loadout-ai 0.5.7 → 0.5.9

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 ## Unreleased
 
+## 0.5.9 - 2026-07-21
+
+### Fixed
+
+- Preserve active Stable skills when preparing Maximum Library by reserving their
+  managed targets before ordinary overlap deferral, while retaining fail-closed
+  commit, quarantine, and missing-source validation.
+- Run the canonical `npm run verify` release gate on ordinary pushes and pull
+  requests so CI cannot silently omit evidence, README-flow, or package checks.
+
+### Changed
+
+- Use one shared 30-skill recommended active-set limit in planning, inventory,
+  upgrade guidance, CLI defaults, and public workflow documentation.
+- Clearly archive superseded dashboard-era release notes and keep the public launch
+  checklist aligned with completed demo work and the current CLI-only product.
+
+## 0.5.8 - 2026-07-21
+
+### Fixed
+
+- Make `install --mode custom` genuinely additive: it now keeps existing managed
+  skills active and does not replace the saved profile.
+
 ## 0.5.7 - 2026-07-21
 
 ### Changed

package/MASTER_PLAN.md

@@ -13,7 +13,7 @@ history** is evidence of how the product was built, not unfinished launch scope.
 
 ### Product complete
 
-- [x] Publish the CLI as `loadout-ai@0.5.6`; keep the product usable without cloning
+- [x] Publish the CLI as `loadout-ai`; keep the product usable without cloning
       this repository or providing an OpenAI/Anthropic API key.
 - [x] Ship Stable, Power, Maximum, and Custom profiles with preview-first apply,
       snapshots, drift protection, explicit rollback, removal, and complete uninstall.
@@ -35,27 +35,27 @@ history** is evidence of how the product was built, not unfinished launch scope.
 
 ### Final founder acceptance
 
-- [ ] Install the exact public npm release in a fresh terminal and run the final short
-      path: Humanizer Custom preview/apply/scan/rollback, read-only update/discovery,
-      complete uninstall, and clean reinstall. Stable, Power, Maximum, project
-      optimization, Graphify, and both-host Playwright MCP lifecycles have already
-      been exercised on the founder's real profiles.
-- [ ] Decide whether to rename the GitHub repository from `loadout` to `loadout-ai`.
-      If approved, rename it before recording and update canonical links; keep the
-      product name **Loadout** and npm package/CLI identity `loadout-ai` / `loadout`.
-- [ ] Make the six unresolved upstream-license decisions explicit. Do not silently
-      convert `NOASSERTION` into a license claim because a repository is popular.
+- [x] Install the exact public npm release, verify `loadout --version`, and scan the
+      founder's restored real profiles. Stable, Power, Maximum, project optimization,
+      Humanizer, Graphify, both-host Playwright MCP lifecycles, rollback, complete
+      uninstall, and clean reinstall were exercised during founder acceptance.
+- [x] Keep the GitHub repository name `loadout`. The product remains **Loadout** and
+      the npm package/CLI identities remain `loadout-ai` / `loadout`.
+- [x] Record explicit decisions for all six `NOASSERTION` sources in
+      `docs/UPSTREAM_LICENSE_DECISIONS.md` without inventing a license claim.
 
 ### Submission work
 
-- [ ] Record the real CLI demo using `docs/DEMO_SCRIPT.md`; keep it under three
+- [x] Record the real CLI demo using `docs/DEMO_SCRIPT.md`; keep it under three
       minutes, include a voiceover, upload it publicly to YouTube, and verify the URL.
-- [ ] Replace the README demo placeholder with the final YouTube link.
-- [ ] In the voiceover, explain what Loadout does and how Codex and GPT-5.6 were used.
+- [x] Replace the README demo placeholder with the final YouTube link.
+- [x] In the voiceover, explain what Loadout does and how Codex and GPT-5.6 were used.
 - [ ] Run `/feedback` in Codex, copy the resulting session ID, and enter it in Devpost.
-- [ ] Confirm the repository URL is accessible to Devpost and OpenAI.
-- [ ] Confirm all team invitations are accepted, select **Developer Tools**, complete
-      the edited Devpost description, and submit rather than leaving a draft.
+- [x] Confirm the public repository URL is accessible to Devpost and OpenAI.
+- [x] Confirm all team invitations are accepted. Both teammates are collaborators and
+      there are no pending repository invitations.
+- [ ] Select **Developer Tools**, complete the edited Devpost description, and submit
+      rather than leaving a draft.
 
 ### Deliberately not part of this submission
 
@@ -72,12 +72,12 @@ These are not launch blockers and should not be rebuilt before submission:
 - Restoring GitHub-hosted Actions capacity before submission; the full gate can run
   locally, and the latest completed `main` CI is already passing.
 
-## Archived current-status diary (historical, not active scope)
+## Archived implementation diary (historical, not active scope)
 
-This section preserves the chronological implementation and founder-testing record.
-Its unchecked boxes may describe older release numbers, superseded acceptance paths,
-external research, or intentionally deferred work. They are not active launch tasks;
-use the launch finish line above.
+Everything below this heading is a frozen chronological implementation record. Its
+dashboard references, old release numbers, unchecked boxes, and superseded acceptance
+paths describe earlier product states; they are neither current capabilities nor
+active launch tasks. Use only the launch finish line above for current status.
 
 ### Implemented product work
 

package/README.md

@@ -34,7 +34,7 @@
 You need Node.js 20 or newer and Git.
 
 ```bash
-npm install --global loadout-ai@0.5.7
+npm install --global loadout-ai@0.5.9
 loadout setup --mode stable
 ```
 
@@ -87,10 +87,10 @@ Useful skills, plugins, MCP servers, and settings arrive one experiment at a tim
 Soon it is hard to remember what is installed, where it came from, whether something
 better launched yesterday, or how to undo a change. The name comes from games, where
 your loadout is the set of tools you choose for the mission. This does the same for AI
-coding agents—without making you rebuild the setup for every agent and every project.
+coding agents without making you rebuild the setup for every agent and every project.
 
 Most extension tools begin with a repo you already know. Loadout begins one step
-earlier—**what is actually worth knowing?**—and stays with you after installation.
+earlier: **what is actually worth knowing?** It stays with you after installation.
 
 Loadout watches a much wider catalog than it activates. You can keep thousands of
 technically screened skill copies in the disabled Maximum library, discover new projects as
@@ -112,17 +112,23 @@ their own explicit setup and permission steps.
 
 ### Demo
 
-**Demo video coming here.** The release walkthrough will show the real path—not a
-mock UI: Stable install, cross-agent inventory, project optimization, update and
-discovery checks, MCP setup, Graphify, rollback, and complete uninstall. The exact
-under-three-minute [recording and voiceover script](./docs/DEMO_SCRIPT.md) is public.
+<p align="center">
+  <a href="https://www.youtube.com/watch?v=opNqJKX7xMw">
+    <img src="https://img.youtube.com/vi/opNqJKX7xMw/maxresdefault.jpg" alt="Watch the 72-second Loadout demo" width="880">
+  </a>
+</p>
 
-For now, the [end-to-end acceptance guide](./docs/USER_TEST_GUIDE.md) contains the same
-commands you can run yourself.
+**[Watch the 72-second Loadout demo on YouTube](https://www.youtube.com/watch?v=opNqJKX7xMw).**
+It shows the real CLI product, including profiles, project-aware selection,
+discovery, explicit integrations, and snapshot-backed rollback. The exact
+[recording and voiceover script](./docs/DEMO_SCRIPT.md) is public.
+
+The [end-to-end acceptance guide](./docs/USER_TEST_GUIDE.md) contains the commands
+you can run yourself.
 
 ## Stable workflow
 
-### Stable Boost — install the essentials and start building
+### Stable Boost: install the essentials and start building
 
 Stable is the recommended daily driver: **30 selected skill directories from four
 pinned public sources**, installed into each agent you choose. It covers planning,
@@ -181,7 +187,7 @@ checked by `loadout update` without moving them to a different agent path.
 
 Loadout is opinionated when you want it to be and precise when you do not.
 
-### Power Boost — a larger cross-project toolkit
+### Power Boost: a larger cross-project toolkit
 
 Power draws a skill-level allowlist from eight major collections. The prepared set
 is deduplicated and invalid units are quarantined, so the final count can be lower
@@ -203,11 +209,11 @@ skills per agent.
 loadout setup --mode power
 ```
 
-### Maximum Library — download broadly, activate intelligently
+### Maximum Library: download broadly, activate intelligently
 
 Maximum is for explorers. It downloads every non-archived, technically screened
 skill component in the catalog into Loadout's **disabled local library**. Disabled
-means cached and available—not injected into agent context. Then let the current
+means cached and available, not injected into agent context. Then let the current
 project choose a focused active set:
 
 ```bash
@@ -221,7 +227,7 @@ This is the difference between “install everything” and “have everything r
 The first overloads agents; the second gives you a large library with a small,
 relevant active loadout.
 
-### Custom — take exact control
+### Custom: take exact control
 
 Use `setup` when the listed packages should become the complete managed profile for
 the selected agents. Packages from the previous managed profile that are not listed
@@ -324,7 +330,7 @@ The bundled catalog currently contains **53 credited public repositories** acros
 
 <!-- loadout:evidence-stages:start -->
 
-Catalog maturity: **53 sourced**, **53 technically inspected**, and **4 selected for Stable**. Independent human-review attestations and signed comparative benchmarks are not yet published, so Loadout does not pretend static inspection proves usefulness. The pinned catalog remains usable today, and local outcomes can be recorded to improve later rankings. Definitions and promotion rules are in the [catalog policy](./docs/CATALOG_POLICY.md).
+Catalog maturity: **53 sourced**, **53 technically inspected**, and **4 selected for Stable**. Independent human-review attestations are not yet published, so Loadout does not pretend static inspection proves usefulness. The pinned catalog remains usable today, and local outcomes can be recorded to improve later rankings. Definitions and promotion rules are in the [catalog policy](./docs/CATALOG_POLICY.md).
 
 <!-- loadout:evidence-stages:end -->
 
@@ -332,7 +338,7 @@ Loadout does not claim there is one universally “best” configuration. Recomm
 
 <!-- loadout:daily-discovery:start -->
 
-**Discovery snapshot (generated 2026-07-21):** [240 repositories observed](./docs/DISCOVERED.md), including 216 uncataloged review candidates and 24 repositories already in the inspected catalog.
+**Discovery snapshot (generated 2026-08-27):** [236 repositories observed](./docs/DISCOVERED.md), including 217 uncataloged review candidates and 19 repositories already in the inspected catalog.
 <!-- loadout:daily-discovery:end -->
 
 The checked-in discovery report proves only its dated snapshot, not the success of every scheduled run. Use `loadout discover --source all --queue`, `loadout review-queue`, and `loadout candidate inspect owner/repository` to inspect candidates before catalog promotion.
@@ -341,7 +347,7 @@ The checked-in discovery report proves only its dated snapshot, not the success
 
 - A pinned commit identifies source bytes; it does not prove safety, correct licensing, usefulness, or future compatibility.
 - Static inspection reports scripts, hooks, binaries, domains, credential references, and unsupported components. It is not a security audit.
-- No bundled source is called benchmarked until isolated real trials, signed evidence, and human approval exist.
+- No bundled source is called proven until human review and recorded local outcomes support it; static inspection alone never earns that label.
 - Project recommendations read bounded local metadata. The documented local flow does not upload project source.
 - Catalog fetches, discovery, update checks, and optional live checks use the network where stated.
 - MCP servers and executable tools have separate preview and approval paths because they can use credentials, start processes, or contact services.
@@ -353,6 +359,10 @@ The checked-in discovery report proves only its dated snapshot, not the success
 
 <!-- loadout:current-limits:end -->
 
+The six records have an explicit public-release decision rather than an assumed
+license. Read [Upstream license decisions](./docs/UPSTREAM_LICENSE_DECISIONS.md) for
+the source-by-source record and the boundary applied to Power, Maximum, and Custom.
+
 Read the [security policy](./SECURITY.md), [catalog policy](./docs/CATALOG_POLICY.md), and [credential and update policy](./docs/CREDENTIAL_AND_UPDATE_POLICY.md) before trusting third-party content.
 
 ## Agent support
@@ -431,7 +441,7 @@ without loading thousands of skills into every prompt.
 | Ecosystem research | Compared repositories, checked source layouts and licenses, and separated popularity from evidence                           | 53 pinned catalog sources plus a discovery snapshot watching 240 repositories                               |
 | Implementation     | Wrote and refactored CLI commands, schemas, source fetchers, installers, active-set logic, and MCP configuration             | The published `loadout-ai` package and the commands documented above                                        |
 | Safety work        | Looked for scripts, hooks, binaries, credential references, target collisions, stale previews, and external edits            | Preview-first changes, quarantined skill units, explicit risk approval, drift protection, and rollback      |
-| Testing            | Generated adversarial cases, reproduced failures from real terminal sessions, and converted them into regression tests       | 620 passing tests, CLI and README end-to-end flows, package smoke tests, and a 1,000-skill performance gate |
+| Testing            | Generated adversarial cases, reproduced failures from real terminal sessions, and converted them into regression tests       | 632 passing tests, CLI and README end-to-end flows, package smoke tests, and a 1,000-skill performance gate |
 | Team integration   | Audited teammate branches, compared them with `main`, prepared focused pull requests, and checked what was actually complete | One public history instead of three disconnected prototypes                                                 |
 | Release work       | Verified npm contents, version behavior, GitHub metadata, documentation claims, and public CI                                | A public npm package, credited upstream catalog, release evidence, and a reproducible verification command  |
 
@@ -495,6 +505,7 @@ The repository's mixed README product-flow test uses an isolated build, disposab
 - [Daily discovery snapshot](./docs/DISCOVERED.md)
 - [Candidate inspection and promotion](./docs/CANDIDATE_INTELLIGENCE.md)
 - [Credential and update policy](./docs/CREDENTIAL_AND_UPDATE_POLICY.md)
+- [Upstream license decisions](./docs/UPSTREAM_LICENSE_DECISIONS.md)
 - [Changelog](./CHANGELOG.md)
 
 ## Contributing, security, and attribution