apt-mcp-agent-setup 3.5.65 → 3.9.0

package/docs/apt-3.7.0-migration.md

@@ -0,0 +1,49 @@
+# Updating to APT 3.7.0: add-on packs
+
+APT 3.7.0 moves five groups of skills out of the npm package into add-on packs. Your admin grants a pack on the admin pages; your next `update` downloads it.
+
+| Pack | What it holds |
+|---|---|
+| `marketing` | 51 marketing skills (copywriting, CRO, launch, pricing, analytics and others) |
+| `aso` | 40 App Store optimization skills |
+| `pm` | Jira project management skills and the Jira backend |
+| `design` | Figma and Stitch handoff skills and their backends |
+| `content` | writing and visual content skills: writing-flow, raw-idea-collector, draft-shaper, edit-article, slides, brand, design-system, banner-design, canvas-design and others |
+
+Development, QC and BA skills stay in the package, as do `humanizer`, `ui-styling` and `presentations`.
+
+## What happens at your first update
+
+```
+npx apt-mcp-agent-setup@latest update
+```
+
+1. The update renews your device token. The new token lists the packs granted to you.
+2. It downloads the granted packs this machine does not have yet and checks their signature and hashes.
+3. It deploys them into the project (or into the machine store of a machine install).
+
+If a project already had skills of a pack you are not granted (for example a project installed with the preset `system`), they stay for 30 days. The update prints the date. Ask your admin to grant the pack to keep them; otherwise the first update after that date removes them. Files you edited or added in those skill folders are never removed; the update lists them.
+
+## Commands
+
+```
+npx apt-mcp-agent-setup packs            # granted, downloaded and deployed packs
+npx apt-mcp-agent-setup packs sync       # renew the token and download granted packs now
+npx apt-mcp-agent-setup update           # deploy them
+```
+
+When an agent is routed to a skill of a pack you lack, APT names the pack (`missing-pack`) instead of loading nothing.
+
+## Your company's own APT server
+
+If your company hosts APT, activate with its address once:
+
+```
+npx apt-mcp-agent-setup install --key <LICENSE_KEY> --server https://apt.example.com
+```
+
+The address is saved in `~/.anhdh/server.json` and used by every later update. A company server needs APT 3.7.1 or later on every member's machine: it signs keys and tokens with its own key, which the client accepts through the delegation certificate APT issued for it.
+
+## Offline
+
+Without the server, an update uses the token and packs already on the machine and removes nothing. A token is renewed daily while you are online; a machine can stay offline for 14 days past the token's end, then it needs the server once.

package/docs/technical-sources.md

@@ -15,29 +15,31 @@ Integrated sources include shipped adaptations awaiting provenance. needs-pinnin
 | ID | Repository | Role | Consumer | Ref type | Pinned ref | Resource digest | License / notice | Last reviewed | Refresh policy | Compatibility gate | Status | Notes |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
 | apt-index-3515-interrupted | https://github.com/alphatechs-ai/apt-mcp-agent | adapted-reference | src/core/recovery-proof.js; src/installer/index-interruption-recovery.js; src/core/interrupted-transport-proof.js; src/core/interrupted-natural-closure-proof.js; src/core/interrupted-boot-transport-proof.js; src/core/transport-boot-contract.json; src/core/interrupted-operation-audit.js; src/installer/interrupted-operation-recovery.js | version | 3.5.15; signed 3.5.18 closure profile and digests listed below | none | APT repository LICENSE | 2026-10-08 | Explicit signed producer review only | sources:validate; signed manifest and producer hashes; cache and scope anchors; boot/process observation; crash/resume; isolated native backend proof; exact transport envelope and missing catalog acknowledgement; v3 explicit confirmation, closure MAC and terminal Job proof; v5 acknowledged original archive, canonical ticket time, later boot, fresh identity, own confirmation and primary/secondary crash proof | reference-only | Historical signed runtime data only. Exact supported runtime digests and containment hash are recorded below. No historical JavaScript execution or dependency upgrade. |
-| codegraph | https://github.com/colbymchenry/codegraph | managed-backend | src/backends/profiles.js; src/backends/source-discovery.js; src/backends/index-store.js | commit | dfccdf62547fcd76d343344d823a0e1998d3a89f; version=1.6.0 | none | MIT @ .agents/NOTICES.md | 2026-10-07 | Explicit before each APT release | sources:validate; source/dist/package tests; native discovery/config gates; read-only native complete-state, engine-version and error-free source-hash coverage; full build required while sync lock failure is ambiguous | active | npm=@colbymchenry/codegraph; Pinned tool contract and platform-isolated cache; External package or adapted history, no vendored bytes digest. |
+| codegraph | https://github.com/colbymchenry/codegraph | managed-backend | src/backends/profiles.js; src/backends/source-discovery.js; src/backends/index-store.js | commit | 6560052a6f856855d3f71eee838fd66ccfa4285d; version=1.6.2 | none | MIT @ .agents/NOTICES.md | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native discovery/config gates; read-only native complete-state, engine-version and error-free source-hash coverage; full build required while sync lock failure is ambiguous | active | npm=@colbymchenry/codegraph; Pinned tool contract and platform-isolated cache; External package or adapted history, no vendored bytes digest. |
 | code-review-graph | https://github.com/tirth8205/code-review-graph | managed-backend | src/backends/profiles.js; src/backends/source-discovery.js; src/backends/review_graph.py | commit | fa04ea21e701d9feb748199dbb0b4cf4f365f8f9; version=2.3.9 | none | MIT @ .agents/NOTICES.md | 2026-10-08 | Explicit before each APT release | sources:validate; source/dist/package tests; native discovery/version/config gates; strict single-command porcelain status extraction; full-build untracked source coverage; non-Git full/update/discovery recovery-backup exclusion through version-pinned process-local default patterns; healthy complete graph and matching contract for incremental build; nested ignore pattern equivalence across Python hash seeds; real source/config changes remain fail-closed | active | Versioned Python environment, registry and workspace cache. Native ignore matching is boolean membership, so APT fingerprints ignore patterns as a sorted unique set. Other configuration order and exact config file bytes remain significant. External package or adapted history, no vendored bytes digest. |
-| mcp-memory | https://github.com/modelcontextprotocol/servers | managed-backend | src/backends/profiles.js | commit | 153cc26a3b3796a17b693277b5e0e1232a76940e; version=2026.8.31 | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=@modelcontextprotocol/server-memory; Pinned npm package and workspace memory migration; External package or adapted history, no vendored bytes digest. |
-| ag-kit | https://github.com/vudovn/ag-kit | adapted-reference | .agents/agent; .agents/skills | commit | f017f41054775a8ec91f54e93acc9ba6a9430070; version=2026.8.31 | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Specialist routing and dependency checks adapted to the APT catalog; no wholesale import; External package or adapted history, no vendored bytes digest. |
-| matt-pocock | https://github.com/mattpocock/skills | adapted-reference | skills-lock.json | commit | c55ee46073ed923f86ce59a5eb3b6d895095d1b7 | 7aa7c92621f6ee56c2ebdfd7a673d62216ba4f1c770f230eba36dabe12dd6265 | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Keep APT canonical skill IDs and execution rules; Hash is reviewed local snapshot, not unmodified upstream bytes. |
+| mcp-memory | https://github.com/modelcontextprotocol/servers | managed-backend | src/backends/profiles.js | commit | c003d0d807409b22fa640d1f8e11f38f15755721; version=1.0.0 | none | MIT @ .agents/NOTICES.md | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=@modelcontextprotocol/server-memory; Pinned npm package and workspace memory migration; 2.0.0 requires Node 24 and is not used while APT supports Node 18.20.8; External package or adapted history, no vendored bytes digest. |
+| ag-kit | https://github.com/vudovn/ag-kit | adapted-reference | .agents/agent; .agents/skills | commit | 549ba3dc2eb1d40fccb5b6d792eba4101c80cd69; version=2026.8.31 | none | MIT @ .agents/NOTICES.md | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Specialist routing and dependency checks adapted to the APT catalog; no wholesale import. 73 APT skills, agents and workflows trace to it; none of their upstream files changed since the previous pin.; External package or adapted history, no vendored bytes digest. |
+| matt-pocock | https://github.com/mattpocock/skills | adapted-reference | skills-lock.json | commit | 5beb35b040e3de97e54fa9e386d7e42d15c295c2 | 82523c653e9e52063fd62abac061028044e6ce5348098836e13f52a1fc4d9a0d | MIT @ .agents/NOTICES.md | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Keep APT canonical skill IDs and execution rules; Hash is reviewed local snapshot, not unmodified upstream bytes. Pinned to HEAD after v1.3.1 (2026-10-19): the tag only renames CONTEXT.md to GLOSSARY.md, which APT does not take. 3.5.68 ports eight skill changes and imports 11 skills (implement-spec, pr, research, retro, wayfinder, wizard, claude-handoff, loop-me, setup-ts-deep-modules, to-questionnaire, wait-what); 10 locked skills were removed upstream (upstreamStatus in skills-lock.json). |
 | taste-skill | https://github.com/leonxlnx/taste-skill | adapted-reference | skills-lock.json | commit | c184364c58658b2f131b4ae8bd3d206cabb3deee | 2ad21943b66f1674670a681fe370cf854a6978abd14323dedc5d9910171f16ed | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Landing and redesign routing only; experimental changes are not the default; Hash is reviewed local snapshot, not unmodified upstream bytes. |
 | web-interface-guidelines | https://github.com/vercel-labs/web-interface-guidelines | adapted-reference | .agents/skills/web-design-guidelines/SKILL.md | commit | e3d624baaf29dc1fc645aff3e38f03e564d2d6b1 | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Use at UI review; preserve the packaged skill version for active runs; External package or adapted history, no vendored bytes digest. |
-| marketing-skills | https://github.com/coreyhaines31/marketingskills | managed-bundle | .agents/marketing-manifest.json | commit | dda3841f0b294e01e93b1541486beefbfab0915e; version=2.11.17 | 71ad0f392c3505b7837436130e099c6a40a52621a32af3db5c05b2adc6d17fa5 | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Package only pinned Markdown and static reference data. Exclude plugin manifests, CLI tools, integrations, partner registries, credentials and network setup. APT SEO/GEO/ASO routing remains authoritative.; Hash is reviewed local snapshot, not unmodified upstream bytes. |
-| ui-ux-pro-max | https://github.com/nextlevelbuilder/ui-ux-pro-max-skill | packaged-vendor | .agents/skills/ui-ux-pro-max/provenance.json | commit | 4d140cf8ff6842de13213c7214eff3810371beb2; version=v2.13.0 | e0988f6a63d757c73d034c95d84814a480e91bd162045bbbaf47c44b5fba3de3 | MIT @ .agents/skills/ui-ux-pro-max/vendor/LICENSE | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Pinned vendor bytes; upstream tag differs from embedded metadata when reported in provenance. |
-| archify | https://github.com/tt-a1i/archify | packaged-vendor | .agents/skills/archify/provenance.json | commit | 2ab3cae7ac2c2a55d7386ca789d03c4fcd31816c; version=v3.0.1 | 962f27d14cb81c41c34afe1623e357087262d0faf11ce7a4c7c74e8072737c42 | MIT @ .agents/skills/archify/vendor/LICENSE | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Pinned vendor bytes; upstream tag differs from embedded metadata when reported in provenance. |
-| flutter-skills | https://github.com/flutter/skills | managed-bundle | skills-lock.json | unpinned | unknown | 9a8ddb42c1795c6b1757ec9511eeb27edbce902752979e36fa2e04b9923a1a84 | BSD-3-Clause @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Local skill hashes only. Upstream URL redirects to flutter/agent-plugins; review rename before changing locks. |
-| aso-skills | https://github.com/Eronred/aso-skills | adapted-reference | scripts/fetch-aso-skills.js | unpinned | unknown | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Fetch script currently reads main; not a release pin. |
-| superpowers | https://github.com/obra/superpowers | adapted-reference | .agents/skills/plan-writing/SKILL.md; .agents/skills/subagent-driven-development/SKILL.md | unpinned | unknown | none | MIT @ .agents/NOTICES.md | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Adapted workflow; no original commit has been recorded. |
-| ponytail | https://github.com/DietrichGebert/ponytail | adapted-reference | .agents/skills/ponytail-lazy-dev/SKILL.md | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Inspired workflow via AG Kit; verify original license and commit before importing additional bytes. |
-| ppt-master | https://github.com/hugohe3/ppt-master | addon | src/installer/presentations.js | commit | a50758ac29ec027e85966db33e2ae80031446756; version=6.6.0 | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Installed addon validates commit. License review required; external install, no local vendor digest. |
-| playwright-mcp | https://github.com/microsoft/playwright-mcp | managed-backend | src/backends/profiles.js | version | 0.0.82 | none | Apache-2.0 @ https://github.com/microsoft/playwright-mcp/blob/main/LICENSE | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=@playwright/mcp; Browser profile separately pins core and Chromium. |
-| fastmcp | https://github.com/jlowin/fastmcp | addon | src/backends/profiles.js | version | 3.4.2 | none | Apache-2.0 | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Python review dependency; pip=fastmcp. External install, no vendor digest. |
-| mcp-python | https://github.com/modelcontextprotocol/python-sdk | addon | src/backends/profiles.js | version | 1.28.1 | none | MIT | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Python review dependency; pip=mcp. External install, no vendor digest. |
-| stitch-mcp | https://github.com/davideast/stitch-mcp | addon | src/installer/project-setup.js | version | 0.9.0 | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | npm=@_davideast/stitch-mcp; optional connector. External install, no vendor digest. |
+| marketing-skills | https://github.com/coreyhaines31/marketingskills | managed-bundle | .agents/marketing-manifest.json | commit | e85f3cbc2e4a79bf33b2a12e9bdd9087d414735b; version=2.13.0 | ecf582b99a2f1aab44003511bfa4106ed0bd9d15d84e8354a311c6df5c6976ed | MIT @ .agents/NOTICES.md | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Package only pinned Markdown, static reference data and the conversion-tracking paste-in snippets under assets/snippets. Exclude plugin manifests, CLI tools (scripts/*.py), integrations, partner registries, credentials and network setup. Upstream paths are kept (references/, evals/, assets/). APT SEO/GEO/ASO routing remains authoritative; the upstream aso skill stays excluded.; Hash is the bundled snapshot, unmodified upstream bytes. |
+| ui-ux-pro-max | https://github.com/nextlevelbuilder/ui-ux-pro-max-skill | packaged-vendor | .agents/skills/ui-ux-pro-max/provenance.json | commit | a38d04c3d5c298c851dbe5e6ee1965ee3de42cb5; version=v2.15.0 | e81ecb72920a9295706493325b91b124549c54a24e0ba46e73099313c1716911 | MIT @ .agents/skills/ui-ux-pro-max/vendor/LICENSE | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Pinned vendor bytes; upstream tag differs from embedded metadata when reported in provenance. 3.5.68 also imports banner-design, brand, design-system, design, slides and ui-styling (Apache-2.0) from .claude/skills of the same commit, without fonts; listed in docs/upstream-provenance.json. |
+| archify | https://github.com/tt-a1i/archify | packaged-vendor | .agents/skills/archify/provenance.json | commit | 208acba8d412335185b2056fedf54b3405df43fb; version=v3.2.0 | a36b73e5d8637cd9851ca4cfdfaaa749dc4191dc29fcb0a8b71f62471feb3b14 | MIT @ .agents/skills/archify/vendor/LICENSE | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Pinned vendor bytes; upstream tag differs from embedded metadata when reported in provenance. v3.2.0 leaves out the rendered example pages (examples/*.html). 3.5.68 also imports archify-review, archify-tuning, simplify-codebase and test-value from .agents/skills of the same commit; they are listed in docs/upstream-provenance.json. |
+| flutter-skills | https://github.com/flutter/skills | managed-bundle | skills-lock.json | commit | 6e590650bb4bab87f33187423dc10113d04d4836 | 9a8ddb42c1795c6b1757ec9511eeb27edbce902752979e36fa2e04b9923a1a84 | BSD-3-Clause @ .agents/NOTICES.md | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Local skill hashes only. The 10 locked flutter-* skills match upstream at this commit (HEAD on 2026-10-20). Upstream URL redirects to flutter/agent-plugins; review rename before changing locks. Upstream dart-* skills are not bundled. |
+| aso-skills | https://github.com/Eronred/aso-skills | adapted-reference | scripts/fetch-aso-skills.js | commit | 3919d7c27402d92c7ef698f2016174b874ea189e | none | MIT @ .agents/NOTICES.md | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | scripts/fetch-aso-skills.js reads this commit. The 40 bundled aso-* skills match upstream at it (no matched file changed since APT's copy); upstream HEAD on 2026-10-20. |
+| superpowers | https://github.com/obra/superpowers | adapted-reference | skills-lock.json; .agents/skills/plan-writing/SKILL.md; .agents/skills/subagent-driven-development/SKILL.md | commit | bb92a77741419a4ab5f06e711a283343f1ada0c3; version=7.0.0 | 88d3be00eaa2523b9a7319b0c76c96aca2490088eb1c91468be021c89fb41bd9 | MIT @ .agents/NOTICES.md | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | v7.0.0. 3.5.68 imports 10 skills unchanged except for the `superpowers:` prefix of skill names (dispatching-parallel-agents, executing-plans, finishing-a-development-branch, receiving-code-review, requesting-code-review, test-driven-development, using-git-worktrees, verification-before-completion, writing-plans, writing-skills). Not imported: using-superpowers and diagnosing-superpowers (they describe the superpowers plugin), and brainstorming, subagent-driven-development, systematic-debugging, which APT has. |
+| anthropic-skills | https://github.com/anthropics/skills | adapted-reference | skills-lock.json | commit | dbd4588f9e1033efb41dad4bef2f7947c8993d44 | fe5c124791214672d122e149a3ef638da9c2ff1ece693d23830a356d59b62c92 | Apache-2.0 @ .agents/NOTICES.md | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Imported in 3.5.68: academy-guide, algorithmic-art, canvas-design, claude-api (as claude-api-guide), discernment-nudge, internal-comms, slack-gif-creator, theme-factory, web-artifacts-builder; each keeps its LICENSE.txt (Apache-2.0). Fonts, PDF and archives are left out. Not imported: docx, pdf, pptx, xlsx (proprietary, all rights reserved), doc-coauthoring and template (no license), brand-guidelines (Anthropic brand), skill-creator (APT has skill-generator), frontend-design, mcp-builder and webapp-testing (APT has them). |
+| ponytail | https://github.com/DietrichGebert/ponytail | adapted-reference | .agents/skills/ponytail-lazy-dev/SKILL.md | commit | 09c434ab73ca43761c5d8b0c5d341926c2fba710; version=5.3.2 | none | MIT @ .agents/NOTICES.md | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | reference-only | Inspired workflow via AG Kit; reviewed against v5.3.2. ponytail-lazy-dev is a rewrite; terse-communication adapts benchmarks/arms/caveman-SKILL.md. No upstream bytes are bundled. |
+| elephant-goldfish-model | https://github.com/google/elephant-goldfish-model | adapted-reference | skills-lock.json; .agents/skills/design-doc; .agents/skills/design-review; .agents/skills/design-resolve; .agents/skills/design-drift | commit | f0ba151b252c9abf1318d9fe857a43265d06de89 | fbd960750e1b51acf6bfa910bcd724d01134be31c96e3cd1bf78c34b2e889f89 | Apache-2.0 @ .agents/egm-LICENSE.txt | 2026-10-29 | Explicit before each APT release | sources:validate; source/dist/package tests; test/core/design-gate-skills.test.js | reference-only | 3.9.0 rewrites four skills (design-doc, design-review, design-resolve, design-drift) with five review lenses and three review standards in APT prose; no upstream files are bundled verbatim. Upstream bootstrap, brainstorm, review-loop, Heilmeier standard and re-implementation lens are omitted (ADR 0039). |
+| ppt-master | https://github.com/hugohe3/ppt-master | addon | src/installer/presentations.js | commit | b113d23720260c411ee47b2b05a73615f954deeb; version=6.7.2 | none | MIT @ https://github.com/hugohe3/ppt-master/blob/main/LICENSE | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Installed addon validates commit; tag v6.7.2. External install, no local vendor digest. |
+| playwright-mcp | https://github.com/microsoft/playwright-mcp | managed-backend | src/backends/profiles.js | version | 0.0.83 | none | Apache-2.0 @ https://github.com/microsoft/playwright-mcp/blob/main/LICENSE | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=@playwright/mcp; Browser profile separately pins core 1.64.0-alpha-1790635538000 and Chromium revision 1247. |
+| fastmcp | https://github.com/jlowin/fastmcp | addon | src/backends/profiles.js | version | 3.4.9 | none | Apache-2.0 | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Python review dependency; pip=fastmcp. code-review-graph 2.3.9 requires fastmcp<4. External install, no vendor digest. |
+| mcp-python | https://github.com/modelcontextprotocol/python-sdk | addon | src/backends/profiles.js | version | 1.30.0 | none | MIT | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | Python review dependency; pip=mcp. Newest release that resolves with fastmcp 3.4.9; mcp 2.x does not. External install, no vendor digest. |
+| stitch-mcp | https://github.com/davideast/stitch-mcp | addon | src/installer/project-setup.js | version | 0.9.0 | none | Apache-2.0 @ https://www.npmjs.com/package/@_davideast/stitch-mcp | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=@_davideast/stitch-mcp; optional connector; 0.9.0 is the latest release on 2026-10-20 (gitHead 0911d6dc48b9515895e1109387e14c2c969114a2). External install, no vendor digest. |
 | mcp-atlassian | https://github.com/sooperset/mcp-atlassian | addon | src/installer/project-setup.js | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Installer uses pip without a version pin. External install, no vendor digest. |
 | context7 | https://github.com/upstash/context7 | addon | .agents/mcp_config.json | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | needs-pinning | Optional documentation connector template; not installed automatically by registry. External install, no vendor digest. |
-| docx | https://github.com/dolanmiu/docx | addon | package-lock.json | version | 9.7.1 | none | MIT @ https://github.com/dolanmiu/docx | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=docx; Lockfile integrity governs installed package. No vendored bytes. |
-| javascript-obfuscator | https://github.com/javascript-obfuscator/javascript-obfuscator | addon | package-lock.json | version | 5.4.3 | none | BSD-2-Clause @ https://github.com/javascript-obfuscator/javascript-obfuscator | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=javascript-obfuscator; Lockfile integrity governs installed package. No vendored bytes. |
+| docx | https://github.com/dolanmiu/docx | addon | package-lock.json | version | 9.13.0 | none | MIT @ https://github.com/dolanmiu/docx | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=docx; Lockfile integrity governs installed package. No vendored bytes. |
+| javascript-obfuscator | https://github.com/javascript-obfuscator/javascript-obfuscator | addon | package-lock.json | version | 5.9.0 | none | BSD-2-Clause @ https://github.com/javascript-obfuscator/javascript-obfuscator | 2026-10-20 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=javascript-obfuscator; Lockfile integrity governs installed package. No vendored bytes. |
 | ssh2 | https://github.com/mscdex/ssh2 | addon | package-lock.json | version | 1.17.0 | none | MIT @ https://github.com/mscdex/ssh2 | 2026-10-03 | Explicit before each APT release | sources:validate; source/dist/package tests; native gate if runtime changes | active | npm=ssh2; Lockfile integrity governs installed package. No vendored bytes. |
 
 | figma-context | https://github.com/figma-developer/figma-context-mcp | addon | src/proxy/backends.js | unpinned | unknown | none | unknown | 2026-10-03 | Explicit before each APT release | sources:validate; connector/schema/native gates | needs-pinning | Backend command currently references GitHub latest. Verify repository resolution and license before pinning; no vendor bytes. |

package/docs/upstream-manifest.json

@@ -1,11 +1,11 @@
 {
-  "reviewedAt": "2026-09-26",
+  "reviewedAt": "2026-10-20",
   "components": [
     {
       "name": "CodeGraph",
       "source": "https://github.com/colbymchenry/codegraph",
-      "version": "1.6.0",
-      "gitRef": "dfccdf62547fcd76d343344d823a0e1998d3a89f",
+      "version": "1.6.2",
+      "gitRef": "6560052a6f856855d3f71eee838fd66ccfa4285d",
       "status": "managed-backend",
       "localPolicy": "Pinned tool contract and platform-isolated cache"
     },
@@ -20,8 +20,8 @@
     {
       "name": "MCP memory",
       "source": "https://github.com/modelcontextprotocol/servers",
-      "version": "2026.8.31",
-      "gitRef": "153cc26a3b3796a17b693277b5e0e1232a76940e",
+      "version": "1.0.0",
+      "gitRef": "c003d0d807409b22fa640d1f8e11f38f15755721",
       "status": "managed-backend",
       "localPolicy": "Pinned npm package and workspace memory migration"
     },
@@ -29,17 +29,25 @@
       "name": "AG Kit",
       "source": "https://github.com/vudovn/ag-kit",
       "version": "2026.8.31",
-      "gitRef": "f017f41054775a8ec91f54e93acc9ba6a9430070",
+      "gitRef": "549ba3dc2eb1d40fccb5b6d792eba4101c80cd69",
       "status": "reference-only",
       "localPolicy": "Specialist routing and dependency checks adapted to the APT catalog; no wholesale import"
     },
     {
       "name": "Matt Pocock skills",
       "source": "https://github.com/mattpocock/skills",
-      "gitRef": "c55ee46073ed923f86ce59a5eb3b6d895095d1b7",
+      "gitRef": "5beb35b040e3de97e54fa9e386d7e42d15c295c2",
       "status": "reviewed-reference",
       "localPolicy": "Keep APT canonical skill IDs and execution rules"
     },
+    {
+      "name": "Anthropic skills",
+      "source": "https://github.com/anthropics/skills",
+      "gitRef": "dbd4588f9e1033efb41dad4bef2f7947c8993d44",
+      "status": "reviewed-reference",
+      "license": "Apache-2.0",
+      "localPolicy": "Nine Apache-2.0 skills imported as text; proprietary document skills are not redistributed"
+    },
     {
       "name": "Taste skill",
       "source": "https://github.com/leonxlnx/taste-skill",
@@ -57,33 +65,42 @@
     {
       "name": "Marketing Skills",
       "source": "https://github.com/coreyhaines31/marketingskills",
-      "version": "2.11.17",
-      "gitRef": "dda3841f0b294e01e93b1541486beefbfab0915e",
+      "version": "2.13.0",
+      "gitRef": "e85f3cbc2e4a79bf33b2a12e9bdd9087d414735b",
       "status": "offline-skill-bundle",
       "license": "MIT",
       "localPolicy": "Package only pinned Markdown and static reference data. Exclude plugin manifests, CLI tools, integrations, partner registries, credentials and network setup. APT SEO/GEO/ASO routing remains authoritative.",
-      "resourceDigest": "71ad0f392c3505b7837436130e099c6a40a52621a32af3db5c05b2adc6d17fa5"
+      "resourceDigest": "ecf582b99a2f1aab44003511bfa4106ed0bd9d15d84e8354a311c6df5c6976ed"
+    },
+    {
+      "name": "Elephant-Goldfish Model",
+      "source": "https://github.com/google/elephant-goldfish-model",
+      "gitRef": "f0ba151b252c9abf1318d9fe857a43265d06de89",
+      "status": "reviewed-reference",
+      "license": "Apache-2.0",
+      "localPolicy": "Methodology rewritten in APT prose for design-doc, design-review, design-resolve and design-drift; no upstream bytes are bundled"
     }
   ],
   "ui-ux-pro-max": {
     "repository": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill",
-    "tag": "v2.13.0",
-    "commit": "4d140cf8ff6842de13213c7214eff3810371beb2",
-    "metadataVersion": "2.11.0",
-    "resourceDigest": "e0988f6a63d757c73d034c95d84814a480e91bd162045bbbaf47c44b5fba3de3",
+    "tag": "v2.15.0",
+    "commit": "a38d04c3d5c298c851dbe5e6ee1965ee3de42cb5",
+    "metadataVersion": "2.13.0",
+    "resourceDigest": "e81ecb72920a9295706493325b91b124549c54a24e0ba46e73099313c1716911",
     "license": "MIT",
     "modifications": []
   },
   "archify": {
     "repository": "https://github.com/tt-a1i/archify",
-    "tag": "v3.0.1",
-    "commit": "2ab3cae7ac2c2a55d7386ca789d03c4fcd31816c",
-    "metadataVersion": "3.0.1",
-    "resourceDigest": "962f27d14cb81c41c34afe1623e357087262d0faf11ce7a4c7c74e8072737c42",
+    "tag": "v3.2.0",
+    "commit": "208acba8d412335185b2056fedf54b3405df43fb",
+    "metadataVersion": "3.2.0",
+    "resourceDigest": "a36b73e5d8637cd9851ca4cfdfaaa749dc4191dc29fcb0a8b71f62471feb3b14",
     "license": "MIT",
     "modifications": [
       "generated-brand-marks.mjs contains no brand artwork",
-      "Upstream SKILL.md retained as UPSTREAM-SKILL.md to prevent duplicate host activation"
+      "Upstream SKILL.md retained as UPSTREAM-SKILL.md to prevent duplicate host activation",
+      "Rendered example pages examples/*.html are not vendored; the wrapper reads the JSON examples only"
     ]
   }
 }