chore: sync private v5.6.0 (3c7fb1a)

[agent-kit-startup]

Summary

• Automated allowlist sync from the private source of truth.
• Release v5.6.0.
• Head branch sync/v5.6.0-3c7fb1a.

Release notes

Added

• Mission Kit landing gains a staging.missionkit.io hop before every production deploy: pnpm landing:deploy:staging (per-file upload into a staging/ subdomain directory, never the production root), pnpm landing:verify:staging (headless-Chrome acceptance gate, reused as scripts/verify-landing.mjs --url <any URL>), and a Phase-3 HITL gate (operator compares staging against the Claude Design canvas) before pnpm landing:promote re-deploys the exact staging-validated dist/ bytes to missionkit.io — never rebuilding — with pnpm landing:rollback [release] restoring a prior archived production artifact in one command. New scripts/lib/hostinger.mjs reimplements the Hostinger REST calls the prior interactive-MCP deploy used, standalone (zero new dependencies). Staging noindex ships as a generated staging/.htaccess + robots.txt, not a dist/ toggle, so promote's identical-bytes invariant can't accidentally noindex production. Live-verified in production 2026-08-23: staged, operator-approved, and promoted to missionkit.io for real, byte-identical DOM confirmed on both hosts. Plan missionkit-staging-promote.
• scripts/build-landing.mjs gains a build-time changelog box injector: it reads CHANGELOG.md's latest public-facing (non-[Unreleased]) release entry and injects a plain-text (markdown decoration stripped, not converted — so truncation can never leak an unclosed token), HTML-escaped preview into a canvas-provided <div data-changelog-content></div> container. The container does not exist in the current Mission Kit Landing canvas export yet, so this step currently no-ops with a logged warning; it is the repo-side half of replacing the Footer CTA's terminal-typer animation with a real changelog box. Canvas-side change (plus the hero eyebrow → live Mission Kit release badge, scoped to the one authorized img.shields.io live-request exception) is a pending hand-off: .cursor/context/landing-missionkit/UPSTREAM-DESIGN-FIX-PROMPT-badge-changelog.md. Confirmed edit route (this account has no owned/shared write access to that canvas) and the scoped self-containment exception are recorded in ADR 2026-08-05_landing-external-design-source-of-record.md (2026-08-22 addendum). Plan landing-eyebrow-live-badge-and-changelog-box.
• registry/registry.json's L0 section is now generated from code (packages/cli/src/lifecycle/l0.ts's L0_ARTIFACTS) on every scripts/build-registry.mjs run, instead of hand-curated — reviving the abandoned archive/l0-generate-from-code tag against the current pipeline. New scripts/derive-l0-artifacts.ts + scripts/emit-l0-artifacts.mjs (via pnpm --filter @dadado/agent-kit-cli exec tsx, since tsx isn't hoisted to the repo root). Verified idempotent (two consecutive rebuilds produce zero diff) and non-regressive on hand-curated L2 entries (readCuratedArtifacts narrowed to layer === "L2" only — L0 no longer needs preserving-by-hand). Closed two real drift gaps surfaced along the way: dashboard-broadcast/update commands added to L0_ARTIFACTS (existed on disk, were never declared), and install.md's Port B table reconciled to match. l0.test.ts deliberately keeps its portable "legacy onboard absent" assert rather than a strict registryL0Paths === canonicalSources equality — private-repo parity is already enforced by CI's repo-gated "Registry catalog parity" step, and the public mirror independently owns registry/**, so a second unconditional test-level assert would reintroduce the public-CI break errors/2026-07-24_public-sync-ci-test-portability.md already paid down twice. Plan l0-generate-from-code-revival.
• Public storefront README gets the visual identity it never had: a shields badge row (npm version, PolyForm NC license, Node >=20, public Release Latest — no CI badge, the public mirror pipeline skips factory tests), a helmet hero (dashboard/logo.svg, visual-kit palette) plus the CLI's 9-line HELMET_ASCII as a monochrome fenced block, a curated 2×2 Mission Control screenshot gallery (assets/production/*.png, newly synced), and a GitHub social preview asset (dashboard/social-preview.svg/.png, 1280×640, helmet on the #0b0e14 plate per the marketplace logo spec) with an apply checklist in docs/github-about.md. packages/cli/README.md (the actual npm storefront) gets minimal badge/hero parity. Plan readme-public-hero-badges.
• DeepSeek Harness (dsh) modernization study, docs-only: ADR 2026-08-22_deepseek-harness-reject-adapt-concepts-docs.md ranks 12 deepseek-harness concepts against Agent Kit surfaces (/run-plan tick contract, Task worker dispatch, HITL Ask questions, memory-loop) — 6 reject, 4 already covered kit-native, 1 adapt-concepts (docs-awareness only: a durable per-step replayable event log is a real gap but stays unadopted to avoid a second state system alongside markdown HANDOFF/memory), 1 thin-adapter note (a second, unrelated ACP surface). No dsh/Cordis dependency, no plugin-composition runtime, no relaxation of sequential one-Task-per-plan dispatch. No incorporation/modernization work ships from this study; any uptake of the two non-reject items is deferred to a separately-scoped future plan. Plan deepseek-harness-modernization-study (Phase 0/1; Phase 2 is this changelog closeout).

Fixed

• Audits monitor_wants_advisor() (.cursor/scripts/plan-external-review.sh:1734) used an unanchored grep -qF substring match on the <!-- audits-advisor-escalate --> sentinel, so any prose mention of it — including a negation like "no <!-- audits-advisor-escalate --> needed" — false-positived and re-spawned a costly Opus advisor pass on every future audit run touching that monitor. Now anchored to a standalone HTML-comment line (grep -qE '^[[:space:]]*<!-- audits-advisor-escalate -->[[:space:]]*$'), matching the prompt template's own "exactly one HTML comment line" contract. Verified against both known false positives (plan-monitor-audits-atomic-wait-reviewer-fallback.md, plan-monitor-deepseek-harness-modernization-study.md:79), which no longer match; a genuine standalone sentinel line still triggers escalation. Regression test added (plan-external-review-model-routing.test.mjs). Found by an Opus advisor pass during the 2026-08-22 deepseek-harness-modernization-study audit; done-marker suppression (Phase 2) considered and skipped as unsafe — see plan body. Plan audits-advisor-escalate-sentinel-anchor-fix.
• scripts/deploy-landing-staging.mjs's DNS-record step raced Hostinger's own auto-provisioning: creating a new subdomain already auto-adds an ALIAS record for it, but the script immediately re-checked the zone and, seeing it not yet propagated, tried to add a conflicting CNAME — a real HTTP 422 (RRset ... IN ALIAS must not be used with CNAME on the same name) on the first live production run. Now skips the explicit DNS step entirely when this run just created the subdomain; only checks/adds on the branch where the subdomain already existed. Found live 2026-08-23, plan missionkit-staging-promote.
• check-public-deny-links.mjs failed closed only on an explicit manifest !exclude; a README/docs link into a path the manifest never mentions at all (neither included nor excluded) passed silently and 404'd on the public mirror. Now checks isPublicSyncedPath directly, so "absent from the manifest" fails too. Also fixes two by-products of the stricter check rather than suppressing them: template {placeholder} interpolations (isPlaceholderTarget, matching the existing check-markdown-links.mjs convention) and a real folder link in a .mdc rule file whose trailing-slash target needs restoring before it matches the git-hooks/** glob. Broad Intake 2026-08-16 error finding, plan readme-public-hero-badges.
• sync-public.mjs's content-denylist scan read every synced file via readFileSync(path, "utf8") and relied on a try/catch to skip binaries — but that read never throws on binary bytes in Node, so the intended binary exemption never actually applied. Latent since the manifest never included a binary file before; surfaced as a false positive (a private-client-name denylist term coincidentally present in a screenshot's compressed PNG bytes) the moment assets/production/*.png was added. Fixed with a real binary check (NUL byte in the first 8000 bytes, the same heuristic git/grep -I use) ahead of the UTF-8 decode + regex scan.

Source

• Commit: 3c7fb1a
• Head branch: sync/v5.6.0-3c7fb1a