chore: sync private v5.4.0 (65d20e0)

.cursor-plugin/plugin.json

@@ -15,7 +15,7 @@
     "anti-slop"
   ],
   "license": "PolyForm-Noncommercial-1.0.0",
-  "version": "5.3.0",
+  "version": "5.4.0",
   "homepage": "https://github.com/agent-kit-startup/agent-kit",
   "repository": "https://github.com/agent-kit-startup/agent-kit",
   "logo": "dashboard/logo-marketplace.svg",

.cursor/agent-kit.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "version": "5.3.0",
+  "version": "5.4.0",
   "protected": [
     ".cursor/HANDOFF.md",
     ".cursor/agents/test-suites.md",

.cursor/agents/clickup-tasks.md

@@ -10,8 +10,8 @@ rules:
 
 # ClickUp — Tasks and conventions
 
-- Always follow conventions from the rule [cursor-skills-clickup.mdc](.cursor/rules/cursor-skills-clickup.mdc).
-- Use the skill [clickup/SKILL.md](.cursor/skills/community/clickup/SKILL.md) for detailed process, examples and checklist.
+- Always follow conventions from the rule [cursor-skills-clickup.mdc](../rules/cursor-skills-clickup.mdc).
+- Use the skill [clickup/SKILL.md](../skills/community/clickup/SKILL.md) for detailed process, examples and checklist.
 
 ## When creating or updating tasks
 
@@ -31,4 +31,4 @@ rules:
 
 - After `git staging`: update status of related task(s) to **staging**.
 - After `git prod`: update status to **complete** on delivered task(s).
-- Details in [autogit/gitupdate.md](autogit/gitupdate.md) step 10.5.
+- Details in [autogit/gitupdate.md](../../autogit/gitupdate.md) step 10.5.

.cursor/agents/docs-repo.md

@@ -27,7 +27,7 @@ Documentation belongs to the **project**: professional, inheritable, without peo
 
 ## References
 
-- [README.md](README.md)
+- [README.md](../../README.md)
 - Rule: `.cursor/rules/docs-professional-standard.mdc`
 
 ## Plan-monitor skim

.cursor/agents/git-autogit.md

@@ -15,6 +15,6 @@ rules:
 - **git prod:** approved staging → `origin/main`.
 - After each promote: update `.cursor/HANDOFF.md`; if applicable, memory-loop WRITE.
 - Messages: Conventional Commits (`feat:`, `fix:`, `docs:`, `chore:`, etc.).
-- Details: [autogit/gitupdate.md](autogit/gitupdate.md). Rule: [cursor-skills-git-workflow.mdc](.cursor/rules/cursor-skills-git-workflow.mdc).
+- Details: [autogit/gitupdate.md](../../autogit/gitupdate.md). Rule: [cursor-skills-git-workflow.mdc](../rules/cursor-skills-git-workflow.mdc).
 - Commands: `/git-staging`, `/git-prod`.
 - **Plan-monitor skim:** before promote, warn on dirty untracked `plan-monitor-*.md` and stage memory files add-by-name only. Advisory mention of Blocking untriaged monitors on `/git-prod` is allowed; never steal prod HITL.

.cursor/agents/mission-kit-comms.md

@@ -28,7 +28,7 @@ Follow skill `registry/skills/community/mission-kit-comms/SKILL.md` (factory ove
 
 - HTTP post, webhook, or `gh` issue comment that is marketing without Ask.
 - Put tokens, webhooks, or cookies in files that can be committed.
-- Claim product behavior that is not in CHANGELOG 5.0.0 / getting-started / five-layer matrix.
+- Claim product behavior that is not in the newest closed CHANGELOG version / getting-started / five-layer matrix.
 
 ## Naming
 

.cursor/agents/n8n-workflows.md

@@ -13,4 +13,4 @@ rules:
 
 - Structure: nodes, connections, credentials; webhook → Switch/IF → Execute Workflow → Respond Webhook.
 - Document changes in docs/context/ or docs/n8n-manual-update-*.md when not re-importing.
-- Rules: [cursor-skills-n8n.mdc](.cursor/rules/cursor-skills-n8n.mdc), [cursor-skills-json.mdc](.cursor/rules/cursor-skills-json.mdc).
+- Rules: [cursor-skills-n8n.mdc](../rules/cursor-skills-n8n.mdc), [cursor-skills-json.mdc](../rules/cursor-skills-json.mdc).

.cursor/agents/prompts-agents.md

@@ -13,4 +13,4 @@ rules:
 - Follow reference model (e.g.: modelo-guest.md) for new prompts.
 - Naming: prompt-{name}-{context}.md or prompt-principal.md; versioning V1/V2 in subfolders.
 - .system/.user pairs when applicable.
-- Project rule: [cursor-skills-prompts.mdc](.cursor/rules/cursor-skills-prompts.mdc).
+- Project rule: [cursor-skills-prompts.mdc](../rules/cursor-skills-prompts.mdc).

.cursor/agents/sql-schema.md

@@ -12,4 +12,4 @@ rules:
 
 - Table scripts: e.g. 001_create_tables.sql, 002_indexes_constraints.sql.
 - DDL in dedicated folders (db/, scripts/, code/) as per project.
-- Conventions: snake_case, IF NOT EXISTS, UUID, TIMESTAMPTZ, COMMENT ON. Rule: [cursor-skills-sql.mdc](.cursor/rules/cursor-skills-sql.mdc).
+- Conventions: snake_case, IF NOT EXISTS, UUID, TIMESTAMPTZ, COMMENT ON. Rule: [cursor-skills-sql.mdc](../rules/cursor-skills-sql.mdc).

.cursor/scripts/comms-draft.mjs

@@ -5,14 +5,13 @@
  *   node .cursor/scripts/comms-draft.mjs --kind recap --channel x
  *   node .cursor/scripts/comms-draft.mjs --publish   # always exits 2
  */
-import { mkdirSync, readFileSync, writeFileSync, existsSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const KINDS = new Set(["recap", "release", "contributor-ask"]);
 const CHANNELS = new Set(["x", "medium", "substack", "hn", "github", "site"]);
-const PUBLISH_REFUSE =
-  "publish refused: comms-draft never posts; operator Ask then human publish";
+const PUBLISH_REFUSE = "publish refused: comms-draft never posts; operator Ask then human publish";
 
 export function utcDay(d = new Date()) {
   return d.toISOString().slice(0, 10);
@@ -67,7 +66,8 @@ export function renderDraft(opts, day) {
   const bodies = {
     recap: `Mission Kit recap (${day})\n\nShipped this cycle: fill from CHANGELOG [Unreleased] that is already in staging.\n\nInstall: npx @dadado/agent-kit-cli@${version} install\nSite: https://missionkit.io\nHITL: production still needs a human yes.\n`,
     release: `Mission Kit ${version} / Agent Kit CLI @${version}\n\nnpx @dadado/agent-kit-cli@${version} install\nhttps://missionkit.io\nPolyForm Noncommercial; commercial: sales@missionkit.io\n`,
-    "contributor-ask": `Help Mission Kit: skills under registry/skills/community/, or agent-kit contribute from a consumer project.\nIssues: https://github.com/agent-kit-startup/agent-kit\nDo not use public issues for vulnerabilities (SECURITY.md).\nCursor Marketplace submit is not this ask.\n`,
+    "contributor-ask":
+      "Help Mission Kit: skills under registry/skills/community/, or agent-kit contribute from a consumer project.\nIssues: https://github.com/agent-kit-startup/agent-kit\nDo not use public issues for vulnerabilities (SECURITY.md).\nCursor Marketplace submit is not this ask.\n",
   };
   const body = redactSecrets(bodies[opts.kind]);
   return {

.cursor/scripts/plan-external-review-progress-gate.test.mjs

@@ -145,9 +145,13 @@ test("heartbeat lines keep status prefixes; suffix is empty under CI", () => {
   assert.match(src, /Try agent-kit doctor for repository readiness\./);
   const fn = extractSuffix();
   assert.match(fn, /audit_kit_suffix/);
-  const result = spawnSync("bash", ["-c", `${fn}\nexport CI=1\nprintf '[%s]' "$(audit_kit_suffix 20)"`], {
-    encoding: "utf8",
-  });
+  const result = spawnSync(
+    "bash",
+    ["-c", `${fn}\nexport CI=1\nprintf '[%s]' "$(audit_kit_suffix 20)"`],
+    {
+      encoding: "utf8",
+    },
+  );
   assert.strictEqual(result.status ?? 1, 0, result.stderr);
   assert.strictEqual(result.stdout, "[]");
 });

.cursor/skills/community/clickup/SKILL.md

@@ -7,7 +7,7 @@ category: pm
 
 # ClickUp - Task management (optional stack)
 
-**Not part of the Core Pack.** Install/use only when the repository integrates ClickUp. Aligned with rule [cursor-skills-clickup.mdc](.cursor/rules/cursor-skills-clickup.mdc) (`alwaysApply: false`).
+**Not part of the Core Pack.** Install/use only when the repository integrates ClickUp. Aligned with rule `.cursor/rules/cursor-skills-clickup.mdc` (`alwaysApply: false`).
 
 ## When to Use
 

.cursor/skills/community/mission-kit-comms/SKILL.md

@@ -26,7 +26,7 @@ Thin reuse: short blocks and one ask per message from sibling skill `ux-message-
 - `docs/public-launch-announcement.md`
 - Channel map: `docs/comms-channel-map.md`
 - Calendar: `docs/comms-content-calendar.md`
-- Product version floor: **5.0.0**. Do not write 4.x as current.
+- Product version floor: **5.0.0**; current release is the newest closed `CHANGELOG.md` version (5.3.0 as of 2026-08-15). Do not write 4.x as current.
 
 Forbidden in drafts: full autonomy without HITL; Cursor Marketplace "listed" unless the parked submit plan has actually listed; npm/CLI renamed to Mission Kit; silent posting.
 

.cursor/skills/community/n8n-workflows/checklist-n8n.md

@@ -0,0 +1,47 @@
+# Checklist: n8n/JSON Change
+
+## Identification
+- **Workflow:** [name]
+- **File:** [path]
+- **Change type:** [new|edit|delete]
+
+## Pre-change
+- [ ] Backup created in `.cursor/context/backups/`
+- [ ] Current JSON is valid
+- [ ] I understand the current structure
+
+## n8n Structure
+- [ ] Webhook has responseMode: "responseNode" when used with Respond Webhook
+- [ ] All branches end in Respond Webhook (or NoOp if not responding)
+- [ ] Node IDs are unique and follow kebab-case pattern
+
+## Connections
+- [ ] All connections point to existing nodes
+- [ ] No orphaned nodes (without input and output, except Webhook and Respond)
+- [ ] Execute Workflow has workflowId filled (not empty)
+
+## Credentials
+- [ ] Credentials referenced by id (not hardcoded)
+- [ ] No secrets in JSON (search for: password, token, key, secret)
+- [ ] Document required credentials in README
+
+## Change
+- [ ] Added/edited nodes are correct
+- [ ] Connections are correct (from → to)
+- [ ] $json references point to correct node in the chain
+- [ ] $('NodeName') uses exact name (case-sensitive)
+- [ ] Postgres nodes with RETURNING when data is used later
+
+## Validation
+- [ ] JSON is valid after change
+- [ ] n8n-checker script passes without errors: `node .cursor/hooks/lib/n8n-checker.js <file>`
+- [ ] No hardcoded secrets
+
+## Documentation
+- [ ] README updated (if necessary)
+- [ ] docs/n8n-manual-update-*.md created (if manual change)
+
+## Testing
+- [ ] Workflow tested in n8n (import and execute)
+- [ ] Main flow works
+- [ ] Errors handled correctly

.github/workflows/ci.yml

@@ -1,8 +1,11 @@
 name: CI
 
 on:
+  # Branch pushes are covered by pull_request; listing "**" here as well ran the
+  # whole build twice for every PR push. Keep the direct pushes that have no PR
+  # of their own: the two long-lived branches and release tags.
   push:
-    branches: ["**"]
+    branches: [main, staging]
     tags: ["v*"]
   pull_request:
   workflow_dispatch:
@@ -12,6 +15,11 @@ on:
         type: boolean
         default: false
 
+# Superseded PR runs are cancelled; main, staging and tag runs always finish.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -61,6 +69,12 @@ jobs:
       - name: Test
         run: pnpm test
 
+      # Build before the guard steps: test:root-node includes the session-start
+      # hook diagnostic, which asserts the hook resolves the CLI via
+      # packages/cli/dist instead of falling back to degraded mode.
+      - name: Build
+        run: pnpm build
+
       # Private-origin allowlist (SoT: agent-kit-startup/agent-kit-dev).
       # Fail-safe: forks / renames / second mirrors skip private-only steps.
       # Adding another allowlisted step requires updating the exact-count pin in
@@ -85,6 +99,9 @@ jobs:
           pnpm evidence:codebase-findings:check
           pnpm evidence:risk-hotspots:check
           pnpm evidence:knowledge-classification:check
+          # Guards that shipped with tests but no runner until the 10-cycle audit.
+          pnpm check:guidance-claims
+          pnpm check:memory-index
           pnpm landing:build
           pnpm landing:build:check
           # Test files for root node --test suites. Scan scripts already run
@@ -101,8 +118,6 @@ jobs:
             exit 1
           fi
 
-      - name: Build
-        run: pnpm build
 
   # ── Sync to public mirror (tag or manual trigger) ──
   # Secret PUBLIC_REPO_TOKEN: fine-grained token with public repo Contents,

CHANGELOG.md

@@ -8,6 +8,30 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and
 
 ## [Unreleased]
 
+## [5.4.0] - 2026-08-15
+
+### Changed
+
+- CI no longer runs the entire build twice per pull-request push. `push: branches ["**"]` overlapped `pull_request` completely; pushes now trigger on `main`, `staging` and `v*` tags, where there is no PR to cover them. Superseded **PR** runs are cancelled by a concurrency group; `main`, `staging` and tag runs always finish. Both properties are pinned by tests.
+- CI builds before its guard steps. `test:root-node` includes the session-start hook diagnostic, which asserts the hook resolves the CLI through `packages/cli/dist` instead of reporting degraded mode; with `Build` ordered last, that suite could only pass on a machine that had already built. A pin test now holds the order.
+- Ten root test suites that no command ran are now in `test:root-node`, which CI executes: the plan-external-review atomic-wait / backend-cascade / model-routing suites, `comms-draft`, `check-guidance-stale-claims`, `validate-memory-index`, `hook-session-start-diagnostic`, `orchestration-defects-regression`, `sync-landing` and `sync-public-guards`. 46 root tests become 87. The two guards that had tests but no runner - `check:guidance-claims` and `check:memory-index` - are npm scripts now and run inside CI's Evidence checks.
+- `docs/DEVELOPMENT.md` gains a repository-layout table for the root artifacts that read as leftovers but are not: `cursor-handoff`, the install contracts, the registry authoring docs, `skills-registry.json`, `HANDOFF.md.example`, `autogit/`, `_legacy/`, `dogfood/`. Each is path-stable for a reason (public-sync manifest entries, raw-URL install links, inbound references), which is why they stay at the root.
+- `dashboard/README.md` documents the Mission Control runtime layout and, explicitly, why its tests live in `packages/cli/src/dashboard/` - the CLI package owns the workspace's only test runner and imports the `.mjs` files directly, so there is one implementation under test rather than a copy.
+- `docs/evidence/README.md` states, per artifact, which generator produces it, whether it reproduces off the generating machine, and whether CI enforces it. `evidence:file-ledger:check` is documented as a local replay tool rather than a gate - its census covers the working tree, stashes and ignored-operational files, so it cannot pass on another checkout - and its failure message now says so instead of reading like a stale artifact.
+- New `check:markdown-links` guard (`scripts/check-markdown-links.mjs`, wired into `test:root-node`, so CI's Evidence checks enforce it): every relative markdown link in the tracked surface must resolve, with template placeholders (`{plan-slug}`) explicitly excluded. 234 files scanned.
+- `pnpm lint` now covers the half of the repository Biome never saw: `dashboard/**`, `scripts/**` and `.cursor/scripts/**` are checked before `turbo run lint` fans out to the workspace packages. Previously the only `lint` task in the graph was `packages/cli`'s `biome check src`, so 56 root-level files - including the Mission Control runtime and the evidence generators - were exempt from the same gate that CI and `/git-staging` present as repo-wide.
+
+### Fixed
+
+- `landing:vendor` reports the real failure. The React/ReactDOM download had no status check and no timeout, so a CDN 404 or 500 was hashed as if it were the library and surfaced as a confusing "SRI mismatch"; a hung connection had no bound at all. It now fails with the HTTP status and aborts after 30s.
+- `sync-public` no longer shells out to `sleep(1)` between poll attempts - a POSIX-only dependency in the publication path. The synchronous wait uses `Atomics.wait` on a zeroed buffer instead.
+- De-flake the dashboard auth-exemption test. Its readiness loop slept only when `fetch` threw, so a non-ready status spun the event loop the spawned `serve.mjs` needed to finish booting, and an accepted-but-unanswered connection could consume the entire budget because no attempt was bounded. Each attempt now carries a 2s `AbortSignal.timeout`, every iteration is spaced, an early child exit fails immediately with its stderr instead of waiting for the test timeout, and the budget is 20s inside a 60s test.
+- `agent-kit contribute` carries a skill's companion files upstream. `buildRegistryPathMap` mapped only `SKILL.md`, and the path guess accepted only paths ending in `/SKILL.md`, so a consumer that added a checklist or a `references/` file to a skill contributed the entry point and silently dropped the rest. Both now treat a skill as the directory it is; the legacy flat layout still maps to `community`.
+- Skill companion files reach the consumer. `agent-kit add`, pack install, L0 sync and `agent-kit diff` enumerated `SKILL.md` and nothing else, so a skill that ships a checklist or a `references/` folder arrived with dead links in every installed tree. Install and diff now share one `skillFileTargets()` enumerator (recursive, `SKILL.md` first, hidden files skipped, and a missing directory still yields the old single pair), so the whole skill lands.
+- Derived guidance no longer pins a superseded release. `.cursor/project-context.md` recorded product version 5.2.1 and lane SHAs frozen at 2026-07-31 while the tree shipped 5.3.0; comms surfaces (`docs/comms*.md`, the `mission-kit-comms` skill and agent), `docs/cursor-update-awareness.md` and `install.md` restated 5.0.0 / 5.2.x as the current release. Where the number was load-bearing it is now dated and paired with the surface to read it from (`CHANGELOG.md`, npm `dist-tags`, `.cursor-plugin/plugin.json`); `docs/npm-publish-checklist.md` drops its 5.0.0-era "today" snapshots for the commands that answer the question at run time.
+- Dead relative links across the tracked markdown surface: `.cursor/agents/**` pointed at `.cursor/rules/*.mdc`, `autogit/gitupdate.md` and `README.md` as if it were reading from the repository root, `docs/capability-inventory.md` prefixed its own siblings with `docs/`, and `autogit/plan-routine.md` did the same. References to private trees (`.cursor/memory/**`) are now inline paths rather than links, since those paths never reach the public sync. `.cursor/skills/community/n8n-workflows/` regained the `checklist-n8n.md` its `SKILL.md` links to.
+- Clear the 16 Biome violations that scope gap had been hiding: formatting in `dashboard/lib/triage-heading.mjs`, `scripts/validate-memory-index*.mjs`, `scripts/git-hooks-pre-commit-composed.test.mjs`, `.cursor/scripts/comms-draft.mjs` and `.cursor/scripts/plan-external-review-progress-gate.test.mjs`; `resolveSnapshotRepoRoot` no longer declares a defaulted parameter before a required one (the `undefined` env still falls back to `process.env`, matching `guards.d.mts`); `indexLinkTargets` uses `matchAll` instead of an assignment-in-condition loop; the session-start hook diagnostic builds its env by destructuring instead of `delete`.
+
 ## [5.3.0] - 2026-08-15
 
 ### Added
@@ -800,7 +824,7 @@ Follows 4.5.1. Version 4.6.0 was withdrawn after release because it carried an u
 - Mission Control terminal list shows capped `lastOutput` previews from the snapshot payload
 - Mission Control Processes section: Copy PID CTA per process row (no kill/restart)
 - Mission Control Git section: bounded dirty `files[]` from `git status --short` (paths only), status badges, and copy-to-clipboard staged/unstaged `git diff` commands per file
-- Error memory entry: public sync PR merge-blocked by ruleset and merge-commit method ([public-sync-pr-merge-blocked-ruleset](errors/2026-07-24_public-sync-pr-merge-blocked-ruleset.md))
+- Error memory entry: public sync PR merge-blocked by ruleset and merge-commit method (`.cursor/memory/errors/2026-07-24_public-sync-pr-merge-blocked-ruleset.md`, private)
 - Decision record: Mission Control local-only security posture (`.cursor/memory/decisions/2026-07-24_mission-control-local-only-security.md`)
 - Repository personalization profile (`.cursor/context/personalization.json`, `.cursor/project-context.md`, `AGENTS.md`) with matching manifest packs and protected paths in `.cursor/agent-kit.json`
 - `docs-repo` core skill and `cursor-skills-node` community skill