed by sources:validate. Do not put an unescaped table separator inside a cell. Dates mean local evidence reviewed, not a claim that upstream latest was checked.
+
+Resource digest is SHA-256 of pinned vendor provenance or the reviewed local skill snapshot. none means external installation, no imported bytes, or historical provenance unavailable as described in Notes. Skill snapshots normalize CRLF to LF; vendor files are byte-exact. skills-lock computedHash describes the imported upstream skill and may differ from APT adaptations.
+
+Integrated sources include shipped adaptations awaiting provenance. needs-pinning is a visible review backlog, not verified upstream pinning. References cannot be promoted to managed sources without license, provenance and compatibility review. Existing manifests govern individual artifacts; this registry does not replace them.
+
+## Integrated sources
+
+| ID | Repository | Role | Consumer | Ref type | Pinned ref | Resource digest | License / notice | Last reviewed | Refresh policy | Compatibility gate | Status | Notes |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| apt-index-3515-interrupted | https://github.com/alphatechs-ai/apt-mcp-agent | adapted-reference | src/core/recovery-proof.js; src/installer/index-interruption-recovery.js; src/core/interrupted-transport-proof.js; src/core/interrupted-natural-closure-proof.js; src/core/interrupted-boot-transport-proof.js; src/core/transport-boot-contract.json; src/core/interrupted-operation-audit.js; src/installer/interrupted-operation-recovery.js | version | 3.5.15; signed 3.5.18 closure profile and digests listed below | none | APT repository LICENSE | 2026-10-08 | Explicit signed producer review only | sources:validate; signed manifest and producer hashes; cache and scope anchors; boot/process observation; crash/resume; isolated native backend proof; exact transport envelope and missing catalog acknowledgement; v3 explicit confirmation, closure MAC and terminal Job proof; v5 acknowledged original archive, canonical ticket time, later boot, fresh identity, own confirmation and primary/secondary crash proof | reference-only | Historical signed runtime data only. Exact supported runtime digests and containment hash are recorded below. No historical JavaScript execution or dependency upgrade. |
+| codegraph | https://github.com/colbymchenry/codegraph | managed-backend | src/backends/profiles.js; src/backends/source-discovery.js; src/backends/index-store.js | commit | dfccdf62547fcd76d343344d823a0e1998d3a89f; version=1.6.0 | none | MIT @ .agents/NOTICES.md | 2026-10-07 | Explicit before each APT release | sources:validate; source/dist/package tests; native discovery/config gates; read-only native complete-state, engine-version and error-free source-hash coverage; full build required while sync lock failure is ambiguous | active | npm=@colbymchenry/codegraph; Pinned tool contract and platform-isolated cache; External package or adapted history, no vendored bytes digest. |
+| code-review-graph | https://github.com/tirth8205/code-review-graph | managed-backend | src/backends/profiles.js; src/backends/source-discovery.js; src/backends/review_graph.py | commit | fa04ea21e701d9feb748199dbb0b4cf4f365f8f9; version=2.3.9 | none | MIT @ .agents/NOTICES.md | 2026-10-08 | Explicit before each APT release | sources:validate; source/dist/package tests; native discovery/version/config gates; strict single-command porcelain status extraction; full-build untracked source coverage; non-Git full/update/discovery recovery-backup exclusion through version-pinned process-local default patterns; healthy complete graph and matching contract for incremental build; nested ignore pattern equivalence across Python hash seeds; real source/config changes remain fail-closed | active | Versioned Python environment, registry and workspace cache. Native ignore matching is boolean membership, so APT fingerprints ignore patterns as a sorted unique set. Other configuration order and exact config file bytes remain significant. External package or adapted history, no vendored bytes digest. |
+| mcp-memory | https://github.com/modelcontextprotocol/servers | managed-backend | src/backends/profiles.js | commit | 153cc26a3b3796a17b693277b5e0e1232a76940e; version=2026.8.31 | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=@modelcontextprotocol/server-memory; Pinned npm package and workspace memory migration; External package or adapted history, no vendored bytes digest. |
+| ag-kit | https://github.com/vudovn/ag-kit | adapted-reference | .agents/agent; .agents/skills | commit | f017f41054775a8ec91f54e93acc9ba6a9430070; version=2026.8.31 | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Specialist routing and dependency checks adapted to the APT catalog; no wholesale import; External package or adapted history, no vendored bytes digest. |
+| matt-pocock | https://github.com/mattpocock/skills | adapted-reference | skills-lock.json | commit | c55ee46073ed923f86ce59a5eb3b6d895095d1b7 | 7aa7c92621f6ee56c2ebdfd7a673d62216ba4f1c770f230eba36dabe12dd6265 | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Keep APT canonical skill IDs and execution rules; Hash is reviewed local snapshot, not unmodified upstream bytes. |
+| taste-skill | https://github.com/leonxlnx/taste-skill | adapted-reference | skills-lock.json | commit | c184364c58658b2f131b4ae8bd3d206cabb3deee | 2ad21943b66f1674670a681fe370cf854a6978abd14323dedc5d9910171f16ed | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Landing and redesign routing only; experimental changes are not the default; Hash is reviewed local snapshot, not unmodified upstream bytes. |
+| web-interface-guidelines | https://github.com/vercel-labs/web-interface-guidelines | adapted-reference | .agents/skills/web-design-guidelines/SKILL.md | commit | e3d624baaf29dc1fc645aff3e38f03e564d2d6b1 | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Use at UI review; preserve the packaged skill version for active runs; External package or adapted history, no vendored bytes digest. |
+| marketing-skills | https://github.com/coreyhaines31/marketingskills | managed-bundle | .agents/marketing-manifest.json | commit | dda3841f0b294e01e93b1541486beefbfab0915e; version=2.11.17 | 71ad0f392c3505b7837436130e099c6a40a52621a32af3db5c05b2adc6d17fa5 | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Package only pinned Markdown and static reference data. Exclude plugin manifests, CLI tools, integrations, partner registries, credentials and network setup. APT SEO/GEO/ASO routing remains authoritative.; Hash is reviewed local snapshot, not unmodified upstream bytes. |
+| ui-ux-pro-max | https://github.com/nextlevelbuilder/ui-ux-pro-max-skill | packaged-vendor | .agents/skills/ui-ux-pro-max/provenance.json | commit | 4d140cf8ff6842de13213c7214eff3810371beb2; version=v2.13.0 | e0988f6a63d757c73d034c95d84814a480e91bd162045bbbaf47c44b5fba3de3 | MIT @ .agents/skills/ui-ux-pro-max/vendor/LICENSE | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Pinned vendor bytes; upstream tag differs from embedded metadata when reported in provenance. |
+| archify | https://github.com/tt-a1i/archify | packaged-vendor | .agents/skills/archify/provenance.json | commit | 2ab3cae7ac2c2a55d7386ca789d03c4fcd31816c; version=v3.0.1 | 962f27d14cb81c41c34afe1623e357087262d0faf11ce7a4c7c74e8072737c42 | MIT @ .agents/skills/archify/vendor/LICENSE | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Pinned vendor bytes; upstream tag differs from embedded metadata when reported in provenance. |
+| flutter-skills | https://github.com/flutter/skills | managed-bundle | skills-lock.json | unpinned | unknown | 9a8ddb42c1795c6b1757ec9511eeb27edbce902752979e36fa2e04b9923a1a84 | BSD-3-Clause @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Local skill hashes only. Upstream URL redirects to flutter/agent-plugins; review rename before changing locks. |
+| aso-skills | https://github.com/Eronred/aso-skills | adapted-reference | scripts/fetch-aso-skills.js | unpinned | unknown | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Fetch script currently reads main; not a release pin. |
+| superpowers | https://github.com/obra/superpowers | adapted-reference | .agents/skills/plan-writing/SKILL.md; .agents/skills/subagent-driven-development/SKILL.md | unpinned | unknown | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Adapted workflow; no original commit has been recorded. |
+| ponytail | https://github.com/DietrichGebert/ponytail | adapted-reference | .agents/skills/ponytail-lazy-dev/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Inspired workflow via AG Kit; verify original license and commit before importing additional bytes. |
+| ppt-master | https://github.com/hugohe3/ppt-master | addon | src/installer/presentations.js | commit | a50758ac29ec027e85966db33e2ae80031446756; version=6.6.0 | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Installed addon validates commit. License review required; external install, no local vendor digest. |
+| playwright-mcp | https://github.com/microsoft/playwright-mcp | managed-backend | src/backends/profiles.js | version | 0.0.82 | none | Apache-2.0 @ https://github.com/microsoft/playwright-mcp/blob/main/LICENSE | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=@playwright/mcp; Browser profile separately pins core and Chromium. |
+| fastmcp | https://github.com/jlowin/fastmcp | addon | src/backends/profiles.js | version | 3.4.2 | none | Apache-2.0 | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Python review dependency; pip=fastmcp. External install, no vendor digest. |
+| mcp-python | https://github.com/modelcontextprotocol/python-sdk | addon | src/backends/profiles.js | version | 1.28.1 | none | MIT | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Python review dependency; pip=mcp. External install, no vendor digest. |
+| stitch-mcp | https://github.com/davideast/stitch-mcp | addon | src/installer/project-setup.js | version | 0.9.0 | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | npm=@_davideast/stitch-mcp; optional connector. External install, no vendor digest. |
+| mcp-atlassian | https://github.com/sooperset/mcp-atlassian | addon | src/installer/project-setup.js | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Installer uses pip without a version pin. External install, no vendor digest. |
+| context7 | https://github.com/upstash/context7 | addon | .agents/mcp_config.json | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Optional documentation connector template; not installed automatically by registry. External install, no vendor digest. |
+| docx | https://github.com/dolanmiu/docx | addon | package-lock.json | version | 9.7.1 | none | MIT @ https://github.com/dolanmiu/docx | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=docx; Lockfile integrity governs installed package. No vendored bytes. |
+| javascript-obfuscator | https://github.com/javascript-obfuscator/javascript-obfuscator | addon | package-lock.json | version | 5.4.3 | none | BSD-2-Clause @ https://github.com/javascript-obfuscator/javascript-obfuscator | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=javascript-obfuscator; Lockfile integrity governs installed package. No vendored bytes. |
+| ssh2 | https://github.com/mscdex/ssh2 | addon | package-lock.json | version | 1.17.0 | none | MIT @ https://github.com/mscdex/ssh2 | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=ssh2; Lockfile integrity governs installed package. No vendored bytes. |
+
+| figma-context | https://github.com/figma-developer/figma-context-mcp | addon | src/proxy/backends.js | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; connector/schema/native gates | needs-pinning | Backend command currently references GitHub latest. Verify repository resolution and license before pinning; no vendor bytes. |
+
+## Reviewed references
+
+Design systems, font notices, marketing citations and host protocol references are grouped by consumer. These rows do not describe installed APT backends.
+
+| ID | Repository | Role | Consumer | Ref type | Pinned ref | Resource digest | License / notice | Last reviewed | Refresh policy | Compatibility gate | Status | Notes |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| git-repository-layout | https://git-scm.com/docs/gitrepository-layout | citation-only | src/core/git-context.js | version | 2.49.0 | none | GPL-2.0 @ https://github.com/git/git/blob/master/COPYING | 2026-10-04 | Explicit review when repository discovery changes | sources:validate; repository/worktree/bare/invalid metadata regression; source/dist/package gates | reference-only | Original filesystem resolver based on documented gitdir/commondir layout. No upstream code imported; Git operations remain explicit. |
+| kernel-proc-lock-reference | https://www.kernel.org/doc/html/v6.8/filesystems/proc.html | citation-only | src/core/owned-lock.js | tag | v6.8 | none | unknown | 2026-10-06 | Explicit review when Linux ownership observation changes | sources:validate; missing/hidden/permission PID lock regressions; source/dist/package gates | reference-only | Linux ownership observation reference for hidepid and invisible live process entries. Versioned documentation URL; license and content digest not recorded. No code or documentation bytes imported; no installed dependency. |
+| material-web | https://github.com/material-components/material-web | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| fluent-ui | https://github.com/microsoft/fluentui | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| carbon | https://github.com/carbon-design-system/carbon | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| polaris | https://github.com/Shopify/polaris-react | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| primer-css | https://github.com/primer/css | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| primer-brand | https://github.com/primer/brand | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| govuk | https://github.com/alphagov/govuk-frontend | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| uswds | https://github.com/uswds/uswds | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| radix | https://github.com/radix-ui/themes | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| shadcn | https://github.com/shadcn-ui/ui | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| bootstrap | https://github.com/twbs/bootstrap | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| tailwind | https://github.com/tailwindlabs/tailwindcss | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| atlassian-design | https://atlassian.design | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| mdn | https://developer.mozilla.org | citation-only | .agents/skills/design-taste-frontend/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| humanizer | https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing | citation-only | .agents/skills/humanizer/references/patterns.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Documentation/reference only; no package installation or model capability claim. |
+| simple-icons | https://github.com/simple-icons/simple-icons | citation-only | .agents/skills/archify/vendor/THIRD_PARTY_NOTICES.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Third-party notice/design source. Archify font bytes remain governed by its provenance and SIL OFL notice; no separate backend. |
+| jetbrains-mono | https://github.com/JetBrains/JetBrainsMono | citation-only | .agents/skills/archify/vendor/THIRD_PARTY_NOTICES.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Third-party notice/design source. Archify font bytes remain governed by its provenance and SIL OFL notice; no separate backend. |
+| dotnet-brand | https://github.com/dotnet/brand | citation-only | .agents/skills/archify/vendor/THIRD_PARTY_NOTICES.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Third-party notice/design source. Archify font bytes remain governed by its provenance and SIL OFL notice; no separate backend. |
+| javascript-logo | https://github.com/voodootikigod/logo.js | citation-only | .agents/skills/archify/vendor/THIRD_PARTY_NOTICES.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Third-party notice/design source. Archify font bytes remain governed by its provenance and SIL OFL notice; no separate backend. |
+| vue-art | https://github.com/vuejs/art | citation-only | .agents/skills/archify/vendor/THIRD_PARTY_NOTICES.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Third-party notice/design source. Archify font bytes remain governed by its provenance and SIL OFL notice; no separate backend. |
+| claude-ads | https://github.com/AgriciDaniel/claude-ads | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
+| gooseworks-ads | https://github.com/gooseworks-ai/gooseworks-ads-skills | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
+| super-video-maker | https://github.com/Bomx/super-video-maker-skill | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
+| ai-visibility | https://github.com/Knowatoa/ai-visibility-skills | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
+| knowledge-catalog | https://github.com/GoogleCloudPlatform/knowledge-catalog | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
+| x-algorithm | https://github.com/xai-org/x-algorithm | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
+| voicebox | https://github.com/jamiepine/voicebox | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
+| better-all | https://github.com/shuding/better-all | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
+| lru-cache | https://github.com/isaacs/node-lru-cache | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
+| mcp-registry | https://github.com/modelcontextprotocol/registry | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
+| posthog | https://github.com/PostHog/posthog-js | citation-only | .agents/skills; marketing/architecture references | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Citation only. Nested upstream reference does not authorize importing code, credentials, plugins or network setup. |
+| codex-host | https://developers.openai.com/codex | citation-only | src/core/host-adapters.js | unpinned | unknown | none | Documentation terms | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Native protocol reference; runtime capability still needs host evidence. |
+| claude-host | https://code.claude.com/docs/en/hooks | citation-only | src/core/host-adapters.js; src/core/readonly-skill.js; src/core/claude-invocation.js; src/installer/hook-dispatcher.js | unpinned | unknown | none | Documentation terms | 2026-10-07 | Explicit before each APT release | sources:validate; source/dist/package tests; delayed transcript, hook deadline and native grant handoff regressions; native gate if runtime changes | reference-only | PreToolUse updatedInput replaces the entire input. Command hook timeout discards output and is not a blocking decision. Transcript path is a locator, never caller authority. Native protocol and skills resolution reference at https://code.claude.com/docs/en/skills; runtime capability still needs host evidence. |
+| windows-job-objects | https://learn.microsoft.com/en-us/windows/win32/procthread/job-objects | citation-only | src/core/windows-job.ps1; src/core/windows-job.js; src/core/recovery-proof.js; src/core/interrupted-natural-closure-proof.js; src/installer/index-interruption-recovery.js | unpinned | unknown | none | Microsoft documentation terms @ https://learn.microsoft.com/en-us/legal/termsofuse | 2026-10-08 | Explicit before each process lifecycle change | sources:validate; Windows owned tree and same-boot terminal receipt regressions; signed producer presence, immutable archive and native shutdown gates; v3 natural closure MAC and exact confirmation | reference-only | Original APT implementation uses Windows APIs. No Microsoft sample code, package, service or MCP registration is imported. Job assignment happens at a controlled launch barrier; no breakaway permissions. Broker disappearance alone is not terminal evidence; same-boot index recovery requires the signed stop-evidence contract, exact durable shutdown receipt and fresh process observations. |
+| node-runtime | https://github.com/nodejs/node | citation-only | package.json; isolated minimum-version test fixtures | version | 18.20.8 | none | MIT @ https://github.com/nodejs/node/blob/main/LICENSE | 2026-10-04 | Check announced minimum before each runtime release | source/dist/package tests on declared minimum; verified official archive checksum | reference-only | Test toolchain only. No Node binary is bundled or installed into client runtime by this registry. |
+| openpyxl | https://foss.heptapod.net/openpyxl/openpyxl | citation-only | spreadsheet skill test prerequisites; isolated WSL test environment | version | 3.1.5 | none | MIT/Expat @ https://openpyxl.readthedocs.io/en/stable/ | 2026-10-04 | Review with spreadsheet skill changes | sources:validate; spreadsheet source/dist regression on Windows and WSL | reference-only | External test prerequisite. APT does not vendor or provision this library. Maintainer fixture uses 3.1.5; this entry does not claim a managed client dependency or a pinned release hash. |
+| antigravity-host | https://www.antigravity.google/docs/hooks | citation-only | src/core/host-adapters.js | unpinned | unknown | none | Documentation terms | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Native protocol reference; runtime capability still needs host evidence. |
+
+| windows-legacy-query | https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-queryfullprocessimagenamew | citation-only | src/core/windows-legacy-query.ps1; src/core/legacy-retirement-proof.js | unpinned | unknown | none | Microsoft documentation terms @ https://learn.microsoft.com/en-us/legal/termsofuse | 2026-10-06 | Explicit before process recovery changes | sources:validate; helper integrity/UAC/identity regressions; signed local acceptance | reference-only | Original APT read-only implementation. Also reviewed GetProcessTimes, GetExitCodeProcess (https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-getexitcodeprocess), WINTRUST_CATALOG_INFO, CryptCATAdminCalcHashFromFileHandle2, CertVerifyCertificateChainPolicy, QueryServiceStatusEx and SHELLEXECUTEINFOW on Microsoft Learn. No samples, services, dependencies or registrations imported. Trusted Windows/System32/SCM exclusion, not loaded-image-byte attestation; helper has no process control or workspace writes. |
+| apt-legacy-direct-node-330 | https://gitlab.com/anhdh/base_mcp_ai_agent | adapted-reference | src/core/legacy-retirement-proof.js; src/core/backend-lease-recovery.js; src/installer/legacy-prepared-plan.js; test/fixtures/legacy-prepared-340.json; test/installer/legacy-prepared-plan.test.js | version | 3.3.0; prepared-profile=3.4.0 | a657c8822f83c1a66a6f25c3f8a8b5eff918599e0ebd467be4a3c58875b454ba | APT proprietary license @ LICENSE | 2026-10-08 | Explicit review before adding producer contracts | production signature; direct receipt/workspace binding; pinned index producer hash; exact lease/cache scope; Windows service identity; retirement regressions; sources:validate; exact prepared producer hashes; staged/backup integrity; immutable backup reuse | reference-only | Digest identifies the verified signed runtime manifest, not imported vendor bytes. Proxy uses the Node process as its direct owner. Historical src/backends/index-store.js SHA-256=8d343544ceb1fa3f024f9503492c9a02958266654ccc13f53c65788609e908d0 defines the four-field Node cache lease semantics, without attesting a particular lease's historical writer. PolicyAgent cache recovery is separate from HvHost connection recovery. Older JavaScript is never executed for recovery and no service PID is controlled. Windows APIs use the existing windows-legacy-query reference. The separate apt-prepared-340 profile and fixture provenance are recorded below. |
+| windows-cim-time | https://learn.microsoft.com/en-us/windows/win32/wmisdk/cim-datetime | citation-only | src/core/windows-legacy-query.ps1; legacy receipt and backend lease providers | unpinned | unknown | none | Microsoft documentation terms @ https://learn.microsoft.com/en-us/legal/termsofuse | 2026-10-07 | Explicit before process identity changes | sources:validate; native Windows handle/CIM precision regression; signed helper integrity and local acceptance | reference-only | CIM DATETIME carries microseconds; GetProcessTimes uses 100-nanosecond FILETIME units. Original APT code tags the CIM anchor, captures the exact native start from the held handle and rechecks that exact value. Time alone does not authorize retirement; signed producer, image, service, bytes and membership checks remain mandatory. No samples, dependencies or registrations imported. |
+| windows-service-observation | https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service | citation-only | src/core/owned-process.js; legacy receipt and backend lease providers | unpinned | unknown | none | Microsoft documentation terms @ https://learn.microsoft.com/en-us/legal/termsofuse | 2026-10-07 | Explicit before retirement changes | sources:validate; service reassignment and archive-race regressions; native read-only service observation; signed local acceptance | reference-only | Original APT code reads SCM-backed State and ProcessId through Win32_Service using fixed System32 PowerShell. Only HvHost and PolicyAgent are queried; no service methods, process signals, samples, dependencies or registrations are imported. Fresh mapping is required before proof reuse and retirement after helper exit. |
+
+| windows-os-boot-time | https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-operatingsystem | citation-only | src/core/boot-evidence.js | unpinned | unknown | none | Microsoft documentation terms @ https://learn.microsoft.com/en-us/legal/termsofuse | 2026-10-08 | Explicit before boot evidence changes | sources:validate; boot and process identity regressions; native read-only Windows capture and repeated capture stability | reference-only | LastBootUpTime is the CIM boot anchor, converted to UTC FILETIME by original APT code. Documentation has no recorded commit pin; no source bytes, samples, dependencies or registrations imported. A reboot observation cannot authorize mutation without caller verification of signed producer, scope, cache and bytes, plus fresh evidence before archive. |
+| windows-boot-uptime | https://learn.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-gettickcount64 | citation-only | src/core/boot-evidence.js | unpinned | unknown | none | Microsoft documentation terms @ https://learn.microsoft.com/en-us/legal/termsofuse | 2026-10-08 | Explicit before boot evidence changes | sources:validate; monotonic uptime and clock conflict regressions; native read-only Windows capture and repeated capture stability | reference-only | GetTickCount64 supplies milliseconds since system start to check the independent CIM anchor against observed UTC time. Original APT code calls fixed System32 kernel32 through an in-memory P/Invoke definition. Documentation has no recorded commit pin; no source bytes, samples, dependencies or registrations imported. No UAC, process signals, runtime state writes or backend startup. |
+
+## Update workflow
+
+1. Before every APT release/update, run npm run sources:validate offline. Errors block packaging; needs-pinning warnings stay visible in release decisions.
+2. Explicitly run npm run sources:refresh, optionally -- --source ID or -- --json. Only this command performs network discovery. It prints a report and does not change this file, pins, lockfiles, bundles or runtime.
+3. Review changed tags, branch head, license, paths and compare URLs. Compatibility remains unverified until focused tests and any affected native gates pass. Registry failures, API rate limits and missing license metadata are not evidence of up-to-date sources.
+4. Approve a source upgrade separately. Update its existing pin, per-file provenance, notices, lockfile and registry together. Keep APT wrappers and local policies; do not wholesale-import upstream plugins, CLIs or integrations.
+5. Run the compatibility gates and record release findings. Refresh results never confirm worker models or native IDE activation. No new MCP registration is created by source tracking.
+
+Commands: npm run sources:validate; npm run sources:refresh; npm run sources:refresh -- --source ui-ux-pro-max --json. Exit 0 means local validation/discovery succeeded, not that upstream changes were approved. Exit 1 means invalid local metadata or incomplete discovery.
+
+For JSON-only stdout, use npm run --silent sources:refresh -- --json (or node scripts/technical-sources.js refresh --json). Without --silent, npm prints its own lifecycle banner before the CLI report. The CLI itself emits one JSON document.
+
 ## APT internal branches
 
-Interrupted-index producer provenance: `apt-index-3515-interrupted` reads signed APT 3.5.15 manifests as data only. Supported observed runtime digests are `3bc70cd3a1c9c60cca9302cfe1fa333db58f1ea06b5b8e2ece8fbb18d0d29ee8`, `4468a85d96b4e3b4996fc54fd28c1710fea1228b8518a66e8cda145cb5d55d35` and `761b3da699f21d1bec6d168dfbc2b9f8b0455e3f34186a677df00fc68b7580d0`. License: APT repository LICENSE. Consumers: `src/installer/index-interruption-recovery.js`, `src/core/recovery-proof.js`. Integrity gates require release signatures and producer file hashes, including Windows containment hash `dea12ccf8d3e488cb3cd2a23617d9c85cde269ffac79ee7c00480b56faf43469`. Compatibility gates: reboot and PID reuse, cache/path and hash tamper, crash/resume, isolated workspace integration, source/dist tests and signed package checks. No old executor JavaScript is run. This reference neither authorizes dependency upgrades nor client changes.
-
-Transport interruption uses only the last digest above for the legacy 3.5.15 producer. Its `src/installer/connection-supervisor.js` SHA-256 is `eaa154bfdc866c923953752e767755339c16744d766bfb74deec36c79488b362`. The only supported legacy request is the exact raw JSON-RPC envelope `{"jsonrpc":"2.0","id":3,"method":"tools/list","params":{}}`, with SHA-256 `ff6a36e278a7a4e41b704964cee4b6fd94aa63ccd563760b695589708d5b2401`. New producers require the exact signed `src/core/transport-contract.json` descriptor. Consumers are `src/core/interrupted-transport-proof.js`, `src/installer/interrupted-operation-recovery.js` and `src/core/interrupted-operation-audit.js`. Compatibility gates preserve unknown outcomes, prohibit replay, require stopped pre-boot identities and an unapplied pending plan, and bind the missing catalogue acknowledgement to the original closed connection archive. No dependencies or archived JavaScript are loaded.
-
-Snapshot at 2026-10-03 against main at 666b9c6033193937ede4b10645b9407178045380. Base commit is the merge-base with main, not a reconstructed original branch-creation point. Inclusion checks committed tip ancestry only. Dirty worktrees and stash experiments are separate; a branch named 3.3.3 can point to an older baseline. Do not use branch labels as release provenance. Recheck ancestry when merging; retain historical snapshots when branches disappear.
-
-| Branch | Purpose | Base commit | Tip | Status | Included in main | Release / artifact | Last reviewed |
-| --- | --- | --- | --- | --- | --- | --- | --- |
-| apt-3.3.1-runtime-fix | apt-3.3.1-runtime-fix | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| apt-3.3.2-claude-runtime-fix | apt-3.3.2-claude-runtime-fix | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| backup/apt340-before-335-merge | Recovery snapshot | e3e14b44e4d72b76e750e48271f3501ab92db077 | e3e14b44e4d72b76e750e48271f3501ab92db077 | archived | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| develop | develop | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| feat/apt-3.2.8-native-model-routing | apt-3.2.8-native-model-routing | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| feat/apt-core-orchestration | apt-core-orchestration | e6aa5164a2ba4df98c536cbfa8375c8f179c72c1 | e6aa5164a2ba4df98c536cbfa8375c8f179c72c1 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| feat/apt-output-quality | apt-output-quality | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| feature/apt-3.1.0 | apt-3.1.0 | d02e32f5eedafaa9077159afae4364f3ab95645f | d02e32f5eedafaa9077159afae4364f3ab95645f | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| feature/apt-3.3.3-design-doc-skills | apt-3.3.3-design-doc-skills | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| feature/apt-3.4.0-candidate | apt-3.4.0-candidate | 105057d0520a31b5dcd53eda6d08fee4bb58f737 | 105057d0520a31b5dcd53eda6d08fee4bb58f737 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| feature/apt-3.4.0-marketing | apt-3.4.0-marketing | b019507378a4b180a51f53c42ded42cb321d0058 | 2c771ec59df59b28f10bfb97830f8748f9e9c2e6 | local-only | no | Historical branch label; not proof of released content | 2026-10-03 |
-| feature/quality-browser-presentations-aso | quality-browser-presentations-aso | d02e32f5eedafaa9077159afae4364f3ab95645f | d02e32f5eedafaa9077159afae4364f3ab95645f | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| feature/technical-sources-registry | technical-sources-registry | 666b9c6033193937ede4b10645b9407178045380 | 666b9c6033193937ede4b10645b9407178045380 | active | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| fix/apt-3.2.6-pipeline-workspace-recovery | apt-3.2.6-pipeline-workspace-recovery | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| fix/apt-3.3.5-runtime-upgrade | apt-3.3.5-runtime-upgrade | bab11e1af13ace6c1a576f69a9e5b49edd29ead9 | bab11e1af13ace6c1a576f69a9e5b49edd29ead9 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| fix/apt-codex-hook-observation | apt-codex-hook-observation | d02e32f5eedafaa9077159afae4364f3ab95645f | d02e32f5eedafaa9077159afae4364f3ab95645f | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| fix/apt-reliability-model-routing | apt-reliability-model-routing | d02e32f5eedafaa9077159afae4364f3ab95645f | d02e32f5eedafaa9077159afae4364f3ab95645f | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| fix/backend-recovery-3.0.5 | backend-recovery-3.0.5 | d02e32f5eedafaa9077159afae4364f3ab95645f | d02e32f5eedafaa9077159afae4364f3ab95645f | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| fix/launcher-startup-3.0.3 | launcher-startup-3.0.3 | d02e32f5eedafaa9077159afae4364f3ab95645f | d02e32f5eedafaa9077159afae4364f3ab95645f | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| fix/sync-production-public-key | sync-production-public-key | 1d98999b73b7e5478700277b822566e7e3d41522 | 1d98999b73b7e5478700277b822566e7e3d41522 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
-| main | Release integration | 666b9c6033193937ede4b10645b9407178045380 | 666b9c6033193937ede4b10645b9407178045380 | active | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+Natural closure after reboot reuses the registered Windows boot and uptime references through `src/core/boot-evidence.js` and `src/core/interrupted-transport-proof.js`; the additional consumer is `src/core/interrupted-natural-closure-proof.js`. The repository proprietary LICENSE and existing exact signed producer pins still apply. Evidence variant 2 retains closure MAC, terminal Job, workspace and generation checks, reconstructs the original child from signed shutdown evidence, and requires its receipt observation before the uncertainty-adjusted later boot. Fresh observations must prove the original identities are absent or reused in that boot. Same-boot reuse, missing identity, denied observation and conflicting clocks remain blocked. Compatibility gates cover exact consent, unchanged boot authority, rehashed audit rejection, crash/resume and source/dist/local acceptance. No new dependency, sample code, service or MCP registration is imported.
+
+Legacy prepared-plan profile `apt-prepared-340`: Reviewed historical runtime digest 2df9eddeb1983dc539c5cc5b1339f3f96d2caa66291bebc43e3133681e0c4032. Producer SHA-256: src/core/resource-transaction.js=f2c17555f7f00567c05d9ee93e64b761f42c355aed159ac6d90650ba56874826; src/installer/deployment-draft.js=cc8948705981a0e5ab71bf2d2b183fcac8aedbad4deca297fe7f0b303b64cd37; src/installer/workspace-transaction.js=e3bf73606e958f431db209e60b380fd01b912f827f688e7ea2bed698d30afdb7. Fixture stores these three original files as inactive gzip/base64 data and signs a minimal release with an ephemeral test key. Historical JavaScript is never executed. No dependency or runtime upgrade. Consumer: `src/installer/legacy-prepared-plan.js`, `test/fixtures/legacy-prepared-340.json`, `test/installer/legacy-prepared-plan.test.js`. License: APT repository LICENSE, proprietary copyright 2026 anhdh. Compatibility requires the caller trust key, signed release identity, exact producer hashes, workspace and target anchors, absence of both digest properties, prepared operations and verified staging/originals. Retirement preserves current bytes and a complete hash-checked archive. Completed archives are reused after interrupted journal writes; incomplete copies fail closed and require separate recovery.
+
+Boot transport producer provenance: the original internal v5 contract uses APT repository LICENSE. Consumers are src/core/interrupted-boot-transport-proof.js, src/core/transport-boot-contract.json, src/core/interrupted-operation-audit.js and src/installer/interrupted-operation-recovery.js. The only descriptorless producer is signed 3.5.18 digest c73b5de3d1ba136903c23a8bd81372d1cbbae1609c6d7ac95badac9aa60d5389 with supervisor SHA-256 29b7475e43c33fba88fdb4b9bf82ae990597a99aaae96a980cbdcdcc3b0bb06f. Future producers require the exact signed boot descriptor. Existing Windows boot time and uptime references provide independent read-only observations. Gates bind the acknowledged raw-line ticket to immutable original receipt/member/fence bytes, canonical admission after both starts and before a later boot uncertainty margin, fresh absent or postboot reused identities, exact cancellation, independently retired cache references and immutable primary/secondary recovery. New acknowledged synthetic approvals require v5 and cannot fall back to v1. Historical v1 archives remain readable; v2 exact tools/list and missing acknowledgement stay separate. No imported bytes, archived JavaScript execution, dependencies, registrations, runtime updates or process control are added.
+
+Natural transport closure producer provenance: the existing APT internal producer is read as signed data under the repository proprietary LICENSE. Consumers are `src/core/interrupted-natural-closure-proof.js`, `src/core/interrupted-operation-audit.js` and `src/installer/interrupted-operation-recovery.js`. The reviewed installed 3.5.18 release digest is `c73b5de3d1ba136903c23a8bd81372d1cbbae1609c6d7ac95badac9aa60d5389`; its signed and observed supervisor hash is `29b7475e43c33fba88fdb4b9bf82ae990597a99aaae96a980cbdcdcc3b0bb06f`. Future producers require the exact signed `transport-close-contract.json` descriptor and its version inside the receipt MAC. Compatibility gates require v3 exact operator confirmation, retained-key closure MAC verification, matching workspace/runtime/generation/member/process anchors, terminal Windows Job assignment and zero active processes with broker shutdown, observed owner absence, immutable archive rechecks and fail-closed index retirement references. The contract attests only the contained transport tree and preserves other worker reservations and unknown outcomes. No historical JavaScript executes; no dependency or client runtime upgrade is authorized by this reference.
+
+Secondary natural recovery compatibility gate: archive version 4 requires its own exact confirmation, the independently verified original interrupted parent ticket and immutable approval, the same generation/plan/candidate/target/successor, an unchanged captured hold, fresh owner observations and the original executor locks. Parent traversal is bounded to one original v1/v2/v3 archive or an unparented primary v5 archive; another secondary, a cycle, altered parent bytes or an unverified synthetic closure is rejected. Ordinary update and crash/resume tests verify separate ticket audits without replacing the original handoff. This reuses the existing APT internal producer reference and imports no new technical source.
+
+Interrupted-index producer provenance: `apt-index-3515-interrupted` reads signed APT 3.5.15 manifests as data only. Supported observed runtime digests are `3bc70cd3a1c9c60cca9302cfe1fa333db58f1ea06b5b8e2ece8fbb18d0d29ee8`, `4468a85d96b4e3b4996fc54fd28c1710fea1228b8518a66e8cda145cb5d55d35` and `761b3da699f21d1bec6d168dfbc2b9f8b0455e3f34186a677df00fc68b7580d0`. License: APT repository LICENSE. Consumers: `src/installer/index-interruption-recovery.js`, `src/core/recovery-proof.js`. Integrity gates require release signatures and producer file hashes, including Windows containment hash `dea12ccf8d3e488cb3cd2a23617d9c85cde269ffac79ee7c00480b56faf43469`. Compatibility gates: reboot and PID reuse, cache/path and hash tamper, crash/resume, isolated workspace integration, source/dist tests and signed package checks. No old executor JavaScript is run. This reference neither authorizes dependency upgrades nor client changes.
+
+Transport interruption uses only the last digest above for the legacy 3.5.15 producer. Its `src/installer/connection-supervisor.js` SHA-256 is `eaa154bfdc866c923953752e767755339c16744d766bfb74deec36c79488b362`. The only supported legacy request is the exact raw JSON-RPC envelope `{"jsonrpc":"2.0","id":3,"method":"tools/list","params":{}}`, with SHA-256 `ff6a36e278a7a4e41b704964cee4b6fd94aa63ccd563760b695589708d5b2401`. New producers require the exact signed `src/core/transport-contract.json` descriptor. Consumers are `src/core/interrupted-transport-proof.js`, `src/installer/interrupted-operation-recovery.js` and `src/core/interrupted-operation-audit.js`. Compatibility gates preserve unknown outcomes, prohibit replay, require stopped pre-boot identities and an unapplied pending plan, and bind the missing catalogue acknowledgement to the original closed connection archive. No dependencies or archived JavaScript are loaded.
+
+Snapshot at 2026-10-03 against main at 666b9c6033193937ede4b10645b9407178045380. Base commit is the merge-base with main, not a reconstructed original branch-creation point. Inclusion checks committed tip ancestry only. Dirty worktrees and stash experiments are separate; a branch named 3.3.3 can point to an older baseline. Do not use branch labels as release provenance. Recheck ancestry when merging; retain historical snapshots when branches disappear.
+
+| Branch | Purpose | Base commit | Tip | Status | Included in main | Release / artifact | Last reviewed |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| apt-3.3.1-runtime-fix | apt-3.3.1-runtime-fix | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| apt-3.3.2-claude-runtime-fix | apt-3.3.2-claude-runtime-fix | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| backup/apt340-before-335-merge | Recovery snapshot | e3e14b44e4d72b76e750e48271f3501ab92db077 | e3e14b44e4d72b76e750e48271f3501ab92db077 | archived | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| develop | develop | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| feat/apt-3.2.8-native-model-routing | apt-3.2.8-native-model-routing | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| feat/apt-core-orchestration | apt-core-orchestration | e6aa5164a2ba4df98c536cbfa8375c8f179c72c1 | e6aa5164a2ba4df98c536cbfa8375c8f179c72c1 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| feat/apt-output-quality | apt-output-quality | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| feature/apt-3.1.0 | apt-3.1.0 | d02e32f5eedafaa9077159afae4364f3ab95645f | d02e32f5eedafaa9077159afae4364f3ab95645f | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| feature/apt-3.3.3-design-doc-skills | apt-3.3.3-design-doc-skills | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| feature/apt-3.4.0-candidate | apt-3.4.0-candidate | 105057d0520a31b5dcd53eda6d08fee4bb58f737 | 105057d0520a31b5dcd53eda6d08fee4bb58f737 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| feature/apt-3.4.0-marketing | apt-3.4.0-marketing | b019507378a4b180a51f53c42ded42cb321d0058 | 2c771ec59df59b28f10bfb97830f8748f9e9c2e6 | local-only | no | Historical branch label; not proof of released content | 2026-10-03 |
+| feature/quality-browser-presentations-aso | quality-browser-presentations-aso | d02e32f5eedafaa9077159afae4364f3ab95645f | d02e32f5eedafaa9077159afae4364f3ab95645f | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| feature/technical-sources-registry | technical-sources-registry | 666b9c6033193937ede4b10645b9407178045380 | 666b9c6033193937ede4b10645b9407178045380 | active | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| fix/apt-3.2.6-pipeline-workspace-recovery | apt-3.2.6-pipeline-workspace-recovery | b019507378a4b180a51f53c42ded42cb321d0058 | b019507378a4b180a51f53c42ded42cb321d0058 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| fix/apt-3.3.5-runtime-upgrade | apt-3.3.5-runtime-upgrade | bab11e1af13ace6c1a576f69a9e5b49edd29ead9 | bab11e1af13ace6c1a576f69a9e5b49edd29ead9 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| fix/apt-codex-hook-observation | apt-codex-hook-observation | d02e32f5eedafaa9077159afae4364f3ab95645f | d02e32f5eedafaa9077159afae4364f3ab95645f | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| fix/apt-reliability-model-routing | apt-reliability-model-routing | d02e32f5eedafaa9077159afae4364f3ab95645f | d02e32f5eedafaa9077159afae4364f3ab95645f | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| fix/backend-recovery-3.0.5 | backend-recovery-3.0.5 | d02e32f5eedafaa9077159afae4364f3ab95645f | d02e32f5eedafaa9077159afae4364f3ab95645f | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| fix/launcher-startup-3.0.3 | launcher-startup-3.0.3 | d02e32f5eedafaa9077159afae4364f3ab95645f | d02e32f5eedafaa9077159afae4364f3ab95645f | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| fix/sync-production-public-key | sync-production-public-key | 1d98999b73b7e5478700277b822566e7e3d41522 | 1d98999b73b7e5478700277b822566e7e3d41522 | merged | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |
+| main | Release integration | 666b9c6033193937ede4b10645b9407178045380 | 666b9c6033193937ede4b10645b9407178045380 | active | yes (committed tip only) | Historical branch label; not proof of released content | 2026-10-03 |