winter-super-cli 2026.5.32 → 2026.6.5

package/resources/local/ecc/docs/releases/2.0.0-rc.1/article-outline.md

@@ -0,0 +1,78 @@
+# Article Outline - ECC v2.0.0-rc.1
+
+## Working Title
+
+Turning ECC Into a Cross-Harness Operating System
+
+## Core Argument
+
+Most agentic work breaks down because the tools stay isolated.
+
+The leverage comes from treating the harness, reusable workflow layer, and operator shell as one system:
+
+- skills for repeatable work
+- hooks and tests for enforcement
+- MCPs for tool access
+- memory and handoffs for continuity
+- one operator shell that can route daily execution
+
+## Structure
+
+### 1. The Problem
+
+- too many chat windows
+- too many tool-specific workflows
+- too much context living in personal habit instead of reusable system shape
+
+### 2. What ECC Already Solved
+
+- reusable skill format
+- cross-harness install surfaces
+- hooks and verification discipline
+- security and review patterns
+- operator workflow skills around content, research, and business ops
+- queue, discussion, Linear, legacy, and release-evidence checks that make the
+  operating state inspectable
+- supply-chain IOC scanning and no-lifecycle install hardening after the
+  Mini Shai-Hulud/TanStack campaign
+
+### 3. Why Hermes Is the Operator Layer
+
+- chat, CLI, TUI, cron, and handoffs can sit above the reusable ECC layer
+- business and content work can run next to engineering work
+- the daily loop becomes easier to inspect and improve
+
+### 4. What Ships in rc.1
+
+- sanitized Hermes setup guide
+- release and distribution collateral
+- cross-harness architecture doc
+- Hermes import guidance
+- clearer 2.0 positioning in the repo
+- preview-pack smoke gate
+- launch drafts for GitHub release copy, X, LinkedIn, article, Telegram/Hermes
+  handoff, and demo prompts
+
+### 5. What Changed Since v1.10.0
+
+- Claude Code remains the core target, but ECC now treats Codex, OpenCode,
+  Cursor, Gemini, Zed, and terminal-only workflows as shared execution surfaces.
+- The release process now has repeatable platform, discussion, observability,
+  supply-chain, Linear progress, and preview-pack checks.
+- AgentShield and ECC Tools work is mirrored into the roadmap so enterprise
+  security, hosted review, policy promotion, and billing-readiness lanes do not
+  drift away from the main release.
+
+### 6. What Stays Local
+
+- secrets and auth
+- raw workspace exports
+- personal datasets
+- operator-specific automations that have not been sanitized
+- deeper CRM, finance, and Google Workspace playbooks
+
+### 7. Closing Point
+
+The goal is not to copy one exact stack.
+
+The goal is to build an operating system around the agent that turns repeated work into reusable, measurable surfaces.

package/resources/local/ecc/docs/releases/2.0.0-rc.1/demo-prompts.md

@@ -0,0 +1,42 @@
+# Hermes x ECC Demo Prompts
+
+## Prompt 1: ECC Builds ECC
+
+Use the current ECC repo and the public release pack at `docs/releases/2.0.0-rc.1/`.
+
+Do 4 things in order:
+
+1. Inspect git status and the current repo diff, then give me a concise ECC v2.0.0-rc.1 PR or release summary that proves ECC is being used to build ECC itself.
+2. Finalize one strong X thread.
+3. Finalize one strong LinkedIn post.
+4. Tell me the exact 3 recordings I should do next plus what Hermes can generate automatically after I record.
+
+Keep it decisive and practical.
+
+## Prompt 2: Turn Recording Into Assets
+
+Assume I just recorded:
+
+- one face-camera hook
+- one screen capture of Hermes using ECC to ship ECC v2.0.0-rc.1
+- one setup walkthrough of the Hermes x ECC workspace
+
+Give me:
+
+1. a short-form edit plan for X, LinkedIn, TikTok, and YouTube Shorts
+2. a voiceover script if I want to re-record clean audio
+3. the exact repo-relative filenames and folders I should use for raw footage
+4. the assets Hermes can generate automatically after I drop the files in place
+
+Keep it operational.
+
+## Prompt 3: Public Launch Push
+
+Using the ECC v2.0.0-rc.1 release pack, give me:
+
+1. one release tweet
+2. one follow-up tweet
+3. one LinkedIn comment I can paste under the post
+4. one short Telegram handoff I can send to Hermes later to keep distributing this launch across channels
+
+Make it sound like an operator shipping real work, not a launch thread cliche.

package/resources/local/ecc/docs/releases/2.0.0-rc.1/launch-checklist.md

@@ -0,0 +1,56 @@
+# ECC v2.0.0-rc.1 Launch Checklist
+
+## Repo
+
+- verify local `main` is synced to `origin/main`
+- verify `docs/ECC-2.0-GA-ROADMAP.md` reflects the current Linear milestone
+  plan and the latest `ECC Platform Roadmap` project snapshot under the Ito
+  Markets workspace
+- verify `docs/HERMES-SETUP.md` is present
+- verify `docs/architecture/cross-harness.md` is present
+- verify this release directory is committed
+- verify `preview-pack-manifest.md` lists the public release, Hermes, adapter,
+  observability, publication, and announcement artifacts before running final
+  publish checks
+- verify `release-name-plugin-publication-checklist-2026-05-18.md` still
+  matches current GitHub, npm, Claude, Codex, OpenCode, and billing surfaces
+- keep private tokens, personal docs, and raw workspace exports out of the repo
+
+## Release Surface
+
+- verify package, plugin, marketplace, OpenCode, and agent metadata stays at `2.0.0-rc.1`
+- verify `ecc2/Cargo.toml` stays at `0.1.0` for rc.1; `ecc2/` remains an alpha control-plane scaffold
+- complete `publication-readiness.md` with fresh evidence before any GitHub release, npm publish, plugin submission, or announcement post
+- rerun the release name/plugin publication checklist before creating a
+  GitHub prerelease, publishing npm, pushing Claude plugin tags, recording the
+  Codex marketplace path, or posting public copy
+- include `publication-evidence-2026-05-17.md` and
+  `operator-readiness-dashboard-2026-05-17.md` in the final evidence review,
+  then rerun publish-facing checks from the exact release commit
+- update release metadata in one dedicated release-version PR
+- run the root test suite
+- run `cd ecc2 && cargo test`
+
+## Content
+
+- publish the X thread from `x-thread.md`
+- publish the LinkedIn draft from `linkedin-post.md`
+- use `article-outline.md` for the longer writeup
+- record one 30-60 second proof-of-work clip
+
+## Demo Asset Suggestions
+
+- Hermes plus ECC side by side
+- release docs being generated or reviewed from the repo
+- a workflow moving from brief to post to checklist
+- `ecc2/` dashboard or session surface with alpha framing
+
+## Messaging
+
+Use language like:
+
+- "release candidate"
+- "sanitized operator stack"
+- "cross-harness operating system for agentic work"
+- "ECC is the reusable substrate; Hermes is the operator shell"
+- "private/local integrations land after sanitization"

package/resources/local/ecc/docs/releases/2.0.0-rc.1/linkedin-post.md

@@ -0,0 +1,42 @@
+# LinkedIn Draft - ECC v2.0.0-rc.1
+
+ECC v2.0.0-rc.1 is ready for final release review as the first release-candidate pass at the 2.0 direction.
+
+The practical shift is simple: ECC is no longer framed as only a Claude Code plugin or config bundle.
+
+It is becoming a cross-harness operating system for agentic work:
+
+- reusable skills instead of one-off prompts
+- hooks and tests instead of manual discipline
+- MCP-backed access to docs, code, browser automation, and research
+- Codex, OpenCode, Cursor, Gemini, Zed, and Claude Code surfaces that share the same core workflow layer
+- Hermes as the operator shell for chat, cron, handoffs, and daily work routing
+
+For this release-candidate surface, I kept the repo honest.
+
+I did not publish private workspace state. I shipped the reusable layer:
+
+- sanitized Hermes setup documentation
+- release notes and launch collateral
+- cross-harness architecture notes
+- Hermes import guidance for turning local operator patterns into public ECC skills
+- release-readiness gates for PRs, issues, discussions, Linear progress, legacy tails, observability, and supply-chain checks
+- a deterministic preview-pack smoke test so the public pack can be verified before a release action
+
+The leverage is not just better prompting.
+
+It is reducing the number of isolated surfaces, turning repeated workflows into reusable skills, and making the operating system around the agent measurable.
+
+The supply-chain work became part of the release story too. After the Mini
+Shai-Hulud/TanStack campaign, rc.1 now includes IOC scanning, no-lifecycle CI
+installs, advisory-source refresh, npm audit/signature checks, and AI-tool
+persistence coverage.
+
+There is still more to harden before GA, especially around packaging, installers, and the `ecc2/` control plane. But rc.1 is enough to show the shape clearly.
+
+Public publication is still approval-gated until the GitHub release, npm
+`next` publish, plugin path, final URLs, and billing/native-payments claims have
+live evidence.
+
+The release URL ledger now separates links that already resolve from links that
+must wait for the approval-gated release, package, plugin, and billing checks.

package/resources/local/ecc/docs/releases/2.0.0-rc.1/naming-and-publication-matrix.md

@@ -0,0 +1,159 @@
+# ECC v2.0.0-rc.1 Naming And Publication Matrix
+
+Snapshot date: 2026-05-18.
+
+This matrix answers the release question "ship as Everything Claude Code, ECC,
+or a renamed surface?" for the rc.1 lane. It is evidence for planning, not a
+publication action.
+
+## Decision
+
+For `v2.0.0-rc.1`, keep the public identity as **Everything Claude Code (ECC)**.
+Use **ECC** as the short product name in copy, plugin slugs, status surfaces,
+and diagrams, but do not rename the GitHub repo, npm package, or package entry
+points before the rc.1 release.
+
+Reason:
+
+- the current install surface already works as `ecc-universal` plus the `ecc`
+  plugin slug;
+- the exact npm package name `ecc` is already occupied by an unrelated elliptic
+  curve cryptography package;
+- the repo name `affaan-m/ecc` is not present, but renaming
+  `affaan-m/everything-claude-code` before rc.1 would create avoidable URL,
+  package, docs, and marketplace churn;
+- Claude and Codex plugin surfaces are already short enough as `ecc`;
+- rc.1 should prove the release, plugin, and publication pipeline before any
+  broader brand migration.
+
+## Current Values
+
+| Surface | Current value | Evidence command | 2026-05-18 result | Release decision |
+| --- | --- | --- | --- | --- |
+| Product display name | `Everything Claude Code` | `rg -n "Everything Claude Code" README.md CHANGELOG.md docs/releases/2.0.0-rc.1` | Present across README, release notes, launch copy, and plugin manifests | Keep for rc.1 |
+| Short name | `ECC` | README/release docs | Used as the short cross-harness brand | Keep and prefer in tight copy |
+| GitHub repo | `affaan-m/everything-claude-code` | `git remote get-url origin` | `https://github.com/affaan-m/everything-claude-code.git` | Keep for rc.1 |
+| Possible short repo | `affaan-m/ecc` | `gh repo view affaan-m/ecc` | Not found with current auth | Candidate after rc.1 only |
+| npm package | `ecc-universal` | `node -p "require('./package.json').name"` | `ecc-universal` | Keep for rc.1 |
+| npm package version | `2.0.0-rc.1` local, `1.10.0` registry latest | `node -p "require('./package.json').version"` and `npm view ecc-universal name version dist-tags --json` | Local rc.1 is ready; registry latest remains `1.10.0` and no `next` dist-tag exists yet | Publish rc as `next`, not `latest` |
+| Exact npm short name | `ecc` | `npm view ecc name version description repository.url --json` | Occupied by `ecc@0.0.2`, "Elliptic curve cryptography functions." | Do not use |
+| Scoped npm short name | `@affaan-m/ecc` | `npm view @affaan-m/ecc name version --json` | Registry 404 | Possible future scoped package if npm scope policy permits |
+| Former package name | `everything-claude-code` | `npm view everything-claude-code name version dist-tags --json` | Registry reports unpublished on 2026-02-07 | Do not revive for rc.1 |
+| Claude plugin slug | `ecc` | `node -p "require('./.claude-plugin/plugin.json').name"` | `ecc` | Keep |
+| Claude plugin version | `2.0.0-rc.1` | `claude plugin validate .claude-plugin/plugin.json`; `claude plugin tag .claude-plugin --dry-run` | Validation passed on Claude Code `2.1.143`; dry run would create `ecc--v2.0.0-rc.1` | Ready for release-tag gate |
+| Claude marketplace entry | `ecc` | `.claude-plugin/marketplace.json`; `claude plugin marketplace add --help`; Anthropic plugin marketplace docs | Version and repo point at current rc.1 surface; GitHub, git URL, remote marketplace JSON, and local path marketplace sources are supported | Keep |
+| Codex plugin slug | `ecc` | `node -p "require('./.codex-plugin/plugin.json').name"` | `ecc` | Keep |
+| Codex plugin version | `2.0.0-rc.1` | `node tests/plugin-manifest.test.js`; `node tests/docs/ecc2-release-surface.test.js` | Plugin manifest passed 54/54; release surface passed 21/21 on Codex CLI `0.131.0` | Ready for Codex marketplace/manual marketplace gate |
+| Codex repo marketplace | `ecc` | `.agents/plugins/marketplace.json`; `codex plugin marketplace add --help`; OpenAI Codex plugin docs | Repo marketplace add supports GitHub shorthand, Git URLs, SSH URLs, local roots, `--ref`, and `--sparse`; local and GitHub-ref temp-home add smokes passed | Use as rc.1 Codex distribution path |
+| OpenCode package | `ecc-universal` | `node -p "require('./.opencode/package.json').name"` | `ecc-universal` | Keep |
+| OpenCode build | Generated package output | `npm run build:opencode` | Passed | Ready for package dry-run gate |
+| npm pack surface | Reduced runtime package | `NPM_CONFIG_USERCONFIG=/dev/null npm pack --dry-run --json` | Produced `ecc-universal-2.0.0-rc.1.tgz`, 2228 entries, 4,348,504 bytes packed, 13,024,929 bytes unpacked | Needs final release-commit rerun |
+
+## Publication Paths
+
+| Path | Current evidence | Required next action | Blocker |
+| --- | --- | --- | --- |
+| GitHub release | `docs/releases/2.0.0-rc.1/` and release notes are in-tree | Re-run required command evidence from the final release commit, then create/verify `v2.0.0-rc.1` prerelease | No tag/release yet |
+| npm | `ecc-universal` local package version is `2.0.0-rc.1`; registry latest is `1.10.0` | Publish rc with `npm publish --tag next` after final `npm pack --dry-run` and release tests | Do not publish before final release commit |
+| Claude plugin | `claude plugin validate .claude-plugin/plugin.json` passed; `claude plugin tag --help` confirms the release tag flow creates `{name}--v{version}` tags and can push them | Run `claude plugin tag .claude-plugin --dry-run` from the clean release commit, then tag/push only after release approval | No plugin release tag created in this pass |
+| Claude marketplace | `.claude-plugin/marketplace.json` points at `ecc` and the public repo | Verify marketplace update/install path after tag exists | External marketplace propagation not verified |
+| Codex plugin | `codex plugin marketplace` supports local and Git marketplace sources; `.codex-plugin/plugin.json` is present; `.agents/plugins/marketplace.json` exposes `ecc` from the repo root; temp-home local and GitHub-ref marketplace adds passed | Publish rc.1 docs with the repo-marketplace command, then monitor OpenAI's official Plugin Directory path | Do not claim official Plugin Directory listing before OpenAI submission evidence |
+| OpenCode package | `.opencode/package.json` builds from source and ships inside npm package | Re-run `npm run build:opencode` and package dry-run from release commit | OpenCode CLI 1.2.21 does not expose a separate plugin publication command in this pass |
+| ECC Tools billing claim | README and launch copy mention ECC Tools / marketplace context | ECC-Tools #73 adds `/api/billing/readiness` `announcementGate`; run it against a Marketplace-managed test account before any payment announcement | Billing announcement code gate exists; live Marketplace account readback still pending |
+| Social and longform copy | X thread, LinkedIn copy, article outline, GitHub release copy exist | Replace any stale URLs, then publish only after release/npm/plugin URLs work | Public URLs not final until release actions complete |
+
+## ITO-46 Blocker Register
+
+| Channel | Current status | Required metadata/evidence | Owner | Blocker or follow-up |
+| --- | --- | --- | --- | --- |
+| GitHub release | Approval-gated; no `v2.0.0-rc.1` prerelease yet | Tag, release URL, prerelease flag, final release notes, URL ledger | Release owner | Create only after final clean-checkout evidence |
+| npm | `ecc-universal@2.0.0-rc.1` dry-run passed; registry latest is `1.10.0` | Pack summary, publish dry-run, `next` dist-tag readback, registry signature evidence | Package owner | Do not publish before approval and final release commit |
+| Short npm name | `ecc` is occupied; `@affaan-m/ecc` returns 404 | Name availability outputs and migration plan | Release owner | Keep `ecc-universal` for rc.1; scoped rename is post-rc only |
+| Claude plugin | `ecc@2.0.0-rc.1` validates; tag dry run would create `ecc--v2.0.0-rc.1` | `claude plugin validate .`, `claude plugin tag .claude-plugin --dry-run`, marketplace install/update smoke | Plugin owner | Real tag push and marketplace propagation require release approval |
+| Claude marketplace | Docs and CLI support GitHub, git URL, remote marketplace JSON, and local path sources | Public repo marketplace JSON, support/contact metadata, post-tag install smoke | Plugin owner | No external official listing has been submitted in this pass |
+| Codex repo marketplace | Local and GitHub-ref temp-home marketplace add smokes passed on Codex CLI `0.131.0` | `.codex-plugin/plugin.json`, `.agents/plugins/marketplace.json`, repo/personal marketplace evidence | Plugin owner | Official Plugin Directory listing requires OpenAI submission/listing evidence |
+| Codex official Plugin Directory | OpenAI docs describe the curated official directory; ECC has not submitted or received listing evidence | Directory submission link or OpenAI approval path once available | Plugin owner | Track as an ITO-56/ITO-46 follow-up; do not claim an official listing |
+| OpenCode package | `npm run build:opencode` passed | Built `.opencode` package metadata inside npm tarball | Package owner | No separate public plugin channel identified; follows npm |
+| Billing/native payments | Announcement remains blocked by ITO-61 | Marketplace Pro target readback, webhook provenance, `INTERNAL_API_SECRET`, announcement gate | ECC Tools owner | Do not include native-payments claim in rc.1 announcement |
+| Social/longform copy | Drafts exist | Final live GitHub, npm, Claude, Codex, billing URLs | Release owner | Publish only after release/package/plugin URLs exist |
+
+## Rename After rc.1
+
+If the project moves from "Everything Claude Code" toward "ECC" after rc.1,
+do it as a staged migration:
+
+1. Keep `ecc-universal` as the npm package until a replacement package has a
+   verified owner, deprecation plan, and install migration.
+2. Keep `affaan-m/everything-claude-code` as the canonical repo until release
+   notes, docs, plugin marketplace entries, npm metadata, and external links
+   are prepared for redirects.
+3. Use `ECC` as the product name in new diagrams, status payloads, and
+   cross-harness docs immediately.
+4. Reserve or create any new GitHub/npm/package surfaces before announcing the
+   rename.
+5. Ship a compatibility guide that maps old commands, package names, plugin
+   slugs, and docs URLs to the new names.
+
+## Evidence Captured In This Pass
+
+```text
+git rev-parse HEAD
+67e63e63f9bfd074bd6a21bf6bac71f3dfefa58b
+
+node -p "require('./package.json').name + '@' + require('./package.json').version"
+ecc-universal@2.0.0-rc.1
+
+node -p "require('./.claude-plugin/plugin.json').name + '@' + require('./.claude-plugin/plugin.json').version"
+ecc@2.0.0-rc.1
+
+node -p "require('./.codex-plugin/plugin.json').name + '@' + require('./.codex-plugin/plugin.json').version"
+ecc@2.0.0-rc.1
+
+node -p "require('./.opencode/package.json').name + '@' + require('./.opencode/package.json').version"
+ecc-universal@2.0.0-rc.1
+
+npm view ecc name version description repository.url --json
+ecc@0.0.2 is occupied by an unrelated elliptic curve cryptography package.
+
+npm view ecc-universal name version dist-tags --json
+registry latest is 1.10.0; no rc dist-tag exists yet.
+
+claude plugin validate .claude-plugin/plugin.json
+Validation passed on Claude Code 2.1.143.
+
+claude plugin validate .
+Validation passed with one warning: root CLAUDE.md is not loaded as plugin
+context; ship plugin context through skills instead.
+
+claude plugin tag .claude-plugin --dry-run
+Would create and push tag ecc--v2.0.0-rc.1.
+
+node tests/docs/ecc2-release-surface.test.js
+21 release-surface checks passed.
+
+node tests/plugin-manifest.test.js
+54 plugin-manifest checks passed.
+
+npm run build:opencode
+Passed.
+
+npm pack --dry-run --json
+Produced ecc-universal-2.0.0-rc.1.tgz, 2228 entries, 4,348,504 bytes
+packed, and 13,024,929 bytes unpacked.
+
+npm publish --tag next --dry-run
+Dry run would publish ecc-universal@2.0.0-rc.1 to npm with tag next.
+
+codex plugin marketplace add --help
+Supports GitHub shorthand, HTTP(S) Git URLs, SSH URLs, local marketplace roots,
+--ref, and Git-only --sparse.
+
+HOME="$(mktemp -d)" codex plugin marketplace add <local-checkout>
+Added marketplace ecc and recorded the installed marketplace root as
+<local-checkout> without touching the real Codex config.
+
+HOME="$(mktemp -d)" codex plugin marketplace add affaan-m/everything-claude-code --ref "$(git rev-parse HEAD)"
+Added marketplace ecc from the GitHub repo pinned to
+67e63e63f9bfd074bd6a21bf6bac71f3dfefa58b without touching the real Codex
+config.
+```

package/resources/local/ecc/docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-15.md

@@ -0,0 +1,55 @@
+# ECC Operator Readiness Dashboard
+
+This dashboard is generated by `npm run operator:dashboard`. It is an operator snapshot, not release approval.
+
+Generated: 2026-05-17T05:08:31.916Z
+Commit: 6d130cfcd5d06b42c7eb30be8e109cfa87fde197
+Status: work remaining
+
+## Current Status
+
+| Area | Status | Evidence |
+| --- | --- | --- |
+| PR queue | Current | 6 open PRs across tracked repos |
+| Issue queue | Current | 3 open issues across tracked repos |
+| Discussions | Current | 0 need maintainer touch; 0 missing accepted answer |
+| Local worktree | Needs work | 7 blocking dirty files; 1 ignored dirty entries |
+| Dashboard generation | Current | platform audit ready: true; GitHub skipped: false |
+| Publication | Not complete | release, npm, plugin, billing, and announcement gates are tracked below |
+
+## Prompt-To-Artifact Checklist
+
+| Objective requirement | Artifact or gate | Status | Evidence | Gap |
+| --- | --- | --- | --- | --- |
+| Keep public PRs below 20 | scripts/platform-audit.js live GitHub sweep | current | 6 open PRs across 5 tracked repos | repeat before release |
+| Keep public issues below 20 | scripts/platform-audit.js live GitHub sweep | current | 3 open issues across 5 tracked repos | repeat before release |
+| Respond and manage repository discussions | scripts/platform-audit.js discussion summary | current | 0 need maintainer touch; 0 answerable discussions missing accepted answer | repeat before release |
+| Build ITO-44 completion dashboard into a repeatable command | npm run operator:dashboard | complete | operator:dashboard package script exists | keep generated dashboard attached to publication evidence |
+| ECC 2.0 preview pack ready | docs/releases/2.0.0-rc.1/preview-pack-manifest.md | in_progress | preview pack manifest is in-tree | final clean-checkout release approval and publish evidence still pending |
+| Include Hermes specialized skills safely | docs/HERMES-SETUP.md and skills/hermes-imports/SKILL.md | in_progress | Hermes setup and import skill are present | final preview-pack smoke and release review pending |
+| Prepare name-change, Claude plugin, and Codex plugin paths | naming-and-publication-matrix plus publication-readiness | in_progress | naming matrix and plugin readiness gates exist | real tag/push, marketplace submission, and final channel choice remain approval-gated |
+| Prepare release notes, articles, tweets, and push notifications | docs/releases/2.0.0-rc.1 social and release-copy files | in_progress | release notes, X thread, and LinkedIn draft are present | URL-backed refresh and publish approval still pending |
+| Advance AgentShield enterprise iteration | AgentShield PR evidence plus enterprise roadmap | in_progress | AgentShield enterprise PR evidence is mirrored in the GA roadmap | workflow automation around protected rollout and richer runtime review UX pending after policy promotion shipped |
+| Advance ECC Tools native payments and AI-native harness-agnostic app | ECC Tools PR evidence, billing gate, hosted analysis lanes | in_progress | billing announcement gate, hosted analysis lanes, AgentShield fleet-summary consumption, hosted finding evidence paths, and harness-route policy linking are mirrored in the GA roadmap | live Marketplace test-account readback, hosted promotion telemetry, and richer operator review UX pending |
+| Audit, prune, or attach legacy work | docs/stale-pr-salvage-ledger.md and legacy inventory | in_progress | legacy salvage ledger and ITO-55 tracking are present | final translation/manual-review tail remains |
+| Keep Linear roadmap detailed and progress tracking synchronized | Linear project mirror plus progress-sync contract | in_progress | repo mirror and progress-sync contract are present | recurring Linear status sync and productized realtime sync remain pending |
+| Provide ECC 2.0 observability for self-use | observability readiness gate | complete | observability:ready command and readiness doc exist | runtime/dashboard implementation can continue after release gates |
+| Keep Mini Shai-Hulud/TanStack protection loop current | supply-chain watch plus runbook | current | scheduled supply-chain watch now emits IOC and advisory-source refresh artifacts | Linear status synchronization remains ITO-57 follow-up after each significant merge batch |
+
+## Top Actions
+
+- `ecc-preview-pack`: final clean-checkout release approval and publish evidence still pending
+- `hermes-specialized-skills`: final preview-pack smoke and release review pending
+- `naming-and-plugin-publication`: real tag/push, marketplace submission, and final channel choice remain approval-gated
+- `release-notes-and-notifications`: URL-backed refresh and publish approval still pending
+- `agentshield-enterprise-iteration`: workflow automation around protected rollout and richer runtime review UX pending after policy promotion shipped
+- `ecc-tools-next-level`: live Marketplace test-account readback, hosted promotion telemetry, and richer operator review UX pending
+- `legacy-salvage`: final translation/manual-review tail remains
+- `linear-roadmap-and-progress`: recurring Linear status sync and productized realtime sync remain pending
+
+## Next Work Order
+
+1. Regenerate this dashboard from the final release commit before publication evidence is recorded.
+2. Continue ITO-57 with Linear status synchronization for the scheduled supply-chain watch advisory-source report.
+3. Advance ECC Tools live Marketplace test-account readback before publishing native-payments announcement copy.
+4. Resume ITO-45, ITO-46, and ITO-56 only after the generated dashboard and final release gates are refreshed.

package/resources/local/ecc/docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-17.md

@@ -0,0 +1,51 @@
+# ECC Operator Readiness Dashboard
+
+This dashboard is generated by `npm run operator:dashboard`. It is an operator snapshot, not release approval.
+
+Generated: 2026-05-18T01:50:19.099Z
+Commit: 000df72d6b9c5b11feb11deef609911943b48424
+Status: work remaining
+
+## Current Status
+
+| Area | Status | Evidence |
+| --- | --- | --- |
+| PR queue | Current | 0 open PRs across tracked repos |
+| Issue queue | Current | 0 open issues across tracked repos |
+| Discussions | Current | 0 need maintainer touch; 0 missing accepted answer |
+| Local worktree | Current | 0 blocking dirty files; 1 ignored dirty entries |
+| Dashboard generation | Current | platform audit ready: true; GitHub skipped: false |
+| Publication | Not complete | release, npm, plugin, billing, and announcement gates are tracked below |
+
+## Prompt-To-Artifact Checklist
+
+| Objective requirement | Artifact or gate | Status | Evidence | Gap |
+| --- | --- | --- | --- | --- |
+| Keep public PRs below 20 | scripts/platform-audit.js live GitHub sweep | current | 0 open PRs across 5 tracked repos | repeat before release |
+| Keep public issues below 20 | scripts/platform-audit.js live GitHub sweep | current | 0 open issues across 5 tracked repos | repeat before release |
+| Respond and manage repository discussions | scripts/platform-audit.js discussion summary | current | 0 need maintainer touch; 0 answerable discussions missing accepted answer | repeat before release |
+| Build ITO-44 completion dashboard into a repeatable command | npm run operator:dashboard | complete | operator:dashboard package script exists | keep generated dashboard attached to publication evidence |
+| ECC 2.0 preview pack ready | docs/releases/2.0.0-rc.1/preview-pack-manifest.md | current | preview pack manifest and deterministic smoke gate are in-tree | repeat clean-checkout preview-pack smoke before publication |
+| Include Hermes specialized skills safely | docs/HERMES-SETUP.md and skills/hermes-imports/SKILL.md | current | Hermes setup/import artifacts are covered by preview-pack smoke | repeat preview-pack smoke before release review |
+| Prepare name-change, Claude plugin, and Codex plugin paths | naming-and-publication-matrix plus publication-readiness | in_progress | naming matrix and plugin readiness gates exist | real tag/push, marketplace submission, and final channel choice remain approval-gated |
+| Prepare release notes, articles, tweets, and push notifications | docs/releases/2.0.0-rc.1 social and release-copy files | in_progress | release notes, X thread, and LinkedIn draft are present | URL-backed refresh and publish approval still pending |
+| Advance AgentShield enterprise iteration | AgentShield PR evidence plus enterprise roadmap | in_progress | AgentShield policy promotion `reviewItems` landed in `87aec47`; package-manager hardening drift detection landed in `28d08c7`; workflow action runtime pins were refreshed in `659f569`; npm age-gate guidance was corrected in `ee585cd`; package-manager hardening Action outputs landed in `1124535`; policy-promotion Action outputs and runtime-smoke job-summary evidence landed in `1593925`; ECC-Tools consumes those outputs in `8658951`, surfaces operator-readable status/pack/count/digest telemetry in `16c537f`, and renders hosted promotion judge audit traces in `05d4e82`; all are mirrored in the GA roadmap | deepen live operator approval/readback after Marketplace/payment gates |
+| Advance ECC Tools native payments and AI-native harness-agnostic app | ECC Tools PR evidence, billing gate, hosted analysis lanes | in_progress | billing announcement gate, hosted analysis lanes, AgentShield fleet-summary consumption, hosted finding evidence paths, harness-route policy linking, policy-promotion Action-output telemetry, operator-visible promotion output details, hosted promotion judge audit traces, billing announcement preflight, and production KV readback state are mirrored in the GA roadmap | complete Marketplace purchase/webhook readback, then run the live announcement gate |
+| Audit, prune, or attach legacy work | docs/stale-pr-salvage-ledger.md and legacy inventory | current | legacy salvage ledger and inventory are current; all localization tails are attached to Linear ITO-55 for manual language-owner review | repeat legacy scan before release |
+| Keep Linear roadmap detailed and progress tracking synchronized | Linear project mirror plus progress-sync contract | current | Linear live sync and project progress snapshot are current; progress-sync contract defines the file-backed work-items/status path | repeat Linear/project status update and local work-items sync after each significant merge batch |
+| Provide ECC 2.0 observability for self-use | observability readiness gate | complete | observability:ready command and readiness doc exist | runtime/dashboard implementation can continue after release gates |
+| Keep Mini Shai-Hulud/TanStack protection loop current | supply-chain watch plus runbook plus AgentShield package-manager hardening | current | scheduled supply-chain watch emits IOC/advisory-source refresh artifacts; ECC scanner covers gh-token-monitor token-store persistence; AgentShield now detects known AI-tool persistence IOCs, npm lifecycle/token drift, unsupported npm age-key drift, and pnpm/Yarn cooldown drift; ITO-57 has May 17 Linear evidence updates | repeat advisory/source refresh and Linear sync after each significant supply-chain batch |
+
+## Top Actions
+
+- `naming-and-plugin-publication`: real tag/push, marketplace submission, and final channel choice remain approval-gated
+- `release-notes-and-notifications`: URL-backed refresh and publish approval still pending
+- `agentshield-enterprise-iteration`: deepen live operator approval/readback after Marketplace/payment gates
+- `ecc-tools-next-level`: complete Marketplace purchase/webhook readback, then run the live announcement gate
+
+## Next Work Order
+
+1. Regenerate this dashboard from the final release commit before publication evidence is recorded.
+2. Repeat ITO-57 Linear/project status sync after the next significant merge batch or advisory-source refresh.
+3. Complete ECC Tools Marketplace purchase/webhook readback, then run preflight and the live announcement gate before publishing native-payments copy.
+4. Resume ITO-45, ITO-46, and ITO-56 only after the generated dashboard and final release gates are refreshed.

package/resources/local/ecc/docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-18.md

@@ -0,0 +1,51 @@
+# ECC Operator Readiness Dashboard
+
+This dashboard is generated by `npm run operator:dashboard`. It is an operator snapshot, not release approval.
+
+Generated: 2026-05-18T20:25:22.649Z
+Commit: 4470e2e6702f17099d6feb137ba03ff00582c202
+Status: work remaining
+
+## Current Status
+
+| Area | Status | Evidence |
+| --- | --- | --- |
+| PR queue | Current | 0 open PRs across tracked repos |
+| Issue queue | Current | 0 open issues across tracked repos |
+| Discussions | Current | 0 need maintainer touch; 0 missing accepted answer |
+| Local worktree | Current | 0 blocking dirty files; 0 ignored dirty entries |
+| Dashboard generation | Current | platform audit ready: true; GitHub skipped: false |
+| Publication | Not complete | release, npm, plugin, billing, and announcement gates are tracked below |
+
+## Prompt-To-Artifact Checklist
+
+| Objective requirement | Artifact or gate | Status | Evidence | Gap |
+| --- | --- | --- | --- | --- |
+| Keep public PRs below 20 | scripts/platform-audit.js live GitHub sweep plus owner-wide queue cleanup ledger | current | 0 open PRs across 5 tracked repos; 0 owner-wide open PRs after cleanup | repeat platform:audit and owner-wide gh search before release |
+| Keep public issues below 20 | scripts/platform-audit.js live GitHub sweep plus owner-wide queue cleanup ledger | current | 0 open issues across 5 tracked repos; 0 owner-wide open issues after cleanup | repeat platform:audit and owner-wide gh search before release |
+| Respond and manage repository discussions | scripts/platform-audit.js discussion summary | current | 0 need maintainer touch; 0 answerable discussions missing accepted answer | repeat before release |
+| Build ITO-44 completion dashboard into a repeatable command | npm run operator:dashboard | complete | operator:dashboard package script exists | keep generated dashboard attached to publication evidence |
+| ECC 2.0 preview pack ready | docs/releases/2.0.0-rc.1/preview-pack-manifest.md | current | preview pack manifest and deterministic smoke gate are in-tree | repeat clean-checkout preview-pack smoke before publication |
+| Include Hermes specialized skills safely | docs/HERMES-SETUP.md and skills/hermes-imports/SKILL.md | current | Hermes setup/import artifacts are covered by preview-pack smoke | repeat preview-pack smoke before release review |
+| Prepare name-change, Claude plugin, and Codex plugin paths | naming-and-publication-matrix plus release-name-plugin-publication checklist plus publication-readiness | in_progress | naming matrix, release publication checklist, and plugin readiness gates exist | real tag/push, marketplace submission, and final channel choice remain approval-gated |
+| Prepare release notes, articles, tweets, and push notifications | docs/releases/2.0.0-rc.1 social and release-copy files | in_progress | release notes, X thread, LinkedIn draft, and URL ledger are present | final live release/npm/plugin/billing URLs and publish approval still pending |
+| Advance AgentShield enterprise iteration | AgentShield PR evidence plus enterprise roadmap | in_progress | AgentShield policy promotion `reviewItems` landed in `87aec47`; package-manager hardening drift detection landed in `28d08c7`; workflow action runtime pins were refreshed in `659f569`; npm age-gate guidance was corrected in `ee585cd`; package-manager hardening Action outputs landed in `1124535`; policy-promotion Action outputs and runtime-smoke job-summary evidence landed in `1593925`; fleet review ticket payloads and current Mini Shai-Hulud IOC breadcrumbs landed in `840952a`; ECC-Tools consumes those outputs in `8658951`, surfaces operator-readable status/pack/count/digest telemetry in `16c537f`, and renders hosted promotion judge audit traces in `05d4e82`; all are mirrored in the GA roadmap | deepen live operator approval/readback after Marketplace/payment gates |
+| Advance ECC Tools native payments and AI-native harness-agnostic app | ECC Tools PR evidence, billing gate, hosted analysis lanes | in_progress | billing announcement gate, hosted analysis lanes, AgentShield fleet-summary consumption, hosted finding evidence paths, harness-route policy linking, policy-promotion Action-output telemetry, operator-visible promotion output details, hosted promotion judge audit traces, billing announcement preflight, aggregate production billing KV readback, Wrangler OAuth readback, target-account billing readback, provenance-aware Marketplace billing-state gates, sanitized Marketplace plan/action provenance counts, hosted team-learning feedback controls, and ECC-Tools Dependabot alert remediation are mirrored in the GA roadmap | create or verify Marketplace-managed Pro target billing-state with webhook provenance, configure the target account and INTERNAL_API_SECRET, then rerun target readback and the live announcement gate |
+| Audit, prune, or attach legacy work | docs/stale-pr-salvage-ledger.md and legacy inventory | current | legacy salvage ledger and inventory are current; all localization tails are attached to Linear ITO-55 for manual language-owner review | repeat legacy scan before release |
+| Keep Linear roadmap detailed and progress tracking synchronized | Linear project mirror plus progress-sync contract | current | Linear live sync and project progress surface are current; progress-sync contract defines the file-backed work-items/status path | repeat Linear/project status update and local work-items sync after each significant merge batch |
+| Provide ECC 2.0 observability for self-use | observability readiness gate | complete | observability:ready command and readiness doc exist | runtime/dashboard implementation can continue after release gates |
+| Keep Mini Shai-Hulud/TanStack protection loop current | supply-chain watch plus runbook plus AgentShield package-manager hardening | current | scheduled supply-chain watch emits IOC/advisory-source refresh artifacts; ECC scanner covers gh-token-monitor token-store persistence; AgentShield now detects known AI-tool persistence IOCs, npm lifecycle/token drift, unsupported npm age-key drift, and pnpm/Yarn cooldown drift; current-head watch evidence and ITO-57 May 18 Linear evidence updates are current | repeat advisory/source refresh and Linear sync after each significant supply-chain batch |
+
+## Top Actions
+
+- `naming-and-plugin-publication`: real tag/push, marketplace submission, and final channel choice remain approval-gated
+- `release-notes-and-notifications`: final live release/npm/plugin/billing URLs and publish approval still pending
+- `agentshield-enterprise-iteration`: deepen live operator approval/readback after Marketplace/payment gates
+- `ecc-tools-next-level`: create or verify Marketplace-managed Pro target billing-state with webhook provenance, configure the target account and INTERNAL_API_SECRET, then rerun target readback and the live announcement gate
+
+## Next Work Order
+
+1. Regenerate this dashboard from the final release commit before publication evidence is recorded.
+2. Repeat ITO-57 Linear/project status sync after the next significant merge batch or advisory-source refresh.
+3. Create or verify Marketplace-managed Pro target billing-state with webhook provenance, configure the target account and INTERNAL_API_SECRET, then rerun target readback and the live announcement gate before publishing native-payments copy.
+4. Resume ITO-45, ITO-46, and ITO-56 only after the generated dashboard and final release gates are refreshed.

package/resources/local/ecc/docs/releases/2.0.0-rc.1/owner-queue-cleanup-2026-05-18.md

@@ -0,0 +1,65 @@
+# Owner-Wide Queue Cleanup - 2026-05-18
+
+This note records the live GitHub queue cleanup outside the five ECC release
+repos tracked by `scripts/platform-audit.js`.
+
+## Commands
+
+```bash
+gh search prs --owner affaan-m --state open --json repository,number,title,url,author,updatedAt --limit 100
+gh search issues --owner affaan-m --state open --json repository,number,title,url,updatedAt --limit 100
+```
+
+## Result
+
+- Owner-wide open PRs after cleanup: 0.
+- Owner-wide open issues after cleanup: 0.
+- Stale dependency-bot PRs closed: 24.
+- Stale legacy payments/0EM roadmap issues closed: 72.
+- Final stale/generated/manual-review PRs closed: 9.
+- Final legacy/outreach/placeholder issues closed: 5.
+- Archived repos temporarily unarchived for stale dependency PR closure and
+  restored to archived state:
+  `affaan-m/stoictradingAI`, `affaan-m/dprc-autotrader-v2`,
+  `affaan-m/polycule-secure`, and `affaan-m/pragmAItism_defAInce`.
+- The final archived-repo sweep temporarily unarchived and restored
+  `affaan-m/dprc-autotrader-v2` and `affaan-m/stoictradingAI`.
+
+## Final PR Disposition
+
+- `affaan-m/dprc-autotrader-v2#5`: closed stale generated ECC bundle with
+  failing checks and dependency-update base.
+- `affaan-m/x-algorithm-score#2`: closed stale/conflicting external feature
+  PR with accidental local AI-tool directories noted in the PR body.
+- `affaan-m/dexploy#28`: closed stale generated ECC skill PR with requested
+  changes.
+- `affaan-m/zenith#5`: closed stale generated ECC skill PR.
+- `affaan-m/zenith#4`: closed test/noise PR whose diff only added a
+  non-actionable script comment.
+- `affaan-m/affaan-m#1`: closed stale/conflicting third-party README-card PR.
+- `affaan-m/affaanmustafa.com#1`: closed stale Cloudflare Worker-name PR with
+  requested changes.
+- `affaan-m/0em-payments-dashboard#11`: closed stale/conflicting Cloudflare
+  Worker-name PR.
+- `affaan-m/0em-payments-dashboard#3`: closed stale/conflicting Cloudflare
+  Worker-name PR.
+
+## Final Issue Disposition
+
+- `affaan-m/dprc-autotrader-v2#3`: closed public integration pitch as not
+  planned for the archived repo.
+- `affaan-m/stoictradingAI#20`: closed public outreach question as not planned
+  for the archived repo.
+- `affaan-m/dexploy#27`: closed stale internal skill-creator test issue.
+- `affaan-m/dexploy#25`: preserved useful deployment/localStorage and
+  Cloudflare findings in Linear `ITO-62`, then closed the stale GitHub issue.
+- `affaan-m/telegram-mcp-ts#1`: closed stale empty placeholder issue.
+
+## Disposition
+
+The closed dependency PRs were stale generated version bumps and should be
+regenerated from current bases if still needed. The closed generated ECC bundle
+PRs should be regenerated from the current ECC Tools flow if those repositories
+become active again. The closed legacy payments/0EM issues were old planning
+items superseded by the ECC Tools native-payments, hosted analysis,
+billing-readback, and Linear/project roadmap lanes.