loadout-ai 0.1.2 → 0.2.0

package/docs/FEATURE_TEST_MATRIX.md

@@ -330,19 +330,20 @@ drift test after manually changing a managed file.
 Run the real reviewed catalog journey only after the local track passes:
 
 ```bash
-loadout setup --mode stable --agents codex
-loadout setup --mode power --agents codex
-loadout setup --mode maximum --agents codex
-loadout setup --mode maximum --agents codex --yes --approve-risk
+loadout setup --mode stable --agents codex --api-access none
+loadout setup --mode power --agents codex --api-access none
+loadout setup --mode maximum --agents codex --api-access none
+loadout setup --mode maximum --agents codex --api-access none --yes --approve-risk
 loadout library
 loadout optimize --project "$TEST_PROJECT" --agents codex --limit 30
 loadout optimize --project "$TEST_PROJECT" --agents codex --limit 30 --yes
 ```
 
 The previews fetch pinned public repositories but do not write agent skill targets.
-Maximum downloads the full reviewed library; MCP-only packages remain explicit setup
-items. `--approve-risk` acknowledges displayed static findings but does not execute
-third-party repository scripts.
+Maximum downloads the screened skill library, quarantines invalid individual units,
+and preserves matching active Stable units at the same reviewed commit; MCP-only
+packages remain explicit setup items. `--approve-risk` acknowledges displayed static
+findings but does not execute third-party repository scripts.
 
 `loadout demo --json` is a shorter N smoke test. It creates its own isolated profile,
 performs a real public-repository install and rollback, and must report that local

package/docs/TESTING.md

@@ -3,6 +3,21 @@
 The primary product is the CLI. Use this walkthrough before installing into your real
 Codex, Claude Code, or other agent directories.
 
+## 0. Choose the truthful account capability
+
+ChatGPT and Claude subscriptions do not include separately billed model API usage.
+If those subscriptions are all you have, choose `None` in interactive setup or pass:
+
+```bash
+npx . setup --mode stable --api-access none
+```
+
+This does not reduce the portable skill library. Automatic broad setup installs only
+screened static skill directories, which do not require OpenAI, Anthropic, or
+OpenRouter credentials. MCP servers and executable runtimes remain explicit. Never
+paste an API key into `--api-access`; it accepts provider names only and rejects
+key-like input.
+
 The automated product journey runs the built CLI against disposable user, state, and
 project directories. It performs a real scan and offline provenance comparison, then
 previews and applies project optimization, verifies the installed bytes, and rolls the
@@ -97,8 +112,8 @@ Power is the broad daily-use profile:
 npx . setup --mode power
 ```
 
-Expect a curated skill-level set across the strongest reviewed collections. Stable
-remains the smallest Superpowers + Context7 option. Maximum prepares the full library:
+Expect a curated skill-level set across reviewed collections. Stable is the bounded
+30-skill daily driver. Maximum prepares the full screened skill library:
 
 ```bash
 npx . setup --mode maximum
@@ -112,6 +127,7 @@ This is read-only. Expect the CLI to show:
 - lower-ranked duplicate skills that were deferred;
 - MCP-only repositories requiring explicit configuration;
 - safety categories requiring a separate approval.
+- invalid individual skill units quarantined without losing safe siblings.
 
 No agent skill directory or Loadout install state is created by preview.
 
@@ -129,6 +145,10 @@ The command should finish with one snapshot identifier. The library download is
 transaction: a failure restores every library/state target rather than leaving a
 half-installed profile.
 
+If Stable is already installed, this command is also a required regression exercise:
+matching Stable units must remain active, their agent-visible bytes must not change,
+and only the additional Maximum units should appear disabled in `npx . library`.
+
 ## 5. Inspect the installed product
 
 ```bash
@@ -177,6 +197,28 @@ Choose Maximum, Stable, or Custom, review the plan, and confirm only when you wa
 write to the detected real agent profiles. After npm publication, replace `npx .` with
 `npx loadout-ai`.
 
+## 8. Test credential-gated MCP configuration without exposing a key
+
+The Playwright recipe has no service credential. The GitHub read-only recipe does and
+must refuse `--yes` until its declared environment reference resolves:
+
+```bash
+npx . mcp-recipe github-readonly --config "$TEST_HOME/mcp.json" --yes
+
+export LOADOUT_TEST_GITHUB_TOKEN='<a disposable, least-privilege token>'
+npx . mcp-recipe github-readonly --config "$TEST_HOME/mcp.json" \
+  --credential GITHUB_PERSONAL_ACCESS_TOKEN=env:LOADOUT_TEST_GITHUB_TOKEN
+npx . mcp-recipe github-readonly --config "$TEST_HOME/mcp.json" \
+  --credential GITHUB_PERSONAL_ACCESS_TOKEN=env:LOADOUT_TEST_GITHUB_TOKEN --yes
+unset LOADOUT_TEST_GITHUB_TOKEN
+```
+
+The first command must fail without writing the server entry. The preview and applied
+output must never contain the token value; the config should contain only
+`${LOADOUT_TEST_GITHUB_TOKEN}`. OS-keychain references are supported by the separate,
+explicit `--connect --approve-risk` verification path because an arbitrary MCP host
+cannot resolve Loadout's keychain reference by itself.
+
 ## Optional dashboard
 
 The dashboard is a secondary inspection surface, not the onboarding requirement:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loadout-ai",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "private": false,
   "license": "MIT",
   "description": "Universal upgrade manager for AI coding agents",
@@ -14,6 +14,7 @@
     "catalog",
     "docs",
     "README.md",
+    "CHANGELOG.md",
     "MASTER_PLAN.md",
     "SIMPLE_PLAN.md",
     "SECURITY.md",