loadout-ai 0.3.1 → 0.4.0

package/README.md

@@ -1,370 +1,243 @@
-# Loadout
+<p align="center">
+  <img src="./docs/assets/loadout-hero.svg" alt="A developer arranging extensions from a messy, unmanaged group into organized loadout slots" width="960">
+</p>
 
-**One CLI that finds, installs, updates, and rolls back useful extensions for AI coding agents.**
+<h1 align="center">Loadout</h1>
 
-Loadout works with Codex, Claude Code, Cursor, Gemini CLI, OpenCode, Hermes, Windsurf, Cline, GitHub Copilot, Roo Code, Kiro CLI, and Junie on macOS, Linux, and Windows.
+<p align="center"><strong>Agent extensions, under control.</strong></p>
 
-It solves a simple problem: useful skills and MCP tools are scattered across hundreds of repositories. Loadout brings them into one place, checks what is actually inside, shows every change before making it, and keeps a snapshot so you can undo it.
+<p align="center">
+  A local CLI for inspecting, previewing, installing, and undoing managed extensions for AI coding agents.
+</p>
 
-## Start here
+<p align="center">
+  <a href="https://github.com/VirajMishra1/loadout/actions/workflows/ci.yml"><img src="https://github.com/VirajMishra1/loadout/actions/workflows/ci.yml/badge.svg" alt="CI status"></a>
+  <a href="./package.json"><img src="https://img.shields.io/badge/Node.js-%3E%3D20-339933?logo=node.js&amp;logoColor=white" alt="Node.js 20 or newer"></a>
+  <a href="./LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="MIT License"></a>
+</p>
 
-You need Node.js 20 or newer and Git.
-
-```bash
-npm install --global loadout-ai@0.3.1
-loadout --version
-loadout upgrade
-```
-
-`loadout upgrade` is a read-only preview. It detects your installed agents, checks what you already have, scans the current project, recommends useful additions, and shows the exact files it would change.
+<p align="center">
+  <a href="#how-it-works">How it works</a> ·
+  <a href="#install">Install</a> ·
+  <a href="#profiles">Profiles</a> ·
+  <a href="#trust-and-limits">Trust</a> ·
+  <a href="#command-reference">Commands</a> ·
+  <a href="#development">Development</a>
+</p>
 
-When the preview looks right:
+> [!IMPORTANT]
+> Installation is version-pinned so the code you test matches these docs. The commands below target `loadout-ai@0.4.0`; review the preview before every apply.
 
-```bash
-loadout upgrade --yes
-```
+## How it works
 
-Every applied change creates a snapshot. Undo the latest change with:
+**Choose -> Inspect -> Preview -> Apply -> Undo**
 
-```bash
-loadout rollback
-```
-
-Remove one package with `loadout remove <package>`. Remove everything Loadout owns
-with a preview-first command:
-
-```bash
-loadout uninstall
-loadout uninstall --yes
-loadout uninstall --yes --remove-cli
-```
+1. **Choose** a bounded profile or explicit packages.
+2. **Inspect** pinned source and catalog metadata separately before setup.
+3. **Preview** detected agents, aggregate repository, directory, and collision counts, warnings, skipped entries, and package IDs needing approval without changing agent target files.
+4. **Apply** by rerunning with `--yes`; Loadout recomputes from current state before using a snapshot-backed transaction.
+5. **Undo** the latest supported mutation with drift checks that protect later edits.
 
-The first command changes nothing. Complete uninstall preserves unmanaged files and
-stops if a Loadout-managed file contains your edits unless you explicitly add
-`--force`.
+### Abridged terminal transcript
 
-## Choose how much you want
+This is an explicitly abridged transcript from a disposable, single-Codex Stable run. A literal `…` marks omitted fetch output; `<snapshot-id>` is a variable placeholder because snapshot IDs vary.
 
-| Mode        | Best for                                     | What happens                                                                                                                                            |
-| ----------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Stable**  | Almost everyone                              | Installs 30 high-value everyday skills from four selected sources. This is the default.                                                                 |
-| **Power**   | Users who want a larger active toolkit       | Selects cross-project skills from eight major collections. The current preview prepares 50 skill directories and quarantines flagged individual skills. |
-| **Maximum** | People who want the largest possible library | Downloads every usable skill in the 50-repository catalog into a disabled library. It does not flood every agent with 1,000+ active skills.             |
-| **Custom**  | Users who know exactly what they want        | Installs only the package IDs they choose.                                                                                                              |
+```console
+$ loadout setup --mode stable --agents codex
+…
+Loadout: Stable Boost
+Detected agents: Codex
+Catalog selection: 4 repositories
+Ready to install: 4 skill repositories (30 agent skill directories)
+Preview complete; nothing was changed. Re-run with --yes to install this exact screened plan.
 
-Preview any mode first:
+$ loadout setup --mode stable --agents codex --yes
+…
+Loadout installed 4 repositories for 1 agent(s). Snapshot: <snapshot-id>
 
-```bash
-loadout setup --mode stable
-loadout setup --mode power
-loadout setup --mode maximum
+$ loadout rollback
+Restored snapshot <snapshot-id>
 ```
 
-Apply the chosen plan only after reading it:
+The final preview sentence above is captured CLI wording. A later `--yes` invocation recomputes the plan from pinned sources and current agent and filesystem state; it does not persist or prove identity with the earlier preview.
 
-```bash
-loadout setup --mode stable --yes
-loadout setup --mode power --yes --approve-risk
-loadout setup --mode maximum --yes --approve-risk
-```
+Preview may populate Loadout's own cache; it leaves agent target files unchanged. Review its aggregate counts, warnings, skipped entries, and package IDs needing approval before deciding whether to run a later apply command.
 
-Maximum currently finds 1,158 usable skill directories across 29 skill repositories and keeps them disabled until needed. Nineteen MCP-only repositories remain separate setup choices because MCP servers may need credentials, local software, or broader permissions.
+## Why Loadout
 
-## How Loadout chooses repositories
+Skills, plugins, MCP servers, and agent settings tend to accumulate one experiment at a time. Eventually it becomes hard to remember what is installed, where it came from, or how to undo it. In a game, a loadout is the deliberate set of tools chosen before a mission. Loadout brings that same discipline to AI coding agents: inspect the available equipment, choose intentionally, apply it through managed changes, and remove or roll it back later.
 
-Loadout does not install every repository above an arbitrary star count. Stars help discovery, but popularity alone cannot show whether a repository is maintained, duplicated, unsafe, incompatible, or even useful for your work.
+- **One managed inventory.** List installed packages, inspect drift, and track what Loadout owns across configured agent paths.
+- **Preview by default.** Setup, updates, removal, MCP recipes, and uninstall expose a plan before their supported writes.
+- **Recoverable changes.** Snapshots and managed-file hashes support rollback while refusing to overwrite later user edits.
 
-The selection process is:
+## Install
 
-1. **Discover broadly.** Search GitHub, Hacker News, skills.sh, and the official MCP Registry.
-2. **Inspect the real contents.** Find skills, MCP declarations, plugins, commands, agents, and executable setup requirements.
-3. **Check trust evidence.** Record the exact Git commit, license status, source paths, maintenance signals, overlaps, and static safety findings.
-4. **Compare like with like.** A testing tool is compared with testing tools, not with an unrelated design skill.
-5. **Choose a tier.** Stable is the strongest bounded default; Power is broader; Maximum keeps the full reviewed library available.
-6. **Keep watching.** New candidates and changes are recorded every day, but nothing is silently promoted or installed.
+You need Node.js 20 or newer and Git.
 
-The bundled catalog contains **50 credited public repositories** across 37 categories. Thirty-one contain skills and 19 are MCP-only. See every source, direct repository link, pinned commit, component type, and license status in **[Catalog and upstream credits](./docs/CATALOG.md)**.
+```bash
+npm install --global loadout-ai@0.4.0
+loadout --version
+loadout guide
+```
 
-Loadout does not claim there is one universally “best” configuration. “Recommended” means the strongest choice supported by the evidence and policy currently stored in Loadout, not a permanent verdict for every person or project.
+For source development instead:
 
-## Get recommendations for the current project
+```bash
+git clone https://github.com/VirajMishra1/loadout.git
+cd loadout
+npm ci
+npm run build
+npm link
+loadout --version
+```
 
-Yes—Loadout can inspect a project and recommend what belongs in its working set.
+For a disposable first success, run:
 
 ```bash
-loadout recommend --project .
+loadout demo
 ```
 
-This reads local project metadata such as `package.json`, `pyproject.toml`, `go.mod`, `Cargo.toml`, framework dependencies, and test configuration. It does not upload your code.
+The demo uses temporary state and cleans it up; it does not write to your normal agent configuration. See the [user test guide](./docs/USER_TEST_GUIDE.md) if linking, `PATH`, networking, risk approval, or rollback needs attention.
 
-If you downloaded Maximum, use project-aware optimization to activate only the most relevant reviewed skills:
+## Stable workflow
 
 ```bash
-loadout optimize --project .             # preview
-loadout optimize --project . --limit 30  # preview with a smaller cap
-loadout optimize --project . --limit 30 --yes
-```
+# Preview for detected agents
+loadout setup --mode stable
 
-You can still override the result:
+# Recompute from current state and apply after reviewing the preview
+loadout setup --mode stable --yes
 
-```bash
-loadout optimize --project . --pin package-id/skill-name
-loadout enable package-id/skill-name --yes
-loadout disable package-id/skill-name --yes
+# Inspect managed state, then undo the latest supported mutation
+loadout list
+loadout health --explain
+loadout rollback
 ```
 
-## Find new and better options every day
+Stable currently selects 30 skill directories from four pinned, SPDX-identified, policy-selected public sources. Selection policy is evidence, not a claim that the sources are safe, trusted, human-reviewed, benchmarked, or the right choice for every user.
 
-Loadout has two separate daily checks:
+## Profiles
 
-- **Discovery radar** finds new and fast-growing repositories and puts them in a review queue.
-- **Update radar** checks installed Loadout packages for a newer reviewed commit, archive status, staleness, file drift, and permission changes.
+| Profile     | Scope                                                                  |
+| ----------- | ---------------------------------------------------------------------- |
+| **Stable**  | Bounded default: 30 skills from four policy-selected sources           |
+| **Power**   | Broader cross-project set from eight checked-in collections            |
+| **Maximum** | Valid skill-bearing contents in a managed, disabled-by-default library |
+| **Custom**  | Only package IDs explicitly supplied by the user                       |
 
-Enable both at a local time of your choice:
+Preview choices with `loadout profiles` and `loadout setup --mode <profile>`. Maximum counts are computed from pinned contents after validation and duplicate resolution; MCP-only entries stay on a separate approval path.
 
-```bash
-loadout autopilot --time 09:00       # preview
-loadout autopilot --time 09:00 --yes # enable
-loadout autopilot --remove --yes     # remove
-```
+## Catalog and discovery
 
-Autopilot uses the native scheduler on macOS, Linux, or Windows. Scheduled jobs are read-only: they can discover and report, but they cannot install, promote, execute, or update anything.
+<!-- loadout:catalog-coverage:start -->
 
-Check the results with:
+The bundled catalog currently contains **50 credited public repositories** across **37 categories**: **31 have skill components** and **19 are MCP-only**. All 50 are technically screened and pinned; 4 sources are selected by the bounded Stable policy. See every linked source, license status, component type, and pinned commit in **[Catalog and upstream credits](./docs/CATALOG.md)**.
 
-```bash
-loadout review-queue
-loadout candidate list --limit 20
-loadout alerts --updates
-loadout update
-```
+<!-- loadout:catalog-coverage:end -->
 
-`loadout update` checks the saved Stable, Power, Maximum, or Custom profile plus every
-managed repository. It is read-only. `loadout update --yes` applies reviewed profile
-changes and safe screened updates; anything disabled, risky, or failed is held for
-review. Daily checks never include `--yes`.
+<!-- loadout:evidence-stages:start -->
 
-The wording matters:
+Catalog evidence-stage counts: **0 benchmarked**, **0 discovered**, **0 human-reviewed**, **46 inspected**, **4 policy-selected**. Stage definitions and Stable selection criteria are in the [catalog policy](./docs/CATALOG_POLICY.md).
 
-- A **new lead** is interesting enough to inspect, not “must install.”
-- An **available update** is a different reviewed commit, not automatically better.
-- A **replacement alert** appears only when category-specific comparison evidence supports it.
+<!-- loadout:evidence-stages:end -->
 
-Loadout will never call a viral repository better just because its star count jumped. That protects users from hype, compromised repositories, and tools that solve a completely different problem.
-
-The repository also refreshes a public discovery report every day:
+Loadout does not claim there is one universally “best” configuration. Recommendations are bounded, rule-based proposals; stars and discovery results are signals for review, not quality proof.
 
 <!-- loadout:daily-discovery:start -->
 
-**Discovery snapshot (generated 2026-07-17):** [242 repositories observed](./docs/DISCOVERED.md), including 219 uncataloged review candidates and 23 repositories already in the reviewed catalog.
+**Discovery snapshot (generated 2026-07-17):** [242 repositories observed](./docs/DISCOVERED.md), including 219 uncataloged review candidates and 23 repositories already in the inspected catalog.
 <!-- loadout:daily-discovery:end -->
 
-See **[today's generated discovery report](./docs/DISCOVERED.md)** for direct links, observed star velocity, age, license metadata, and the searches that found each repository. The GitHub README updates when the daily workflow commits new evidence; an already-installed npm package keeps its own versioned documentation until the next npm release.
+The checked-in discovery report proves only its dated snapshot, not the success of every scheduled run. Use `loadout discover --source all --queue`, `loadout review-queue`, and `loadout candidate inspect owner/repository` to inspect candidates before catalog promotion.
 
-Inspect a promising lead without running its code:
+## Trust and limits
 
-```bash
-loadout discover --source all --queue
-loadout review-queue
-loadout candidate inspect owner/repository --output ./candidate-dossier.json
-```
+- A pinned commit identifies source bytes; it does not prove safety, correct licensing, usefulness, or future compatibility.
+- Static inspection reports scripts, hooks, binaries, domains, credential references, and unsupported components. It is not a security audit.
+- No bundled source is called benchmarked until isolated real trials, signed evidence, and human approval exist.
+- Project recommendations read bounded local metadata. The documented local flow does not upload project source.
+- Catalog fetches, discovery, update checks, and optional live checks use the network where stated.
+- MCP servers and executable tools have separate preview and approval paths because they can use credentials, start processes, or contact services.
+- Shared manifests hold environment-variable or OS-keychain references, not secret values.
 
-The dossier records what the repository contains, its exact commit, its license signal, possible overlaps, and static findings. Promotion into the catalog still requires review.
+<!-- loadout:current-limits:start -->
 
-## Chat subscriptions and API keys
+- **6 catalog records** currently have `NOASSERTION` license status and need upstream-license review before a public release decision.
 
-A ChatGPT Plus/Pro or Claude Pro/Max subscription is not the same as separately billed API access. You do **not** need an OpenAI, Anthropic, or OpenRouter API key for Stable, Power, Maximum, discovery, project recommendations, updates, or rollback.
+<!-- loadout:current-limits:end -->
 
-Tell non-interactive setup what separately billed API access is available without passing a secret:
+Read the [security policy](./SECURITY.md), [catalog policy](./docs/CATALOG_POLICY.md), and [credential and update policy](./docs/CREDENTIAL_AND_UPDATE_POLICY.md) before trusting third-party content.
 
-```bash
-loadout setup --mode stable --api-access none
-loadout setup --mode maximum --api-access openai,anthropic
-```
+## Agent support
 
-Loadout never treats API access as permission to install an MCP server. Credentialed MCP tools remain explicit setup steps, and configuration stores an environment-variable or OS-keychain reference rather than the secret value.
+<!-- loadout:support-summary:start -->
 
-See the reviewed MCP recipes that need no separately billed AI/model API key:
+Loadout's adapter capability matrix currently covers **12 agents**: Claude Code, Cline, Codex, Cursor, Gemini CLI, GitHub Copilot, Hermes, Junie, Kiro CLI, OpenCode, Roo Code, Windsurf. See the [complete feature matrix](./docs/FEATURE_TEST_MATRIX.md) for configured paths, filesystem lifecycle, platform, and native-host evidence.
 
-```bash
-loadout mcp-recipe --no-key
-```
+`tests/adapter-conformance.test.ts` plans, applies, inspects, disables, re-enables, and rolls back one skill for every configured target when the suite runs. A configured target path does not prove that the native application recognizes or executes it. Native application execution is not inferred from filesystem simulation.
 
-This includes Playwright MCP, Chrome DevTools MCP, and GitHub's read-only MCP. Loadout
-shows non-AI credentials separately: GitHub MCP needs a GitHub token, while the two
-browser recipes need no credential. Use `loadout mcp-recipe --credential-free` for the
-stricter zero-credential list. Browser control and service authorization remain
-explicit.
+Configured platform evidence: Linux (CI configured), macOS (CI configured), Windows (CI configured).
 
-```bash
-export LOADOUT_GITHUB_TOKEN="$GITHUB_PERSONAL_ACCESS_TOKEN"
+Platform evidence source: `.github/workflows/ci.yml (cross-platform job)`.
 
-loadout mcp-recipe github-readonly --config ./mcp.json \
-  --credential GITHUB_PERSONAL_ACCESS_TOKEN=env:LOADOUT_GITHUB_TOKEN
+Configured CI platforms describe a manually triggered workflow, not evidence that a current run passed.
 
-loadout mcp-recipe github-readonly --config ./mcp.json \
-  --credential GITHUB_PERSONAL_ACCESS_TOKEN=env:LOADOUT_GITHUB_TOKEN \
-  --yes
-```
+<!-- loadout:support-summary:end -->
 
-## Graphify and other executable tools
+Configured paths and disposable filesystem lifecycle tests do not prove that native applications recognize or execute installed skills. Use `loadout capabilities --inspect` for the local component matrix.
 
-Graphify is included as a separate reviewed tool recipe, not disguised as a portable skill. Its setup uses a pinned version and artifact hash, an isolated runtime, an exact preview, and rollback.
+## Command reference
 
-```bash
-loadout tool
-loadout tool graphify --agents codex
-loadout tool graphify --agents codex --yes --approve-risk
-loadout tool graphify --remove
-```
+| Job                                | Command                                     |
+| ---------------------------------- | ------------------------------------------- |
+| Guided read-only path              | `loadout guide`                             |
+| Preview or apply a profile         | `loadout setup --mode stable [--yes]`       |
+| List and inspect managed state     | `loadout list`; `loadout health --explain`  |
+| Browse or search                   | `loadout catalog`; `loadout search <words>` |
+| Recommend for a project            | `loadout recommend --project .`             |
+| Preview or apply updates           | `loadout update [--yes]`                    |
+| Undo the latest supported mutation | `loadout rollback`                          |
+| Remove one managed package         | `loadout remove <package>`                  |
+| Preview complete removal           | `loadout uninstall`                         |
+| Test with temporary state          | `loadout demo`                              |
+| Discover the full surface          | `loadout --help`; `loadout advanced`        |
 
-Executable tools and MCP servers receive separate treatment because they can run processes, use credentials, or open network connections. Broad setup never runs third-party repository installers.
-
-## Useful commands
-
-| Goal                                      | Command                                       |
-| ----------------------------------------- | --------------------------------------------- |
-| See the guided upgrade                    | `loadout upgrade`                             |
-| Install a loadout                         | `loadout setup --mode stable\|power\|maximum` |
-| See detected agents and installed skills  | `loadout status`                              |
-| Inspect health and evidence               | `loadout health --explain`                    |
-| Browse the reviewed catalog               | `loadout catalog`                             |
-| Search by capability                      | `loadout search <words>`                      |
-| Recommend for a project                   | `loadout recommend --project .`               |
-| Activate relevant library skills          | `loadout optimize --project .`                |
-| Find new repositories                     | `loadout discover --source all --queue`       |
-| Read the discovery queue                  | `loadout review-queue`                        |
-| Check installed changes                   | `loadout alerts --updates`                    |
-| Preview updates                           | `loadout update`                              |
-| Apply all safe reviewed updates           | `loadout update --yes`                        |
-| Undo the latest applied change            | `loadout rollback`                            |
-| Completely remove Loadout                 | `loadout uninstall`                           |
-| Test safely without touching your profile | `loadout demo`                                |
-| See every command                         | `loadout --help`                              |
-
-Shell completion is available for Bash, Zsh, Fish, and PowerShell:
+## Development
 
 ```bash
-loadout completion zsh > ~/.zfunc/_loadout
+npm ci
+npm run verify
+npm run verify:full
 ```
 
-## What Loadout changes
+<!-- loadout:verification-summary:start -->
 
-Before any managed write, Loadout:
+`verify` invokes `format:check`, `lint`, `typecheck`, `check:evidence`, `test`, `test:e2e:cli`, `test:e2e:readme`, `test:package`, `test:performance` in that order. Use `npm run verify:full` to include the optional Playwright dashboard check.
 
-1. fetches the exact reviewed Git commit;
-2. inspects the selected contents;
-3. resolves duplicate target names;
-4. prints safety findings and every destination;
-5. waits for explicit approval;
-6. snapshots the old state;
-7. applies the change as one transaction;
-8. records hashes for later drift checks and rollback.
+<!-- loadout:verification-summary:end -->
 
-Loadout state lives under `~/.loadout` by default. It never executes arbitrary third-party install scripts during broad setup. Maximum stores additional skills in a disabled library, and invalid individual skills are quarantined without discarding their safe siblings.
+The repository's mixed README product-flow test uses an isolated build, disposable state, an offline fixture, direct core calls, and CLI subprocesses. It does not prove live-network availability or behavior inside native agent applications. The [testing guide](./docs/TESTING.md) documents the exact checks and their boundaries.
 
-## Test the product
+## Documentation
 
-Run a real install-and-rollback flow in a temporary Codex profile:
+- [Catalog and upstream credits](./docs/CATALOG.md)
+- [Catalog evidence policy](./docs/CATALOG_POLICY.md)
+- [Feature and evidence matrix](./docs/FEATURE_TEST_MATRIX.md)
+- [Testing contract](./docs/TESTING.md)
+- [User test and troubleshooting guide](./docs/USER_TEST_GUIDE.md)
+- [Daily discovery snapshot](./docs/DISCOVERED.md)
+- [Candidate inspection and promotion](./docs/CANDIDATE_INTELLIGENCE.md)
+- [Credential and update policy](./docs/CREDENTIAL_AND_UPDATE_POLICY.md)
+- [Repository stabilization record](./docs/REPOSITORY_STABILIZATION.md)
+- [Engineering plan](./MASTER_PLAN.md) and [changelog](./CHANGELOG.md)
 
-```bash
-loadout demo
-```
+## Contributing, security, and attribution
 
-For contributors:
+Keep changes scoped, add regression coverage for behavior changes, and run `npm run verify:full`. Report vulnerabilities through [SECURITY.md](./SECURITY.md), without credentials, private source, or unredacted state. General bugs and proposals belong in the [issue tracker](https://github.com/VirajMishra1/loadout/issues).
 
-```bash
-npm ci
-npm run verify
-```
-
-`verify` checks formatting, lint, types, catalog evidence, unit and integration tests, a real CLI product flow, an installed-package smoke test, and a 1,000-skill performance gate.
-
-Use the **[product testing guide](./docs/TESTING.md)** for Power, Maximum, project optimization, credentials, and rollback. Use the **[complete feature matrix](./docs/FEATURE_TEST_MATRIX.md)** when you want to exercise every CLI feature and understand which commands read files, use the network, start processes, or write state.
-
-No bundled source is called benchmarked until real isolated trials, signed evidence, and human approval exist.
-
-## Current beta limits
-
-- Daily discovery creates leads; it does not automatically make them trusted catalog entries.
-- Replacement alerts need real comparison evidence. Loadout does not invent a winner from stars or recency.
-- MCP-only records need explicit configuration and may need external credentials or software.
-- Graphify is the first fully reviewed executable recipe; other runtime tools need equivalent recipe work.
-- Six catalog records currently have `NOASSERTION` license metadata and should be reviewed before relying on their license status.
-- The local registry works for development and self-hosting; there is no hosted Loadout registry service yet.
-- The optional dashboard exists for diagnostics, but the complete product is CLI-first.
-
-## More detail
-
-<details>
-<summary><strong>All 50 upstream projects credited by Loadout</strong></summary>
-
-- [Superpowers](https://github.com/obra/superpowers)
-- [Context7](https://github.com/upstash/context7)
-- [Playwright MCP](https://github.com/microsoft/playwright-mcp)
-- [UI UX Pro Max](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill)
-- [GitHub MCP Server](https://github.com/github/github-mcp-server)
-- [OpenAI Skills Catalog](https://github.com/openai/skills)
-- [Anthropic Skills](https://github.com/anthropics/skills)
-- [Agent Skills Marketplace](https://github.com/wshobson/agents)
-- [Vercel Agent Skills](https://github.com/vercel-labs/agent-skills)
-- [Vercel Skills](https://github.com/vercel-labs/skills)
-- [Cloudflare MCP Server](https://github.com/cloudflare/mcp-server-cloudflare)
-- [Supabase MCP](https://github.com/supabase/mcp)
-- [Sentry MCP](https://github.com/getsentry/sentry-mcp)
-- [Exa MCP Server](https://github.com/exa-labs/exa-mcp-server)
-- [Firecrawl MCP Server](https://github.com/firecrawl/firecrawl-mcp-server)
-- [Azure DevOps MCP](https://github.com/microsoft/azure-devops-mcp)
-- [Docker MCP Gateway](https://github.com/docker/mcp-gateway)
-- [Hugging Face MCP Server](https://github.com/huggingface/hf-mcp-server)
-- [Awesome Copilot](https://github.com/github/awesome-copilot)
-- [OpenAI Codex Skills](https://github.com/openai/codex)
-- [Ponytail](https://github.com/DietrichGebert/ponytail)
-- [Addy Osmani Agent Skills](https://github.com/addyosmani/agent-skills)
-- [Scientific Agent Skills](https://github.com/K-Dense-AI/scientific-agent-skills)
-- [Planning with Files](https://github.com/OthmanAdi/planning-with-files)
-- [PM Skills](https://github.com/phuryn/pm-skills)
-- [Baoyu Skills](https://github.com/JimLiu/baoyu-skills)
-- [Trail of Bits Skills](https://github.com/trailofbits/skills)
-- [Antfu Skills](https://github.com/antfu/skills)
-- [.NET Skills](https://github.com/dotnet/skills)
-- [Microsoft Skills](https://github.com/microsoft/skills)
-- [Web Quality Skills](https://github.com/addyosmani/web-quality-skills)
-- [Softaworks Agent Toolkit](https://github.com/softaworks/agent-toolkit)
-- [Draw.io Skill](https://github.com/Agents365-ai/drawio-skill)
-- [Chrome DevTools MCP](https://github.com/ChromeDevTools/chrome-devtools-mcp)
-- [Serena](https://github.com/oraios/serena)
-- [Model Context Protocol Servers](https://github.com/modelcontextprotocol/servers)
-- [AWS MCP Servers](https://github.com/awslabs/mcp)
-- [DBHub](https://github.com/bytebase/dbhub)
-- [FastAPI MCP](https://github.com/tadata-org/fastapi_mcp)
-- [Browser MCP](https://github.com/BrowserMCP/mcp)
-- [AntV Chart MCP](https://github.com/antvis/mcp-server-chart)
-- [Excel MCP Server](https://github.com/haris-musa/excel-mcp-server)
-- [arXiv MCP Server](https://github.com/blazickjp/arxiv-mcp-server)
-- [Google Workspace MCP](https://github.com/taylorwilsdon/google_workspace_mcp)
-- [MongoDB MCP Server](https://github.com/mongodb-js/mongodb-mcp-server)
-- [Redis MCP Server](https://github.com/redis/mcp-redis)
-- [Stripe AI](https://github.com/stripe/ai)
-- [MCP Toolbox for Databases](https://github.com/googleapis/mcp-toolbox)
-- [Browserbase MCP Server](https://github.com/browserbase/mcp-server-browserbase)
-- [Bright Data MCP](https://github.com/brightdata/brightdata-mcp)
-
-Thank you to every maintainer and contributor. Inclusion is attribution and discovery metadata, not ownership, endorsement, or relicensing.
-
-</details>
-
-- [Catalog and all upstream credits](./docs/CATALOG.md)
-- [Daily generated discovery report](./docs/DISCOVERED.md)
-- [How candidates are inspected and promoted](./docs/CANDIDATE_INTELLIGENCE.md)
-- [Catalog ranking and conflict policy](./docs/CATALOG_POLICY.md)
-- [Security policy](./SECURITY.md)
-- [Testing guide](./docs/TESTING.md)
-- [Complete CLI feature test matrix](./docs/FEATURE_TEST_MATRIX.md)
-- [Engineering master plan](./MASTER_PLAN.md)
+The catalog contains 50 credited public repositories. Inclusion records discovery and attribution; it does not transfer ownership, imply endorsement, or relicense upstream work.
 
 ## License
 
-Loadout is licensed under the [MIT License](./LICENSE). Catalog entries keep their own upstream licenses and terms; Loadout links and credits them but does not relicense them.
-
-Built for the OpenAI Build Week **Developer Tools** category.
+Loadout is licensed under the [MIT License](./LICENSE). Catalog entries retain their upstream licenses and terms.

package/dashboard/app.js

@@ -331,7 +331,7 @@ function renderHealth(data) {
   setMarkupState(
     health,
     `health-list ${state}`,
-    `<div class="metric-row"><strong>${Number(report.installedPackages) || 0}</strong><span>packages</span><strong>${report.updatesChecked ? Number(report.updatesAvailable) || 0 : "—"}</strong><span>${report.updatesChecked ? "updates" : "updates not checked"}</span><strong>${Number(report.driftedFiles) || 0}</strong><span>drifted files</span><strong>${Number(report.driftedMcpServers) || 0}</strong><span>drifted MCP</span></div>${findings.map((finding) => `<p><span class="finding-level">${escapeHtml(finding.level || "info")}</span>${escapeHtml(finding.message || "")}</p>`).join("")}`,
+    `<p><strong>Evidence coverage and managed-state hygiene</strong></p><div class="metric-row"><strong>${Number(report.installedPackages) || 0}</strong><span>packages</span><strong>${report.updatesChecked ? Number(report.updatesAvailable) || 0 : "—"}</strong><span>${report.updatesChecked ? "updates" : "updates not checked"}</span><strong>${Number(report.driftedFiles) || 0}</strong><span>drifted files</span><strong>${Number(report.driftedMcpServers) || 0}</strong><span>drifted MCP</span></div>${findings.map((finding) => `<p><span class="finding-level">${escapeHtml(finding.level || "info")}</span>${escapeHtml(finding.message || "")}</p>`).join("")}`,
   );
 }
 
@@ -363,12 +363,12 @@ function renderRecommendations(data) {
   setMarkupState(
     recommendations,
     "grid",
-    items
+    `<p><strong>Rule-based project suggestions</strong>: detected project signals select catalog entries; this is not empirical quality evidence.</p>${items
       .map((item, index) => {
         const headingId = `recommendation-${index}`;
         return `<article aria-labelledby="${headingId}"><div class="card-heading"><h3 id="${headingId}">${escapeHtml(item.packageId || "Unknown package")}</h3><span class="badge">${escapeHtml(item.confidence || "unknown")}</span></div><p>${escapeHtml(item.reason || "No recommendation reason available.")}</p></article>`;
       })
-      .join(""),
+      .join("")}`,
   );
 }
 
@@ -378,7 +378,7 @@ function renderProfiles(data) {
       ? Object.entries(data.profiles)
       : [];
   if (!entries.length)
-    return setTextState(profiles, "No tested profiles are available.");
+    return setTextState(profiles, "No Loadout policy profiles are available.");
   setMarkupState(
     profiles,
     "grid",

package/dashboard/index.html

@@ -13,8 +13,8 @@
         <p class="eyebrow">LOADOUT</p>
         <h1 id="page-title">Your agent control center.</h1>
         <p class="subhead">
-          Health, safe updates, tested setups, and real packages from this
-          machine.
+          Evidence health, safe updates, policy setups, and real packages from
+          this machine.
         </p>
         <nav class="dashboard-nav" aria-label="Dashboard views">
           <a href="#home" data-route="home">Home</a>
@@ -125,7 +125,7 @@
 
       <section data-screen="home" aria-labelledby="recommendations-heading">
         <div class="section-title">
-          <h2 id="recommendations-heading">Recommended for this project</h2>
+          <h2 id="recommendations-heading">Rule-based project suggestions</h2>
           <span id="project-signals"></span>
         </div>
         <div
@@ -141,7 +141,7 @@
 
       <section data-screen="home" aria-labelledby="profiles-heading">
         <div class="section-title">
-          <h2 id="profiles-heading">Tested profiles</h2>
+          <h2 id="profiles-heading">Loadout policy profiles</h2>
           <span>Preview only</span>
         </div>
         <div