merge origin/main

2026-06-18 15:54:13 +08:00 · 2026-05-20 10:22:42 +02:00
parent ebfbcac2bf 1e8c7e7994
commit e6c2da7ae4
100 changed files with 7122 additions and 540 deletions
@@ -12,18 +12,124 @@ execution truth is split across:
 - merged PR evidence;
 - handoffs under `~/.cluster-swarm/handoffs/`.

+The May 19 release/growth execution map lives at
+[`docs/releases/2.0.0/ecc-2-hypergrowth-release-command-center.md`](releases/2.0.0/ecc-2-hypergrowth-release-command-center.md).
+It is the operator surface for the final ECC 2.0 repo identity, video suite,
+partner/sponsor funnel, consulting/talk funnel, and social launch plan.
+
+## 2026-05-20 Delta
+
+- The tracked platform audit is still green on May 20 with 0 open PRs,
+  0 open issues, 0 discussion maintainer-touch gaps, 0 answerable Q&A gaps,
+  0 conflicting PRs, and 0 blocking dirty files across `affaan-m/ECC`,
+  `affaan-m/agentshield`, `affaan-m/JARVIS`, `ECC-Tools/ECC-Tools`, and
+  `ECC-Tools/ECC-website`.
+- The new #2015 setup-location Q&A was answered and marked accepted. The
+  answer keeps install guidance conservative: do not install into `C:\`; use a
+  normal workspace, install the `ecc@ecc` Claude plugin once, copy only needed
+  rule folders when using manual rules, and avoid stacking plugin plus full
+  manual install.
+- ECC-Tools PRs #80-#88 landed the next hosted-platform batch: runtime
+  receipts now require failure reasons; AgentShield fleet approval IDs survive
+  hosted security review and render into comments/check-runs; Linear follow-up
+  sync reuses deterministic external IDs; hosted AgentShield remediation items
+  sync to Linear; hosted job observability events are emitted for queued,
+  completed, blocked, failed, and budget-blocked states; and both hosted job
+  status comments and hosted depth-plan check-runs read back recent
+  observability/budget events. PR #88 adds the authenticated observability API
+  readback for operator dashboards and production smoke tests.
+- AgentShield PR #94 landed the next cross-harness adapter slice: Zed and
+  VS Code are first-class adapter detections, `.zed/settings.json` and
+  `.zed/tasks.json` are discoverable scan inputs, and `.zed/setup.mjs` now
+  trips the same AI-tool persistence IOC rule as `.vscode/setup.mjs`.
+- AgentShield PR #95 cleared the remaining default-branch Dependabot alert by
+  moving transitive `brace-expansion` 5.x lockfile entries to `5.0.6`; the
+  post-merge Dependabot open-alert API now returns `[]`, and local
+  `npm audit --audit-level=moderate` returns 0 vulnerabilities.
+- ECC PR #2019 merged the Marketplace Pro selected-target release-gate sync
+  into this repo as `30f60710d4e0424fc70d9bbdc105009db141d9d8`. The post-merge
+  main CI run `26135974576` completed green across lint, coverage, security,
+  validation, and the full OS/package-manager matrix.
+- ECC PR #2020 merged the selected-target announcement-gate mirror as
+  `c2471fe5c535310f8a8008c9ed7ea9f6757b33f2`. The post-merge main CI run
+  `26136949698` completed green across lint, coverage, security, validation,
+  and the full OS/package-manager matrix.
+- ECC-Tools PR #90 added the selected-target official announcement gate for
+  `billing:announcement-gate -- --select-ready-target`; safe production
+  preflight no longer requires a raw GitHub login and now blocks only on the
+  local/internal `INTERNAL_API_SECRET` input before live execution.
+- ECC-Tools PR #91 added `--env-file` support to both billing gate scripts so
+  ignored local operator credential files can supply `INTERNAL_API_SECRET`,
+  Cloudflare auth, Wrangler auth mode, or target fallbacks without printing
+  secret contents. Verify, Security Audit, and Workers Builds passed before
+  merge as `72119a1`, and main CI run `26137280847` completed successfully after
+  merge.
+- ECC-Tools PR #92 added a non-breaking `INTERNAL_OPERATOR_API_SECRET` bearer
+  accepted by privileged internal API routes without rotating the existing
+  `INTERNAL_API_SECRET`; Verify, Security Audit, and Workers Builds passed
+  before merge as `18d80197be779619283e0b37e2952bac53819a07`, and the merged
+  Worker was deployed to `api.ecc.tools`.
+- The May 20 live native-payments gate now passes: the vault-backed Wrangler
+  readback selected a ready Marketplace Pro target with fingerprint
+  `e953a74209fe`, both key families present, webhook evidence ready, 0 KV
+  blockers, and the official
+  `npm run billing:announcement-gate -- --select-ready-target` returned
+  `announcementGateReady: true`, 0 required actions, 0 blockers, and audit
+  summary 6 pass / 1 warn / 0 fail through the new operator bearer path.
+- ECC-Tools PR #93 recorded that live billing evidence in the app launch
+  checklist and distribution roadmap as
+  `d3d62df83fa075660fa4530c3e0edc311a4355fe`; public native-payments copy is no
+  longer blocked by billing evidence, but publication timing remains behind the
+  final release, plugin, live URL, and owner-approval gates.
+- Linear ITO-54 and the ECC Platform Roadmap now have the May 20 ECC-Tools
+  hosted observability update comments
+  `74dcc101-3be5-4173-be13-62b80d54f569` and
+  `348ea8f5-2a2d-46d9-a0fe-ed99653e7fe5`, after earlier PR #84/#85 comments
+  recorded remediation sync and hosted observability events. PR #88 is recorded
+  in Linear comments `291e2a4b-06e3-4672-a057-cdb141478161` and
+  `b2d35de0-ca49-44cb-982a-ddec229e7691`; AgentShield #94 is recorded in
+  ITO-49 comment `faed69dd-35f5-469d-acb5-ddde6a70d6a1` and project comment
+  `70187c1e-d481-4181-b418-09bd65d54b5e`; AgentShield #95 is recorded in
+  ITO-49 comment `371fc3e4-611f-4d20-a23f-67db1260b418`, ITO-57 comment
+  `bd06e252-15c1-4256-b667-caa3f64f5968`, and project comment
+  `22c2c388-2fd1-4dea-a939-6141f40c9a21`.
+- Linear ITO-61 and the ECC Platform Roadmap now have the May 20 Marketplace
+  Pro release-gate comments `467d148a-712a-4777-aad9-95593e9f1739` and
+  `7642ee9c-3107-400c-a229-53e2895a8914`, recording ECC-Tools #89, ECC #2019,
+  the green post-merge CI run, and the remaining internal bearer-token gate.
+  The repo mirror now also records ECC-Tools #90 and #91 as the selected-target
+  announcement gate and billing gate env-file operator-path follow-up.
+
+## 2026-05-19 Delta
+
+- The public repo identity is now `affaan-m/ECC`; release, package, plugin,
+  workflow, and launch-copy surfaces should use that URL for current public
+  links.
+- The late May 19 queue drain added the deterministic `release:approval-gate`
+  on ECC `main`, merged ECC-Tools billing-announcement redaction hardening, and
+  cleared the JARVIS Dependabot/deploy repair tail. The tracked platform audit
+  is now green with 0 open PRs, 0 open issues, and 0 discussion gaps across all
+  five tracked repos, but release/publication actions remain owner and live-URL
+  gated.
+- The ECC 2.0 release story should lead with the product shape directly:
+  harness-native operator system, reusable skills/rules/hooks/MCP conventions,
+  `ecc2/` alpha control plane, Hermes as optional operator shell, and ECC Tools
+  Pro/Sponsors/consulting as the business surface.
+- Copy should avoid presenting this as a repo rename or config-pack migration.
+  The release proof should show the system through install flow, cross-harness
+  demos, security evidence, hosted product evidence, and the video suite.
+
 ## Current Evidence

-As of 2026-05-18:
+As of 2026-05-20:

- GitHub queues are clean across `affaan-m/everything-claude-code`,
+- GitHub queues are clean across `affaan-m/ECC`,
  `affaan-m/agentshield`, `affaan-m/JARVIS`, `ECC-Tools/ECC-Tools`, and
  `ECC-Tools/ECC-website`: the latest `platform-audit` sweep found 0 open PRs,
  0 open issues, 0 discussion maintainer-touch gaps, 0 answerable Q&A missing
-  accepted answers, and 0 blocking dirty files when allowing the unrelated
-  local `docs/drafts/` directory. The May 18 sync also refreshed
-  `scripts/work-items.js sync-github` across all five tracked repos, leaving
-  no open or blocked local work items.
+  accepted answers, and 0 blocking dirty files. The current
+  `scripts/work-items.js list --json` output also reports `totalCount: 0`, so
+  there are no open or blocked local work items in the SQLite bridge.
 - Owner-wide queue cleanup is also inside the requested budget:
  `docs/releases/2.0.0-rc.1/owner-queue-cleanup-2026-05-18.md` records the
  live `gh search` sweep that closed 24 stale dependency-bot PRs and 72 stale
@@ -33,40 +139,90 @@ As of 2026-05-18:
  now at 0 open PRs and 0 open issues by live `gh search`. Archived repos
  touched during closure were restored to archived state.
 - GitHub discussions are current across those tracked repos:
-  `affaan-m/everything-claude-code` has 58 total discussions and 0 without
-  maintainer touch after May 15 maintainer updates on #73 and #1239; AgentShield,
+  `affaan-m/ECC` has 60 total discussions and 0 without
+  maintainer touch after the May 19 #2003 AURA integration proposal was routed
+  as an external-adapter proposal, not core wallet/escrow coupling, and the
+  May 20 #2015 setup-location Q&A was answered and accepted; AgentShield,
  JARVIS, ECC Tools, and the ECC Tools website have discussions disabled or 0
-  total discussions.
+  total discussions. `docs/architecture/discussion-response-playbook.md` now
+  supplies the ITO-59 response categories, public templates, security-escalation
+  path, and readback rules for future discussion batches.
 - The current Linear roadmap contains 16 issue lanes (`ITO-44` through
  `ITO-59`) and five milestones: Security and Access Baseline, ECC 2.0 Preview
  and Publication, AgentShield Enterprise Iteration, ECC Tools Next-Level
  Platform, and Legacy Audit and Salvage.
- Linear live sync is current for the May 18 merge and supply-chain batch:
-  ITO-57 has a new current-head supply-chain protection comment
-  (`0b9931b9-1556-4ebc-a70c-f3635557625d`), and the ECC platform project has
-  a new operator progress comment (`e32e5b7a-287b-4bf4-9ed7-314389a157e1`).
-  Linear project status updates are disabled in this workspace, so the project
-  comment is the supported external status surface.
+- Linear live sync is current for the May 19 PR #2002 merge and discussion
+  batch: the ECC platform project has the post-PR #2002 sync document
+  `ecc-may-19-post-pr-2002-sync-64cef8f668e0`, project comment
+  `a6411e3a-8c8e-4a58-adba-687e77d4c543`, and issue comments on ITO-44,
+  ITO-47, ITO-48, ITO-49, ITO-51, ITO-54, and ITO-56. ITO-47, ITO-48,
+  ITO-49, ITO-51, ITO-54, and ITO-56 were moved to In Progress because those
+  lanes now have current implementation/evidence and remaining gate/readback
+  work. ITO-57 still has the May 18 emergency supply-chain refresh comment
+  (`3fe5b2b7-c4fe-401c-a317-b40d72119cb3`). Linear project status updates are
+  disabled in this workspace, so project documents and comments are the
+  supported external status surface.
 - The latest May 18 merge batch on `main` includes PR #1970 workflow-security
  validator bypass fixes, PR #1971 metrics bridge cost-reporting and warning
  de-dup fixes, PR #1972 `uncloud` skill activation structure, PR #1976
  OpenAI/AstraFlow provider response guards, ECC-Tools Wrangler OAuth billing
  readback mirror evidence, the `04d4d819` defensive-deny IOC scanner hardening
-  recheck, and release evidence with a refreshed operator dashboard.
- `docs/releases/2.0.0-rc.1/publication-evidence-2026-05-18.md` records the
-  May 18 queue-zero state, current-head TanStack/Mini Shai-Hulud protection
-  recheck, no-lifecycle npm install, npm audit/signature checks, AgentShield
-  project `.claude` scan, Linear sync, work-items sync, operator dashboard
-  refresh, PR #1976 provider-guard validation, ECC-Tools Wrangler OAuth billing
-  readback evidence, defensive-deny IOC scanner coverage, and current-head CI
-  success for `04d4d819`; a detached clean-worktree preview-pack smoke from
-  `742bc58d` passed 5/5 with digest `59bbf2630a44`.
- `docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-18.md`
+  recheck, `7911af4a` release OIDC publishing-scope hardening, `97567a91`
+  release workflow line-ending normalization, and release evidence with a
+  refreshed operator dashboard.
+- `docs/releases/2.0.0-rc.1/publication-evidence-2026-05-19.md` records the
+  current May 19 queue-zero state, canonical ECC identity merge, release video
+  suite gate, partner/sponsor/talk outreach pack, owner approval packet
+  (`owner-approval-packet-2026-05-19.md`), current preview-pack smoke digest
+  `eebb8a66c33e`, local 2568-test suite, PR #2001 merge and GitHub Actions run
+  `26102500291` success, PR #2002's owner-approval dashboard gate refresh and
+  GitHub Actions run `26103853507`, PR #2004's Linear readiness evidence sync
+  and GitHub Actions run `26105012698`, plus PR #2005's post-PR #2004
+  evidence refresh and GitHub Actions run `26106321921`, PR #2008's supply-chain
+  evidence gate fix and GitHub Actions run `26108473648`, post-PR #2006 main CI
+  run `26109953093`, and PR #2009's project-registry hygiene GitHub Actions run
+  `26111313938`, post-PR #2009 main CI run `26111946778`, post-PR #2011
+  GateGuard main CI run `26113695068`, and post-PR #2013 release-approval-gate
+  main CI run `26128749863`. The late May 19 sync target also includes
+  ECC-Tools PR #79 billing-announcement redaction hardening and JARVIS PR #15
+  / PR #16 queue/deploy repair, with JARVIS main CI, CodeQL, and Deploy green
+  after the workflow repair. The Linear external project status surface now has
+  both the post-PR #2002 sync document and the late-pass document
+  `ecc-may-19-late-queue-zero-and-release-gate-sync-1c26f65e6b3f`, plus project
+  comment `d42bf0e2-7a8e-4934-9f3f-e281498ee805`. The supply-chain gate now
+  also records the `@types/node@25.7.0` pin and `brace-expansion` lock refresh
+  needed for current npm audit/signature verification.
+- The May 20 ECC-Tools hosted-platform pass extends that evidence with PR #80
+  through PR #88, all merged after green GitHub Verify/Security Audit/Workers
+  Builds checks. Local validation for the final depth-plan observability slice
+  passed the focused hosted depth-plan route test, the full route suite
+  (89/89), typecheck, lint, full ECC-Tools Vitest suite (683/683), and
+  `git diff --check`. PR #88 additionally exposes authenticated hosted
+  observability readback at `/api/analysis/observability` for operator
+  dashboards and production smoke tests; its local verification passed
+  typecheck, lint, the full ECC-Tools Vitest suite (686/686), and
+  `git diff --check`.
+- AgentShield PR #94 adds Zed and VS Code to the first-class adapter registry
+  after local verification with typecheck, lint, the focused core scanner/rule
+  tests, full `npm test` (1822 tests), `npm run build`, and `git diff --check`.
+  GitHub checks passed across GitGuardian, scan suite, self-scan,
+  self-scan examples, Node 18/20/22 CI, CodeRabbit, and Cubic after rerunning a
+  transient GitHub artifact-upload failure.
+- AgentShield PR #95 resolves Dependabot #20 / `GHSA-jxxr-4gwj-5jf2` /
+  `CVE-2026-45149` by updating the vulnerable `brace-expansion` 5.x
+  transitive lockfile entries to `5.0.6`. Local validation passed
+  `npm audit --audit-level=moderate`, typecheck, lint, full `npm test`
+  (1822 tests), build, and whitespace checks; GitHub checks passed across
+  Verify Node 18/20/22, self-scan, self-scan examples, Test GitHub Action,
+  GitGuardian, CodeRabbit, and Cubic.
+- `docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-20.md`
  regenerates the ITO-44 prompt-to-artifact dashboard from live platform audit
  evidence: PR queue, issue queue, discussion queue, local worktree gate,
-  dashboard generation, and supply-chain loop are current; publication, plugin,
-  billing, AgentShield, ECC Tools, legacy, and Linear/productized sync lanes
-  remain the next work.
+  dashboard generation, and supply-chain loop are current; the dashboard now
+  also tracks the `$1,728/mo` to `$10,000/mo` hypergrowth baseline, release
+  video-suite lane, partner/sponsor/talk outbound pack, and owner approval
+  packet; publication, plugin, billing, AgentShield, ECC Tools, Linear release
+  gate sync, and final outbound approval remain the next work.
 - `docs/releases/2.0.0-rc.1/publication-evidence-2026-05-17.md` records the
  May 17 queue-zero state, Japanese localization merge, Dependabot TypeScript
  and Node type merges, post-merge ja-JP lint repair, Mini Shai-Hulud/TanStack
@@ -86,7 +242,7 @@ As of 2026-05-18:
  finding evidence paths, ECC-Tools #78 harness policy-route linking, PR #1947
  supply-chain protection, and May 16 release-evidence
  refresh.
- `npm run harness:audit -- --format json` reports 70/70 on current `main`.
+- `npm run harness:audit -- --format json` reports 80/80 on current `main`.
 - `npm run observability:ready` reports 21/21 readiness on current `main`,
  including the GitHub/Linear/handoff/roadmap progress-sync contract.
 - GitHub CI run `26017368895` completed successfully for
@@ -327,15 +483,68 @@ As of 2026-05-18:
  counts to `npm run billing:kv-readback`, including
  `marketplaceSourceRecords`, `marketplaceSourceWithWebhookEvidence`,
  `marketplaceSourceWithoutWebhookEvidence`, `byMarketplacePlanName`, and
-  `byMarketplaceEventAction`. The 2026-05-18 live Wrangler OAuth readback
-  found 254 account-billing records, 254 billing-state records, 195
+  `byMarketplaceEventAction`. The 2026-05-18 live Wrangler OAuth readback now
+  works and found 256 account-billing records, 256 billing-state records, 197
  Marketplace-source records, 59 Stripe-source records, 53 Pro records, 0
-  Marketplace Pro records, 2 Marketplace webhook-provenance records, both
+  Marketplace Pro records, 4 Marketplace webhook-provenance records, all
  `Open Source` purchases, and 193 Marketplace-source records without webhook
  provenance. Native-payments copy remains blocked by Linear ITO-61 until a
  real Marketplace-managed Pro webhook creates target account provenance and
  `billing:kv-readback -- --wrangler --wrangler-bin ./node_modules/.bin/wrangler --account <github-login> --require-ready`
  plus the official internal announcement gate pass.
+- ECC-Tools commit `13cd3fc` normalizes billing-state key casing so
+  Marketplace webhook writes and announcement readbacks agree on GitHub login
+  case; current-head CI `26037611421` passed. The code-side readback hardening
+  remains green, but it does not create live Marketplace Pro state.
+- ECC-Tools commit `69ca535` surfaces hosted team-learning feedback controls:
+  harness compatibility and team-backlog routing now show retention days,
+  deletion route/SLA, and opt-out route before adaptive recommendations are
+  routed into team-owned queues. Linear ITO-52 is Done with CI `26054455434`.
+- ECC-Tools commit `e56fc1a` updates the lockfile for
+  `brace-expansion@5.0.6` and fixed Dependabot alert 44 for CVE-2026-45149;
+  GitHub API reported `state: fixed` at `2026-05-18T19:10:15Z` and current-head
+  CI `26054671308` passed.
+- ECC-Tools PR #89 merged as `512bca6b99cdaa67058a6aa9a4e7e7f0b1d9873a`
+  and adds
+  `npm run billing:kv-readback -- --select-ready-target --require-ready` so
+  operators can prove a ready Marketplace Pro account without passing or
+  printing the login. The 2026-05-20 production Wrangler OAuth readback found
+  ready-like Marketplace Pro records with webhook provenance and 0 parse
+  failures. The selected target report printed only a stable fingerprint,
+  confirmed both key families, `marketplace` source, `pro` tier, seat ready,
+  webhook evidence ready, automatic overage disabled, and 0 blockers. The old
+  "no Marketplace-managed Pro target billing-state" blocker is cleared. Linear
+  comment `f14ed2fe-a219-470c-8119-63429e197027` records the redacted readback
+  counts.
+- ECC-Tools PR #90 merged as
+  `16a5bb33ee5ce7c31d2ad8d041e5afac03308f05` after Verify, Security Audit,
+  and Workers Builds passed. It adds the selected-target official announcement
+  gate through `/api/billing/readiness?selectReadyTarget=1` and
+  `npm run billing:announcement-gate -- --select-ready-target`, so operators no
+  longer need to pass or print a raw GitHub login for the official
+  native-payments gate. The 2026-05-20 safe production preflight requested a
+  selected ready target and narrowed the remaining blocker to the missing
+  local/internal `INTERNAL_API_SECRET` bearer token. Native-payments copy remains
+  blocked until that token path is available and the live
+  `billing:announcement-gate -- --select-ready-target` call passes.
+- ECC-Tools PR #91 merged as `72119a1acc6f5a0cd3bb5d90afd6e87fd1fefd05`
+  after Verify, Security Audit, and Workers Builds passed. It adds the billing
+  gate env-file operator path with `--env-file` support for the announcement
+  gate and KV readback scripts, plus sentinel tests proving loaded secrets and
+  account logins are not printed.
+- ECC-Tools PR #92 merged as `18d80197be779619283e0b37e2952bac53819a07` after
+  Verify, Security Audit, and Workers Builds passed. It adds the optional
+  `INTERNAL_OPERATOR_API_SECRET` recovery bearer so operators can run privileged
+  internal readiness gates without replacing the primary `INTERNAL_API_SECRET`;
+  the merged Worker was deployed to `api.ecc.tools` before the live gate run.
+- ECC-Tools PR #93 merged as `d3d62df83fa075660fa4530c3e0edc311a4355fe` after
+  Verify, Security Audit, and Workers Builds passed. It records the live
+  2026-05-20 billing evidence in the app launch checklist and roadmap:
+  selected ready Marketplace Pro target, fingerprint `e953a74209fe`, 0 KV
+  blockers, preflight ready, `announcementGateReady: true`, 0 required actions,
+  0 blockers, and audit summary 6 pass / 1 warn / 0 fail. Native-payments copy
+  is no longer blocked by billing evidence, but final announcement timing still
+  requires the release, plugin, live URL, and owner-approval gates.
 - Handoff `ecc-supply-chain-audit-20260513-0645.md` under
  `~/.cluster-swarm/handoffs/`
  records the May 13 supply-chain sweep: no active lockfile/manifest hit for
@@ -594,6 +803,44 @@ As of 2026-05-18:
  fleet summaries are collected as harness evidence, target paths are mapped to
  Claude, Codex, OpenCode, MCP, plugin, and cross-harness owners, and routed
  findings carry source evidence paths for operator review.
+- ECC-Tools PR #79 merged as `67ee247ae1b7b50ecc1261ed5d62d65cc8390da8`
+  and redacts billing announcement gate account output: the billing preflight
+  and live readback now print stable account fingerprints and sanitized
+  readiness booleans instead of raw account logins or KV key names.
+- ECC-Tools PR #80 merged as `4efc8cc858022f84c844690f3298633b081c4398`
+  and requires runtime receipt failure reasons before harness runtime receipts
+  can count as hosted observability evidence.
+- ECC-Tools PR #81 merged as `1fbf635f492284f75ba7166c029c39eb8cc15794`
+  and preserves AgentShield fleet approval IDs through hosted security review
+  so policy-promotion follow-ups keep owner-review identity stable.
+- ECC-Tools PR #82 merged as `7a7b4d096a176ae80b3a2076c09d45601e36013a`
+  and renders AgentShield fleet approval IDs in hosted comments and check-runs,
+  giving operators a direct bridge from hosted security review back to
+  AgentShield policy-promotion review items.
+- ECC-Tools PR #83 merged as `b6b107f33961bef18a85fb619f3a976eb5d752dd`
+  and makes Linear follow-up sync reuse deterministic external IDs before title
+  fallback, preventing duplicate deferred backlog issues during repeated
+  `/ecc-tools followups sync-linear` runs.
+- ECC-Tools PR #84 merged as `73bac7058071c55cb30c6b8ac6db779b3660c02c`
+  and syncs hosted AgentShield remediation items to Linear when the workspace
+  token/team are configured; hosted result comments now include created/reused
+  Linear remediation links.
+- ECC-Tools PR #85 merged as `1637e0f2bfa0a889387f2c20675680ccc5528123`
+  and emits hosted job observability events for queued, completed, blocked,
+  failed, and budget-blocked states into `ANALYSIS_CACHE`, including budget
+  snapshots and result counts.
+- ECC-Tools PR #86 merged as `5a9e94d3ff860307c3e7fd9fd065f0de2bd633dd`
+  and reads recent hosted observability events in
+  `/ecc-tools analyze --job status`, so status comments show budget snapshots,
+  blocked results, and budget-blocked outcomes alongside latest job runs.
+- ECC-Tools PR #87 merged as `508fbc02b63cf1fcb5af2f3624608fa66e53b5d4`
+  and adds the same hosted observability readback to hosted depth-plan
+  check-runs, keeping the PR check surface aligned with status comments.
+- ECC-Tools PR #88 merged as `c836ac3fb24ed7e2ae38cd61e41c9651ac9c00f8`
+  and exposes authenticated hosted observability API readback at
+  `/api/analysis/observability`, summarizing recent hosted events by event type
+  and job while skipping malformed stale KV records. The deployment runbook now
+  includes the production smoke command for operator/dashboard readback.
 - AgentShield PR #90 merged as `6d1c57c92000541d65a3b6bc366f0322d7d0dacc`
  and adds durable fleet `reviewItems`: `agentshield evidence-pack fleet --json`
  now returns owner-ready review items with route, severity, repository/target
@@ -610,6 +857,16 @@ As of 2026-05-18:
  policy SHA-256 digest, rejects tampered policy JSON, requires explicit pack
  selection for multi-pack manifests, and supports dry-run JSON review before
  writing the active `.agentshield/policy.json`.
+- AgentShield PR #94 merged as `4caee27acfadb50a4cd024e738b5c3cbd4b0bb03`
+  and adds editor-native adapter coverage for Zed and VS Code. Zed
+  `.zed/settings.json`, `.zed/tasks.json`, and `.zed` hook-code files are now
+  scan inputs, adapter reports expose Zed MCP/tool-permission/task metadata and
+  VS Code workspace/task/extension metadata, and `.zed/setup.mjs` is covered by
+  the AI-tool persistence IOC rule.
+- AgentShield PR #95 merged as `25d91f0002214c408da4ceaac7def20bad40ca10`
+  and clears the `brace-expansion` Dependabot alert. The lockfile now resolves
+  the vulnerable transitive 5.x copies to `5.0.6`; the remaining 1.x copy is
+  outside the advisory range.
 - AgentShield main commit `87aec47fb55d04ea28d494852d4f664c268c5601`
  extends policy promotion with durable `reviewItems` for manifest digest
  evidence, policy-owner approval, protected rollout PR handoff, and runtime
@@ -675,7 +932,7 @@ As of 2026-05-18:

 - Keep public PRs and issues below 20, with zero as the preferred release-lane
  target.
- Maintain 70/70 harness audit and 21/21 observability readiness after every
+- Maintain 80/80 harness audit and 21/21 observability readiness after every
  GA-readiness batch.
 - Do not publish release or social announcements until the GitHub release,
  npm/package state, billing state, and plugin submission surfaces are verified
@@ -683,7 +940,9 @@ As of 2026-05-18:
 - Do not treat closed stale PRs as discarded. Pair each cleanup batch with a
  salvage pass: inspect the closed diffs, port useful compatible work on
  maintainer-owned branches, and credit the source PR.
- Do not create new Linear issues until the active issue limit is cleared.
+- Use Linear project documents/comments for project-level updates because
+  project status updates are disabled in this workspace; create or update
+  issues when a lane needs a durable execution owner.

 ## Prompt-To-Artifact Execution Checklist

@@ -692,23 +951,23 @@ is not complete unless the evidence column exists and has been freshly verified.

 | Prompt requirement | Required artifact or gate | Current evidence | Status |
 | --- | --- | --- | --- |
-| Keep public PRs below 20 | Repo-family PR recheck | 0 open PRs across `everything-claude-code`, AgentShield, JARVIS, `ECC-Tools/ECC-Tools`, and `ECC-Tools/ECC-website` on 2026-05-18 after merging PR #1976 and refreshing platform audit evidence | Complete |
-| Keep public issues below 20 | Repo-family issue recheck | 0 open issues across `everything-claude-code`, AgentShield, JARVIS, `ECC-Tools/ECC-Tools`, and `ECC-Tools/ECC-website` on 2026-05-18 after the live platform audit refresh | Complete |
-| Manage repository discussions | Repo-family discussion recheck | Platform audit reports 0 discussion maintainer-touch gaps and 0 answerable Q&A missing accepted answers; trunk still has 58 total discussions | Complete |
-| Manage PR discussions | PR review/comment closure plus merge/close state | ECC #1976 merged after maintainer follow-up validation; no open tracked PRs remain | Complete |
+| Keep public PRs below 20 | Repo-family PR recheck | 0 open PRs across `ECC`, AgentShield, JARVIS, `ECC-Tools/ECC-Tools`, and `ECC-Tools/ECC-website` on the late 2026-05-19 platform audit after merging ECC PR #2013, ECC-Tools PR #79, JARVIS PR #15, and JARVIS PR #16 | Complete |
+| Keep public issues below 20 | Repo-family issue recheck | 0 open issues across `ECC`, AgentShield, JARVIS, `ECC-Tools/ECC-Tools`, and `ECC-Tools/ECC-website` on 2026-05-19 after the live platform audit refresh | Complete |
+| Manage repository discussions | Repo-family discussion recheck plus response playbook | Platform audit reports 0 discussion maintainer-touch gaps and 0 answerable Q&A missing accepted answers; trunk has 59 total discussions after #2003 was routed with a maintainer response; `docs/architecture/discussion-response-playbook.md` distinguishes support, maintainer coordination, stale/concluded, release, informational, and security-sensitive response paths | Complete |
+| Manage PR discussions | PR review/comment closure plus merge/close state | ECC #1990-#2013 merged through the harness audit, canonical identity, release video suite, growth outreach, evidence refresh, visual QA, suite-count, owner-approval packet, owner-approval dashboard gate, Linear readiness evidence, supply-chain evidence gate, per-project Claude Code adapter, continuous-learning project-registry hygiene, GateGuard quoted git introspection, and deterministic release-approval gate batch; ECC-Tools #79 and JARVIS #15/#16 also merged; no open tracked PRs remain | Complete |
 | Salvage useful stale work | `docs/stale-pr-salvage-ledger.md` plus `docs/legacy-artifact-inventory.md` | Ledger records salvaged, superseded, skipped, and manual-review tails; #1815-#1818 added cost tracking, skill scout, frontend design guidance, code-reviewer false-positive guardrails, and the May 12 gap pass; #1687, #1609, #1563, #1564, and #1565 localization tails are attached to Linear ITO-55 for language-owner review and no automatic import remains release-blocking | Complete; repeat legacy scan before release |
-| ECC 2.0 preview pack ready | Release docs, quickstart, publication readiness, release notes | `docs/releases/2.0.0-rc.1/` and readiness docs are in-tree; May 18 evidence records queue-zero state, #1970/#1971/#1972/#1976 merge batch, supply-chain recheck, defensive-deny IOC scanner hardening, npm no-lifecycle install/audit/signature gates, Linear sync, refreshed operator dashboard, provider-guard validation, ECC-Tools Wrangler OAuth billing readback evidence, successful current-head CI on `04d4d819`, and detached clean-worktree preview-pack smoke digest `59bbf2630a44` | Needs final release approval |
+| ECC 2.0 preview pack ready | Release docs, quickstart, publication readiness, release notes | `docs/releases/2.0.0-rc.1/` and readiness docs are in-tree; May 19/20 evidence records queue-zero state, canonical ECC identity, release video suite, growth outreach pack, owner approval packet, local 2568-test suite, PR #2001 merge and GitHub Actions run `26102500291`, PR #2002 owner-approval dashboard gate refresh and GitHub Actions run `26103853507`, PR #2004 Linear readiness evidence sync and GitHub Actions run `26105012698`, PR #2008 supply-chain evidence gate CI run `26108473648`, post-PR #2006 main CI run `26109953093`, PR #2009 project-registry hygiene GitHub Actions run `26111313938`, post-PR #2009 main CI run `26111946778`, post-PR #2011 GateGuard main CI run `26113695068`, post-PR #2013 release-approval main CI run `26128749863`, post-PR #2019 main CI run `26135974576`, post-PR #2020 main CI run `26136949698`, ECC-Tools #91 main CI run `26137280847`, May 20 operator dashboard, `owner-approval-packet-2026-05-19.md`, `release-approval-gate.js`, and preview-pack smoke digest `eebb8a66c33e` | Needs final release approval |
 | Hermes specialized skills included safely | Hermes setup/import docs and sanitized skill surface | Hermes setup and import playbook are public; secrets stay local | Needs final release review |
 | Naming and rename readiness | Naming matrix across package/plugin/docs/social surfaces | `docs/releases/2.0.0-rc.1/naming-and-publication-matrix.md` records current package, repo, Claude plugin, Codex plugin, OpenCode, and npm availability evidence | Complete for rc.1; post-rc rename remains future work |
 | Claude and Codex plugin publication | Contact/submission path with required artifacts and status | Publication readiness, naming matrix, and May 12 dry-run evidence document plugin validation, clean-checkout Claude tag/install smoke, and Codex marketplace CLI shape | Needs explicit approval for real tag/push and marketplace submission |
-| Articles, tweets, and announcements | X thread, LinkedIn copy, GitHub release copy, push checklist | Draft launch collateral exists under rc.1 release docs | Needs URL-backed refresh |
-| AgentShield enterprise iteration | Policy gates, SARIF, packs, provenance, corpus, HTML reports, exception lifecycle audit, baseline drift Action/CLI surfaces, evidence-pack redaction, harness adapter registry, enterprise research roadmap, supply-chain hardened release path, CI-safe baseline fingerprints, corpus accuracy recommendations, remediation workflow phases, env proxy hijack corpus coverage, Mini Shai-Hulud full-campaign package IOCs, CI-provenance evidence packs, plugin-cache runtime-confidence triage, evidence-pack consumer readback, fleet-level evidence-pack routing, fleet review items, checksum-backed policy export, checksum-verified policy promotion, policy promotion review items, package-manager hardening drift detection, npm age-gate guidance correction, workflow action-runtime pin refresh, package-manager hardening Action outputs, policy-promotion Action outputs, ECC-Tools hosted consumption of promotion Action outputs, ECC-Tools operator-visible promotion output values, and ECC-Tools hosted promotion judge audit traces | PRs #53, #55-#64, #67-#69, and #78-#92 landed with test evidence, ECC-Tools #76 consumes the fleet-summary output in hosted security review, #77 surfaces source evidence paths in hosted finding output, and #78 links fleet routes to harness owner review; AgentShield #91 adds `agentshield policy export` bundles for branch-protection review and downstream promotion; AgentShield #92 adds `agentshield policy promote` with digest verification, tamper rejection, explicit pack selection, dry-run review, and JSON output before writing active policy; AgentShield commit `87aec47` adds `reviewItems` for digest evidence, owner review, protected rollout PR handoff, and runtime smoke testing with green local and remote CI; AgentShield commit `28d08c7` adds package-manager hardening drift detection for plaintext registry credentials, lifecycle-script enablement, and weak pnpm/Yarn release-age cooldowns with green local and remote CI; AgentShield commit `659f569` refreshes all workflow action runtime pins to SHA-pinned checkout v6.0.2 and setup-node v6.4.0 with green remote CI and no remaining action-runtime deprecation annotation; AgentShield commit `ee585cd` corrects npm release-age guidance by flagging unsupported npm age keys and keeping enforceable cooldown findings on pnpm/Yarn with green local and remote CI; AgentShield commit `1124535` exposes package-manager hardening status/count outputs and a redacted job-summary section for registry credentials, lifecycle scripts, and release-age gates with green local and remote CI; AgentShield commit `1593925` exposes policy-promotion status/count/digest outputs plus job-summary review items for owner approval, protected rollout, and runtime smoke, and marks runtime smoke verified when the same Action job scans with the promoted policy; ECC-Tools commit `8658951` routes those policy-promotion Action outputs into hosted security review findings and Hosted Promotion Readiness scoring; ECC-Tools commit `16c537f` renders policy-promotion status, pack, review item count, action-required count, and digest in hosted security job comments/check-runs; ECC-Tools commit `05d4e82` renders hosted promotion judge request fingerprints and allowed-citation counts without raw provider output; native PDF export deferred in favor of self-contained HTML plus print-to-PDF until explicit enterprise demand appears; `docs/architecture/agentshield-enterprise-research-roadmap.md` now has baseline drift, evidence-pack bundle, redaction, adapter-registry, supply-chain hardening, hashed baseline fingerprints, corpus accuracy recommendation, remediation workflow, env proxy hijack corpus, Mini Shai-Hulud full-campaign package-table, `ci-context.json` provenance, `plugin-cache` confidence, `evidence-pack inspect` readback, `evidence-pack fleet` routing, fleet `reviewItems`, policy export, policy promotion, policy promotion `reviewItems`, package-manager hardening Action outputs, policy-promotion Action outputs, hosted consumption of promotion Action outputs, operator-visible promotion output values, and hosted promotion judge audit traces landed | Next workflow automation should deepen live operator approval/readback after Marketplace/payment gates |
-| ECC Tools next-level app | Billing audit, PR checks, deep analyzer, sync backlog, evaluator/RAG corpus, analysis-depth readiness, hosted execution planning, hosted CI diagnostics, hosted security evidence review, hosted harness compatibility audit, hosted reference-set evaluation, hosted AI routing/cost review, hosted team backlog routing, hosted depth-plan check-run, PR-comment hosted job dispatch, hosted job result history/check-runs, hosted result status command, status-aware depth-plan recommendations, hosted promotion readiness, hosted promotion output scoring, hosted promotion retrieval planning, hosted promotion judge contract, gated hosted promotion judge execution, hosted promotion judge audit trace, payment-announcement readiness, billing announcement preflight, aggregate production billing KV readback, Marketplace webhook provenance, target-account billing readback, Marketplace-source provenance counts, AgentShield fleet-summary hosted routing, hosted finding evidence paths, harness-route policy linking, policy-promotion Action-output hosted telemetry, and operator-visible promotion output values | PRs #26-#43 plus #53-#78 landed with test evidence, including AgentShield evidence-pack gap routing, canonical bundle recognition, supply-chain signature gates, PR draft follow-up Linear tracking, evidence-backed/deep-ready repository classification, the `/api/analysis/depth-plan` hosted job plan, `/api/analysis/jobs/ci-diagnostics`, `/api/analysis/jobs/security-evidence-review`, `/api/analysis/jobs/harness-compatibility-audit`, `/api/analysis/jobs/reference-set-evaluation`, `/api/analysis/jobs/ai-routing-cost-review`, `/api/analysis/jobs/team-backlog-routing`, the `ECC Tools / Hosted Depth Plan` check-run, `/ecc-tools analyze --job ...` PR-comment dispatch, non-blocking per-hosted-job result check-runs backed by 30-day result cache records, `/ecc-tools analyze --job status` cache lookup, cache-aware next-job recommendations in the depth-plan check-run, the `ECC Tools / Hosted Promotion Readiness` corpus-backed PR check-run, deterministic hosted-output scoring against cached completed job artifacts/findings, ranked retrieval/model-prompt planning, the fail-closed `hosted-promotion-judge.v1` request contract, opt-in live model-judge execution behind hosted evidence, entitlement, budget, provider, executor, strict JSON, and citation gates, hosted promotion judge request fingerprints plus allowed-citation audit trails, a fail-closed `/api/billing/readiness` `announcementGate` for native GitHub payments claims, `npm run billing:announcement-gate` plus `--preflight` as the non-secret operator verifier, hosted security findings for AgentShield fleet summaries, an `Evidence` column in hosted finding comments/check-runs, hosted harness findings that route AgentShield fleet target paths to harness owners, ECC-Tools commit `8658951` routing AgentShield policy-promotion Action outputs into hosted security review and promotion-readiness scoring, ECC-Tools commit `16c537f` rendering policy-promotion status/pack/count/digest values directly in hosted security job comments/check-runs, ECC-Tools commit `05d4e82` rendering model-judge audit traces without exposing raw provider output, ECC-Tools commit `91a441b` adding the safe billing announcement preflight path, ECC-Tools commit `eb69412` recording the initial production readback state, ECC-Tools commit `95d0bec` adding `npm run billing:kv-readback` with 253 aggregate account-billing and billing-state records but 0 Marketplace Pro billing-state records, ECC-Tools commit `2859678` requiring webhook-derived Marketplace provenance before announcement readiness, ECC-Tools commit `42653f9` adding Wrangler OAuth readback with live aggregate evidence of 253 account-billing records, 253 billing-state records, and 0 ready-like Marketplace Pro states, ECC-Tools commit `632e059` adding sanitized target-account readback that requires both target key families before `--require-ready` can pass, and ECC-Tools commit `d5f60db` adding sanitized Marketplace plan/action provenance counts; the 2026-05-18 live Wrangler OAuth recheck found 254 account-billing records, 254 billing-state records, 195 Marketplace-source records, 2 Marketplace webhook-provenance records, both `Open Source`, and 0 Marketplace Pro records, then updated Linear ITO-61 with the data/provisioning blocker | Next work is create or verify Marketplace-managed Pro target billing-state with webhook provenance, then run `billing:kv-readback -- --wrangler --wrangler-bin ./node_modules/.bin/wrangler --account <github-login> --require-ready`, followed by the live announcement gate |
+| Articles, tweets, and announcements | X thread, LinkedIn copy, GitHub release copy, push checklist, partner/sponsor/talk pack | Draft launch collateral and approval-gated outreach copy exist under rc.1 release docs | Needs URL-backed refresh and human approval before posting or sending |
+| AgentShield enterprise iteration | Policy gates, SARIF, packs, provenance, corpus, HTML reports, exception lifecycle audit, baseline drift Action/CLI surfaces, evidence-pack redaction, harness adapter registry, editor-native Zed/VS Code adapter coverage, Dependabot alert closure, enterprise research roadmap, supply-chain hardened release path, CI-safe baseline fingerprints, corpus accuracy recommendations, remediation workflow phases, env proxy hijack corpus coverage, Mini Shai-Hulud full-campaign package IOCs, CI-provenance evidence packs, plugin-cache runtime-confidence triage, evidence-pack consumer readback, fleet-level evidence-pack routing, fleet review items, fleet review ticket payloads, checksum-backed policy export, checksum-verified policy promotion, policy promotion review items, package-manager hardening drift detection, npm age-gate guidance correction, workflow action-runtime pin refresh, package-manager hardening Action outputs, policy-promotion Action outputs, ECC-Tools hosted consumption of promotion Action outputs, ECC-Tools operator-visible promotion output values, and ECC-Tools hosted promotion judge audit traces | PRs #53, #55-#64, #67-#69, #78-#92, #94, and #95 landed with test evidence, ECC-Tools #76 consumes the fleet-summary output in hosted security review, #77 surfaces source evidence paths in hosted finding output, and #78 links fleet routes to harness owner review; AgentShield #91 adds `agentshield policy export` bundles for branch-protection review and downstream promotion; AgentShield #92 adds `agentshield policy promote` with digest verification, tamper rejection, explicit pack selection, dry-run review, and JSON output before writing active policy; AgentShield #94 adds Zed/VS Code adapter detection, `.zed/settings.json` and `.zed/tasks.json` scan discovery, and `.zed/setup.mjs` AI-tool persistence IOC coverage; AgentShield #95 clears the `brace-expansion` Dependabot alert with a patched lockfile and 0 open Dependabot alerts after merge; AgentShield commit `87aec47` adds `reviewItems` for digest evidence, owner review, protected rollout PR handoff, and runtime smoke testing with green local and remote CI; AgentShield commit `28d08c7` adds package-manager hardening drift detection for plaintext registry credentials, lifecycle-script enablement, and weak pnpm/Yarn release-age cooldowns with green local and remote CI; AgentShield commit `659f569` refreshes all workflow action runtime pins to SHA-pinned checkout v6.0.2 and setup-node v6.4.0 with green remote CI and no remaining action-runtime deprecation annotation; AgentShield commit `ee585cd` corrects npm release-age guidance by flagging unsupported npm age keys and keeping enforceable cooldown findings on pnpm/Yarn with green local and remote CI; AgentShield commit `1124535` exposes package-manager hardening status/count outputs and a redacted job-summary section for registry credentials, lifecycle scripts, and release-age gates with green local and remote CI; AgentShield commit `1593925` exposes policy-promotion status/count/digest outputs plus job-summary review items for owner approval, protected rollout, and runtime smoke, and marks runtime smoke verified when the same Action job scans with the promoted policy; AgentShield commit `840952a` adds Linear/operator-ready fleet review ticket payloads and expands current Mini Shai-Hulud IOC breadcrumbs with green local and remote CI; ECC-Tools commit `8658951` routes those policy-promotion Action outputs into hosted security review findings and Hosted Promotion Readiness scoring; ECC-Tools commit `16c537f` renders policy-promotion status, pack, review item count, action-required count, and digest in hosted security job comments/check-runs; ECC-Tools commit `05d4e82` renders hosted promotion judge request fingerprints and allowed-citation counts without raw provider output; native PDF export deferred in favor of self-contained HTML plus print-to-PDF until explicit enterprise demand appears; `docs/architecture/agentshield-enterprise-research-roadmap.md` now has baseline drift, evidence-pack bundle, redaction, adapter-registry, supply-chain hardening, hashed baseline fingerprints, corpus accuracy recommendation, remediation workflow, env proxy hijack corpus, Mini Shai-Hulud full-campaign package-table, `ci-context.json` provenance, `plugin-cache` confidence, `evidence-pack inspect` readback, `evidence-pack fleet` routing, fleet `reviewItems`, fleet review ticket payloads, policy export, policy promotion, policy promotion `reviewItems`, package-manager hardening Action outputs, policy-promotion Action outputs, hosted consumption of promotion Action outputs, operator-visible promotion output values, hosted promotion judge audit traces, editor-native adapter coverage, and Dependabot closure landed | Next workflow automation should deepen live operator approval/readback after Marketplace/payment gates |
+| ECC Tools next-level app | Billing audit, PR checks, deep analyzer, sync backlog, evaluator/RAG corpus, hosted promotion judge audit trace, native-payments readback, ready Marketplace Pro target selection, selected-target announcement gate, billing gate env-file operator path, hosted observability, AgentShield fleet-summary hosted routing, hosted finding evidence paths, harness-route policy linking, policy-promotion Action-output hosted telemetry, and operator-visible promotion output values | PRs #26-#43 plus #53-#93 landed with test evidence across hosted analysis, hosted promotion readiness, model-judge execution, native-payments announcement gating, AgentShield evidence consumption, hosted remediation/Linear sync, hosted observability readback, ready Marketplace Pro target selection, selected-target official announcement gating, and env-file operator loading; ECC-Tools #89 merged as `512bca6` after Verify, Security Audit, and Workers Builds passed, and the 2026-05-20 production Wrangler OAuth readback found ready-like Marketplace Pro records with webhook provenance, selected a target with both key families, and reported 0 blockers without printing the login; ECC-Tools #90 merged as `16a5bb3` after Verify, Security Audit, and Workers Builds passed, and production preflight now requests `/api/billing/readiness?selectReadyTarget=1` without a raw login; ECC-Tools #91 merged as `72119a1` with `--env-file` support for ignored local billing credentials and sentinel no-secret/no-login output tests; ECC-Tools #92 merged as `18d8019`, deployed the non-breaking `INTERNAL_OPERATOR_API_SECRET` path to `api.ecc.tools`, and the 2026-05-20 live selected-target gate returned `announcementGateReady: true` with 0 required actions and 0 blockers; ECC-Tools #93 merged as `d3d62df` to record the live billing evidence in the app launch checklist and roadmap | Repeat KV readback and selected-target announcement gate immediately before launch; keep native-payments copy behind final release, plugin, live URL, and owner-approval gates |
 | GitGuardian/Dependabot/CodeRabbit-style checks | Non-blocking taxonomy, deterministic follow-up checks, and local supply-chain gates | ECC-Tools risk taxonomy check plus follow-up signals landed, including Skill Quality, Deep Analyzer Evidence, Analyzer Corpus Evidence, RAG/Evaluator Evidence, PR Review/Salvage Evidence, and AgentShield evidence-pack evidence; #1846 added npm registry signature gates; #1848 added the supply-chain incident-response playbook and `pull_request_target` cache-poisoning validator guard; #1851 added the privileged checkout credential-persistence guard; AgentShield #78, JARVIS #13, and ECC-Tools #53 applied the same hardening outside trunk | Current supply-chain gate complete; deeper hosted review features remain future |
 | Harness-agnostic learning system | Audit, adapter matrix, observability, traces, promotion loop | Audit/adapters/observability gates plus `docs/architecture/evaluator-rag-prototype.md`, `examples/evaluator-rag-prototype/`, and ECC-Tools PR #40 define read-only stale-salvage, billing-readiness, CI-failure-diagnosis, harness-config-quality, AgentShield policy-exception, skill-quality evidence, deep-analyzer evidence, and RAG/evaluator comparison scenarios with trace, report, playbook, verifier, and predictive-check artifacts; ECC-Tools PRs #68-#72 now turn that corpus into a deterministic PR check-run gate with cached hosted-output scoring, ranked retrieval candidates, a model prompt seed, a fail-closed hosted model-judge request contract, and opt-in live model execution behind strict hosted-evidence gates | Deterministic hosted PR check, cached output scoring, retrieval planning, judge contract, and gated model execution integrated |
-| Linear roadmap is detailed | Linear project status plus repo mirror | Repo mirror exists; issue creation was retried on 2026-05-12 and remains blocked by the workspace free issue limit; the May 18 sync adds queue-zero/work-items state, #1970/#1971/#1972/#1976 merge evidence, ITO-57 current-head supply-chain refresh comment `0b9931b9-1556-4ebc-a70c-f3635557625d`, ITO-57 defensive-deny scanner recheck reply `6fa15367-d994-4e53-ade3-9462477e1100`, ECC platform progress comment `e32e5b7a-287b-4bf4-9ed7-314389a157e1`, and generated `operator:dashboard` prompt-to-artifact audit for recurring status updates | Needs recurring status updates after each significant merge batch |
+| Linear roadmap is detailed | Linear project document/comments plus repo mirror | Repo mirror exists and issue creation works again; the May 19 sync adds post-PR #2002 document `ecc-may-19-post-pr-2002-sync-64cef8f668e0`, project comment `a6411e3a-8c8e-4a58-adba-687e77d4c543`, ITO-44/47/48/49/51/54/56 issue comments, and In Progress state for ITO-47, ITO-48, ITO-49, ITO-51, ITO-54, and ITO-56; the late-pass batch adds document `ecc-may-19-late-queue-zero-and-release-gate-sync-1c26f65e6b3f`, project comment `d42bf0e2-7a8e-4934-9f3f-e281498ee805`, and ITO-44/50/54/56/61 comments for PR #2013, ECC-Tools #79, and JARVIS #15/#16 because project status updates are disabled in the workspace | Needs recurring document/comment updates after each significant merge batch |
 | Flow separation and progress tracking | Flow lanes with owner artifacts and update cadence | This roadmap defines lanes below and `docs/architecture/progress-sync-contract.md` makes GitHub/Linear/handoff/roadmap sync part of the readiness gate | Active |
-| Realtime Linear sync | Project comments while issue/status capacity is blocked; issues later | ECC-Tools #39 implements opt-in Linear API sync for deferred follow-up backlog items, and ECC-Tools #54 adds copy-ready PR drafts to that backlog when draft PR shells are not opened; `docs/architecture/progress-sync-contract.md` defines the local file-backed realtime boundary while issue capacity is blocked; May 18 live connector comments were posted to ITO-57 and the ECC platform project after project status updates returned disabled | Needs workspace capacity/config rollout for productized issue sync |
+| Realtime Linear sync | Project documents/comments plus issue comments for lane updates | ECC-Tools #39 implements opt-in Linear API sync for deferred follow-up backlog items, and ECC-Tools #54 adds copy-ready PR drafts to that backlog when draft PR shells are not opened; `docs/architecture/progress-sync-contract.md` defines the local file-backed realtime boundary; May 18 and May 19 live connector comments were posted to the ECC platform project and lane issues after project status updates returned disabled | Needs workspace config/product rollout for hosted issue sync |
 | Observability for self-use | Local readiness gate, traces, status snapshots, HUD/status contract, risk ledger, progress-sync contract | `npm run observability:ready` reports 21/21 | Complete for local gate |
 | Proper release and notifications | Release tag, npm publish state, plugin state, social posts | Publication readiness gate exists with May 12 dry-run and May 13 readiness evidence | Not complete; approval/live URLs required |

@@ -726,8 +985,8 @@ repo evidence and merge commits.
 | Release and publication | rc.1 release docs, publication readiness doc | Naming matrix and plugin submission/contact checklist | Before any tag |
 | Harness OS core | Audit, adapter matrix, observability docs, `ecc2/` | HUD/session-control acceptance spec | Weekly until GA |
 | Evaluation and RAG | Reference-set validation, harness audit, traces, ECC-Tools corpus | Read-only evaluator/RAG prototype plus stale-salvage, billing-readiness, CI-failure-diagnosis, harness-config-quality, AgentShield policy-exception, skill-quality evidence, deep-analyzer evidence, and RAG/evaluator comparison fixtures; ECC-Tools #68 publishes the corpus as a hosted promotion readiness check-run, #69 scores cached hosted job outputs against the same corpus, #70 emits ranked retrieval candidates plus a model prompt seed, #71 adds a fail-closed hosted model-judge request contract, and #72 executes that judge only when explicitly enabled and backed by hosted retrieval citations; ECC-Tools `16c537f` surfaces policy-promotion Action output values in hosted security comments/checks; ECC-Tools `05d4e82` adds hosted model-judge audit traces with request fingerprints and allowed-citation counts | Marketplace Pro billing-state verification with webhook provenance |
-| AgentShield enterprise | AgentShield PR evidence and roadmap notes | Fleet routing landed in #89 after evidence-pack inspect/readback shipped in #88; #90 emits fleet `reviewItems`; #91 exports checksum-backed policy bundles; #92 promotes checksum-verified policies from those bundles into active policy files; AgentShield `87aec47` adds policy promotion `reviewItems`; `28d08c7` adds package-manager hardening drift detection; `659f569` refreshes workflow action runtime pins; `ee585cd` corrects unsupported npm release-age guidance and keeps enforceable cooldown findings on pnpm/Yarn; `1124535` exposes package-manager hardening Action outputs for CI/hosted routing; `1593925` exposes policy-promotion Action outputs and runtime-smoke job-summary evidence; ECC-Tools #76 consumes fleet summaries, #77 surfaces source evidence paths in hosted findings, #78 links fleet routes to harness owners, ECC-Tools `8658951` consumes policy-promotion Action outputs, and ECC-Tools `16c537f` renders operator-visible output values | Deepen live operator approval/readback after Marketplace/payment gates |
-| ECC Tools app | ECC-Tools PR evidence, billing audit, risk taxonomy, evaluator/RAG corpus | ECC-Tools #53 published the supply-chain workflow hardening branch, #54 tracks copy-ready PR drafts in the Linear/project backlog, #55 classifies analysis-depth readiness, #56 exposes the hosted execution plan, #57 executes the first hosted CI diagnostics job, #58 executes the hosted security evidence review job, #59 executes the hosted harness compatibility audit, #60 executes the hosted reference-set evaluation, #61 executes the hosted AI routing/cost review, #62 executes hosted team backlog routing, #63 publishes the hosted depth-plan check-run, #64 dispatches hosted jobs from PR comments, #65 persists hosted result history/check-runs, #66 exposes hosted job status from PR comments, #67 makes depth-plan recommendations cache-aware, #68 publishes hosted promotion readiness from the evaluator/RAG corpus, #69 scores cached hosted job outputs against that corpus, #70 emits ranked retrieval candidates plus a model prompt seed, #71 emits the gated `hosted-promotion-judge.v1` contract without live model calls, #72 adds opt-in live model-judge execution behind hosted-evidence and strict JSON/citation gates, #73 adds a fail-closed native-payments `announcementGate` to billing readiness, #74 adds `npm run billing:announcement-gate` for operator verification, #75 tightens the billing announcement gate for live Marketplace readback, #76 routes AgentShield fleet-summary evidence into hosted security findings, #77 adds source evidence paths to hosted finding output, #78 links AgentShield fleet target paths to hosted harness owner findings, `8658951` routes AgentShield policy-promotion Action outputs into hosted security review and promotion readiness, `16c537f` renders policy-promotion status/pack/count/digest values in hosted security comments/checks, `05d4e82` renders hosted promotion judge request fingerprints plus allowed-citation audit traces, `91a441b` adds billing announcement preflight output for required readback inputs, `eb69412` records the initial production readback state, `95d0bec` adds aggregate `billing:kv-readback` evidence, `2859678` requires Marketplace webhook provenance in billing readiness, `42653f9` adds Wrangler OAuth readback with live aggregate production counts, and `632e059` adds sanitized target-account billing readback for the exact Marketplace test account | Create or verify Marketplace-managed Pro target billing-state with webhook provenance, then live target readback and announcement gate |
+| AgentShield enterprise | AgentShield PR evidence and roadmap notes | Fleet routing landed in #89 after evidence-pack inspect/readback shipped in #88; #90 emits fleet `reviewItems`; #91 exports checksum-backed policy bundles; #92 promotes checksum-verified policies from those bundles into active policy files; #94 adds Zed and VS Code adapter detection, Zed project scan discovery, and `.zed/setup.mjs` persistence IOC coverage; #95 closes the `brace-expansion` Dependabot alert with 0 open alerts after merge; AgentShield `87aec47` adds policy promotion `reviewItems`; `28d08c7` adds package-manager hardening drift detection; `659f569` refreshes workflow action runtime pins; `ee585cd` corrects unsupported npm release-age guidance and keeps enforceable cooldown findings on pnpm/Yarn; `1124535` exposes package-manager hardening Action outputs for CI/hosted routing; `1593925` exposes policy-promotion Action outputs and runtime-smoke job-summary evidence; `840952a` adds fleet review ticket payloads and current Mini Shai-Hulud IOC breadcrumbs; ECC-Tools #76 consumes fleet summaries, #77 surfaces source evidence paths in hosted findings, #78 links fleet routes to harness owners, ECC-Tools `8658951` consumes policy-promotion Action outputs, and ECC-Tools `16c537f` renders operator-visible output values | Deepen live operator approval/readback after Marketplace/payment gates |
+| ECC Tools app | ECC-Tools PR evidence, billing audit, risk taxonomy, evaluator/RAG corpus | ECC-Tools #53 published the supply-chain workflow hardening branch, #54 tracks copy-ready PR drafts in the Linear/project backlog, #55 classifies analysis-depth readiness, #56 exposes the hosted execution plan, #57 executes the first hosted CI diagnostics job, #58 executes the hosted security evidence review job, #59 executes the hosted harness compatibility audit, #60 executes the hosted reference-set evaluation, #61 executes the hosted AI routing/cost review, #62 executes hosted team backlog routing, #63 publishes the hosted depth-plan check-run, #64 dispatches hosted jobs from PR comments, #65 persists hosted result history/check-runs, #66 exposes hosted job status from PR comments, #67 makes depth-plan recommendations cache-aware, #68 publishes hosted promotion readiness from the evaluator/RAG corpus, #69 scores cached hosted job outputs against that corpus, #70 emits ranked retrieval candidates plus a model prompt seed, #71 emits the gated `hosted-promotion-judge.v1` contract without live model calls, #72 adds opt-in live model-judge execution behind hosted-evidence and strict JSON/citation gates, #73 adds a fail-closed native-payments `announcementGate` to billing readiness, #74 adds `npm run billing:announcement-gate` for operator verification, #75 tightens the billing announcement gate for live Marketplace readback, #76 routes AgentShield fleet-summary evidence into hosted security findings, #77 adds source evidence paths to hosted finding output, #78 links AgentShield fleet target paths to hosted harness owner findings, `8658951` routes AgentShield policy-promotion Action outputs into hosted security review and promotion readiness, `16c537f` renders policy-promotion status/pack/count/digest values in hosted security comments/checks, `05d4e82` renders hosted promotion judge request fingerprints plus allowed-citation audit traces, `91a441b` adds billing announcement preflight output for required readback inputs, `eb69412` records the initial production readback state, `95d0bec` adds aggregate `billing:kv-readback` evidence, `2859678` requires Marketplace webhook provenance in billing readiness, `42653f9` adds Wrangler OAuth readback with live aggregate production counts, `632e059` adds sanitized target-account billing readback for the exact Marketplace test account, ECC-Tools #89 adds selected-ready-target KV readback, ECC-Tools #90 adds selected-target official announcement gating without raw login input, and ECC-Tools #91 adds `--env-file` support for ignored local billing credentials without printing secrets or logins | Obtain or rotate the local/internal `INTERNAL_API_SECRET` bearer-token path, via exported env or ignored `--env-file`, then run the live selected-target billing announcement gate |
 | Linear progress | Linear project status updates, `docs/architecture/progress-sync-contract.md`, generated `operator:dashboard` output, and this mirror | Status update with queue/evidence/missing gates | Every significant merge batch |

 The project status update should always include:
@@ -787,7 +1046,7 @@ Acceptance:
  Zed-adjacent surfaces, dmux, Orca, Superset, Ghast, and terminal-only use.
 - Each adapter has supported assets, unsupported surfaces, install path,
  verification command, and risk notes.
- Harness audit remains 70/70 and gains a public onramp that explains how teams
+- Harness audit remains 80/80 and gains a public onramp that explains how teams
  use the scorecard.
 - Reference findings are converted into concrete adapter, observability, or
  operator-surface deltas.
@@ -974,6 +1233,11 @@ Acceptance:
   security review and Hosted Promotion Readiness scoring, and ECC-Tools
   commit `16c537f` renders promotion status, pack, review item count,
   remaining action count, and digest in hosted security comments/check-runs.
+   AgentShield commit `840952a` adds Linear/operator-ready fleet review ticket
+   payloads and expands current Mini Shai-Hulud IOC breadcrumbs, with green
+   local and remote CI. AgentShield commit `4e36aab` hardens CI package installs
+   after the expanded Mini Shai-Hulud refresh, with CI, Test GitHub Action,
+   Self-Scan, and Dependabot Update workflows green.
   ECC-Tools commit `05d4e82` adds hosted promotion judge audit traces with
   deterministic request fingerprints and allowed-citation counts, without
   exposing raw provider output.
@@ -984,13 +1248,23 @@ Acceptance:
   ECC-Tools commit `42653f9` adds Wrangler OAuth KV readback and confirms the
   current blocker is not Cloudflare read access; it is the absence of a
   ready-like Marketplace Pro billing-state record with webhook provenance.
-   ECC-Tools commit `632e059` adds sanitized target-account readback, so the
-   final operator gate should verify the exact Marketplace test account without
-   printing its login or raw KV key names.
-2. Run `npm run billing:announcement-gate -- --preflight --account
-   <github-login>`, then run the same command without `--preflight` against a
-   Marketplace-managed test account and require `announcementGate.ready ===
-   true` before any native GitHub payments announcement.
+   ECC-Tools commit `632e059` adds sanitized target-account readback, and PRs
+   #89/#90/#91 move the final operator path to selected-target readback,
+   selected-target announcement gating, and ignored env-file credential loading
+   without printing account logins or raw KV key names.
+   ECC-Tools PR #79 redacts the billing announcement gate account output;
+   PR #80 requires failure reasons in runtime receipts; PRs #81/#82 preserve
+   and render AgentShield fleet approval IDs; PR #83 makes Linear follow-up
+   sync idempotent by external ID; PR #84 syncs hosted AgentShield
+   remediation items into Linear; PR #85 emits hosted job observability events
+   including budget-blocked outcomes; PRs #86/#87 read those events back into
+   hosted status comments and hosted depth-plan check-runs; and PR #88 exposes
+   authenticated hosted observability API readback for operator dashboards.
+2. Run `npm run billing:announcement-gate -- --preflight
+   --select-ready-target`, adding `--env-file /path/to/ecc-tools.env` when the
+   local bearer token is stored in an ignored operator file, then run the same
+   command without `--preflight` and require `announcementGate.ready === true`
+   before any native GitHub payments announcement.
 3. Enable/configure the merged Linear backlog sync path after workspace issue
   capacity clears or the Linear workspace is upgraded, then verify PR-draft
   salvage items land in the expected project.
@@ -1,6 +1,7 @@
 # AgentShield Enterprise Research Roadmap

-Generated: 2026-05-12; refreshed with May 16 AgentShield PR #87, #88, and #89 evidence.
+Generated: 2026-05-12; refreshed with May 18 AgentShield fleet-ticket and
+Mini Shai-Hulud IOC evidence.

 This is a planning artifact for the next AgentShield enterprise iteration. It
 does not modify AgentShield code. The goal is to turn the current scanner,
@@ -116,14 +117,21 @@ AgentShield PR #89 merged as
 `agentshield evidence-pack fleet <dirs...> [--json]`, verifies each pack through
 the inspect path, aggregates finding, policy, baseline, supply-chain, and
 remediation totals, and assigns each pack to a deterministic fleet route.
+AgentShield commit `840952a7a07f820f24081c43df656d7f7295f23b` adds
+Linear/operator-ready fleet review ticket payloads with priority, labels,
+titles, and Markdown bodies. The same commit expands current Mini
+Shai-Hulud/TanStack IOC coverage for the in-cluster Vault endpoint and
+temporary lockfile breadcrumb, with local typecheck, lint, full tests,
+`git diff --check`, and GitHub CI/Self-Scan/Action-test evidence.

 The next iteration after fleet routing should not be "add more regex rules" by
 default. ECC-Tools follow-up routing now consumes fleet summaries and surfaces
 source evidence paths in hosted findings, and the first cross-harness policy
 slice now links AgentShield fleet route target paths to harness-owner review.
 AgentShield fleet output now also emits `reviewItems` with source evidence paths
-and owner-ready recommendations for routed packs. The higher leverage move is
-durable policy export and workflow automation for routed fleet findings.
+and owner-ready recommendations plus copy-ready ticket payloads for routed
+packs. The higher leverage move is durable operator approval/readback and
+workflow automation for routed fleet findings.

 ## Enterprise Gaps

@@ -0,0 +1,90 @@
+# Discussion Response Playbook
+
+This playbook turns GitHub Discussions into the same operating queue as PRs,
+issues, Linear work, and release evidence. It is an operator guide, not a
+promise that every informational thread needs a public reply.
+
+## Audit Loop
+
+Run these checks before a release, after a major merge batch, and when Linear
+ITO-59 is refreshed:
+
+```bash
+npm run discussion:audit -- --json
+node scripts/platform-audit.js --json
+```
+
+The queue is current only when:
+
+- discussion fetch errors are explained or fixed;
+- `needsMaintainerTouch` is zero for support-like discussion categories;
+- answerable Q&A discussions either have an accepted answer or a clear routing
+  note; and
+- any product-scope thread is linked to a GitHub issue, Linear issue, roadmap
+  row, or explicit deferral.
+
+Informational threads such as announcements, references, show-and-tell, or
+maintainer-authored updates can remain visible without becoming response debt.
+
+## Categories
+
+| Category | Route | Required readback |
+| --- | --- | --- |
+| Product support or install confusion | Reply with the exact command/doc path; mark accepted answer for Q&A when the fix is complete | Discussion URL plus accepted-answer URL when applicable |
+| Bug report | Ask for a minimal repro, version, harness, and logs; create or link a GitHub issue when reproducible | Issue URL or deferral reason |
+| Feature request | Acknowledge the desired outcome and link the closest roadmap issue; do not imply commitment unless scoped | Linear/GitHub roadmap link |
+| Security concern | Move exploit details and secrets to a private channel; keep the public reply short and non-operational | Private escalation note plus public safety reply |
+| Release or billing question | Answer from the release URL ledger and publication-readiness gates; do not claim unpublished URLs, billing readiness, or plugin availability | Evidence artifact or blocker link |
+| Show-and-tell, reference, or announcement | Leave as informational unless there is a direct question or a product-scope signal | Optional roadmap link if useful |
+| Stale or concluded thread | Summarize the current state and link the durable doc/issue; avoid reviving low-signal threads | Closure note or explicit no-action rationale |
+
+## Templates
+
+### Public Support
+
+Thanks for the report. The current supported path is:
+
+```bash
+<command>
+```
+
+The relevant doc is `<doc path or URL>`. If this does not match your setup,
+please reply with the harness, OS, package manager, and the exact error text.
+
+### Maintainer Coordination
+
+I am routing this into `<issue or Linear key>` so it does not get lost in the
+discussion queue. The next decision is `<specific decision>`. Until that lands,
+the supported workaround is `<workaround or "none">`.
+
+### Stale Or Concluded
+
+This thread looks resolved or superseded by `<doc/issue/release>`. I am leaving
+it visible for history, but it is no longer an active support queue item. New
+repro details should go to `<issue/discussion path>`.
+
+### Release Announcement
+
+The current release status is `<rc/beta/GA state>`. Live URLs are recorded in
+`docs/releases/2.0.0-rc.1/release-url-ledger-2026-05-18.md`. Anything marked
+pending there should not be announced as shipped yet.
+
+### Security Escalation
+
+Thanks for flagging this. Please do not post exploit steps, tokens, customer
+data, or secret values in the public thread. I am routing this through the
+security response path and will keep the public thread limited to safe status
+updates.
+
+## Recording Outcomes
+
+For each high-signal discussion, record one of these outcomes:
+
+- replied publicly and accepted answer read back;
+- linked to a GitHub issue or Linear issue;
+- routed to the security response path;
+- classified as informational; or
+- explicitly deferred with a reason.
+
+Mirror the summary into ITO-59 when the batch closes, and include the counts in
+the next operator dashboard or publication evidence refresh.
@@ -9,7 +9,7 @@ status update can claim a lane is current.
 | Surface | Role | Current rule |
 | --- | --- | --- |
 | GitHub PRs/issues/discussions | Public queue and review state | Recheck live counts before every significant merge batch and before release approval. |
-| Linear project | Executive roadmap and stakeholder status update | Post project status updates while issue capacity blocks issue creation. Create/reuse issues only when workspace capacity is available. |
+| Linear project | Executive roadmap and stakeholder status update | Use project documents and project/issue comments because project status updates are disabled in this workspace; create/reuse issues for durable execution lanes. |
 | Local handoff | Durable operator continuity | Update the active handoff after every merge batch, queue drain, skipped release gate, or blocked external action. |
 | Repo roadmap | Auditable planning mirror | Keep `docs/ECC-2.0-GA-ROADMAP.md` aligned to merged PR evidence and unresolved gates. |
 | `scripts/work-items.js` | Local tracker bridge | Sync GitHub PRs/issues into the SQLite work-items store for status snapshots and blocked follow-up. |
@@ -41,9 +41,12 @@ After a significant merge batch, update Linear and the handoff with:
 4. Deferred or skipped work and the explicit reason.
 5. The next one or two implementation slices.

-When Linear issue capacity is unavailable, use a project status update instead
-of creating placeholder issues. When issue capacity is available, create or
-reuse exact-title issues and link them to the repo evidence.
+When Linear project status updates are unavailable, use a project document plus
+project/issue comments instead of creating placeholder issues. Issue capacity is
+available for durable execution lanes, but do not use that issue capacity as a
+substitute for evidence-backed project status. Create or reuse exact-title
+issues only when the lane needs a durable execution owner, and link those issues
+to repo evidence.

 ## Realtime Boundary

@@ -28,15 +28,15 @@ curl -s https://api.npmjs.org/downloads/point/last-month/ecc-agentshield
 ### GitHub repository adoption

 ```bash
-gh api repos/affaan-m/everything-claude-code \
+gh api repos/affaan-m/ECC \
  --jq '{stars:.stargazers_count,forks:.forks_count,contributors_url:.contributors_url,open_issues:.open_issues_count}'
 ```

 ### GitHub traffic (maintainer access required)

 ```bash
-gh api repos/affaan-m/everything-claude-code/traffic/views
-gh api repos/affaan-m/everything-claude-code/traffic/clones
+gh api repos/affaan-m/ECC/traffic/views
+gh api repos/affaan-m/ECC/traffic/clones
 ```

 ### GitHub App installs
@@ -7,7 +7,8 @@ Use these templates as launch-ready starting points. Review channel tone before
 ```text
 ECC v2.0.0-rc.1 preview pack is ready for final release review.

-The repo is moving from a Claude Code config pack into a cross-harness operating system for agentic work.
+ECC 2.0 is the harness-native operator system for agentic work: skills, hooks,
+rules, MCP conventions, release gates, and an optional Hermes operator shell.

 What ships:
 - Hermes setup guide
@@ -15,8 +16,8 @@ What ships:
 - cross-harness architecture docs
 - Hermes import guidance for turning local operator workflows into public ECC skills

-Start here: https://github.com/affaan-m/everything-claude-code
-Release notes: https://github.com/affaan-m/everything-claude-code/blob/main/docs/releases/2.0.0-rc.1/release-notes.md
+Start here: https://github.com/affaan-m/ECC
+Release notes: https://github.com/affaan-m/ECC/blob/main/docs/releases/2.0.0-rc.1/release-notes.md
 ```

 ## X Post: Proof + Metrics
@@ -57,7 +58,7 @@ ECC v2.0.0-rc.1 pushes that further: reusable skills, thin harness adapters, and
 ```text
 ECC v2.0.0-rc.1 preview pack is ready for final release review.

-The practical shift: ECC is no longer just a Claude Code config pack. It is becoming a cross-harness operating system for agentic work.
+ECC 2.0 is the harness-native operator system for agentic work. The same reusable layer now reaches Claude Code, Codex, OpenCode, Cursor, Gemini, Zed, GitHub Copilot workflows, and terminal-only operator lanes.

 This release-candidate surface includes:
 - sanitized Hermes setup documentation
@@ -67,6 +68,6 @@ This release-candidate surface includes:

 It does not include private workspace state, credentials, raw local exports, or personal datasets.

-Repo: https://github.com/affaan-m/everything-claude-code
-Release notes: https://github.com/affaan-m/everything-claude-code/blob/main/docs/releases/2.0.0-rc.1/release-notes.md
+Repo: https://github.com/affaan-m/ECC
+Release notes: https://github.com/affaan-m/ECC/blob/main/docs/releases/2.0.0-rc.1/release-notes.md
 ```
@@ -0,0 +1,63 @@
+# ECC 1.10.1 release announcement draft
+
+ECC 1.10.1 is the follow-up stabilization release to 1.10.0.
+
+This release is focused on install correctness, cross-surface naming clarity, Windows/PowerShell recovery, Cursor project install correctness, and Claude Code hook compatibility. It is not a feature-heavy release.
+
+## What landed in the stabilization pass
+- npm/package/release surfaces are aligned and `ecc-universal@1.10.0` is live on npm
+- Windows locale/path and PowerShell install-path regressions fixed
+- Bash hook process-storm regression fixed
+- Claude Code 2.1.x hook schema compatibility fixed
+- Cursor native project install path repaired:
+  - `.cursor/hooks.json` now includes the required schema/version surface
+  - `.cursor/mcp.json` is written in the native Cursor project location
+- continuous-learning-v2 now accepts `claude-desktop` as a valid entrypoint
+- Windows observe path now skips `AppInstallerPythonRedirector.exe`
+- docs now distinguish plugin installs from full manual installs more clearly
+
+## What 1.10.1 is for
+- make the current install surfaces predictable
+- reduce stale naming/install guidance
+- close the follow-up regressions from 1.10.0
+- give users one stable update point instead of piecing together fixes across issues and discussions
+
+## Included release fixes
+- `#1543` Cursor native project hook + MCP install repair
+- `#1524` Claude Code v2.1.116 argv-dup mitigation in `settings.local.json`
+- `#1522` continuous-learning-v2 accepts `claude-desktop` as a valid entrypoint
+- `#1511` Windows observe path skips `AppInstallerPythonRedirector.exe`
+- `#1546` continuous-learning-v2 plugin quick start correction
+- `#1535` hero overflow follow-up
+
+## Important naming clarification
+- Claude marketplace/plugin identifier: `everything-claude-code@everything-claude-code`
+- npm package: `ecc-universal`
+- GitHub repo: `affaan-m/everything-claude-code`
+
+Those are intentionally different surfaces. The plugin identifier follows Anthropic marketplace rules; the npm package remains `ecc-universal`.
+
+## Still being monitored
+This should be announced as a stabilization release, not as “all edge cases are solved.”
+
+We are still watching for:
+- OS-specific edge cases across macOS, Windows, Linux
+- shell-specific behavior differences
+- Cursor vs Claude plugin install-path mismatches that only appear in older or mixed installs
+- third-party provider/tool-name compatibility reports that still need current-main repro
+
+Current watch-list examples:
+- `#1520` likely obsolete unless repro returns on the current installer
+- `#1516` not gating unless reproduced on current `main`
+- `#1484` remains a Windows umbrella/watch-list issue rather than an active release gate
+
+## Recommended update guidance
+If you hit 1.10.0 install/runtime problems:
+1. update to the latest package/plugin surface
+2. avoid mixing plugin install plus full manual repo copy unless the docs explicitly say to
+3. if problems persist, report:
+   - OS + shell
+   - Claude Code/Cursor version
+   - install method used
+   - exact stderr/output
+   - whether the issue is plugin install, npm install, repo sync, or Cursor project install
@@ -21,6 +21,9 @@
 - verify package, plugin, marketplace, OpenCode, and agent metadata stays at `2.0.0-rc.1`
 - verify `ecc2/Cargo.toml` stays at `0.1.0` for rc.1; `ecc2/` remains an alpha control-plane scaffold
 - complete `publication-readiness.md` with fresh evidence before any GitHub release, npm publish, plugin submission, or announcement post
+- run `npm run release:approval-gate -- --format json` after owner approvals
+  and live URL readbacks are recorded; it must return ready true before any
+  publish, upload, social, or outbound action
 - rerun the release name/plugin publication checklist before creating a
  GitHub prerelease, publishing npm, pushing Claude plugin tags, recording the
  Codex marketplace path, or posting public copy
@@ -36,7 +39,13 @@
 - publish the X thread from `x-thread.md`
 - publish the LinkedIn draft from `linkedin-post.md`
 - use `article-outline.md` for the longer writeup
+- route sponsor, partner, consulting, conference, podcast, and GitHub
+  Discussion copy through `partner-sponsor-talks-pack.md`
 - record one 30-60 second proof-of-work clip
+- validate the release video suite with `npm run release:video-suite -- --format json`
+  after setting `ECC_VIDEO_SOURCE_ROOT` and `ECC_VIDEO_RELEASE_SUITE_ROOT`
+- keep `video-suite-production.md` aligned with the actual primary launch
+  render, timeline, captions, and self-eval gate

 ## Demo Asset Suggestions

@@ -54,3 +63,6 @@ Use language like:
 - "cross-harness operating system for agentic work"
 - "ECC is the reusable substrate; Hermes is the operator shell"
 - "private/local integrations land after sanitization"
+
+Do not send sponsor, partner, consulting, conference, or podcast outreach
+without explicit human approval.
@@ -1,17 +1,18 @@
 # ECC v2.0.0-rc.1 Naming And Publication Matrix

-Snapshot date: 2026-05-12.
+Snapshot date: 2026-05-19.

-This matrix answers the release question "ship as Everything Claude Code, ECC,
-or a renamed surface?" for the rc.1 lane. It is evidence for planning, not a
-publication action.
+This matrix records the rc.1 identity after the public repository rename to
+`affaan-m/ECC`. It is evidence for planning, not a publication action.

 ## Decision

-For `v2.0.0-rc.1`, keep the public identity as **Everything Claude Code (ECC)**.
-Use **ECC** as the short product name in copy, plugin slugs, status surfaces,
-and diagrams, but do not rename the GitHub repo, npm package, or package entry
-points before the rc.1 release.
+For `v2.0.0-rc.1`, ship the public identity as **ECC**.
+
+Use `affaan-m/ECC` as the canonical GitHub repo and `ECC` as the product name
+in copy, plugin slugs, status surfaces, diagrams, and release collateral. Keep
+the npm package and package entry points as `ecc-universal` until a separate
+post-rc migration plan exists.

 Reason:

@@ -19,35 +20,31 @@ Reason:
  plugin slug;
 - the exact npm package name `ecc` is already occupied by an unrelated elliptic
  curve cryptography package;
- the repo name `affaan-m/ecc` is not present, but renaming
-  `affaan-m/everything-claude-code` before rc.1 would create avoidable URL,
-  package, docs, and marketplace churn;
+- `affaan-m/ECC` is the live public GitHub repo;
 - Claude and Codex plugin surfaces are already short enough as `ecc`;
 - rc.1 should prove the release, plugin, and publication pipeline before any
-  broader brand migration.
+  npm/package rename.

 ## Current Values

-| Surface | Current value | Evidence command | 2026-05-12 result | Release decision |
+| Surface | Current value | Evidence command | 2026-05-18 result | Release decision |
 | --- | --- | --- | --- | --- |
-| Product display name | `Everything Claude Code` | `rg -n "Everything Claude Code" README.md CHANGELOG.md docs/releases/2.0.0-rc.1` | Present across README, release notes, launch copy, and plugin manifests | Keep for rc.1 |
-| Short name | `ECC` | README/release docs | Used as the short cross-harness brand | Keep and prefer in tight copy |
-| GitHub repo | `affaan-m/everything-claude-code` | `git remote get-url origin` | `https://github.com/affaan-m/everything-claude-code.git` | Keep for rc.1 |
-| Possible short repo | `affaan-m/ecc` | `gh repo view affaan-m/ecc` | Not found with current auth | Candidate after rc.1 only |
+| Product display name | `ECC` | `rg -n "^# ECC\|displayName.*ECC\|affaan-m/ECC" README.md .codex-plugin/plugin.json docs/releases/2.0.0-rc.1` | Present across README, plugin manifests, release copy, and URL ledger | Keep for rc.1 and GA |
+| GitHub repo | `affaan-m/ECC` | `git remote get-url origin` | `https://github.com/affaan-m/ECC.git` | Keep for rc.1 and GA |
 | npm package | `ecc-universal` | `node -p "require('./package.json').name"` | `ecc-universal` | Keep for rc.1 |
-| npm package version | `2.0.0-rc.1` local, `1.10.0` registry latest | `node -p "require('./package.json').version"` and `npm view ecc-universal name version dist-tags --json` | Local rc.1 is ready; registry latest remains `1.10.0` | Publish rc as `next`, not `latest` |
+| npm package version | `2.0.0-rc.1` local, `1.10.0` registry latest | `node -p "require('./package.json').version"` and `npm view ecc-universal name version dist-tags --json` | Local rc.1 is ready; registry latest remains `1.10.0` and no `next` dist-tag exists yet | Publish rc as `next`, not `latest` |
 | Exact npm short name | `ecc` | `npm view ecc name version description repository.url --json` | Occupied by `ecc@0.0.2`, "Elliptic curve cryptography functions." | Do not use |
 | Scoped npm short name | `@affaan-m/ecc` | `npm view @affaan-m/ecc name version --json` | Registry 404 | Possible future scoped package if npm scope policy permits |
 | Former package name | `everything-claude-code` | `npm view everything-claude-code name version dist-tags --json` | Registry reports unpublished on 2026-02-07 | Do not revive for rc.1 |
 | Claude plugin slug | `ecc` | `node -p "require('./.claude-plugin/plugin.json').name"` | `ecc` | Keep |
-| Claude plugin version | `2.0.0-rc.1` | `claude plugin validate .claude-plugin/plugin.json` | Validation passed on Claude Code `2.1.121` | Ready for release-tag gate |
-| Claude marketplace entry | `ecc` | `.claude-plugin/marketplace.json` | Version and repo point at current rc.1 surface | Keep |
+| Claude plugin version | `2.0.0-rc.1` | `claude plugin validate .claude-plugin/plugin.json`; `claude plugin tag .claude-plugin --dry-run` | Validation passed on Claude Code `2.1.143`; dry run would create `ecc--v2.0.0-rc.1` | Ready for release-tag gate |
+| Claude marketplace entry | `ecc` | `.claude-plugin/marketplace.json`; `claude plugin marketplace add --help`; Anthropic plugin marketplace docs | Version and repo point at current rc.1 surface; GitHub, git URL, remote marketplace JSON, and local path marketplace sources are supported | Keep |
 | Codex plugin slug | `ecc` | `node -p "require('./.codex-plugin/plugin.json').name"` | `ecc` | Keep |
-| Codex plugin version | `2.0.0-rc.1` | `node tests/docs/ecc2-release-surface.test.js` | Release surface test passed | Ready for Codex marketplace/manual marketplace gate |
-| Codex repo marketplace | `ecc` | `.agents/plugins/marketplace.json`; `codex plugin marketplace add --help` | Repo marketplace add supports GitHub shorthand and local roots; local temp-home add smoke passed | Use as rc.1 Codex distribution path |
+| Codex plugin version | `2.0.0-rc.1` | `node tests/plugin-manifest.test.js`; `node tests/docs/ecc2-release-surface.test.js` | Plugin manifest passed 54/54; release surface passed 21/21 on Codex CLI `0.131.0` | Ready for Codex marketplace/manual marketplace gate |
+| Codex repo marketplace | `ecc` | `.agents/plugins/marketplace.json`; `codex plugin marketplace add --help`; OpenAI Codex plugin docs | Repo marketplace add supports GitHub shorthand, Git URLs, SSH URLs, local roots, `--ref`, and `--sparse`; local and GitHub-ref temp-home add smokes passed | Use as rc.1 Codex distribution path |
 | OpenCode package | `ecc-universal` | `node -p "require('./.opencode/package.json').name"` | `ecc-universal` | Keep |
 | OpenCode build | Generated package output | `npm run build:opencode` | Passed | Ready for package dry-run gate |
-| npm pack surface | Reduced runtime package | `npm pack --dry-run --json` | Produced `ecc-universal-2.0.0-rc.1.tgz`, 969 entries, about 5.0 MB unpacked | Needs final release-commit rerun |
+| npm pack surface | Reduced runtime package | `NPM_CONFIG_USERCONFIG=/dev/null npm pack --dry-run --json` | Produced `ecc-universal-2.0.0-rc.1.tgz`, 2228 entries, 4,348,504 bytes packed, 13,024,929 bytes unpacked | Needs final release-commit rerun |

 ## Publication Paths

@@ -57,33 +54,45 @@ Reason:
 | npm | `ecc-universal` local package version is `2.0.0-rc.1`; registry latest is `1.10.0` | Publish rc with `npm publish --tag next` after final `npm pack --dry-run` and release tests | Do not publish before final release commit |
 | Claude plugin | `claude plugin validate .claude-plugin/plugin.json` passed; `claude plugin tag --help` confirms the release tag flow creates `{name}--v{version}` tags and can push them | Run `claude plugin tag .claude-plugin --dry-run` from the clean release commit, then tag/push only after release approval | No plugin release tag created in this pass |
 | Claude marketplace | `.claude-plugin/marketplace.json` points at `ecc` and the public repo | Verify marketplace update/install path after tag exists | External marketplace propagation not verified |
-| Codex plugin | `codex plugin marketplace` supports add/upgrade/remove; `.codex-plugin/plugin.json` is present; `.agents/plugins/marketplace.json` exposes `ecc` from the repo root; temp-home local `codex plugin marketplace add` passed | Publish rc.1 docs with the repo-marketplace command, then monitor OpenAI's official Plugin Directory self-serve path | Official Plugin Directory publishing is documented as coming soon |
+| Codex plugin | `codex plugin marketplace` supports local and Git marketplace sources; `.codex-plugin/plugin.json` is present; `.agents/plugins/marketplace.json` exposes `ecc` from the repo root; temp-home local and GitHub-ref marketplace adds passed | Publish rc.1 docs with the repo-marketplace command, then monitor OpenAI's official Plugin Directory path | Do not claim official Plugin Directory listing before OpenAI submission evidence |
 | OpenCode package | `.opencode/package.json` builds from source and ships inside npm package | Re-run `npm run build:opencode` and package dry-run from release commit | OpenCode CLI 1.2.21 does not expose a separate plugin publication command in this pass |
-| ECC Tools billing claim | README and launch copy mention ECC Tools / marketplace context | ECC-Tools #73 adds `/api/billing/readiness` `announcementGate`; run it against a Marketplace-managed test account before any payment announcement | Billing announcement code gate exists; live Marketplace account readback still pending |
+| ECC Tools billing claim | README and launch copy mention ECC Tools / marketplace context | ECC-Tools #89/#90/#91 add selected-target billing readback, selected-target announcement gating, and ignored `--env-file` support; #92 adds the non-breaking operator bearer path; #93 records the live selected-target gate pass | Billing evidence ready; repeat the live selected-target gate before any payment announcement |
 | Social and longform copy | X thread, LinkedIn copy, article outline, GitHub release copy exist | Replace any stale URLs, then publish only after release/npm/plugin URLs work | Public URLs not final until release actions complete |

-## Rename After rc.1
+## ITO-46 Blocker Register

-If the project moves from "Everything Claude Code" toward "ECC" after rc.1,
-do it as a staged migration:
+| Channel | Current status | Required metadata/evidence | Owner | Blocker or follow-up |
+| --- | --- | --- | --- | --- |
+| GitHub release | Approval-gated; no `v2.0.0-rc.1` prerelease yet | Tag, release URL, prerelease flag, final release notes, URL ledger | Release owner | Create only after final clean-checkout evidence |
+| npm | `ecc-universal@2.0.0-rc.1` dry-run passed; registry latest is `1.10.0` | Pack summary, publish dry-run, `next` dist-tag readback, registry signature evidence | Package owner | Do not publish before approval and final release commit |
+| Short npm name | `ecc` is occupied; `@affaan-m/ecc` returns 404 | Name availability outputs and migration plan | Release owner | Keep `ecc-universal` for rc.1; scoped rename is post-rc only |
+| Claude plugin | `ecc@2.0.0-rc.1` validates; tag dry run would create `ecc--v2.0.0-rc.1` | `claude plugin validate .`, `claude plugin tag .claude-plugin --dry-run`, marketplace install/update smoke | Plugin owner | Real tag push and marketplace propagation require release approval |
+| Claude marketplace | Docs and CLI support GitHub, git URL, remote marketplace JSON, and local path sources | Public repo marketplace JSON, support/contact metadata, post-tag install smoke | Plugin owner | No external official listing has been submitted in this pass |
+| Codex repo marketplace | Local and GitHub-ref temp-home marketplace add smokes passed on Codex CLI `0.131.0` | `.codex-plugin/plugin.json`, `.agents/plugins/marketplace.json`, repo/personal marketplace evidence | Plugin owner | Official Plugin Directory listing requires OpenAI submission/listing evidence |
+| Codex official Plugin Directory | OpenAI docs describe the curated official directory; ECC has not submitted or received listing evidence | Directory submission link or OpenAI approval path once available | Plugin owner | Track as an ITO-56/ITO-46 follow-up; do not claim an official listing |
+| OpenCode package | `npm run build:opencode` passed | Built `.opencode` package metadata inside npm tarball | Package owner | No separate public plugin channel identified; follows npm |
+| Billing/native payments | Marketplace Pro target readback, selected-target announcement preflight, env-file operator path, non-breaking operator bearer, and live selected-target gate have passed | 2026-05-20 selected-target readback, webhook provenance, selected-target announcement gate, ECC-Tools #91 `--env-file` support, ECC-Tools #92 operator bearer, ECC-Tools #93 live gate evidence | ECC Tools owner | Repeat the live gate immediately before rc.1 announcement; final copy still waits on release/plugin/live URL approvals |
+| Social/longform copy | Drafts exist | Final live GitHub, npm, Claude, Codex, billing URLs | Release owner | Publish only after release/package/plugin URLs exist |
+
+## Package Rename After rc.1
+
+If the package layer moves from `ecc-universal` toward a shorter npm surface
+after rc.1, do it as a staged migration:

 1. Keep `ecc-universal` as the npm package until a replacement package has a
   verified owner, deprecation plan, and install migration.
-2. Keep `affaan-m/everything-claude-code` as the canonical repo until release
-   notes, docs, plugin marketplace entries, npm metadata, and external links
-   are prepared for redirects.
-3. Use `ECC` as the product name in new diagrams, status payloads, and
-   cross-harness docs immediately.
-4. Reserve or create any new GitHub/npm/package surfaces before announcing the
-   rename.
-5. Ship a compatibility guide that maps old commands, package names, plugin
+2. Keep `affaan-m/ECC` as the canonical repo for public docs, release notes,
+   plugin marketplace entries, npm metadata, and external links.
+3. Reserve or create any new npm/package surfaces before announcing the
+   package rename.
+4. Ship a compatibility guide that maps old commands, package names, plugin
   slugs, and docs URLs to the new names.

 ## Evidence Captured In This Pass

 ```text
 git rev-parse HEAD
-7109ee08db7209c5d14809efcf832043020dfc57
+67e63e63f9bfd074bd6a21bf6bac71f3dfefa58b

 node -p "require('./package.json').name + '@' + require('./package.json').version"
 ecc-universal@2.0.0-rc.1
@@ -104,19 +113,30 @@ npm view ecc-universal name version dist-tags --json
 registry latest is 1.10.0; no rc dist-tag exists yet.

 claude plugin validate .claude-plugin/plugin.json
-Validation passed on Claude Code 2.1.121.
+Validation passed on Claude Code 2.1.143.
+
+claude plugin validate .
+Validation passed with one warning: root CLAUDE.md is not loaded as plugin
+context; ship plugin context through skills instead.
+
+claude plugin tag .claude-plugin --dry-run
+Would create and push tag ecc--v2.0.0-rc.1.

 node tests/docs/ecc2-release-surface.test.js
-18 release-surface checks passed.
+21 release-surface checks passed.

-node tests/scripts/npm-publish-surface.test.js
-2 npm publish-surface checks passed.
+node tests/plugin-manifest.test.js
+54 plugin-manifest checks passed.

 npm run build:opencode
 Passed.

 npm pack --dry-run --json
-Produced ecc-universal-2.0.0-rc.1.tgz, 969 entries, about 5.0 MB unpacked.
+Produced ecc-universal-2.0.0-rc.1.tgz, 2228 entries, 4,348,504 bytes
+packed, and 13,024,929 bytes unpacked.
+
+npm publish --tag next --dry-run
+Dry run would publish ecc-universal@2.0.0-rc.1 to npm with tag next.

 codex plugin marketplace add --help
 Supports GitHub shorthand, HTTP(S) Git URLs, SSH URLs, local marketplace roots,
@@ -125,4 +145,9 @@ Supports GitHub shorthand, HTTP(S) Git URLs, SSH URLs, local marketplace roots,
 HOME="$(mktemp -d)" codex plugin marketplace add <local-checkout>
 Added marketplace ecc and recorded the installed marketplace root as
 <local-checkout> without touching the real Codex config.
+
+HOME="$(mktemp -d)" codex plugin marketplace add affaan-m/ECC --ref "$(git rev-parse HEAD)"
+Added marketplace ecc from the GitHub repo pinned to
+67e63e63f9bfd074bd6a21bf6bac71f3dfefa58b without touching the real Codex
+config.
 ```
@@ -2,8 +2,8 @@

 This dashboard is generated by `npm run operator:dashboard`. It is an operator snapshot, not release approval.

-Generated: 2026-05-18T13:12:35.523Z
-Commit: 680aeff0fb9a8598858e3105ba4742973ef386ab
+Generated: 2026-05-18T20:25:22.649Z
+Commit: 4470e2e6702f17099d6feb137ba03ff00582c202
 Status: work remaining

 ## Current Status
@@ -13,7 +13,7 @@ Status: work remaining
 | PR queue | Current | 0 open PRs across tracked repos |
 | Issue queue | Current | 0 open issues across tracked repos |
 | Discussions | Current | 0 need maintainer touch; 0 missing accepted answer |
-| Local worktree | Current | 0 blocking dirty files; 1 ignored dirty entries |
+| Local worktree | Current | 0 blocking dirty files; 0 ignored dirty entries |
 | Dashboard generation | Current | platform audit ready: true; GitHub skipped: false |
 | Publication | Not complete | release, npm, plugin, billing, and announcement gates are tracked below |

@@ -29,8 +29,8 @@ Status: work remaining
 | Include Hermes specialized skills safely | docs/HERMES-SETUP.md and skills/hermes-imports/SKILL.md | current | Hermes setup/import artifacts are covered by preview-pack smoke | repeat preview-pack smoke before release review |
 | Prepare name-change, Claude plugin, and Codex plugin paths | naming-and-publication-matrix plus release-name-plugin-publication checklist plus publication-readiness | in_progress | naming matrix, release publication checklist, and plugin readiness gates exist | real tag/push, marketplace submission, and final channel choice remain approval-gated |
 | Prepare release notes, articles, tweets, and push notifications | docs/releases/2.0.0-rc.1 social and release-copy files | in_progress | release notes, X thread, LinkedIn draft, and URL ledger are present | final live release/npm/plugin/billing URLs and publish approval still pending |
-| Advance AgentShield enterprise iteration | AgentShield PR evidence plus enterprise roadmap | in_progress | AgentShield policy promotion `reviewItems` landed in `87aec47`; package-manager hardening drift detection landed in `28d08c7`; workflow action runtime pins were refreshed in `659f569`; npm age-gate guidance was corrected in `ee585cd`; package-manager hardening Action outputs landed in `1124535`; policy-promotion Action outputs and runtime-smoke job-summary evidence landed in `1593925`; ECC-Tools consumes those outputs in `8658951`, surfaces operator-readable status/pack/count/digest telemetry in `16c537f`, and renders hosted promotion judge audit traces in `05d4e82`; all are mirrored in the GA roadmap | deepen live operator approval/readback after Marketplace/payment gates |
-| Advance ECC Tools native payments and AI-native harness-agnostic app | ECC Tools PR evidence, billing gate, hosted analysis lanes | in_progress | billing announcement gate, hosted analysis lanes, AgentShield fleet-summary consumption, hosted finding evidence paths, harness-route policy linking, policy-promotion Action-output telemetry, operator-visible promotion output details, hosted promotion judge audit traces, billing announcement preflight, aggregate production billing KV readback, Wrangler OAuth readback, target-account billing readback, provenance-aware Marketplace billing-state gates, and sanitized Marketplace plan/action provenance counts are mirrored in the GA roadmap | create or verify Marketplace-managed Pro target billing-state with webhook provenance, then run `billing:kv-readback -- --wrangler --wrangler-bin ./node_modules/.bin/wrangler --account <github-login> --require-ready`, followed by the live announcement gate |
+| Advance AgentShield enterprise iteration | AgentShield PR evidence plus enterprise roadmap | in_progress | AgentShield policy promotion `reviewItems` landed in `87aec47`; package-manager hardening drift detection landed in `28d08c7`; workflow action runtime pins were refreshed in `659f569`; npm age-gate guidance was corrected in `ee585cd`; package-manager hardening Action outputs landed in `1124535`; policy-promotion Action outputs and runtime-smoke job-summary evidence landed in `1593925`; fleet review ticket payloads and current Mini Shai-Hulud IOC breadcrumbs landed in `840952a`; ECC-Tools consumes those outputs in `8658951`, surfaces operator-readable status/pack/count/digest telemetry in `16c537f`, and renders hosted promotion judge audit traces in `05d4e82`; all are mirrored in the GA roadmap | deepen live operator approval/readback after Marketplace/payment gates |
+| Advance ECC Tools native payments and AI-native harness-agnostic app | ECC Tools PR evidence, billing gate, hosted analysis lanes | in_progress | billing announcement gate, hosted analysis lanes, AgentShield fleet-summary consumption, hosted finding evidence paths, harness-route policy linking, policy-promotion Action-output telemetry, operator-visible promotion output details, hosted promotion judge audit traces, billing announcement preflight, aggregate production billing KV readback, Wrangler OAuth readback, target-account billing readback, provenance-aware Marketplace billing-state gates, sanitized Marketplace plan/action provenance counts, hosted team-learning feedback controls, and ECC-Tools Dependabot alert remediation are mirrored in the GA roadmap | create or verify Marketplace-managed Pro target billing-state with webhook provenance, configure the target account and INTERNAL_API_SECRET, then rerun target readback and the live announcement gate |
 | Audit, prune, or attach legacy work | docs/stale-pr-salvage-ledger.md and legacy inventory | current | legacy salvage ledger and inventory are current; all localization tails are attached to Linear ITO-55 for manual language-owner review | repeat legacy scan before release |
 | Keep Linear roadmap detailed and progress tracking synchronized | Linear project mirror plus progress-sync contract | current | Linear live sync and project progress surface are current; progress-sync contract defines the file-backed work-items/status path | repeat Linear/project status update and local work-items sync after each significant merge batch |
 | Provide ECC 2.0 observability for self-use | observability readiness gate | complete | observability:ready command and readiness doc exist | runtime/dashboard implementation can continue after release gates |
@@ -41,11 +41,11 @@ Status: work remaining
 - `naming-and-plugin-publication`: real tag/push, marketplace submission, and final channel choice remain approval-gated
 - `release-notes-and-notifications`: final live release/npm/plugin/billing URLs and publish approval still pending
 - `agentshield-enterprise-iteration`: deepen live operator approval/readback after Marketplace/payment gates
- `ecc-tools-next-level`: create or verify Marketplace-managed Pro target billing-state with webhook provenance, then run `billing:kv-readback -- --wrangler --wrangler-bin ./node_modules/.bin/wrangler --account <github-login> --require-ready`, followed by the live announcement gate
+- `ecc-tools-next-level`: create or verify Marketplace-managed Pro target billing-state with webhook provenance, configure the target account and INTERNAL_API_SECRET, then rerun target readback and the live announcement gate

 ## Next Work Order

 1. Regenerate this dashboard from the final release commit before publication evidence is recorded.
 2. Repeat ITO-57 Linear/project status sync after the next significant merge batch or advisory-source refresh.
-3. Create or verify Marketplace-managed Pro target billing-state with webhook provenance, then run `billing:kv-readback -- --wrangler --wrangler-bin ./node_modules/.bin/wrangler --account <github-login> --require-ready`, followed by the live announcement gate before publishing native-payments copy.
+3. Create or verify Marketplace-managed Pro target billing-state with webhook provenance, configure the target account and INTERNAL_API_SECRET, then rerun target readback and the live announcement gate before publishing native-payments copy.
 4. Resume ITO-45, ITO-46, and ITO-56 only after the generated dashboard and final release gates are refreshed.
@@ -0,0 +1,66 @@
+# ECC Operator Readiness Dashboard
+
+This dashboard is generated by `npm run operator:dashboard`. It is an operator snapshot, not release approval.
+
+Generated: 2026-05-20T01:28:52.541Z
+Commit: a2bbc45504ff55f09e9e06be0e253d72f3c54f90
+Status: work remaining
+
+## Current Status
+
+| Area | Status | Evidence |
+| --- | --- | --- |
+| PR queue | Current | 0 open PRs across tracked repos |
+| Issue queue | Current | 0 open issues across tracked repos |
+| Discussions | Current | 0 need maintainer touch; 0 missing accepted answer |
+| Local worktree | Current | 0 blocking dirty files; 0 ignored dirty entries |
+| Dashboard generation | Current | platform audit ready: true; GitHub skipped: false |
+| Publication | Not complete | release, npm, plugin, billing, and announcement gates are tracked below |
+
+## Growth Baseline
+
+| Metric | Current | Target | Gap |
+| --- | ---: | ---: | ---: |
+| MRR | $1,728/mo | $10,000/mo | $8,272/mo |
+
+Growth lanes: GitHub Sponsors and OSS partner sponsors; ECC Tools Pro subscriptions; consulting and implementation contracts; talks, podcasts, conference demos, and partner webinars.
+
+## Prompt-To-Artifact Checklist
+
+| Objective requirement | Artifact or gate | Status | Evidence | Gap |
+| --- | --- | --- | --- | --- |
+| Keep public PRs below 20 | scripts/platform-audit.js live GitHub sweep plus owner-wide queue cleanup ledger | current | 0 open PRs across 5 tracked repos; 0 owner-wide open PRs after cleanup | repeat platform:audit and owner-wide gh search before release |
+| Keep public issues below 20 | scripts/platform-audit.js live GitHub sweep plus owner-wide queue cleanup ledger | current | 0 open issues across 5 tracked repos; 0 owner-wide open issues after cleanup | repeat platform:audit and owner-wide gh search before release |
+| Respond and manage repository discussions | scripts/platform-audit.js discussion summary | current | 0 need maintainer touch; 0 answerable discussions missing accepted answer | repeat before release |
+| Build ITO-44 completion dashboard into a repeatable command | npm run operator:dashboard | complete | operator:dashboard package script exists | keep generated dashboard attached to publication evidence |
+| ECC 2.0 preview pack ready | docs/releases/2.0.0-rc.1/preview-pack-manifest.md | current | preview pack manifest and deterministic smoke gate are in-tree | repeat clean-checkout preview-pack smoke before publication |
+| Include Hermes specialized skills safely | docs/HERMES-SETUP.md and skills/hermes-imports/SKILL.md | current | Hermes setup/import artifacts are covered by preview-pack smoke | repeat preview-pack smoke before release review |
+| Prepare name-change, Claude plugin, and Codex plugin paths | naming-and-publication-matrix plus release-name-plugin-publication checklist plus publication-readiness | in_progress | naming matrix, release publication checklist, and plugin readiness gates exist | real tag/push, marketplace submission, and final channel choice remain approval-gated |
+| Prepare release notes, articles, tweets, and push notifications | docs/releases/2.0.0-rc.1 social and release-copy files | in_progress | release notes, X thread, LinkedIn draft, and URL ledger are present | final live release/npm/plugin/billing URLs and publish approval still pending |
+| Prepare final owner approval packet | docs/releases/2.0.0-rc.1/owner-approval-packet-2026-05-19.md | current | owner approval packet covers release, package, plugin, video, billing, social, and outbound decisions | review owner approvals from the final release commit before any publication or outbound action |
+| Create a second-phase hypergrowth release command center | docs/releases/2.0.0/ecc-2-hypergrowth-release-command-center.md plus May 19 evidence | current | current MRR, target MRR, gap, release claim, video lane, distribution plan, and approval boundaries are in-tree | refresh after every MRR, channel, or approval-state change before public launch |
+| Produce the ECC 2.0 release video suite | docs/releases/2.0.0-rc.1/video-suite-production.md and npm run release:video-suite | current | video-suite gate is ready with 15/15 source assets, 13/13 suite artifacts, 12/12 publish candidates, primary self-eval, and zero detected black-frame segments recorded in May 19 evidence | final owner approval, upload, and public video URLs remain approval-gated |
+| Prepare sponsor, partner, consulting, podcast, talk, and Discussion copy | docs/releases/2.0.0-rc.1/partner-sponsor-talks-pack.md | in_progress | sponsor outbound, platform partner DM, consulting intro, talk/podcast pitch, GitHub Discussion announcement, CTA hooks, and do-not-send gate are drafted | replace final URLs after publication gates, then get explicit approval before outbound or personal-account posts |
+| Advance AgentShield enterprise iteration | AgentShield PR evidence plus enterprise roadmap | in_progress | AgentShield policy promotion `reviewItems` landed in `87aec47`; package-manager hardening drift detection landed in `28d08c7`; workflow action runtime pins were refreshed in `659f569`; npm age-gate guidance was corrected in `ee585cd`; package-manager hardening Action outputs landed in `1124535`; policy-promotion Action outputs and runtime-smoke job-summary evidence landed in `1593925`; fleet review ticket payloads and current Mini Shai-Hulud IOC breadcrumbs landed in `840952a`; ECC-Tools consumes those outputs in `8658951`, surfaces operator-readable status/pack/count/digest telemetry in `16c537f`, and renders hosted promotion judge audit traces in `05d4e82`; all are mirrored in the GA roadmap | deepen live operator approval/readback after Marketplace/payment gates |
+| Advance ECC Tools native payments and AI-native harness-agnostic app | ECC Tools PR evidence, billing gate, hosted analysis lanes | in_progress | billing announcement gate, hosted analysis lanes, AgentShield fleet-summary consumption, hosted finding evidence paths, harness-route policy linking, policy-promotion Action-output telemetry, operator-visible promotion output details, hosted promotion judge audit traces, billing announcement preflight, aggregate production billing KV readback, Wrangler OAuth readback, target-account billing readback, provenance-aware Marketplace billing-state gates, sanitized Marketplace plan/action provenance counts, ready Marketplace Pro target selection, hosted team-learning feedback controls, and ECC-Tools Dependabot alert remediation are mirrored in the GA roadmap | obtain or rotate the local/internal INTERNAL_API_SECRET bearer-token path, then run the live billing announcement gate for the selected Marketplace Pro target before publishing native-payments copy |
+| Audit, prune, or attach legacy work | docs/stale-pr-salvage-ledger.md and legacy inventory | current | legacy salvage ledger and inventory are current; all localization tails are attached to Linear ITO-55 for manual language-owner review | repeat legacy scan before release |
+| Keep Linear roadmap detailed and progress tracking synchronized | Linear project mirror plus progress-sync contract | current | Linear live sync is current with the May 19 post-PR #2002 sync document, project comment, and active issue-lane updates; progress-sync contract defines the file-backed work-items/status path | repeat Linear/project status update and local work-items sync after each significant merge batch |
+| Provide ECC 2.0 observability for self-use | observability readiness gate | complete | observability:ready command and readiness doc exist | runtime/dashboard implementation can continue after release gates |
+| Keep Mini Shai-Hulud/TanStack protection loop current | supply-chain watch plus runbook plus AgentShield package-manager hardening | current | scheduled supply-chain watch emits IOC/advisory-source refresh artifacts; ECC scanner covers gh-token-monitor token-store persistence; AgentShield now detects known AI-tool persistence IOCs, npm lifecycle/token drift, unsupported npm age-key drift, and pnpm/Yarn cooldown drift; current-head watch evidence and ITO-57 May 18 Linear evidence updates are current | repeat advisory/source refresh and Linear sync after each significant supply-chain batch |
+
+## Top Actions
+
+- `naming-and-plugin-publication`: real tag/push, marketplace submission, and final channel choice remain approval-gated
+- `release-notes-and-notifications`: final live release/npm/plugin/billing URLs and publish approval still pending
+- `partner-sponsor-talks-pack`: replace final URLs after publication gates, then get explicit approval before outbound or personal-account posts
+- `agentshield-enterprise-iteration`: deepen live operator approval/readback after Marketplace/payment gates
+- `ecc-tools-next-level`: obtain or rotate the local/internal INTERNAL_API_SECRET bearer-token path, then run the live billing announcement gate for the selected Marketplace Pro target before publishing native-payments copy
+
+## Next Work Order
+
+1. Regenerate this dashboard from the final release commit before publication evidence is recorded.
+2. Review the owner approval packet from the final release commit and approve, defer, or block each publication and outbound lane.
+3. Review the owner-approved primary launch video candidates, choose the final cuts, upload after approval, and attach public video URLs to the release pack.
+4. Replace final release, npm, plugin, billing, and video URLs in the partner/sponsor/talk pack, then get explicit approval before outbound.
+5. Repeat ITO-57 Linear/project status sync after the next significant merge batch or advisory-source refresh.
+6. Obtain or rotate the local/internal INTERNAL_API_SECRET bearer-token path, then run the live billing announcement gate for the selected Marketplace Pro target before publishing native-payments copy.
@@ -0,0 +1,66 @@
+# ECC Operator Readiness Dashboard
+
+This dashboard is generated by `npm run operator:dashboard`. It is an operator snapshot, not release approval.
+
+Generated: 2026-05-20T03:14:39.338Z
+Commit: 66733b511b70cf1cb501e8a3298b1cbd9968a9a0
+Status: work remaining
+
+## Current Status
+
+| Area | Status | Evidence |
+| --- | --- | --- |
+| PR queue | Current | 0 open PRs across tracked repos |
+| Issue queue | Current | 0 open issues across tracked repos |
+| Discussions | Current | 0 need maintainer touch; 0 missing accepted answer |
+| Local worktree | Current | 0 blocking dirty files; 0 ignored dirty entries |
+| Dashboard generation | Current | platform audit ready: true; GitHub skipped: false |
+| Publication | Not complete | release, npm, plugin, billing, and announcement gates are tracked below |
+
+## Growth Baseline
+
+| Metric | Current | Target | Gap |
+| --- | ---: | ---: | ---: |
+| MRR | $1,728/mo | $10,000/mo | $8,272/mo |
+
+Growth lanes: GitHub Sponsors and OSS partner sponsors; ECC Tools Pro subscriptions; consulting and implementation contracts; talks, podcasts, conference demos, and partner webinars.
+
+## Prompt-To-Artifact Checklist
+
+| Objective requirement | Artifact or gate | Status | Evidence | Gap |
+| --- | --- | --- | --- | --- |
+| Keep public PRs below 20 | scripts/platform-audit.js live GitHub sweep plus owner-wide queue cleanup ledger | current | 0 open PRs across 5 tracked repos; 0 owner-wide open PRs after cleanup | repeat platform:audit and owner-wide gh search before release |
+| Keep public issues below 20 | scripts/platform-audit.js live GitHub sweep plus owner-wide queue cleanup ledger | current | 0 open issues across 5 tracked repos; 0 owner-wide open issues after cleanup | repeat platform:audit and owner-wide gh search before release |
+| Respond and manage repository discussions | scripts/platform-audit.js discussion summary | current | 0 need maintainer touch; 0 answerable discussions missing accepted answer | repeat before release |
+| Build ITO-44 completion dashboard into a repeatable command | npm run operator:dashboard | complete | operator:dashboard package script exists | keep generated dashboard attached to publication evidence |
+| ECC 2.0 preview pack ready | docs/releases/2.0.0-rc.1/preview-pack-manifest.md | current | preview pack manifest and deterministic smoke gate are in-tree | repeat clean-checkout preview-pack smoke before publication |
+| Include Hermes specialized skills safely | docs/HERMES-SETUP.md and skills/hermes-imports/SKILL.md | current | Hermes setup/import artifacts are covered by preview-pack smoke | repeat preview-pack smoke before release review |
+| Prepare name-change, Claude plugin, and Codex plugin paths | naming-and-publication-matrix plus release-name-plugin-publication checklist plus publication-readiness | in_progress | naming matrix, release publication checklist, and plugin readiness gates exist | real tag/push, marketplace submission, and final channel choice remain approval-gated |
+| Prepare release notes, articles, tweets, and push notifications | docs/releases/2.0.0-rc.1 social and release-copy files | in_progress | release notes, X thread, LinkedIn draft, and URL ledger are present | final live release/npm/plugin/billing URLs and publish approval still pending |
+| Prepare final owner approval packet | docs/releases/2.0.0-rc.1/owner-approval-packet-2026-05-19.md | current | owner approval packet covers release, package, plugin, video, billing, social, and outbound decisions | review owner approvals from the final release commit before any publication or outbound action |
+| Create a second-phase hypergrowth release command center | docs/releases/2.0.0/ecc-2-hypergrowth-release-command-center.md plus May 19 evidence | current | current MRR, target MRR, gap, release claim, video lane, distribution plan, and approval boundaries are in-tree | refresh after every MRR, channel, or approval-state change before public launch |
+| Produce the ECC 2.0 release video suite | docs/releases/2.0.0-rc.1/video-suite-production.md and npm run release:video-suite | current | video-suite gate is ready with 15/15 source assets, 13/13 suite artifacts, 12/12 publish candidates, primary self-eval, and zero detected black-frame segments recorded in May 19 evidence | final owner approval, upload, and public video URLs remain approval-gated |
+| Prepare sponsor, partner, consulting, podcast, talk, and Discussion copy | docs/releases/2.0.0-rc.1/partner-sponsor-talks-pack.md | in_progress | sponsor outbound, platform partner DM, consulting intro, talk/podcast pitch, GitHub Discussion announcement, CTA hooks, and do-not-send gate are drafted | replace final URLs after publication gates, then get explicit approval before outbound or personal-account posts |
+| Advance AgentShield enterprise iteration | AgentShield PR evidence plus enterprise roadmap | in_progress | AgentShield policy promotion `reviewItems` landed in `87aec47`; package-manager hardening drift detection landed in `28d08c7`; workflow action runtime pins were refreshed in `659f569`; npm age-gate guidance was corrected in `ee585cd`; package-manager hardening Action outputs landed in `1124535`; policy-promotion Action outputs and runtime-smoke job-summary evidence landed in `1593925`; fleet review ticket payloads and current Mini Shai-Hulud IOC breadcrumbs landed in `840952a`; ECC-Tools consumes those outputs in `8658951`, surfaces operator-readable status/pack/count/digest telemetry in `16c537f`, and renders hosted promotion judge audit traces in `05d4e82`; all are mirrored in the GA roadmap | deepen live operator approval/readback after Marketplace/payment gates |
+| Advance ECC Tools native payments and AI-native harness-agnostic app | ECC Tools PR evidence, billing gate, hosted analysis lanes | in_progress | billing announcement gate, selected-target announcement gate, billing gate env-file operator path, non-breaking operator bearer path, hosted analysis lanes, AgentShield fleet-summary consumption, hosted finding evidence paths, harness-route policy linking, policy-promotion Action-output telemetry, operator-visible promotion output details, hosted promotion judge audit traces, billing announcement preflight, aggregate production billing KV readback, Wrangler selected-target readback, target-account billing readback, provenance-aware Marketplace billing-state gates, sanitized Marketplace plan/action provenance counts, ready Marketplace Pro target selection, hosted team-learning feedback controls, and ECC-Tools Dependabot alert remediation are mirrored in the GA roadmap | repeat KV readback and selected-target announcement gate immediately before launch; keep native-payments copy behind the final release, plugin, URL, and owner-approval gates |
+| Audit, prune, or attach legacy work | docs/stale-pr-salvage-ledger.md and legacy inventory | current | legacy salvage ledger and inventory are current; all localization tails are attached to Linear ITO-55 for manual language-owner review | repeat legacy scan before release |
+| Keep Linear roadmap detailed and progress tracking synchronized | Linear project mirror plus progress-sync contract | current | Linear live sync is current with the May 20 Marketplace Pro release-gate comments on ITO-61 and the ECC platform roadmap; progress-sync contract defines the file-backed work-items/status path | repeat Linear/project status update and local work-items sync after each significant merge batch |
+| Provide ECC 2.0 observability for self-use | observability readiness gate | complete | observability:ready command and readiness doc exist | runtime/dashboard implementation can continue after release gates |
+| Keep Mini Shai-Hulud/TanStack protection loop current | supply-chain watch plus runbook plus AgentShield package-manager hardening | current | scheduled supply-chain watch emits IOC/advisory-source refresh artifacts; ECC scanner covers gh-token-monitor token-store persistence; AgentShield now detects known AI-tool persistence IOCs, npm lifecycle/token drift, unsupported npm age-key drift, and pnpm/Yarn cooldown drift; current-head watch evidence and ITO-57 May 18 Linear evidence updates are current | repeat advisory/source refresh and Linear sync after each significant supply-chain batch |
+
+## Top Actions
+
+- `naming-and-plugin-publication`: real tag/push, marketplace submission, and final channel choice remain approval-gated
+- `release-notes-and-notifications`: final live release/npm/plugin/billing URLs and publish approval still pending
+- `partner-sponsor-talks-pack`: replace final URLs after publication gates, then get explicit approval before outbound or personal-account posts
+- `agentshield-enterprise-iteration`: deepen live operator approval/readback after Marketplace/payment gates
+- `ecc-tools-next-level`: repeat KV readback and selected-target announcement gate immediately before launch; keep native-payments copy behind the final release, plugin, URL, and owner-approval gates
+
+## Next Work Order
+
+1. Regenerate this dashboard from the final release commit before publication evidence is recorded.
+2. Review the owner approval packet from the final release commit and approve, defer, or block each publication and outbound lane.
+3. Review the owner-approved primary launch video candidates, choose the final cuts, upload after approval, and attach public video URLs to the release pack.
+4. Replace final release, npm, plugin, billing, and video URLs in the partner/sponsor/talk pack, then get explicit approval before outbound.
+5. Repeat ITO-57 Linear/project status sync after the next significant merge batch or advisory-source refresh.
+6. Repeat KV readback and the selected-target billing announcement gate immediately before launch; keep native-payments copy behind the final release, plugin, URL, and owner-approval gates.
@@ -0,0 +1,98 @@
+# ECC v2.0.0-rc.1 Owner Approval Packet
+
+Snapshot date: 2026-05-19.
+
+This packet is the final human decision sheet for the rc.1 public launch. It
+does not publish anything by itself. Use it to approve, defer, or block each
+release action after the final evidence commands are rerun from the intended
+release commit.
+
+Source commit for the clean evidence baseline this packet extends:
+`9819626459a662773be7d0b1c18d82c1316b8c36`.
+
+## Current Evidence
+
+| Evidence | Current recorded state | Repeat before approval |
+| --- | --- | --- |
+| Platform audit | ready true, 0 open PRs, 0 open issues, 0 discussion gaps, 0 dirty files | yes |
+| Preview pack smoke | ready true, digest `531328aaaa53`, 5/5 checks | yes |
+| Release approval gate | ready false, digest `ef8f49f727b7`, 4/6 checks pass; owner decisions and live URL readbacks pending | yes |
+| Video suite | ready true, 15/15 source assets, 13/13 suite artifacts, 12/12 publish candidates | yes |
+| Release surface tests | 27/27 passed after this packet was added | yes |
+| Full local suite | 2568/2568 passed before PR #2013 merged; focused GateGuard regression passed 91/91 again before PR #2011 merged | yes |
+| GitHub CI | PR #1998, PR #1999, PR #2000, PR #2001, PR #2002, PR #2004, PR #2008, post-PR #2006 `main`, PR #2009, post-PR #2009 `main`, post-PR #2011 `main`, and post-PR #2013 `main` all merged or advanced after green required checks | verify current head |
+
+## Decision Register
+
+| Decision | Approve / defer / block | Evidence required first | Notes |
+| --- | --- | --- | --- |
+| GitHub prerelease | defer | final clean branch, URL ledger, release notes, attached video or video link | Approve only after final release notes contain live package/plugin/video URLs or explicitly marked blocked URLs. |
+| npm `next` publish | defer | `npm pack --dry-run`, `npm publish --tag next --dry-run`, registry dist-tag readback plan | Keep `ecc-universal@2.0.0-rc.1` on `next`; do not move `latest` during rc.1. |
+| Claude plugin tag | defer | `claude plugin validate .claude-plugin/plugin.json`, `claude plugin tag .claude-plugin --dry-run` | Create and push the real tag only after release approval. |
+| Codex repo marketplace | defer | temp-home marketplace add smoke and current official Plugin Directory status | Claim repo-marketplace distribution only; do not claim official Plugin Directory listing without listing evidence. |
+| ECC Tools billing language | defer | live readiness readback for the target account and billing/product state | Do not announce native payments or Marketplace-managed Pro until the gate is live. |
+| Video upload | defer | owner selects primary launch cut plus short clips, self-eval stays clean | Upload only approved cuts; keep editable timeline/project output preserved. |
+| X, LinkedIn, GitHub Discussion, longform | defer | live release, npm, plugin, video, and billing URL ledger updates | Personal-account posts and outbound copy need explicit approval. |
+| Sponsor, partner, consulting, conference, podcast outreach | defer | final public URLs plus owner-approved outbound copy | Do not send drafts until the owner approves the exact batch. |
+
+## Final URL Fill-In
+
+Update these surfaces after the approved publication actions finish:
+
+| Surface | Final value source | Update targets |
+| --- | --- | --- |
+| GitHub prerelease URL | `gh release view v2.0.0-rc.1 --repo affaan-m/ECC --json url` | release notes, URL ledger, social copy |
+| npm rc package URL | `npm view ecc-universal@2.0.0-rc.1 version dist-tags --json` | URL ledger, quickstart, release notes |
+| Claude plugin tag URL | pushed `ecc--v2.0.0-rc.1` tag or marketplace readback | URL ledger, plugin docs, release notes |
+| Codex repo-marketplace evidence | temp-home `codex plugin marketplace add <local-checkout>` readback | URL ledger, publication readiness |
+| Primary launch video URL | uploaded owner-approved primary launch video | GitHub release, X, LinkedIn, longform |
+| Short clip URLs | uploaded approved clips | X thread, LinkedIn, partner/sponsor/talk pack |
+| ECC Tools billing/readiness URL | live readiness readback or explicit blocked status | sponsor copy, Pro copy, release notes |
+
+## Final Evidence Commands
+
+Run these from the exact release commit before approving publication:
+
+```bash
+git status --short --branch
+node scripts/platform-audit.js --json
+npm run preview-pack:smoke -- --format json
+npm run release:approval-gate -- --format json
+npm run release:video-suite -- --format json
+npm run harness:adapters -- --check
+npm run harness:audit -- --format json
+npm run observability:ready
+npm run security:ioc-scan
+npm audit --audit-level=moderate
+npm audit signatures
+node tests/docs/ecc2-release-surface.test.js
+node tests/hooks/gateguard-fact-force.test.js
+node tests/run-all.js
+cd ecc2 && cargo test
+```
+
+## Approval Text
+
+Use short, explicit approvals. Example:
+
+```text
+Approved for rc.1 GitHub prerelease, npm next publish, Claude plugin tag, and
+release announcement after the final evidence commands pass from commit <sha>.
+Video uploads approved for <primary-video> and <shorts-list>.
+Outbound sponsor, partner, consulting, conference, and podcast messages remain
+blocked until I approve the exact batch.
+```
+
+## Do Not Approve If
+
+- The final branch is dirty or no longer matches the intended release commit.
+- Any required evidence command fails or is skipped without a written deferral.
+- The release copy claims live billing, plugin marketplace propagation, npm
+  `next`, or official Codex Plugin Directory listing before readback exists.
+- Announcement copy contains stale URLs, private paths, or unresolved live-link
+  decisions.
+- The selected video cut has black frames, missing audio, stale URLs, weak
+  product proof, or unreviewed captions.
+- The outbound batch has not been reviewed exactly as it will be sent.
+
+No outbound email, personal-account post, package publish, plugin tag, or billing announcement is authorized by this packet alone.
@@ -0,0 +1,208 @@
+# ECC v2.0.0-rc.1 Partner, Sponsor, and Talks Pack
+
+This pack turns the rc.1 release surface into outbound-ready copy for sponsors,
+partners, consulting conversations, conference talks, podcast bookings, and
+community announcements.
+
+It is not a publish action. Use it after the release URL ledger, video suite,
+and publication gates are current.
+
+## Current Business Baseline
+
+| Metric | Current | Target | Gap |
+| --- | ---: | ---: | ---: |
+| MRR | `$1,728/mo` | `$10,000/mo` | `$8,272/mo` |
+| Core revenue lanes | Sponsors, ECC Tools Pro, consulting, talks | Repeatable growth loop | Approval-gated outbound |
+| Launch proof | rc.1 preview pack, video suite, queue-zero audit | Public release package | Final URLs and human approval |
+
+## Positioning Line
+
+ECC 2.0 is the harness-native operator system for agentic work.
+
+Use this short version in partner and sponsor messages:
+
+```text
+ECC gives teams one reusable layer for skills, hooks, rules, MCP conventions,
+release gates, and operator workflows across Claude Code, Codex, OpenCode,
+Cursor, Gemini, Zed, GitHub Copilot, and terminal-only workflows.
+```
+
+## Offer Ladder
+
+| Motion | Best fit | Starting point | Primary ask |
+| --- | --- | ---: | --- |
+| Pilot sponsor | OSS-friendly team that wants early signal | `$200/mo` | GitHub Sponsors |
+| Business sponsor | Tooling or AI infra company that wants logo and case-study surface | `$500/mo` | GitHub Sponsors or direct invoice |
+| Strategic partner | Platform, marketplace, security, or developer-tool company | `$1,000+/mo` | Sponsor plus launch or integration plan |
+| Consulting sprint | Team adopting agent harnesses internally | Scoped quote | Harness audit, rollout plan, and operating loop |
+| Talk or podcast | Devtools, AI engineering, security, OSS, or founder audience | No fee required for high-leverage reach | Recording slot, demo slot, or conference proposal |
+
+## Partner Targets
+
+Prioritize partners that already benefit from a harness-agnostic operating
+layer:
+
+- AI coding platforms and IDEs;
+- hosted agent and workflow orchestration tools;
+- code review, security, and supply-chain vendors;
+- model and inference providers;
+- developer education, podcast, and conference organizers;
+- teams adopting multiple harnesses at once.
+
+## Sponsor Outbound
+
+Subject:
+
+```text
+ECC 2.0 sponsor slot for cross-harness agent workflows
+```
+
+Body:
+
+```text
+Hey [name],
+
+I am getting ECC v2.0.0-rc.1 ready for release review.
+
+The project is now positioned around one reusable operator layer for agentic
+work across Claude Code, Codex, OpenCode, Cursor, Gemini, Zed, GitHub Copilot,
+and terminal workflows.
+
+The sponsor fit is pretty direct: ECC reaches the exact builders who are
+standardizing their AI coding stack, security posture, and workflow automation.
+
+The current public sponsor ladder is:
+
+- Pilot Partner: $200/mo
+- Business Sponsor: $500/mo
+- Strategic Partner: $1,000+/mo
+
+Business sponsors get logo placement and release visibility. Strategic partners
+can turn it into a deeper integration or launch motion.
+
+Repo: https://github.com/affaan-m/ECC
+Sponsor: https://github.com/sponsors/affaan-m
+Release notes: https://github.com/affaan-m/ECC/blob/main/docs/releases/2.0.0-rc.1/release-notes.md
+
+If useful, I can send the short sponsor packet and a proposed first 30-day plan.
+
+Affaan
+```
+
+## Platform Partner DM
+
+```text
+ECC 2.0 is getting close to rc.1.
+
+The release is centered on cross-harness agent workflows: reusable skills,
+hooks, rules, MCP conventions, release gates, and an optional Hermes operator
+shell.
+
+The partner angle is not "another prompt pack." It is a tested operating layer
+for teams using more than one AI coding harness.
+
+I think there is a real integration or co-launch angle here if your team wants
+better setup, policy, security, or workflow portability for agent users.
+
+Repo: https://github.com/affaan-m/ECC
+```
+
+## Consulting Intro
+
+```text
+I am open to a small number of ECC 2.0 implementation sprints for teams that
+are standardizing AI coding workflows.
+
+The useful scope is usually:
+
+1. audit the current harness setup;
+2. turn repeated workflows into ECC skills, hooks, and rules;
+3. add release, security, and CI gates;
+4. create a team operating loop that works across Claude Code, Codex, OpenCode,
+   Cursor, Gemini, Zed, GitHub Copilot, and terminal workflows.
+
+This is not generic AI consulting. The output is a working harness operating
+system your team can keep using.
+```
+
+## Talk And Podcast Pitch
+
+Title options:
+
+- Building a Cross-Harness Operating System for AI Coding
+- From Prompt Packs to Operator Systems
+- What Breaks When Teams Adopt Too Many AI Coding Harnesses
+- Security and Release Discipline for Agentic Coding Workflows
+
+Short pitch:
+
+```text
+ECC started as an open-source workflow layer for Claude Code and is now moving
+toward a cross-harness operating system for agentic work.
+
+The talk is about the practical problems teams hit after the first AI coding
+honeymoon: scattered prompts, duplicated setup, weak release gates, fragile
+security posture, and no clear operating loop across tools.
+
+I can show how ECC uses reusable skills, hooks, MCP conventions, release gates,
+AgentShield-style security checks, and an optional Hermes operator shell to make
+agentic work more measurable and portable.
+```
+
+## GitHub Discussion Announcement
+
+```text
+ECC v2.0.0-rc.1 preview pack is ready for final release review.
+
+The main point: ECC 2.0 is the harness-native operator system for agentic work.
+
+It now has a reviewed public surface for:
+
+- reusable skills, hooks, rules, and MCP conventions;
+- Claude Code, Codex, OpenCode, Cursor, Gemini, Zed, GitHub Copilot, and
+  terminal workflows;
+- Hermes as the optional operator shell;
+- release, security, queue, discussion, Linear, observability, and video-suite
+  gates.
+
+The release is still approval-gated until the GitHub prerelease, npm package,
+plugin paths, final URLs, and billing claims have live evidence.
+
+Feedback wanted: install friction, cross-harness gaps, partner integrations,
+sponsor fit, and examples of teams using multiple AI coding harnesses.
+```
+
+## Video CTA Hooks
+
+Use these with the release video suite:
+
+- "If your AI coding setup only works in one harness, it is not an operating
+  system yet."
+- "ECC 2.0 is the shared layer: skills, hooks, MCPs, release gates, and team
+  workflows across the tools people actually use."
+- "OSS stays free. Sponsors, Pro, and implementation work fund the public
+  layer."
+- "Start with one workflow lane: engineering, research, content, or outreach."
+
+## Do Not Send Or Publish If
+
+- The release URL ledger still has stale or placeholder links.
+- `npm run release:video-suite -- --format json` is not green against the
+  intended video roots.
+- The GitHub prerelease, npm package, plugin path, or billing claim is described
+  as live without evidence.
+- The message claims native payments are ready before ECC Tools billing readback
+  passes.
+- The recipient needs a custom promise that is not covered by `SPONSORS.md`,
+  `SPONSORING.md`, or a separate consulting scope.
+- The user has not approved outbound sponsor, partner, consulting, or media
+  messages.
+
+## Routing Links
+
+- Repo: <https://github.com/affaan-m/ECC>
+- Release notes: <https://github.com/affaan-m/ECC/blob/main/docs/releases/2.0.0-rc.1/release-notes.md>
+- Quickstart: <https://github.com/affaan-m/ECC/blob/main/docs/releases/2.0.0-rc.1/quickstart.md>
+- Sponsor: <https://github.com/sponsors/affaan-m>
+- Sponsor tiers: <https://github.com/affaan-m/ECC/blob/main/SPONSORS.md>
+- Sponsoring guide: <https://github.com/affaan-m/ECC/blob/main/SPONSORING.md>
@@ -15,8 +15,9 @@ surfaces, or posting announcements.
 | `docs/architecture/cross-harness.md` | Shared substrate model for Claude Code, Codex, OpenCode, Cursor, Gemini, Hermes, and terminal-only use | Names portability boundaries and does not claim unsupported native parity |
 | `docs/architecture/harness-adapter-compliance.md` | Adapter matrix and scorecard | Verified by `npm run harness:adapters -- --check` |
 | `docs/architecture/observability-readiness.md` | Local operator-readiness gate | Verified by `npm run observability:ready` |
-| `docs/architecture/progress-sync-contract.md` | GitHub, Linear, handoff, roadmap, and work-item sync boundary | Checked by `node scripts/platform-audit.js --format json --allow-untracked docs/drafts/` |
+| `docs/architecture/progress-sync-contract.md` | GitHub, Linear, handoff, roadmap, and work-item sync boundary | Checked by `node scripts/platform-audit.js --json` |
 | `scripts/preview-pack-smoke.js` | Deterministic preview-pack smoke gate | Verified by `npm run preview-pack:smoke` |
+| `scripts/release-approval-gate.js` | Final owner-decision, live-URL, and launch-copy gate | Must return ready true before any release publish, package publish, plugin tag, video upload, announcement, or outbound batch |
 | `docs/releases/2.0.0-rc.1/release-notes.md` | GitHub release copy source | Must be refreshed with final live release/package/plugin URLs before publication |
 | `docs/releases/2.0.0-rc.1/quickstart.md` | Clone-to-first-workflow path | Covers clone, install, verify, first skill, and harness switch |
 | `docs/releases/2.0.0-rc.1/launch-checklist.md` | Operator launch checklist | Must remain approval-gated for release, package, plugin, and announcement actions |
@@ -24,11 +25,17 @@ surfaces, or posting announcements.
 | `docs/releases/2.0.0-rc.1/publication-evidence-2026-05-15.md` | Current May 15 queue, roadmap, security, supply-chain watch, no-lifecycle CI install hardening, AgentShield #86 evidence-pack provenance, ECC Tools billing-gate, Actions cache purge, and `ecc2` test evidence through PR #1941 | Must be superseded by a final clean-checkout evidence file before real publication |
 | `docs/releases/2.0.0-rc.1/publication-evidence-2026-05-16.md` | Current May 16/17 queue cleanup, recsys skill merge, GateGuard triage, PR #1947 supply-chain protection, AgentShield #87 plugin-cache confidence evidence, AgentShield #88 evidence-pack inspect/readback, AgentShield #89 evidence-pack fleet routing, AgentShield #90 fleet review items, AgentShield #91 policy export, AgentShield #92 policy promotion, ECC-Tools #76 fleet-summary consumption, ECC-Tools #77 hosted finding evidence paths, ECC-Tools #78 harness policy-route linking, dashboard refresh, and combined Node/Rust/release-surface gate evidence through the May 16 mirror | Must still be repeated from a strict clean checkout before real publication |
 | `docs/releases/2.0.0-rc.1/publication-evidence-2026-05-17.md` | May 17 queue-zero state, Japanese localization merge, Dependabot TypeScript and Node type merges, post-merge ja-JP lint repair, Mini Shai-Hulud/TanStack protection recheck, npm audit/signature checks, legacy and Linear progress routing, deterministic preview-pack smoke, operator dashboard refresh, Linear sync, and GitHub CI evidence for `27dc2918` | Superseded by the May 18 evidence snapshot; repeat from a strict clean checkout before real publication |
-| `docs/releases/2.0.0-rc.1/publication-evidence-2026-05-18.md` | Current May 18 queue-zero state, #1970/#1971/#1972 merge batch, current-head Mini Shai-Hulud/TanStack protection recheck, no-lifecycle install, npm audit/signature checks, AgentShield project `.claude` scan, work-items sync, Linear sync, operator dashboard refresh, and Supply-Chain Watch success for `3b7e0ba3` | Current strongest readiness snapshot; must still be repeated from a strict clean checkout before real publication |
+| `docs/releases/2.0.0-rc.1/publication-evidence-2026-05-18.md` | May 18 queue-zero state, #1970/#1971/#1972 merge batch, #1978 review/closure, supply-chain recheck, AgentShield evidence mirror, Linear sync, current-head CI/security scan success for `4470e2e6`, and ITO-46 naming/plugin publication closure | Superseded by the May 19 ECC identity, video, and growth evidence snapshot |
+| `docs/releases/2.0.0-rc.1/publication-evidence-2026-05-19.md` | Current May 19/20 evidence for canonical ECC identity, release video suite, partner/sponsor/talk outreach pack, owner approval packet, release approval gate, May 20 operator dashboard, preview-pack smoke digest `eebb8a66c33e`, 2568-test local suite, PR #1998 visual QA CI success, PR #1999 dashboard evidence CI success, PR #2000 suite-count evidence success, PR #2001 owner approval packet CI success, PR #2002 owner-approval dashboard gate CI success, PR #2004 Linear readiness evidence sync CI success, PR #2008 supply-chain evidence gate CI success, post-PR #2006 main CI success, PR #2009 project-registry hygiene CI success, post-PR #2009 main CI success, post-PR #2011 GateGuard CI success, post-PR #2013 release-approval-gate CI success, PR #2017/#2018 AgentShield evidence sync, ECC-Tools #79 billing-announcement redaction hardening, ECC-Tools #80-#93 runtime-receipt, AgentShield approval-ID, Linear sync, remediation sync, hosted observability event/status/depth-plan/API readback, Marketplace Pro selected-target readback, selected-target announcement gate, env-file billing operator path, non-breaking operator bearer path, live `announcementGateReady: true`, AgentShield #94 Zed/VS Code adapter coverage, AgentShield #95 Dependabot alert closure, JARVIS #15/#16 queue/deploy repair, ECC #2019/#2020 Marketplace Pro gate sync, and the May 19/20 Linear sync comments | Current strongest readiness snapshot; must still be repeated from a strict clean checkout before real publication |
 | `docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-17.md` | Previous prompt-to-artifact operator dashboard | Superseded by the May 18 generated dashboard |
-| `docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-18.md` | Current prompt-to-artifact operator dashboard | Shows PR/issue/discussion/platform/supply-chain gates current and publication, plugin, billing, AgentShield, ECC Tools, legacy, and Linear productization gaps still open |
-| `docs/releases/2.0.0-rc.1/release-url-ledger-2026-05-18.md` | Live URL and approval-gated URL ledger for release copy | Must be regenerated from the final release commit before public announcements |
-| `docs/releases/2.0.0-rc.1/naming-and-publication-matrix.md` | Naming, slug, and publication-path decision record | Keeps `Everything Claude Code / ECC`, npm `ecc-universal`, and plugin slug `ecc` for rc.1 |
+| `docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-18.md` | Previous prompt-to-artifact operator dashboard | Superseded by the May 19 generated dashboard |
+| `docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-19.md` | Previous prompt-to-artifact operator dashboard | Superseded by the May 20 generated dashboard |
+| `docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-20.md` | Current prompt-to-artifact operator dashboard | Shows PR/issue/discussion/platform/supply-chain gates current and adds the current `$1,728/mo` to `$10,000/mo` hypergrowth, video owner-approval, Linear release-gate sync, selected-target billing gate, operator bearer path, live billing gate pass, and outbound-pack operating lanes |
+| `docs/releases/2.0.0-rc.1/owner-approval-packet-2026-05-19.md` | Final human decision sheet for release, package, plugin, video, billing, social, and outbound approvals | Must be reviewed by the owner before any publication or outbound action |
+| `docs/releases/2.0.0-rc.1/release-url-ledger-2026-05-19.md` | Live URL and approval-gated URL ledger for release copy | Must be regenerated from the final release commit before public announcements |
+| `docs/releases/2.0.0-rc.1/video-suite-production.md` | Release video production manifest | Gates local media inventory, rough primary render, captions, timeline, self-eval, and no-private-path publication rules |
+| `docs/releases/2.0.0-rc.1/partner-sponsor-talks-pack.md` | Partner, sponsor, consulting, conference, podcast, and discussion copy | Must stay approval-gated and avoid live billing, release, package, or plugin claims without evidence |
+| `docs/releases/2.0.0-rc.1/naming-and-publication-matrix.md` | Naming, slug, and publication-path decision record | Keeps `ECC`, npm `ecc-universal`, and plugin slug `ecc` for rc.1 |
 | `docs/releases/2.0.0-rc.1/release-name-plugin-publication-checklist-2026-05-18.md` | Release name, package, Claude plugin, Codex plugin, and publication-order checklist | Freezes rc.1 identity and requires final commit evidence before release, npm, plugin, billing, or announcement actions |
 | `docs/releases/2.0.0-rc.1/x-thread.md` | X launch draft | Must replace placeholders with live URLs after release/package/plugin publication |
 | `docs/releases/2.0.0-rc.1/linkedin-post.md` | LinkedIn launch draft | Must replace placeholders with live URLs after release/package/plugin publication |
@@ -73,8 +80,10 @@ Run these from the exact release commit before publication:

 ```bash
 git status --short --branch
-node scripts/platform-audit.js --format json --allow-untracked docs/drafts/
+node scripts/platform-audit.js --json
 npm run preview-pack:smoke
+npm run release:approval-gate -- --format json
+npm run release:video-suite -- --format json
 npm run harness:adapters -- --check
 npm run harness:audit -- --format json
 npm run observability:ready
@@ -92,6 +101,8 @@ The preview pack is assembled, but publication is still blocked until these live
 surfaces exist and are recorded in a final evidence file:

 - final release URL ledger regenerated from the intended release commit;
+- `npm run release:approval-gate -- --format json` returning ready true after
+  owner approvals and live URL readbacks are recorded;
 - final release name/plugin publication checklist rerun from the intended
  release commit;
 - GitHub prerelease `v2.0.0-rc.1`;
@@ -100,8 +111,10 @@ surfaces exist and are recorded in a final evidence file:
 - Codex repo-marketplace distribution evidence plus official Plugin Directory
  availability status;
 - final announcement URLs in X, LinkedIn, GitHub release, and longform copy;
- ECC Tools billing/product readiness evidence before any native-payments
-  announcement copy is published.
+- ECC Tools billing/product readiness evidence remains fresh: the May 20
+  selected-target KV readback and live announcement gate passed through the
+  operator bearer path. Repeat the billing readback and gate immediately before
+  any native-payments announcement copy is published.

 ## Result

@@ -7,10 +7,10 @@ npm publication, plugin tag, marketplace submission, or announcement post.

 | Field | Evidence |
 | --- | --- |
-| Upstream main | `680aeff0fb9a8598858e3105ba4742973ef386ab` |
+| Upstream main | `4470e2e6702f17099d6feb137ba03ff00582c202` |
 | Git remote | `https://github.com/affaan-m/everything-claude-code.git` |
-| Evidence scope | Current `main` after PR #1970 workflow-security validator bypass fixes, PR #1971 metrics bridge cost-reporting fixes, PR #1972 `uncloud` skill merge, PR #1973 stale script cleanup, issue #1974 cost-reporting verification/closure, PR #1976 OpenAI/AstraFlow provider response guards, catalog/operator dashboard refresh, ECC-Tools Wrangler OAuth billing readback mirror, Mini Shai-Hulud/TanStack protection recheck, defensive-deny IOC scanner hardening, release name/plugin publication checklist, readiness/smoke gate enforcement for that checklist, current-head CI/security scan, work-items sync, and Linear progress sync |
-| Local status caveat | `git status --short --branch` showed `## main...origin/main` plus unrelated untracked `docs/drafts/`; generated evidence files are committed after the source snapshot they describe |
+| Evidence scope | Current `main` after PR #1970 workflow-security validator bypass fixes, PR #1971 metrics bridge cost-reporting fixes, PR #1972 `uncloud` skill merge, PR #1973 stale script cleanup, issue #1974 cost-reporting verification/closure, PR #1976 OpenAI/AstraFlow provider response guards, PR #1978 review/closure, catalog/operator dashboard refresh, ECC-Tools Wrangler OAuth billing readback mirror, AgentShield `840952a` fleet-ticket and Mini Shai-Hulud IOC evidence mirror, Mini Shai-Hulud/TanStack protection recheck, defensive-deny IOC scanner hardening, release name/plugin publication checklist, readiness/smoke gate enforcement for that checklist, release OIDC publishing-scope hardening, workflow line-ending normalization, current-head CI/security scan, work-items sync, Linear progress sync, the ITO-46 publication-path dry-run refresh, ITO-46 Linear closure, and the post-closure operator dashboard refresh |
+| Local status caveat | `git status --short --branch` was clean at dashboard generation time; generated evidence files are committed after the source snapshot they describe |

 The actual release operator should repeat all publish-facing checks from the
 final release commit with a strictly clean checkout before publishing.
@@ -24,7 +24,7 @@ final release commit with a strictly clean checkout before publishing.
 | Discussion audit | `npm run discussion:audit -- --json` | Ready; 58 sampled discussions in `affaan-m/everything-claude-code`, 0 needing maintainer touch, 0 answerable discussions missing accepted answer, and 0 fetch errors |
 | Platform audit | `node scripts/platform-audit.js --json --allow-untracked docs/drafts/` | Ready; tracked repos report 0 open PRs, 0 open issues, 0 discussion maintainer-touch gaps, 0 answerable Q&A missing accepted answers, and 0 blocking dirty files |
 | Work-items sync | `node scripts/work-items.js sync-github --repo <tracked-repo>` for five tracked repos; `node scripts/status.js --json`; `node scripts/work-items.js list --json` | All five tracked repos synced with 0 open PRs/issues and no changed work items; local status reports 0 open, 0 blocked, and 0 closed work items |
-| Operator dashboard | `node scripts/operator-readiness-dashboard.js --markdown --allow-untracked docs/drafts/ --write docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-18.md` | Generated current dashboard for `680aeff0fb9a8598858e3105ba4742973ef386ab`; dashboard ready true, publication ready false because release, npm, plugin, billing, and announcement gates are approval-gated; ECC Tools target-account billing readback remains the documented native-payments gate; the naming/plugin row now requires the release-name/plugin publication checklist |
+| Operator dashboard | `npm run operator:dashboard -- --markdown --write docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-18.md` | Regenerated at `4470e2e6702f17099d6feb137ba03ff00582c202`; dashboard ready true, publication ready false because release, npm, plugin, billing, and announcement gates are approval-gated; 0 PRs, 0 issues, and 0 discussion gaps remain across tracked repos; AgentShield enterprise evidence includes `840952a`; ECC Tools native-payments gate now names the narrowed ITO-61 blocker: create or verify Marketplace-managed Pro target billing-state with webhook provenance, configure the target account and `INTERNAL_API_SECRET`, then rerun target readback and the live announcement gate |

 Tracked repositories in the platform audit and work-items sync were:

@@ -49,8 +49,14 @@ Tracked repositories in the platform audit and work-items sync were:
 | Defensive-deny IOC scanner hardening | Pushed `04d4d819` so explicit Claude `permissions.deny` IOC entries are treated as defensive controls while the same IOC still fails in hooks, tasks, scripts, locks, and payload files; local `npm test` passed 2511/2511 and current-head CI `26017368895` passed 37/37 |
 | Release name/plugin publication checklist | Pushed `6c0fbfb6` to add `docs/releases/2.0.0-rc.1/release-name-plugin-publication-checklist-2026-05-18.md`; the artifact freezes rc.1 as Everything Claude Code / ECC, keeps npm `ecc-universal`, keeps Claude/Codex plugin slug `ecc`, cites current Anthropic/OpenAI plugin publication paths, and blocks rename/npm publish/plugin tag/submission/billing/social actions until final release evidence exists; GitHub Actions CI `26034898420` passed |
 | Dashboard and preview-pack checklist enforcement | Added `680aeff0` so `scripts/operator-readiness-dashboard.js` and `scripts/preview-pack-smoke.js` require the release-name/plugin publication checklist; local dashboard and smoke tests passed and preview-pack smoke now enforces 26 required artifacts |
+| AgentShield enterprise evidence mirror | Added `2ba0c62d` and refreshed the dashboard generator/GA roadmap/AgentShield enterprise roadmap so the ECC release evidence names AgentShield `840952a` fleet review ticket payloads and current Mini Shai-Hulud IOC breadcrumb coverage |
+| PR #1978 | Closed broad/failing outside Excel harness PR after review; recorded a corrected split path for a future smaller Excel harness proposal, install-target/tooling PR, plugin-runtime PR, and translation-automation PR |
+| Announcement draft tracking | Added `docs/drafts/release-1.10.1-announcement.md` so the stabilization announcement draft is tracked instead of remaining as release-blocking untracked local state |
 | Clean-worktree preview-pack smoke | Detached worktree at `680aeff0fb9a8598858e3105ba4742973ef386ab`; `node scripts/preview-pack-smoke.js --root <worktree> --format json` passed 5/5 with digest `0ed831dbd0cf`; 26 required artifacts, final verification commands, Hermes public sanitization boundary, and approval-gated publication blockers were all preserved |
 | Public queues | Rechecked after the merge and issue-closure batch; 0 PRs, 0 issues, and 0 discussion gaps remain across tracked repos |
+| Release OIDC publishing scope | Pushed `7911af4a` to keep the release workflow's trusted-publishing path scoped to release publication instead of broadening OIDC permissions across unrelated jobs; local workflow security validation passed |
+| Release workflow normalization | Pushed `97567a91` to normalize release workflow line endings after the OIDC hardening slice; current-head CI `26050727969` passed for `97567a91e79e1ee4c291eb78f5f9c30c2046ac94` |
+| Operator readiness evidence refresh | Pushed `0f1775e3`, `fe7b4f2b`, and `67e63e63` to refresh blocker evidence, regenerate the operator dashboard, and align publication readiness to the latest CI/security evidence; pushed `4470e2e6` to close ITO-46 publication-path evidence, then regenerated the dashboard at `4470e2e6702f17099d6feb137ba03ff00582c202`; current-head CI `26057806361` passed for `4470e2e6702f17099d6feb137ba03ff00582c202` |

 ## Supply-Chain And Security Evidence

@@ -58,23 +64,46 @@ Tracked repositories in the platform audit and work-items sync were:
 | --- | --- | --- |
 | Repo IOC scan | `npm run security:ioc-scan` | Passed; 198 files inspected |
 | Home persistence IOC scan | `node scripts/ci/scan-supply-chain-iocs.js --home --json` | Passed; 200 files inspected; `findings: []` |
+| ECC workspace IOC recheck | `node scripts/ci/scan-supply-chain-iocs.js --root <local ECC root> --home --json` | Passed; 1212 files inspected; `findings: []`; exact local path is kept out of public release evidence |
 | Narrow active persistence sweep | Targeted search over user-level Claude, VS Code, LaunchAgent/systemd, local-bin, `/tmp`, and `/private/tmp` campaign paths | Existing active targets: 2; no campaign marker hits |
 | Scanner fixture tests | `node tests/ci/scan-supply-chain-iocs.test.js` | 20 passed, 0 failed, including defensive Claude deny-wall pass and hook-with-same-IOC fail-closed coverage |
 | Advisory source refresh | `node scripts/ci/supply-chain-advisory-sources.js --refresh --json` | Ready with 9 sources; live refresh produced 1 OpenAI URL warning from Node fetch while primary TanStack, GitHub advisory, StepSecurity, Wiz, Socket, npm, and CISA sources returned OK |
 | No-lifecycle install | `npm ci --ignore-scripts` | Completed cleanly; 213 packages installed, 0 vulnerabilities |
 | npm audit | `npm audit --audit-level=high` | 0 vulnerabilities |
 | npm signatures | `npm audit signatures` | 213 verified registry signatures; 17 verified attestations |
-| Workflow security | `node scripts/ci/validate-workflow-security.js` | Validated 8 workflow files |
+| Workflow security | `node scripts/ci/validate-workflow-security.js` | Validated 8 workflow files after the release OIDC publishing-scope hardening |
 | AgentShield project scan | `npx --no-install ecc-agentshield scan --format json` | Grade A / 99; 0 critical, 0 high, 0 medium; 6 low docs-example skill telemetry/governance findings |
-| Current-head CI security scan | `gh run view 26017368895 --repo affaan-m/everything-claude-code --json status,conclusion,jobs,url` | Completed successfully for `04d4d81938b20ac2bac1f0025145ab77d6a59f5f`; 37/37 CI jobs passed, including lint, workflow/component validation, coverage, cross-platform package-manager tests, npm audit, and supply-chain IOC scan |
+| Current-head CI security scan | `gh run view 26057806361 --repo affaan-m/everything-claude-code --json status,conclusion,headSha,jobs,url` | Completed successfully for `4470e2e6702f17099d6feb137ba03ff00582c202`; 37/37 CI jobs passed, including lint, workflow/component validation, coverage, cross-platform package-manager tests, npm audit, and supply-chain IOC scan |
 | Latest Supply-Chain Watch | `gh run view 26010432490 --repo affaan-m/everything-claude-code --json status,conclusion,headSha,url` | Completed successfully for `25ac57ac40e9fc5a0606e76e6339e72c79748c99`; rerun from the final release commit before publication |

+## ITO-46 Publication Path Refresh
+
+| Gate | Command | Result |
+| --- | --- | --- |
+| Clean publication-path baseline | `git status --short --branch`; `git rev-parse HEAD`; `git remote get-url origin` | Clean `main` at `67e63e63f9bfd074bd6a21bf6bac71f3dfefa58b`; remote `https://github.com/affaan-m/everything-claude-code.git` |
+| Package/plugin identity readback | `node -p "JSON.stringify({pkg, claude, codex, opencode}, null, 2)"` | `ecc-universal@2.0.0-rc.1`; Claude plugin `ecc@2.0.0-rc.1`; Codex plugin `ecc@2.0.0-rc.1`; OpenCode package `ecc-universal@2.0.0-rc.1` |
+| Name availability | `npm view ecc name version description repository.url --json`; `npm view @affaan-m/ecc name version --json`; `npm view ecc-universal name version dist-tags --json` | `ecc` is occupied by unrelated `ecc@0.0.2`; `@affaan-m/ecc` returns 404; `ecc-universal` registry latest remains `1.10.0` with no `next` dist-tag |
+| Plugin manifest tests | `node tests/plugin-manifest.test.js` | 54 passed, 0 failed |
+| Release surface tests | `node tests/docs/ecc2-release-surface.test.js` | 21 passed, 0 failed |
+| Claude plugin validation | `claude plugin validate .claude-plugin/plugin.json`; `claude plugin validate .`; `claude plugin tag .claude-plugin --dry-run` | Claude Code `2.1.143`; manifest validation passed; full plugin validation passed with one expected root `CLAUDE.md` context warning; tag dry run would create `ecc--v2.0.0-rc.1` |
+| Claude marketplace source help | `claude plugin marketplace add --help`; `claude plugin marketplace update --help` | Marketplace add supports URL, local path, GitHub repo, `--scope`, and `--sparse`; update supports targeted or all-marketplace refresh |
+| Codex marketplace help | `codex plugin marketplace add --help` | Codex CLI `0.131.0`; marketplace add supports local paths, `owner/repo[@ref]`, HTTPS Git URL, SSH Git URL, `--ref`, and `--sparse` |
+| Codex local marketplace smoke | `HOME="$(mktemp -d)" codex plugin marketplace add ./` | Added marketplace `ecc` from the local checkout without touching the real Codex config |
+| Codex GitHub-ref marketplace smoke | `HOME="$(mktemp -d)" codex plugin marketplace add affaan-m/everything-claude-code --ref "$(git rev-parse HEAD)"` | Added marketplace `ecc` from the public GitHub repo pinned to `67e63e63f9bfd074bd6a21bf6bac71f3dfefa58b` without touching the real Codex config |
+| npm package dry-run | `NPM_CONFIG_USERCONFIG=/dev/null npm pack --dry-run --json`; `NPM_CONFIG_USERCONFIG=/dev/null npm publish --tag next --dry-run` | Pack produced `ecc-universal-2.0.0-rc.1.tgz`, 2228 files, 4,348,504 bytes packed, 13,024,929 bytes unpacked, shasum `29d6a17029d80f5cb1df068880ba86c55a5d60f1`; publish dry-run would publish `ecc-universal@2.0.0-rc.1` with tag `next` |
+| OpenCode package build | `npm run build:opencode` | Passed |
+| Preview pack smoke | `npm run preview-pack:smoke` | Ready yes; digest `0ed831dbd0cf`; 5 passed, 0 failed |
+| Official docs check | Anthropic `https://code.claude.com/docs/en/plugins` and `https://code.claude.com/docs/en/plugin-marketplaces`; OpenAI `https://developers.openai.com/codex/plugins/build` | Anthropic documents self-hosted marketplace sources; OpenAI documents repo/personal marketplaces and the official Plugin Directory. ECC has not created a real release tag, official listing, or npm publication in this pass |
+| ITO-46 closure | Linear ITO-46 comment `9ef92056-ab23-4eed-bfdb-932dddc2b056`; Linear issue status `Done`; GitHub Actions `26057806361` | Publication-path docs now record every channel, name conflicts, package/plugin dry-run commands, and blocker register; Codex repo-marketplace distribution is verified but official Plugin Directory listing is not claimed before OpenAI submission/listing evidence |
+
 ## Linear Progress Sync

 | Surface | Evidence |
 | --- | --- |
-| ITO-57 issue comments | `0b9931b9-1556-4ebc-a70c-f3635557625d` records May 18 queue counts, #1970/#1971/#1972/#1976 merge evidence, supply-chain verification, current-head CI URL, deferred gates, and next slices; reply `6fa15367-d994-4e53-ade3-9462477e1100` records the expanded TanStack/Mini Shai-Hulud recheck, defensive-deny scanner fix, current-head CI `26017368895`, and post-push platform audit |
-| ECC platform project comment | `e32e5b7a-287b-4bf4-9ed7-314389a157e1` records the same current public queue, security, #1976, and remaining-gate state at the project level |
+| ITO-57 issue comments | `0b9931b9-1556-4ebc-a70c-f3635557625d` records May 18 queue counts, #1970/#1971/#1972/#1976 merge evidence, supply-chain verification, current-head CI URL, deferred gates, and next slices; reply `6fa15367-d994-4e53-ade3-9462477e1100` records the expanded TanStack/Mini Shai-Hulud recheck, defensive-deny scanner fix, current-head CI `26017368895`, and post-push platform audit; comment `3fe5b2b7-c4fe-401c-a317-b40d72119cb3` records the final emergency refresh against `97567a91`, AgentShield `4e36aab`, clean ECC/Ito/Documents workspace IOC scans, absent dead-man/persistence artifacts, and package-manager/Claude deny-wall posture; comment `43837404-c01c-4aaa-b5e2-1e784c136d69` records ECC-Tools `brace-expansion` alert 44 fixed in `e56fc1a` with CI `26054671308` and Dependabot API `state: fixed` |
+| ITO-52 issue status | `f2e5a208-de91-4a3a-960b-5362d12aa5a4` records ECC-Tools `69ca535` team-learning feedback controls, local verification, and CI `26054455434`; Linear ITO-52 is Done |
+| ITO-61 issue status | `6904e4fb-bec7-4787-90e2-759f077a628c` records the narrowed native-payments readback blocker: Wrangler OAuth now works, aggregate readback is clean, but there is still no Marketplace-managed Pro target billing-state with webhook provenance and the local announcement preflight is missing the target account plus `INTERNAL_API_SECRET` |
+| ECC platform project comment | `e32e5b7a-287b-4bf4-9ed7-314389a157e1` records the earlier current public queue, security, #1976, and remaining-gate state at the project level; follow-up ITO-44 comments `a01eeef3-c69b-48c0-8804-a4682acfc1ef` and `6b0885cc-c4e9-40db-899b-f7b88b4aa046` record ITO-52 completion and the fixed ECC-Tools Dependabot alert |
 | Project status update caveat | Linear returned "Project status updates are not enabled for this workspace"; project comment was used as the supported status surface |

 ## Current Publication Blockers
@@ -92,26 +121,30 @@ Tracked repositories in the platform audit and work-items sync were:
  `npm run billing:kv-readback -- --account <github-login> --require-ready`
  with working Cloudflare API auth or repaired Wrangler OAuth, followed by
  `npm run billing:announcement-gate -- --account <github-login>`, return
-  announcement-ready gates. The latest API-authenticated aggregate readback
-  from the ECC vault Cloudflare credential found 253 `account-billing:*`
-  records, 253 `billing-state:*` records, 0 Marketplace Pro states, 0
-  ready-like Marketplace Pro states, and 0 parse failures; local Wrangler OAuth
-  currently fails with Cloudflare authentication error `10000`. ECC-Tools
+  announcement-ready gates. The latest Wrangler OAuth aggregate readback found
+  256 `account-billing:*` records, 256 `billing-state:*` records, 197
+  Marketplace-source records, 59 Stripe-source records, 53 Pro records, 4
+  Marketplace webhook-provenance records, all `Open Source`, 0 Marketplace Pro
+  states, 0 ready-like Marketplace Pro states, and 0 parse failures. ECC-Tools
  commit `632e059` adds the follow-up target-account readback mode, redacts
  the account login and raw KV key names, and requires both target key families
-  before `--require-ready` can pass. Linear ITO-61 now tracks the exact
-  target-account acceptance criteria.
+  before `--require-ready` can pass. ECC-Tools commit `13cd3fc` normalizes
+  billing-state key casing. The latest ITO-61 retry fails because no
+  Marketplace-managed Pro state exists and the announcement preflight is
+  missing the target account plus `INTERNAL_API_SECRET`; Linear ITO-61 tracks
+  the exact target-account acceptance criteria.
 - Release notes, X, LinkedIn, GitHub release, and longform copy still need final
  live URLs after release/package/plugin URLs exist.
- The local checkout still has unrelated untracked `docs/drafts/`, so a strict
-  clean-checkout release pass remains required before real publication.
+- The local checkout is clean after the dashboard/evidence refresh, but a
+  strict clean-checkout release pass remains required before real publication.

 ## Result

 The tracked public PR queue, issue queue, discussion queue, local work-items
 bridge, release-name/plugin publication gate, and Mini Shai-Hulud/TanStack
 protection loop are current on May 18, 2026 for current `main` through
-`680aeff0`, with follow-up ECC Tools billing-gate hardening in `632e059`.
+`97567a91`, with follow-up ECC Tools billing-gate hardening in `632e059`
+and AgentShield enterprise/security hardening through `4e36aab`.
 This improves publication readiness but does not replace the approval-gated
 release, package, plugin, billing, and announcement steps in
 `publication-readiness.md`.
@@ -0,0 +1,207 @@
+# ECC v2.0.0-rc.1 Publication Evidence - 2026-05-19
+
+This is release-readiness evidence only. It does not create a GitHub release,
+npm publication, plugin tag, marketplace submission, billing announcement, or
+social announcement.
+
+## Source Commit
+
+| Field | Evidence |
+| --- | --- |
+| Upstream main | `c2471fe5c535310f8a8008c9ed7ea9f6757b33f2` |
+| Git remote | `https://github.com/affaan-m/ECC.git` |
+| Evidence scope | Current `main` after PR #1990 harness-audit GitHub integration scoring, PR #1991 canonical ECC identity gate, PR #1992 release video-suite gate, PR #1993 growth outreach pack, PR #1994 May 19 publication evidence refresh, PR #1995 operator dashboard refresh, PR #1996 primary render self-eval gate, PR #1997 publish-candidate gate, PR #1998 visual QA gate, PR #1999 video dashboard evidence refresh, PR #2000 suite-count evidence refresh, PR #2001 owner approval packet addition, PR #2002 owner approval dashboard gate refresh, PR #2004 Linear readiness evidence sync, PR #2005 post-PR #2004 evidence refresh, PR #2008 release supply-chain evidence gate fix, PR #2006 per-project Claude Code adapter, PR #2009 continuous-learning project registry hygiene fix, PR #2011 GateGuard quoted git introspection fix, PR #2013 deterministic release approval gate, PR #2017 AgentShield adapter evidence sync, PR #2018 AgentShield Dependabot evidence sync, ECC-Tools #80-#91 hosted observability/readback, Marketplace Pro selected-target, selected-target announcement gate, and env-file operator-path batch, AgentShield #94 Zed/VS Code adapter coverage, AgentShield #95 Dependabot alert closure, PR #2019 Marketplace Pro release-gate sync, and PR #2020 selected-target announcement gate sync |
+| Local status caveat | `git status --short --branch` was clean after pulling `origin/main`; generated evidence files are committed after the source snapshot they describe |
+
+The release operator must repeat all publish-facing checks from the exact final
+release commit with a strictly clean checkout before publishing.
+
+## Queue And Discussion State
+
+| Surface | Command | Result |
+| --- | --- | --- |
+| Platform audit | `node scripts/platform-audit.js --json` | Ready true; tracked repos report 0 open PRs, 0 open issues, 0 discussion maintainer-touch gaps, 0 answerable Q&A gaps, 0 conflicting PRs, and 0 blocking dirty files |
+| Trunk PRs | `gh pr list --repo affaan-m/ECC --state open --json number,title,url,author --limit 100` | `[]` |
+| Trunk issues | `gh issue list --repo affaan-m/ECC --state open --json number,title,url,author --limit 100` | `[]` |
+| Discussion audit through platform audit | `node scripts/platform-audit.js --json` | `affaan-m/ECC` discussions enabled; 60 sampled after #2015 setup-location Q&A was answered and accepted; 0 needing maintainer touch; 0 answerable without accepted answer |
+| Worktree | `git status --short --branch` | `## main...origin/main` |
+
+Tracked repositories in the platform audit were:
+
+- `affaan-m/ECC`
+- `affaan-m/agentshield`
+- `affaan-m/JARVIS`
+- `ECC-Tools/ECC-Tools`
+- `ECC-Tools/ECC-website`
+
+## Merge Batch
+
+| Item | Result |
+| --- | --- |
+| PR #1990 | Merged GitHub integration harness-audit scoring and conflict salvage from the earlier unsafe PR lane |
+| PR #1991 | Merged canonical ECC release identity gate across README, plugin/package metadata, OpenCode surfaces, Marketplace metadata, audit defaults, quickstart, release URL ledger, naming/publication matrix, and release tests |
+| PR #1992 | Merged the release video-suite gate, production manifest, validator, package file surface, preview-pack smoke wiring, release-surface tests, and compact CI JSON output |
+| PR #1993 | Merged the partner, sponsor, consulting, conference, podcast, GitHub Discussion, and video CTA pack for the hypergrowth outbound lane |
+| PR #1994 | Merged the May 19 publication-evidence refresh, platform-audit evidence gate, preview-pack smoke evidence gate, and URL/readiness/roadmap references |
+| PR #1995 | Merged the May 19 operator dashboard refresh with the `$1,728/mo` MRR baseline, `$10,000/mo` target, and release/video/outbound top actions |
+| PR #1996 | Merged the primary launch render self-eval gate for duration, size, resolution, video stream, and audio stream checks |
+| PR #1997 | Merged the publish-candidate gate for the primary launch MP4/captions plus five short clips in wide and vertical formats |
+| PR #1998 | Merged the release video visual QA gate for publish candidates and black-frame segment detection |
+| PR #1999 | Merged the operator dashboard refresh that moved the release video suite to current once publish-candidate evidence was recorded |
+| PR #2000 | Merged the suite-count evidence refresh so the platform audit rejects stale local-suite totals |
+| PR #2001 | Merged the final human decision sheet for release, package, plugin, video, billing, social, and outbound approvals; GitHub Actions run `26102500291` completed successfully |
+| PR #2002 | Merged the owner-approval dashboard refresh so the operator dashboard fails closed when the final decision sheet is missing or incomplete; CI passed before merge |
+| PR #2004 | Merged the May 19 Linear readiness evidence sync after PR #2002, including roadmap, dashboard, preview-pack manifest, publication evidence, operator dashboard generator, and release-surface test updates |
+| PR #2005 | Merged the post-PR #2004 evidence refresh, keeping the May 19 readiness ledger, dashboard, roadmap, and release-surface references current on `main` |
+| PR #2008 | Merged the release supply-chain evidence gate fix so platform-audit readiness keeps matching current publication evidence |
+| PR #2006 | Merged the `claude-project` install target for per-project Claude Code adapter support, then fixed the manifest schema enum on top of the feature branch before merge |
+| PR #2009 | Merged the continuous-learning project registry hygiene fix: non-git hook payloads stay global, no-remote linked worktrees migrate to the main worktree project ID, and `instinct-cli.py projects delete`, `merge`, and `gc` provide operator maintenance commands |
+| PR #2011 | Merged the GateGuard read-only git introspection tokenizer fix so quoted `git show` pathspecs with spaces are preserved while quoted shell separators stay outside the bypass |
+| PR #2013 | Merged the deterministic `release:approval-gate` so final publication, package, plugin, video, billing, social, and outbound actions remain blocked until owner decisions and live URL readbacks are complete |
+| PR #2017 | Merged the AgentShield #94 evidence mirror as `906e06406e95742944ccb05065f95a7e4dd4a036`, syncing roadmap, publication evidence, preview-pack manifest, and supply-chain incident-response surfaces after full GitHub CI passed |
+| PR #2018 | Merged the AgentShield #95 Dependabot evidence mirror as `68b4e45145968acd52e68d900f8422061ed7f4a2`, syncing the roadmap, publication evidence, and preview-pack manifest after full PR CI passed |
+| PR #2019 | Merged the Marketplace Pro selected-target release-gate sync as `30f60710d4e0424fc70d9bbdc105009db141d9d8`, updating the roadmap, publication evidence, naming matrix, preview manifest, and operator dashboard after full PR CI passed |
+| PR #2020 | Merged the selected-target announcement gate sync as `c2471fe5c535310f8a8008c9ed7ea9f6757b33f2`, updating the roadmap, publication evidence, naming matrix, preview manifest, release URL ledger, platform audit surfaces, and operator dashboard after full PR CI passed |
+
+## Post-Queue-Zero Sync - 2026-05-19 Late Pass
+
+| Surface | Evidence |
+| --- | --- |
+| ECC approval gate | PR #2013 merged as `9819626459a662773be7d0b1c18d82c1316b8c36`; GitHub Actions run `26128749863` completed successfully; `npm run release:approval-gate -- --format json` remains intentionally blocked with digest `ef8f49f727b7`, 4/6 passing, and failures only on owner decisions plus live URL readbacks |
+| ECC platform audit | `node scripts/platform-audit.js --json` at `2026-05-19T22:45:15Z` returned ready true, 0 open PRs, 0 open issues, 0 discussion maintainer-touch gaps, 0 answerable Q&A gaps, and 0 dirty blockers across `affaan-m/ECC`, `affaan-m/agentshield`, `affaan-m/JARVIS`, `ECC-Tools/ECC-Tools`, and `ECC-Tools/ECC-website` |
+| ECC-Tools billing hardening | ECC-Tools PR #79 merged as `67ee247ae1b7b50ecc1261ed5d62d65cc8390da8`; preflight and live billing-announcement output now redact account login values to a stable fingerprint while preserving readiness blockers/actions; local validation passed targeted tests, full test suite 678/678, lint, typecheck, manual preflight, and `git diff --check`; post-merge main CI run `26129253509` completed successfully |
+| JARVIS queue drain | JARVIS PR #15 merged the Dependabot `idna` 3.11 to 3.15 security bump as `4b3685d6ee23b4da1f1a7d22281c6b5d6c0a42c7`; PR checks and post-merge CI/CodeQL passed |
+| JARVIS deploy repair | JARVIS PR #16 merged as `4369c34babd21d539c420866da51c7a8365f1c9e`; the deploy workflow no longer uses an invalid job-level `secrets.*` condition, Vercel deploy skips cleanly when secrets are absent, backend image build/push succeeds, and main CI, CodeQL, and Deploy runs `26129539376`, `26129539427`, and `26129539425` completed successfully |
+| Linear roadmap sync | Linear document `ecc-may-19-late-queue-zero-and-release-gate-sync-1c26f65e6b3f`, project comment `d42bf0e2-7a8e-4934-9f3f-e281498ee805`, and issue comments on ITO-44, ITO-50, ITO-54, ITO-56, and ITO-61 record the late-pass queue-zero, release-gate, billing-safety, and progress-sync state. |
+
+## May 20 Hosted Observability And AgentShield Adapter Sync
+
+| Surface | Evidence |
+| --- | --- |
+| ECC discussion queue | Discussion #2015 was answered and marked accepted with conservative setup guidance: do not install in `C:\`; use a normal workspace; install `ecc@ecc` once through the Claude plugin marketplace; copy only needed rule folders when using manual rules; do not stack plugin plus full manual install. |
+| ECC platform audit | `node scripts/platform-audit.js --json` at `2026-05-20T00:25:38Z` returned ready true with 0 open PRs, 0 open issues, 0 discussion maintainer-touch gaps, 0 answerable Q&A gaps, 0 conflicting PRs, and 0 dirty blockers across `affaan-m/ECC`, `affaan-m/agentshield`, `affaan-m/JARVIS`, `ECC-Tools/ECC-Tools`, and `ECC-Tools/ECC-website`. |
+| ECC platform audit recheck | `npm run platform:audit -- --json` at `2026-05-20T00:42:11Z` returned ready true with 0 open PRs, 0 open issues, 0 discussion maintainer-touch gaps, 0 answerable Q&A gaps, 0 conflicting PRs, 0 GitHub errors, and 0 dirty blockers across the same tracked repo set after AgentShield #94 merged. |
+| ECC-Tools #80/#81/#82 | PR #80 merged runtime-receipt failure-reason enforcement as `4efc8cc858022f84c844690f3298633b081c4398`; PR #81 preserved AgentShield fleet approval IDs as `1fbf635f492284f75ba7166c029c39eb8cc15794`; PR #82 rendered those approval IDs in hosted security review comments/check-runs as `7a7b4d096a176ae80b3a2076c09d45601e36013a`. |
+| ECC-Tools #83/#84 | PR #83 merged deterministic Linear external-ID reuse for deferred follow-ups as `b6b107f33961bef18a85fb619f3a976eb5d752dd`; PR #84 merged hosted AgentShield remediation sync to Linear as `73bac7058071c55cb30c6b8ac6db779b3660c02c`. Local validation covered focused route/client tests, typecheck, lint, full ECC-Tools test suite, and whitespace checks before merge; GitHub Verify, Security Audit, and Workers Builds passed. |
+| ECC-Tools #85/#86/#87 | PR #85 merged hosted job observability events as `1637e0f2bfa0a889387f2c20675680ccc5528123`; PR #86 merged hosted status observability readback as `5a9e94d3ff860307c3e7fd9fd065f0de2bd633dd`; PR #87 merged hosted depth-plan observability readback as `508fbc02b63cf1fcb5af2f3624608fa66e53b5d4`. Local validation for the final depth-plan readback slice passed the focused hosted depth-plan route test, full route suite (89/89), typecheck, lint, full ECC-Tools Vitest suite (683/683), and `git diff --check`; GitHub Verify, Security Audit, and Workers Builds passed before merge. |
+| ECC-Tools #88 | PR #88 merged authenticated hosted observability API readback as `c836ac3fb24ed7e2ae38cd61e41c9651ac9c00f8`. `GET /api/analysis/observability` now summarizes hosted events by event type and job for operator/dashboard readback, skips malformed stale KV records, and the deployment runbook includes the production smoke command. Local verification passed typecheck, lint, full ECC-Tools Vitest suite (686/686), and `git diff --check`; GitHub Verify, Security Audit, and Workers Builds passed before merge. |
+| AgentShield #94 | PR #94 merged Zed/VS Code adapter coverage as `4caee27acfadb50a4cd024e738b5c3cbd4b0bb03`. AgentShield now reports Zed and VS Code as first-class harness adapters, discovers `.zed/settings.json`, `.zed/tasks.json`, and `.zed` hook-code files, and flags `.zed/setup.mjs` in the AI-tool persistence IOC rule alongside `.vscode/setup.mjs`. Local verification passed typecheck, lint, focused scanner/rule tests, full `npm test` (1822 tests), `npm run build`, and `git diff --check`; GitHub checks passed across GitGuardian, scan suite, self-scan, self-scan examples, Node 18/20/22 CI, CodeRabbit, and Cubic after rerunning a transient artifact-upload failure. |
+| AgentShield #95 | PR #95 merged the `brace-expansion` Dependabot fix as `25d91f0002214c408da4ceaac7def20bad40ca10`. The lockfile now resolves vulnerable transitive `brace-expansion` 5.x entries to `5.0.6`, local `npm audit --audit-level=moderate` returns 0 vulnerabilities, and `gh api repos/affaan-m/agentshield/dependabot/alerts?state=open` returns `[]`. Local validation passed typecheck, lint, full `npm test` (1822 tests), build, audit, and whitespace checks; GitHub checks passed across Verify Node 18/20/22, self-scan, self-scan examples, Test GitHub Action, GitGuardian, CodeRabbit, and Cubic. |
+| Linear roadmap sync | Linear ITO-54 comment `74dcc101-3be5-4173-be13-62b80d54f569` and ECC Platform Roadmap project comment `348ea8f5-2a2d-46d9-a0fe-ed99653e7fe5` record the May 20 hosted observability status/depth-plan readback batch; Linear comments `291e2a4b-06e3-4672-a057-cdb141478161` and `b2d35de0-ca49-44cb-982a-ddec229e7691` add the #88 observability API readback; Linear ITO-49 comment `faed69dd-35f5-469d-acb5-ddde6a70d6a1` and project comment `70187c1e-d481-4181-b418-09bd65d54b5e` add the #94 AgentShield Zed/VS Code adapter evidence; Linear ITO-49 comment `371fc3e4-611f-4d20-a23f-67db1260b418`, ITO-57 comment `bd06e252-15c1-4256-b667-caa3f64f5968`, and project comment `22c2c388-2fd1-4dea-a939-6141f40c9a21` add the #95 AgentShield Dependabot alert closure; earlier comments on ITO-54, ITO-48, and the project record the #84 hosted remediation sync and #85 hosted observability event emission batches. |
+
+## May 20 Marketplace Pro Release-Gate Sync
+
+| Surface | Evidence |
+| --- | --- |
+| ECC-Tools #89 | PR #89 merged as `512bca6b99cdaa67058a6aa9a4e7e7f0b1d9873a` after Verify, Security Audit, and Workers Builds passed. It added `billing:kv-readback -- --select-ready-target --require-ready`, allowing operators to select a ready Marketplace Pro target internally without passing or printing the login. |
+| Live production readback | The 2026-05-20 Wrangler OAuth readback found ready-like Marketplace Pro records with webhook provenance, selected a target with both key families, seat and webhook readiness, no overage, and 0 blockers, with account details redacted. The old missing Marketplace Pro target-state blocker is cleared. |
+| ECC #2019 | PR #2019 merged as `30f60710d4e0424fc70d9bbdc105009db141d9d8`, syncing the selected-target readback evidence into the GA roadmap, rc.1 publication evidence, naming matrix, preview manifest, and operator dashboard. |
+| ECC-Tools #90 | PR #90 merged as `16a5bb33ee5ce7c31d2ad8d041e5afac03308f05` after Verify, Security Audit, and Workers Builds passed. It added the selected-target official announcement gate through `/api/billing/readiness?selectReadyTarget=1` and `npm run billing:announcement-gate -- --select-ready-target`, keeping the raw account login out of command logs. |
+| ECC #2020 | PR #2020 merged as `c2471fe5c535310f8a8008c9ed7ea9f6757b33f2`, syncing ECC-Tools #90 into the roadmap, publication evidence, naming matrix, preview manifest, publication readiness, release URL ledger, platform audit surfaces, and operator dashboard. |
+| ECC-Tools #91 | PR #91 merged as `72119a1acc6f5a0cd3bb5d90afd6e87fd1fefd05` after Verify, Security Audit, and Workers Builds passed. It added `--env-file` to the billing announcement and KV readback scripts for ignored local operator credential files, with tests proving sentinel secrets and account logins are not printed. |
+| ECC-Tools #92 | PR #92 merged as `18d80197be779619283e0b37e2952bac53819a07` after Verify, Security Audit, and Workers Builds passed. It added the non-breaking `INTERNAL_OPERATOR_API_SECRET` bearer accepted by privileged internal API routes without rotating the primary `INTERNAL_API_SECRET`, and the merged Worker was deployed to `api.ecc.tools`. |
+| May 20 live selected-target gate | Vault-backed Wrangler readback passed with Marketplace Pro state, target fingerprint `e953a74209fe`, both key families, webhook evidence, seat readiness, no overage, and 0 blockers. After rotating the operator bearer, `npm run billing:announcement-gate -- --preflight --select-ready-target` returned ready and `npm run billing:announcement-gate -- --select-ready-target` returned `announcementGateReady: true`, 0 required actions, 0 blockers, and audit summary 6 pass / 1 warn / 0 fail. |
+| ECC-Tools #93 | PR #93 merged as `d3d62df83fa075660fa4530c3e0edc311a4355fe`, recording the live billing announcement gate pass in the launch checklist and distribution roadmap while preserving final release/plugin/URL approval gates. |
+| Post-merge main CI | ECC GitHub Actions runs `26135974576`, `26136949698`, and `26138015245` completed successfully on `main` for `30f60710d4e0424fc70d9bbdc105009db141d9d8`, `c2471fe5c535310f8a8008c9ed7ea9f6757b33f2`, and `6e25458dbc15cd07cfb7a4e1f0b06f3eda41a043` across lint, coverage, security, validation, and the full OS/package-manager matrix. ECC-Tools main CI runs `26137280847`, `26138403065`, and `26138669148` completed successfully for `72119a1acc6f5a0cd3bb5d90afd6e87fd1fefd05`, `18d80197be779619283e0b37e2952bac53819a07`, and `d3d62df83fa075660fa4530c3e0edc311a4355fe`. |
+| Post-merge local gates | `npm run platform:audit -- --json` returned ready true with 0 PRs, 0 issues, 0 discussion gaps, and 0 dirty blockers; `npm run preview-pack:smoke -- --format json` returned ready true with digest `531328aaaa53` before the May 20 dashboard rollover and `eebb8a66c33e` after adding the May 20 dashboard artifact; `git diff --check HEAD~1..HEAD` was clean. |
+| Linear roadmap sync | Linear ITO-61 comment `467d148a-712a-4777-aad9-95593e9f1739` and ECC Platform Roadmap project comment `7642ee9c-3107-400c-a229-53e2895a8914` record ECC-Tools #89, ECC #2019, the green post-merge CI run, and the earlier internal bearer-token gate; Linear ITO-44 comment `a9297467-208a-41e4-8dbb-35f0dad5fe2b`, ITO-56 comment `5008b70b-cf98-43cd-a8d4-f098ba9b9780`, ITO-61 comment `5ebf0aaf-e2d3-4537-878f-484f49dcf87a`, and project reply `1c74a3d0-f8ca-4306-997e-a37c53d49f97` record the ECC #2020 selected-target announcement-gate sync; a new Linear sync should record ECC-Tools #92/#93 and the live gate pass. |
+| Remaining blocker | Native-payments billing evidence is ready as of the May 20 selected-target gate pass. Repeat KV readback and `billing:announcement-gate -- --select-ready-target` immediately before launch, and keep native-payments copy behind the final release, plugin, live URL, and owner-approval gates. |
+
+## Release And Growth Evidence
+
+| Gate | Command | Result |
+| --- | --- | --- |
+| Release-surface tests | `node tests/docs/ecc2-release-surface.test.js` | 28 passed, 0 failed |
+| Preview-pack smoke | `npm run preview-pack:smoke -- --format json` | Ready true; digest `eebb8a66c33e`; 33 required artifacts; 5 passed, 0 failed |
+| Release approval gate | `npm run release:approval-gate -- --format json` | Expected blocked; digest `ef8f49f727b7`; 4 passed, 2 failed; owner decisions and live URL readbacks remain approval-gated |
+| Operator dashboard | `npm run operator:dashboard -- --write docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-20.md` | Regenerated from the May 20 `main` baseline with platform audit ready true, 0 tracked PRs, 0 tracked issues, 0 discussion gaps, `$1,728/mo` current MRR, `$10,000/mo` target MRR, the release video suite marked current, Linear release-gate sync current, and top actions for plugin publication, notifications, outbound approval, AgentShield, and ECC Tools billing |
+| Supply-chain verification | `npm audit --audit-level=moderate`; `npm audit signatures`; `yarn install --immutable --mode=skip-build` | Current supply-chain refresh found 0 npm vulnerabilities, verified 254 registry signatures and 30 attestations, and accepted the Yarn lock after pinning `@types/node@25.7.0` plus refreshing `brace-expansion` to `5.0.6` / `1.1.14` |
+| Release video suite | `npm run release:video-suite -- --format json --summary` with `ECC_VIDEO_SOURCE_ROOT` and `ECC_VIDEO_RELEASE_SUITE_ROOT` | Ready true; 15/15 source assets present; 13/13 render, timeline, caption, EDL, and segment artifacts present; 12/12 publish-candidate outputs present with zero detected black-frame segments; primary rough render self-eval passed at 144.759 seconds, 1920x1080, 1 audio stream, and 106.78 MB |
+| Focused post-merge regression set | `node tests/hooks/detect-project-worktree.test.js`; `node tests/hooks/observe-subdirectory-detection.test.js`; `node tests/scripts/instinct-cli-projects.test.js`; `node tests/hooks/hooks.test.js` | 10/10, 6/6, 5/5, and 237/237 passed after PR #2009 merged |
+| GateGuard PR #2011 regression | `node tests/hooks/gateguard-fact-force.test.js`; `npm test`; `git diff --check main...HEAD` | 91/91 passed on the PR branch; full local suite passed 2560/2560 before merge; whitespace check passed; focused GateGuard suite passed again on current `main` |
+| Release approval gate PR #2013 validation | `npm test`; `npm run lint`; `git diff --check`; `npm run preview-pack:smoke -- --format json`; `npm run release:approval-gate -- --format json` | 2568/2568 tests passed before merge; lint and whitespace passed; preview pack stayed ready with digest `531328aaaa53`; release approval gate returned the expected blocked exit with digest `ef8f49f727b7` |
+| Full local suite | `node tests/run-all.js` | 2568 passed, 0 failed before PR #2013 merge |
+| PR #1998 CI | GitHub Actions run `26099020341` | Completed successfully for `d500de1e9f11c0446b6a1349bd98b522d31f9125`; all reported checks passed, including lint, validation, security scan, coverage, GitGuardian, CodeRabbit, Cubic, and the macOS/Ubuntu/Windows test matrix |
+| PR #1999 CI | GitHub Actions run `26100148726` | Completed successfully for `90584b6d5e5814bc2ad9a4cd651bebd043de989d`; lint, validation, security scan, coverage, GitGuardian, CodeRabbit, and the macOS/Ubuntu/Windows test matrix passed; Cubic completed neutral and did not block merge |
+| PR #2001 CI | GitHub Actions run `26102500291` | Completed successfully for `8148340ad14eb32c971346f0cb4cb9431ec0f5de`; required checks passed before merge |
+| PR #2002 CI | GitHub Actions run `26103853507` | Completed successfully before merge; required checks passed, Cubic remained non-blocking, and PR #2002 merged into `main` as `c7d662c3c68719e5ef0b5305ca3f6782b3214224` |
+| PR #2004 CI | GitHub Actions run `26105012698` | Completed successfully after rerunning the single failed Windows Node 18 yarn job; required checks passed, Cubic remained non-blocking, and PR #2004 merged into `main` as `ac7434ea8f39166b11e9d06ce64b38c4fb8d9202` |
+| PR #2005 CI | GitHub Actions run `26106321921` | Completed successfully with 37 completed jobs, 0 failed jobs, and PR #2005 merged into `main` as `d6022d6b8dc5ef1393cf18ae40ee58f646f3754e` |
+| PR #2008 CI | GitHub Actions run `26108473648` | Completed successfully across the required matrix before merge; non-blocking Cubic skipped after review |
+| Post-PR #2006 main CI | GitHub Actions run `26109953093` | Completed successfully with 37 completed jobs, 0 failed jobs, and `main` advanced to `98bd517451f38fa0150a53aab4234c2239a47b7e` |
+| PR #2009 CI | GitHub Actions run `26111313938` | Completed successfully with 37 completed jobs, 0 failed jobs after replacing the brittle fake-worktree regression fixture with a real `git worktree add` setup |
+| Post-PR #2009 main CI | GitHub Actions run `26111946778` | Completed successfully with 37 completed jobs, 0 failed jobs, and `main` advanced to `bc519e5b8ed42f26c0a5a611756e04351c323f21` |
+| Post-PR #2011 main CI | GitHub Actions run `26113695068` | Completed successfully with 37 completed jobs, 0 failed jobs, and `main` advanced to `14d88e517b0c56a80c1a6392b1cde2474948d29f` |
+| Post-PR #2013 main CI | GitHub Actions run `26128749863` | Completed successfully with `main` advanced to `9819626459a662773be7d0b1c18d82c1316b8c36` |
+| Post-PR #2019 main CI | GitHub Actions run `26135974576` | Completed successfully with `main` advanced to `30f60710d4e0424fc70d9bbdc105009db141d9d8` |
+| Post-PR #2020 main CI | GitHub Actions run `26136949698` | Completed successfully with `main` advanced to `c2471fe5c535310f8a8008c9ed7ea9f6757b33f2` |
+| ECC-Tools #91 main CI | GitHub Actions run `26137280847` | Completed successfully on ECC-Tools `main` with `72119a1acc6f5a0cd3bb5d90afd6e87fd1fefd05` after the env-file billing gate support merged |
+| ECC-Tools #92 main CI | GitHub Actions run `26138403065` | Completed successfully on ECC-Tools `main` with `18d80197be779619283e0b37e2952bac53819a07` after the operator bearer path merged |
+| ECC-Tools #93 main CI | GitHub Actions run `26138669148` | Completed successfully on ECC-Tools `main` with `d3d62df83fa075660fa4530c3e0edc311a4355fe` after the live billing announcement evidence merged |
+| Linear sync | Linear document `ecc-may-19-post-pr-2002-sync-64cef8f668e0` plus project comment `a6411e3a-8c8e-4a58-adba-687e77d4c543`; late-pass document `ecc-may-19-late-queue-zero-and-release-gate-sync-1c26f65e6b3f` plus project comment `d42bf0e2-7a8e-4934-9f3f-e281498ee805`; May 20 ITO-61 comment `467d148a-712a-4777-aad9-95593e9f1739` plus project comment `7642ee9c-3107-400c-a229-53e2895a8914`; May 20 ITO-44 comment `a9297467-208a-41e4-8dbb-35f0dad5fe2b`, ITO-56 comment `5008b70b-cf98-43cd-a8d4-f098ba9b9780`, ITO-61 comment `5ebf0aaf-e2d3-4537-878f-484f49dcf87a`, and project reply `1c74a3d0-f8ca-4306-997e-a37c53d49f97` | Project and issue lanes record PR #2002 evidence, discussion #2003 routing, owner-approval dashboard gate, and In Progress status for ITO-47, ITO-48, ITO-49, ITO-51, ITO-54, and ITO-56; the late-pass sync attaches PR #2013, ECC-Tools #79, and JARVIS #15/#16 evidence to ITO-44, ITO-50, ITO-54, ITO-56, and ITO-61; the May 20 sync attaches ECC-Tools #89/#90, ECC #2019/#2020 Marketplace Pro selected-target and selected-target announcement-gate evidence, and the remaining env-file/bearer-token gate to ITO-44, ITO-56, ITO-61, and the project |
+| Public-path sanitization | `node scripts/ci/validate-no-personal-paths.js` through local suite and CI | Passed |
+| Markdown and whitespace | `markdownlint` focused release docs plus `git diff --check` before PR #1999 | Passed |
+
+## Product And Positioning Evidence
+
+| Surface | Evidence |
+| --- | --- |
+| Canonical repo identity | Public URLs and release docs now use `https://github.com/affaan-m/ECC` where public links are needed |
+| Release claim | Release notes and launch collateral frame ECC as the harness-native operator system for agentic work, not a Claude-only config pack |
+| Video proof | `video-suite-production.md` gates the local rough render, timeline, captions, source inventory, publish-candidate clip set, self-eval, black-frame QA, and no-private-path publication rules |
+| Growth proof | `partner-sponsor-talks-pack.md` provides approval-gated copy for sponsors, partners, consulting, talks, podcasts, GitHub Discussion, and video CTAs |
+| Owner approval proof | `owner-approval-packet-2026-05-19.md` centralizes release, package, plugin, video, billing, social, and outbound decision gates |
+| Business baseline | Hypergrowth command center and partner pack use `$1,728/mo` current MRR, `$10,000/mo` target MRR, and `$8,272/mo` gap |
+| Operator dashboard | `operator-readiness-dashboard-2026-05-20.md` pulls the growth baseline into the same queue, publication, video, outbound, AgentShield, ECC Tools billing/env-file gate, Linear, and supply-chain control surface |
+| Linear progress proof | Linear project document `ecc-may-19-post-pr-2002-sync-64cef8f668e0` mirrors the post-PR #2002 state and records active lanes for launch materials, AgentShield, ECC Tools deep analysis, observability, and final release publication; Linear document `ecc-may-19-late-queue-zero-and-release-gate-sync-1c26f65e6b3f` adds the PR #2013 approval gate, ECC-Tools #79 redaction hardening, and JARVIS #15/#16 queue/deploy repair evidence; May 20 Linear comments `74dcc101-3be5-4173-be13-62b80d54f569`, `348ea8f5-2a2d-46d9-a0fe-ed99653e7fe5`, `291e2a4b-06e3-4672-a057-cdb141478161`, `b2d35de0-ca49-44cb-982a-ddec229e7691`, `faed69dd-35f5-469d-acb5-ddde6a70d6a1`, `70187c1e-d481-4181-b418-09bd65d54b5e`, `371fc3e4-611f-4d20-a23f-67db1260b418`, `bd06e252-15c1-4256-b667-caa3f64f5968`, `22c2c388-2fd1-4dea-a939-6141f40c9a21`, `a9297467-208a-41e4-8dbb-35f0dad5fe2b`, `5008b70b-cf98-43cd-a8d4-f098ba9b9780`, `5ebf0aaf-e2d3-4537-878f-484f49dcf87a`, and `1c74a3d0-f8ca-4306-997e-a37c53d49f97` add ECC-Tools hosted observability readback evidence, AgentShield adapter evidence, AgentShield Dependabot alert closure, and Marketplace selected-target announcement-gate evidence to ITO-44, ITO-49, ITO-54, ITO-56, ITO-57, ITO-61, and the project |
+
+## Current Publication Blockers
+
+- GitHub prerelease `v2.0.0-rc.1` is still not created in this pass.
+- npm `ecc-universal@2.0.0-rc.1` is still not published to the `next`
+  dist-tag.
+- Claude plugin tag and marketplace propagation remain approval-gated.
+- Codex repo-marketplace distribution is verified by prior evidence, but
+  official Plugin Directory publishing remains blocked on OpenAI submission or
+  listing evidence.
+- ECC Tools billing/native-payments evidence is no longer blocked by the
+  internal bearer-token path or selected-target announcement gate. Repeat
+  `billing:kv-readback -- --select-ready-target --require-ready` and
+  `billing:announcement-gate -- --select-ready-target` immediately before
+  launch, and keep the copy behind the final release, plugin, live URL, and
+  owner-approval gates.
+  ECC-Tools PR #89 (`512bca6`) added `billing:kv-readback --
+  --select-ready-target --require-ready`; its 2026-05-20 production run cleared
+  the old missing-target-state blocker without printing the account login.
+  ECC-Tools PR #90 (`16a5bb3`) added the selected-target official announcement
+  gate, so production preflight no longer needs a raw GitHub login.
+  ECC-Tools PR #91 (`72119a1`) added `--env-file` support for ignored local
+  billing credentials without printing loaded secrets or account logins.
+  ECC-Tools PR #92 (`18d8019`) added the non-breaking operator bearer path, and
+  ECC-Tools PR #93 (`d3d62df`) recorded the live gate pass.
+- Release notes, X, LinkedIn, GitHub release, GitHub Discussion, longform copy,
+  sponsor outreach, partner outreach, consulting copy, conference pitches, and
+  podcast pitches still need final live URLs plus human approval before posting
+  or sending.
+- Discord/community links still need a real invite or bot/guild credential path
+  before public docs should route users there.
+
+## Result
+
+The tracked public PR queue, issue queue, discussion queue, canonical ECC
+identity, release video suite, preview pack, growth outreach packet, per-project
+Claude Code adapter surface, continuous-learning project registry hygiene,
+GateGuard quoted git introspection fix, deterministic release approval gate,
+ECC-Tools billing-announcement redaction hardening, selected-target billing
+readback, selected-target announcement gate, billing gate env-file operator path,
+ECC-Tools hosted observability readback, AgentShield Zed/VS Code adapter coverage,
+AgentShield Dependabot alert closure, and JARVIS security/deploy queue repairs
+are current on May 20, 2026 for ECC `main` through
+`c2471fe5c535310f8a8008c9ed7ea9f6757b33f2`, ECC-Tools `main` through
+`72119a1acc6f5a0cd3bb5d90afd6e87fd1fefd05`, and AgentShield `main` through
+`25d91f0002214c408da4ceaac7def20bad40ca10`. The remaining video work is owner
+approval, upload, and public URL attachment, not render or QA production.
+
+This improves publication readiness but does not replace the approval-gated
+release, package, plugin, billing, Discord, and announcement steps in
+`publication-readiness.md`.
@@ -39,11 +39,15 @@ routing, deterministic preview-pack smoke gate, and current operator dashboard
 refresh, see
 [`publication-evidence-2026-05-17.md`](publication-evidence-2026-05-17.md).
 For the May 18 current-head queue, workflow-security/metrics/uncloud merge
-batch, Mini Shai-Hulud/TanStack local and home protection recheck, npm
-no-lifecycle install/audit/signature gates, AgentShield project scan,
-work-items sync, Linear progress comments, operator dashboard refresh, and
-current-head Supply-Chain Watch, see
-[`publication-evidence-2026-05-18.md`](publication-evidence-2026-05-18.md).
+batch, PR #1978 review/closure, Mini Shai-Hulud/TanStack local and home
+protection recheck, npm no-lifecycle install/audit/signature gates,
+AgentShield project scan, AgentShield `840952a` enterprise/IOC evidence mirror,
+release OIDC publishing-scope hardening, workflow normalization, later
+dashboard/publication-readiness refreshes through `67e63e63`, work-items sync,
+Linear progress comments, ITO-46 closure, operator dashboard refresh, and
+current-head CI/security scan success through the May 19 identity, video, and
+growth-pack merge batch, see
+[`publication-evidence-2026-05-19.md`](publication-evidence-2026-05-19.md).
 For the operator-facing prompt-to-artifact readiness dashboard from the same
 May 16 pass, see
 [`operator-readiness-dashboard-2026-05-15.md`](operator-readiness-dashboard-2026-05-15.md).
@@ -51,23 +55,31 @@ For the May 17 operator dashboard refresh, see
 [`operator-readiness-dashboard-2026-05-17.md`](operator-readiness-dashboard-2026-05-17.md).
 For the May 18 operator dashboard refresh, see
 [`operator-readiness-dashboard-2026-05-18.md`](operator-readiness-dashboard-2026-05-18.md).
-For the May 18 live/pending release URL ledger, see
-[`release-url-ledger-2026-05-18.md`](release-url-ledger-2026-05-18.md).
+
+For the May 19 hypergrowth/operator dashboard, see
+[`operator-readiness-dashboard-2026-05-19.md`](operator-readiness-dashboard-2026-05-19.md).
+The current May 20 Marketplace Pro release-gate operator dashboard is
+[`operator-readiness-dashboard-2026-05-20.md`](operator-readiness-dashboard-2026-05-20.md).
+For the final owner decision sheet across release, npm, plugin, video, billing,
+social, and outbound approvals, see
+[`owner-approval-packet-2026-05-19.md`](owner-approval-packet-2026-05-19.md).
+For the May 19 live/pending release URL ledger after the public repo rename, see
+[`release-url-ledger-2026-05-19.md`](release-url-ledger-2026-05-19.md).

 ## Release Identity Matrix

 | Surface | Expected value | Source of truth | Fresh check | Evidence artifact | Owner | Status |
 | --- | --- | --- | --- | --- | --- | --- |
-| Product name | Everything Claude Code / ECC | `README.md`, `CHANGELOG.md`, release notes | `rg -n "Everything Claude Code" README.md CHANGELOG.md docs/releases/2.0.0-rc.1` | `publication-evidence-2026-05-12.md` | Release owner | Evidence recorded |
-| GitHub repo | `affaan-m/everything-claude-code` | Git remote and release URLs | `git remote get-url origin` | `publication-evidence-2026-05-12.md` | Release owner | Evidence recorded |
-| Git tag | `v2.0.0-rc.1` | GitHub releases | `gh release view v2.0.0-rc.1 --repo affaan-m/everything-claude-code` | `release not found` | Release owner | Blocked until release approval |
+| Product name | ECC | `README.md`, plugin manifests, release notes | `rg -n "^# ECC\|displayName.*ECC\|affaan-m/ECC" README.md .codex-plugin/plugin.json docs/releases/2.0.0-rc.1` | `release-name-plugin-publication-checklist-2026-05-18.md` plus `release-url-ledger-2026-05-19.md` | Release owner | Evidence recorded |
+| GitHub repo | `affaan-m/ECC` | Git remote and release URLs | `git remote get-url origin` | `release-url-ledger-2026-05-19.md` | Release owner | Evidence recorded |
+| Git tag | `v2.0.0-rc.1` | GitHub releases | `gh release view v2.0.0-rc.1 --repo affaan-m/ECC` | `release not found` | Release owner | Blocked until release approval |
 | npm package | `ecc-universal` | `package.json` | `node -p "require('./package.json').name"` | `publication-evidence-2026-05-12.md` | Package owner | Evidence recorded |
 | npm version | `2.0.0-rc.1` | `VERSION`, `package.json`, lockfiles | `node -p "require('./package.json').version"` | `publication-evidence-2026-05-12.md` | Package owner | Evidence recorded |
 | npm dist-tag | `next` for rc, `latest` only for GA | npm registry | `npm view ecc-universal dist-tags --json` | Current registry only has `latest: 1.10.0`; `next` is pending publish | Package owner | Blocked until publish approval |
 | Claude plugin slug | `ecc` / `ecc@ecc` install path | `.claude-plugin/plugin.json`, `.claude-plugin/marketplace.json` | `node tests/hooks/hooks.test.js` | `publication-evidence-2026-05-12.md` | Plugin owner | Evidence recorded |
 | Claude plugin manifest | `2.0.0-rc.1`, no unsupported `agents` or explicit `hooks` fields | `.claude-plugin/plugin.json`, `.claude-plugin/PLUGIN_SCHEMA_NOTES.md` | `claude plugin validate .claude-plugin/plugin.json` | `publication-evidence-2026-05-12.md` | Plugin owner | Evidence recorded |
 | Codex plugin manifest | `2.0.0-rc.1` with shared skill source | `.codex-plugin/plugin.json` | `node tests/docs/ecc2-release-surface.test.js` | `publication-evidence-2026-05-12.md` | Plugin owner | Evidence recorded |
-| Codex repo marketplace | `ecc@2.0.0-rc.1` exposed through `.agents/plugins/marketplace.json` | `.agents/plugins/marketplace.json`, `.codex-plugin/README.md` | `HOME="$(mktemp -d)" codex plugin marketplace add <local-checkout>` | `publication-evidence-2026-05-15.md` | Plugin owner | Repo-marketplace path verified; official Plugin Directory publishing coming soon |
+| Codex repo marketplace | `ecc@2.0.0-rc.1` exposed through `.agents/plugins/marketplace.json` | `.agents/plugins/marketplace.json`, `.codex-plugin/README.md` | `HOME="$(mktemp -d)" codex plugin marketplace add <local-checkout>` | `publication-evidence-2026-05-15.md` | Plugin owner | Repo-marketplace path verified; do not claim official Plugin Directory listing before OpenAI submission evidence |
 | OpenCode package | `ecc-universal` plugin module | `.opencode/package.json`, `.opencode/index.ts` | `npm run build:opencode` | `publication-evidence-2026-05-12.md` | Package owner | Evidence recorded |
 | Agent metadata | `2.0.0-rc.1` | `agent.yaml`, `.agents/plugins/marketplace.json` | `node tests/scripts/catalog.test.js` | `publication-evidence-2026-05-12.md` | Release owner | Evidence recorded |
 | Migration copy | rc.1 upgrade path, not GA claim | `release-notes.md`, `quickstart.md`, `HERMES-SETUP.md` | `npx markdownlint-cli '**/*.md' --ignore node_modules` | `publication-evidence-2026-05-13.md` | Docs owner | Evidence recorded |
@@ -79,10 +91,10 @@ For the May 18 live/pending release URL ledger, see
 | GitHub release | Tag exists, release notes use final URLs, assets attached if needed | `gh release view v2.0.0-rc.1 --json tagName,url,isPrerelease` | `Blocker: release not found on 2026-05-12` | Release owner | Pending approval |
 | npm package | `npm pack --dry-run` has expected files, version matches, rc goes to `next` | `npm pack --dry-run` and `npm publish --tag next --dry-run` where supported | `Blocker: actual publish requires approval; dry run passed with next tag` | Package owner | Dry-run passed |
 | Claude plugin | Manifest validates, marketplace JSON points to public repo, install docs match slug | `claude plugin validate .claude-plugin/plugin.json`; `claude plugin tag .claude-plugin --dry-run`; isolated temp-home install smoke | `Blocker: real tag creation/push requires approval` | Plugin owner | Clean-checkout dry-run and install smoke recorded |
-| Codex plugin | Manifest version matches package and docs, repo marketplace points at the plugin root, and OpenAI's current official Plugin Directory status is recorded | `node tests/docs/ecc2-release-surface.test.js`; `node tests/plugin-manifest.test.js`; `codex plugin marketplace add --help`; temp-home `codex plugin marketplace add <local-checkout>` | `Blocker: official Plugin Directory publishing and self-serve management are documented as coming soon` | Plugin owner | Repo-marketplace distribution verified; official directory pending |
+| Codex plugin | Manifest version matches package and docs, repo marketplace points at the plugin root, and OpenAI's current official Plugin Directory status is recorded | `node tests/docs/ecc2-release-surface.test.js`; `node tests/plugin-manifest.test.js`; `codex plugin marketplace add --help`; temp-home `codex plugin marketplace add <local-checkout>` | `Blocker: official Plugin Directory listing requires OpenAI submission/listing evidence` | Plugin owner | Repo-marketplace distribution verified; official directory pending |
 | OpenCode package | Build output is regenerated from source and package metadata is current | `npm run build:opencode` | `Blocker: none for local build; public distribution still follows npm/plugin release` | Package owner | Evidence recorded |
-| ECC Tools billing reference | Any billing claim links to verified Marketplace/App state | `env -u GITHUB_TOKEN gh repo view ECC-Tools/ECC-Tools --json nameWithOwner,isPrivate,viewerPermission` plus internal `/api/billing/readiness?accountLogin=<marketplace-test-account>` readback | `Blocker: ECC-Tools #73 added announcementGate; live Marketplace test-account readback must return announcementGate.ready === true before payment announcement` | ECC Tools owner | Code gate recorded; live billing readback pending |
-| Announcement copy | X, LinkedIn, GitHub release, and longform copy point to live URLs | placeholder-marker scan and `release-url-ledger-2026-05-18.md` | `Blocker: final live release/npm/plugin/billing URLs do not exist yet; live and pending URLs are separated in the May 18 ledger` | Release owner | URL ledger recorded; final URLs pending |
+| ECC Tools billing reference | Any billing claim links to verified Marketplace/App state | `env -u GITHUB_TOKEN gh repo view ECC-Tools/ECC-Tools --json nameWithOwner,isPrivate,viewerPermission` plus internal `/api/billing/readiness?selectReadyTarget=1` readback using the operator bearer path | `Ready: ECC-Tools #92 main CI and ECC-Tools #93 main CI passed; live selected-target readback returned announcementGate.ready === true on 2026-05-20; repeat before payment announcement` | ECC Tools owner | Billing evidence ready; final copy still waits on release/plugin/live URL approvals |
+| Announcement copy | X, LinkedIn, GitHub release, and longform copy point to live URLs | placeholder-marker scan and `release-url-ledger-2026-05-19.md` | `Blocker: final live release/npm/plugin/billing URLs do not exist yet; live and pending URLs are separated in the May 19 ledger` | Release owner | URL ledger recorded; final URLs pending |
 | Privileged workflow hardening | Release and maintenance workflows avoid persisted checkout tokens | `node scripts/ci/validate-workflow-security.js` | `Blocker:` | Release owner | Evidence recorded in post-hardening refresh |

 ## Required Command Evidence
@@ -91,24 +103,25 @@ Record the exact commit SHA and command output before any publication action:

 | Evidence | Command | Required result | Recorded output |
 | --- | --- | --- | --- |
-| Clean release branch | `git status --short --branch` | On intended release commit; no unrelated files | Pending final strict clean-checkout release pass; `publication-evidence-2026-05-17.md` records current `main` with unrelated untracked `docs/drafts/` |
-| Preview-pack smoke | `npm run preview-pack:smoke` | Preview pack artifacts, Hermes boundary, final verification command list, and publication blockers pass | `publication-evidence-2026-05-17.md`: ready yes, digest `dfb1ed014607`, 5 passed, 0 failed; repeat in a final strict clean-checkout release pass |
-| Harness audit | `npm run harness:audit -- --format json` | 70/70 passing | `publication-evidence-2026-05-17.md`: 70/70 |
-| Adapter scorecard | `npm run harness:adapters -- --check` | PASS | `publication-evidence-2026-05-16.md`: PASS, 11 adapters |
-| Observability readiness | `npm run observability:ready` | 21/21 passing | `publication-evidence-2026-05-17.md`: 21/21, ready yes |
-| Release safety gate | `npm run observability:ready -- --format json` | Release Safety category passing with publication readiness, supply-chain, workflow security, package surface, and release-surface evidence | `publication-evidence-2026-05-13-post-hardening.md`: Release Safety 3/3 |
-| Supply-chain verification | `npm audit --json`; `npm audit signatures`; `cd ecc2 && cargo audit -q`; Dependabot alerts; GitGuardian Security Checks | 0 vulnerabilities/alerts, registry signatures verified, GitGuardian clean | `publication-evidence-2026-05-18.md`: npm registry signatures and attestations verified, 0 high-or-higher npm vulnerabilities, repo/home IOC scans clean, current-head Supply-Chain Watch passed |
-| Root suite | `node tests/run-all.js` | 0 failures | `publication-evidence-2026-05-17.md`: `npm test` passed 2487/2487, 0 failed |
-| Markdown lint | `npx markdownlint-cli '**/*.md' --ignore node_modules` | 0 failures | `publication-evidence-2026-05-17.md`: passed after ja-JP autonomous-loop anchor repair |
-| Package surface | `node tests/scripts/npm-publish-surface.test.js` | 0 failures; no Python bytecode in npm tarball | `2/2` passed in May 12 evidence pass |
-| Release surface | `node tests/docs/ecc2-release-surface.test.js` | 0 failures | `publication-evidence-2026-05-16.md`: 20/20 passed |
+| Clean release branch | `git status --short --branch` | On intended release commit; no unrelated files | Current May 20 baseline `c2471fe5c535310f8a8008c9ed7ea9f6757b33f2`: `## main...origin/main`; repeat from the exact final publication commit before release |
+| Preview-pack smoke | `npm run preview-pack:smoke` | Preview pack artifacts, Hermes boundary, final verification command list, and publication blockers pass | `publication-evidence-2026-05-19.md`: ready yes, digest `eebb8a66c33e`, 33 artifacts, 5 passed, 0 failed; repeat in the final strict clean-checkout release pass |
+| Release approval gate | `npm run release:approval-gate -- --format json` | Ready true only after owner decision rows are approved, live release/package/plugin/video/billing URLs are recorded, and launch/outbound copy has no placeholders or private paths | Current May 19 state is intentionally blocked because owner decisions and live URL readbacks remain approval-gated |
+| Harness audit | `npm run harness:audit -- --format json` | 80/80 passing | Current release gate: 80/80 across 8 applicable categories, 0 top actions |
+| Adapter scorecard | `npm run harness:adapters -- --check` | PASS | Current release gate: PASS, 11 adapters |
+| Observability readiness | `npm run observability:ready` | 21/21 passing | Current release gate: 21/21, ready true |
+| Release safety gate | `npm run observability:ready -- --format json` | Release Safety category passing with publication readiness, supply-chain, workflow security, package surface, and release-surface evidence | Current release gate keeps Release Safety passing at 3/3; repeat the JSON gate from the exact final release commit |
+| Supply-chain verification | `npm audit --audit-level=moderate`; `npm audit signatures`; `yarn install --immutable --mode=skip-build`; `cd ecc2 && cargo audit -q`; Dependabot alerts; GitGuardian Security Checks | 0 vulnerabilities/alerts, registry signatures verified, package-manager locks accepted, GitGuardian clean | Current supply-chain branch: `npm audit` found 0 vulnerabilities; `npm audit signatures` verified 254 registry signatures and 30 attestations; Yarn immutable install accepted the lock after pinning `@types/node@25.7.0` and moving `brace-expansion` to `5.0.6` / `1.1.14`; PR #2008 CI `26108473648`, post-PR #2006 main CI `26109953093`, PR #2009 CI `26111313938`, and post-PR #2009 main CI `26111946778` completed with 0 failures |
+| Root suite | `node tests/run-all.js` | 0 failures | Current May 19 local suite: 2568 passed, 0 failed before PR #2013 merged; post-PR #2009 focused regressions also passed for worktree detection, observe subdirectory/global fallback, project maintenance CLI, and the hooks suite |
+| Markdown lint | `npx markdownlint-cli '**/*.md' --ignore node_modules` | 0 failures | Current release gate: focused lint passed for `publication-readiness.md`, `publication-evidence-2026-05-19.md`, and `docs/ECC-2.0-GA-ROADMAP.md` |
+| Package surface | `node tests/scripts/npm-publish-surface.test.js` | 0 failures; no Python bytecode in npm tarball | Current release gate: 2/2 passed |
+| Release surface | `node tests/docs/ecc2-release-surface.test.js` | 0 failures | Current release gate: 27/27 passed after refreshing the discussion-count assertion to the post-PR #2005 baseline |
 | Optional Rust surface | `cd ecc2 && cargo test` | 0 failures or explicit deferral | `publication-evidence-2026-05-16.md`: 462/462 passed, existing warnings only |
-| Queue baseline | `gh pr list` / `gh issue list` across trunk, AgentShield, JARVIS, ECC Tools, and ECC website | Under 20 open PRs and under 20 open issues | `publication-evidence-2026-05-17.md`: platform audit ready, 0 open PRs and 0 open issues across checked repos |
-| Discussion baseline | `node scripts/discussion-audit.js --json` | No unmanaged active discussion queue and no answerable Q&A missing an accepted answer | `publication-evidence-2026-05-15.md`: 58 trunk discussions, 0 without maintainer touch; other tracked repos disabled or 0 |
-| Linear roadmap | Linear project and issue readback | Detailed roadmap exists with release, security, AgentShield, ECC Tools, legacy, and observability lanes | `publication-evidence-2026-05-15.md`: project and 16 issue lanes recorded |
-| Operator readiness dashboard | `npm run operator:dashboard -- --json --allow-untracked docs/drafts/` | Current queue state mapped to macro-goal deliverables and incomplete gaps | `publication-evidence-2026-05-18.md`: generated from `3b7e0ba3`, platform ready true, dashboard ready true, 0 open PRs, 0 open issues, 0 discussion gaps; regenerated May 18 dashboard now also tracks the URL ledger |
-| Release URL ledger | `docs/releases/2.0.0-rc.1/release-url-ledger-2026-05-18.md` plus placeholder-marker scan | Live links and approval-gated links are separated before announcement copy is posted | Ledger records public repo/docs/CI/supply-chain/npm/OpenAI Codex documentation URLs and blocks GitHub release/npm/plugin/billing/social URLs until approval-gated checks pass |
-| Release name and plugin publication checklist | `docs/releases/2.0.0-rc.1/release-name-plugin-publication-checklist-2026-05-18.md` | Name/package/plugin values are frozen, final-release commands are listed, and Claude/Codex publication paths cite current official docs | Checklist keeps `Everything Claude Code / ECC`, `ecc-universal`, and plugin slug `ecc` for rc.1; no rename, npm publish, plugin tag, official listing, billing claim, or announcement before final evidence |
+| Queue baseline | `node scripts/platform-audit.js --json` across trunk, AgentShield, JARVIS, ECC Tools, and ECC website | Under 20 open PRs and under 20 open issues | Current May 20 baseline after PR #2020: platform audit ready true, 0 open PRs, 0 open issues, 0 discussion gaps, 0 conflicting PRs, and 0 blocking dirty files across tracked repos |
+| Discussion baseline | `node scripts/platform-audit.js --json` and `node scripts/discussion-audit.js --json` | No unmanaged active discussion queue and no answerable Q&A missing an accepted answer | Post-PR #2005 baseline: platform audit sampled 59 trunk discussions, 0 needing maintainer touch, 0 answerable discussions missing accepted answer; `docs/architecture/discussion-response-playbook.md` records response templates and security escalation rules |
+| Linear roadmap | Linear project and issue readback | Detailed roadmap exists with release, security, AgentShield, ECC Tools, legacy, and observability lanes | May 18 Linear comments include ITO-57 `3fe5b2b7-c4fe-401c-a317-b40d72119cb3` and ITO-44 `fb4a4f33-6c2d-421a-bbdb-63cfad3e3ee4`; earlier evidence records the project and 16 issue lanes |
+| Operator readiness dashboard | `npm run operator:dashboard -- --json` | Current queue state mapped to macro-goal deliverables and incomplete gaps | Current May 20 dashboard is refreshed from the post-PR #2020 baseline; platform audit ready true, 0 open PRs, 0 open issues, 0 discussion gaps, 0 dirty files, release video suite current, selected-target billing/env-file path mirrored, and publication gates still approval-gated |
+| Release URL ledger | `docs/releases/2.0.0-rc.1/release-url-ledger-2026-05-19.md` plus placeholder-marker scan | Live links and approval-gated links are separated before announcement copy is posted | Ledger records public repo/docs/npm/OpenAI Codex documentation URLs and blocks GitHub release/npm/plugin/billing/social URLs until approval-gated checks pass |
+| Release name and plugin publication checklist | `docs/releases/2.0.0-rc.1/release-name-plugin-publication-checklist-2026-05-18.md` | Name/package/plugin values are frozen, final-release commands are listed, and Claude/Codex publication paths cite current official docs | Checklist keeps `ECC`, `ecc-universal`, and plugin slug `ecc` for rc.1; no npm rename, npm publish, plugin tag, official listing, billing claim, or announcement before final evidence |

 ## Do Not Publish If

@@ -5,8 +5,8 @@ This path is for a new contributor who wants to verify the release surface befor
 ## Clone

 ```bash
-git clone https://github.com/affaan-m/everything-claude-code.git
-cd everything-claude-code
+git clone https://github.com/affaan-m/ECC.git
+cd ECC
 ```

 Start from a clean checkout. Do not copy private operator state, raw workspace exports, tokens, or local Hermes files into the repo.
@@ -1,6 +1,7 @@
 # ECC v2.0.0-rc.1 Release Name And Plugin Publication Checklist

-Snapshot date: 2026-05-18.
+Snapshot date: 2026-05-18. Canonical repo decision refreshed 2026-05-19
+after the public repo rename to `affaan-m/ECC`.

 This checklist is the operator gate for release naming, package publication,
 and Claude/Codex plugin distribution. It is not a publication action by itself.
@@ -9,37 +10,38 @@ submitting marketplace forms, or posting announcements.

 ## Fixed rc.1 Decision

-Ship `v2.0.0-rc.1` as **Everything Claude Code (ECC)**.
+Ship `v2.0.0-rc.1` as **ECC**.

- Keep the GitHub repo at `affaan-m/everything-claude-code`.
+- Keep the GitHub repo at `affaan-m/ECC`.
 - Keep the npm package as `ecc-universal`.
 - Keep Claude and Codex plugin slugs as `ecc`.
 - Publish the npm prerelease on the `next` dist-tag, not `latest`.
- Do not rename to `affaan-m/ecc`, `ecc`, or `@affaan-m/ecc` before rc.1.
+- Do not rename the npm package to `ecc` or `@affaan-m/ecc` before rc.1.
+- Treat `affaan-m/ECC` as the canonical public repo for rc.1 and GA release
+  copy.

 Reasons:

 - `ecc-universal` is the current working install and package surface.
 - `ecc` on npm is occupied by an unrelated elliptic-curve package.
 - `@affaan-m/ecc` is unclaimed on npm, but would require a migration plan.
- `affaan-m/ecc` is not available to the current GitHub auth context.
+- `affaan-m/ECC` is now the live public GitHub repo.
 - Claude and Codex already expose the desired short namespace as `ecc`.

 ## Current Surface Evidence

 | Surface | Current value | Evidence command | 2026-05-18 result | Release action |
 | --- | --- | --- | --- | --- |
-| Git commit | `0e88e6a4ddf9968e55faa07f3ad8a03d3943b58c` | `git rev-parse HEAD` | Recorded from `main` | Re-run from final release commit |
-| GitHub repo | `affaan-m/everything-claude-code` | `git remote get-url origin` | `https://github.com/affaan-m/everything-claude-code.git` | Keep for rc.1 |
-| Possible short repo | `affaan-m/ecc` | `gh repo view affaan-m/ecc --json nameWithOwner,url,isPrivate` | GraphQL could not resolve repository | Do not depend on it for rc.1 |
+| Git commit | `67e63e63f9bfd074bd6a21bf6bac71f3dfefa58b` | `git rev-parse HEAD` | Recorded from clean `main` before this ITO-46 evidence refresh | Re-run from final release commit |
+| GitHub repo | `affaan-m/ECC` | `git remote get-url origin` | `https://github.com/affaan-m/ECC.git` | Keep for rc.1 and GA |
 | npm package | `ecc-universal@2.0.0-rc.1` local, `1.10.0` registry latest | `node -p "require('./package.json').name + '@' + require('./package.json').version"` and `npm view ecc-universal name version dist-tags --json` | Local rc.1 ready; registry still latest `1.10.0` | Publish rc.1 with `--tag next` after approval |
 | Exact npm short name | `ecc` | `npm view ecc name version description repository.url --json` | Occupied by unrelated `ecc@0.0.2` | Do not use |
 | Scoped npm short name | `@affaan-m/ecc` | `npm view @affaan-m/ecc name version --json` | 404 | Candidate only after migration plan |
-| Claude plugin | `ecc@2.0.0-rc.1` | `claude plugin validate .claude-plugin/plugin.json` | Validation passed | Run dry-run tag, then tag/push only after approval |
-| Claude marketplace | `.claude-plugin/marketplace.json` | `claude plugin marketplace --help`; Anthropic plugin marketplace docs | GitHub, git URL, remote marketplace JSON, and local path marketplace sources are supported | Submit official listing through the current Anthropic forms only after final evidence |
-| Codex plugin | `ecc@2.0.0-rc.1` | `node tests/plugin-manifest.test.js`; `codex plugin marketplace add --help`; OpenAI Codex plugin docs | Repo marketplace and local marketplace roots are supported | Use repo marketplace for rc.1; official Plugin Directory is still pending |
+| Claude plugin | `ecc@2.0.0-rc.1` | `claude plugin validate .claude-plugin/plugin.json`; `claude plugin validate .`; `claude plugin tag .claude-plugin --dry-run` | Validation passed on Claude Code `2.1.143`; full plugin validation has one expected root `CLAUDE.md` context warning; dry run would create `ecc--v2.0.0-rc.1` | Run dry-run tag again from the final commit, then tag/push only after approval |
+| Claude marketplace | `.claude-plugin/marketplace.json` | `claude plugin marketplace add --help`; Anthropic plugin marketplace docs | GitHub repo, git URL, remote marketplace JSON, and local path marketplace sources are supported | Verify post-tag marketplace install/update path after final evidence |
+| Codex plugin | `ecc@2.0.0-rc.1` | `node tests/plugin-manifest.test.js`; `codex plugin marketplace add --help`; OpenAI Codex plugin docs | Plugin manifest passed 54/54; local and GitHub-ref repo marketplace smokes passed on Codex CLI `0.131.0` | Use repo marketplace for rc.1; do not claim official directory listing until OpenAI publishing path is available |
 | OpenCode package | `ecc-universal@2.0.0-rc.1` | `node -p "require('./.opencode/package.json').name + '@' + require('./.opencode/package.json').version"` | Matches rc.1 package identity | Follow npm package publication |
-| Billing claim | Pending ECC Tools readiness | ECC Tools billing gate and Marketplace account readback | Code-side gate exists; live Marketplace account readback still pending | Do not announce native payments |
+| Billing claim | ECC Tools selected-target billing evidence ready | ECC Tools billing gate and Marketplace account readback | May 20 selected-target readback and live selected-target announcement gate passed with `announcementGateReady: true`; repeat immediately before announcement | Do not announce native payments until final release/plugin/live URL approvals are green |

 ## Required Gate

@@ -59,11 +61,12 @@ claude plugin validate .claude-plugin/plugin.json
 claude plugin tag .claude-plugin --dry-run
 codex plugin marketplace add --help
 HOME="$(mktemp -d)" codex plugin marketplace add ./
-HOME="$(mktemp -d)" codex plugin marketplace add affaan-m/everything-claude-code --ref "$(git rev-parse HEAD)"
+HOME="$(mktemp -d)" codex plugin marketplace add affaan-m/ECC --ref "$(git rev-parse HEAD)"
 npm pack --dry-run --json
 npm publish --tag next --dry-run
 npm run build:opencode
 npm run preview-pack:smoke
+npm run release:approval-gate -- --format json
 ```

 If a command is unavailable on the release machine, record the exact error and
@@ -77,8 +80,8 @@ keep the related publication action blocked.
 | 2 | Verify clean release branch | `git status --short --branch` shows only the intended release commit and no unrelated drift | Any unexplained dirty file |
 | 3 | Verify package and plugin manifests | `node tests/plugin-manifest.test.js` and `node tests/docs/ecc2-release-surface.test.js` pass | Manifest or release-surface failure |
 | 4 | Dry-run package surface | `npm pack --dry-run --json`; `npm publish --tag next --dry-run` | Missing files, wrong dist-tag, or publish dry-run failure |
-| 5 | Dry-run Claude distribution | `claude plugin validate`; `claude plugin tag .claude-plugin --dry-run`; temp install smoke | Validation, tag, or install-smoke failure |
-| 6 | Verify Codex repo marketplace | `codex plugin marketplace add --help`; temp-home repo marketplace add smoke; OpenAI official directory status recorded | Missing repo marketplace or unverified official-directory status |
+| 5 | Dry-run Claude distribution | `claude plugin validate`; `claude plugin tag .claude-plugin --dry-run`; marketplace source/help evidence | Validation, tag, or install-smoke failure |
+| 6 | Verify Codex repo marketplace | `codex plugin marketplace add --help`; temp-home local and GitHub-ref repo marketplace add smoke; OpenAI official directory status recorded | Missing repo marketplace or unverified official-directory status |
 | 7 | Verify OpenCode package | `npm run build:opencode` | Build failure |
 | 8 | Regenerate release URL ledger | Live and approval-gated URLs separated in `release-url-ledger-YYYY-MM-DD.md` | Placeholder, private URL, or announcement URL drift |
 | 9 | Create GitHub prerelease | `gh release view v2.0.0-rc.1 --json tagName,url,isPrerelease` | Missing URL or wrong prerelease flag |
@@ -92,12 +95,12 @@ keep the related publication action blocked.
  final release commit.
 - Do not create or push Claude plugin tags before `claude plugin tag
  .claude-plugin --dry-run` passes from the final release commit.
- Do not claim Codex official Plugin Directory availability unless OpenAI docs
-  no longer say official public plugin publishing is pending.
+- Do not claim an official Codex Plugin Directory listing unless OpenAI
+  documents a public submission path or confirms the plugin has been listed.
 - Do not announce billing, Marketplace, or native payments until ECC Tools live
  Marketplace account readback returns ready.
- Do not rename the repo or package until rc.1 is published and a migration
-  guide maps old names to new names.
+- Do not rename the npm package until rc.1 is published and a migration guide
+  maps old install names to new names.
 - Do not post social copy while any release, npm, plugin, or billing URL is
  still approval-gated.

@@ -109,7 +112,8 @@ keep the related publication action blocked.
 - OpenAI Codex plugin docs:
  `https://developers.openai.com/codex/plugins/build#add-a-marketplace-from-the-cli`

-As of this snapshot, Anthropic documents official marketplace submission through
-Claude.ai and Console forms. OpenAI documents repo/local marketplace
-distribution for Codex and says official public Plugin Directory publishing and
-self-serve plugin management are coming soon.
+As of this snapshot, Anthropic documents self-hosted marketplace distribution
+through GitHub, git URL, remote marketplace JSON, and local path sources.
+OpenAI documents repo/personal marketplace distribution for Codex and describes
+an official Plugin Directory, but ECC has not submitted or received an official
+directory listing in this pass.
@@ -46,8 +46,8 @@ feature branch:
 - documentation expansion, Japanese localization, zh-CN to ja-JP parity
  repair, and dependency readiness through TypeScript 6 and Node type updates;
 - launch collateral for GitHub release copy, X, LinkedIn, article outline,
-  Telegram/Hermes handoff, demo prompts, and the approval-gated launch
-  checklist.
+  Telegram/Hermes handoff, demo prompts, partner/sponsor/talk outreach, and
+  the approval-gated launch checklist.
 - a release URL ledger that separates links which already resolve from links
  that must wait for the GitHub release, npm rc package, plugin tag/directory,
  and ECC Tools billing readback.
@@ -91,7 +91,7 @@ What stays local:
 2. Read the [Hermes setup guide](../../HERMES-SETUP.md).
 3. Review the [cross-harness architecture](../../architecture/cross-harness.md).
 4. Run the [observability readiness gate](../../architecture/observability-readiness.md).
-5. Check the [release URL ledger](release-url-ledger-2026-05-18.md) before
+5. Check the [release URL ledger](release-url-ledger-2026-05-19.md) before
   using any announcement links.
 6. Start with one workflow lane: engineering, research, content, or outreach.
 7. Import only sanitized operator patterns into ECC skills.
@@ -0,0 +1,55 @@
+# ECC v2.0.0-rc.1 Release URL Ledger
+
+This ledger separates links that are already public from links that only become
+valid after the approval-gated release, package, plugin, and announcement
+steps. Regenerate it from the final release commit before posting any public
+announcement.
+
+Refreshed on 2026-05-19 after the public repository rename to
+`affaan-m/ECC`. The final release pass must replace commit-specific evidence
+with output from the exact release commit.
+
+## Live Now
+
+| Surface | URL | Verification |
+| --- | --- | --- |
+| Repository | <https://github.com/affaan-m/ECC> | `git remote get-url origin` returns `https://github.com/affaan-m/ECC.git` |
+| Release pack folder | <https://github.com/affaan-m/ECC/tree/main/docs/releases/2.0.0-rc.1> | In-tree release pack |
+| Release notes draft | <https://github.com/affaan-m/ECC/blob/main/docs/releases/2.0.0-rc.1/release-notes.md> | In-tree release copy |
+| Hermes setup guide | <https://github.com/affaan-m/ECC/blob/main/docs/HERMES-SETUP.md> | In-tree sanitized Hermes guide |
+| May 19 evidence snapshot | <https://github.com/affaan-m/ECC/blob/main/docs/releases/2.0.0-rc.1/publication-evidence-2026-05-19.md> | Current strongest identity, video, growth, and CI readiness evidence |
+| May 18 evidence snapshot | <https://github.com/affaan-m/ECC/blob/main/docs/releases/2.0.0-rc.1/publication-evidence-2026-05-18.md> | Previous supply-chain and publication-path readiness evidence |
+| May 18 operator dashboard | <https://github.com/affaan-m/ECC/blob/main/docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-18.md> | Previous prompt-to-artifact dashboard |
+| May 19 operator dashboard | <https://github.com/affaan-m/ECC/blob/main/docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-19.md> | Previous prompt-to-artifact dashboard with hypergrowth, video, and outbound lanes |
+| May 20 operator dashboard | <https://github.com/affaan-m/ECC/blob/main/docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-20.md> | Current prompt-to-artifact dashboard with Marketplace Pro release-gate sync |
+| npm package page | <https://www.npmjs.com/package/ecc-universal> | `npm view ecc-universal name version dist-tags --json` returned `latest: 1.10.0`; rc.1 is not published yet |
+| Codex marketplace CLI docs | <https://developers.openai.com/codex/cli/reference#codex-plugin-marketplace> | Official docs list `codex plugin marketplace add` for GitHub shorthand, Git URLs, SSH URLs, and local marketplace roots |
+| Codex official Plugin Directory status | <https://developers.openai.com/codex/plugins/build#publish-official-public-plugins> | Official docs say public Plugin Directory publishing and self-serve management are coming soon |
+
+## Approval-Gated URLs
+
+| Surface | Intended URL or command | Gate before use |
+| --- | --- | --- |
+| GitHub prerelease | <https://github.com/affaan-m/ECC/releases/tag/v2.0.0-rc.1> | `gh release view v2.0.0-rc.1 --repo affaan-m/ECC --json tagName,url,isPrerelease` must return the prerelease |
+| npm rc package | <https://www.npmjs.com/package/ecc-universal/v/2.0.0-rc.1> | `npm publish --tag next` approval and post-publish `npm view ecc-universal dist-tags --json` |
+| Claude plugin tag | `claude plugin tag .claude-plugin --dry-run`, then real tag only after approval | Clean release commit and plugin tag/push approval |
+| Codex repo marketplace install | `codex plugin marketplace add affaan-m/ECC --ref v2.0.0-rc.1` | GitHub tag must exist; official Plugin Directory submission remains separate |
+| ECC Tools native-payments announcement | ECC Tools Marketplace/App URL plus selected-target billing readiness readback through the operator bearer path | Marketplace-managed selected target returned `announcementGate.ready === true` on 2026-05-20; repeat immediately before publication |
+| Public announcements | X, LinkedIn, GitHub release, and longform URLs | GitHub release, npm, plugin, and billing URLs must resolve first |
+
+## Pre-Post Check
+
+Run these immediately before publication:
+
+```bash
+git status --short --branch
+gh release view v2.0.0-rc.1 --repo affaan-m/ECC --json tagName,url,isPrerelease
+npm view ecc-universal name version dist-tags --json
+codex plugin marketplace add --help
+rg -n "TODO|TBD|PLACEHOLDER" docs/releases/2.0.0-rc.1
+npm run preview-pack:smoke
+npm run release:approval-gate -- --format json
+```
+
+Do not post the social or notification copy until the approval-gated URLs above
+resolve from a clean release commit.
@@ -0,0 +1,202 @@
+# ECC 2.0 Video Suite Production Manifest
+
+Snapshot date: 2026-05-19.
+
+This is the production contract for the ECC 2.0 release video suite. It keeps
+the public release story, local source inventory, render outputs, and self-eval
+gate in one place without committing raw footage, private transcript exports, or
+absolute local paths.
+
+## Claim
+
+ECC 2.0 is the harness-native operator system for agentic work.
+
+The videos should prove that claim directly:
+
+- one reusable layer across Claude Code, Codex, OpenCode, Cursor, Gemini, Zed,
+  GitHub Copilot, and terminal workflows;
+- reusable skills, rules, hooks, agents, MCP conventions, release gates, and
+  operator workflows;
+- `ecc2/` as the alpha control-plane/TUI direction, not the whole product;
+- AgentShield and supply-chain gates as the enterprise trust layer;
+- OSS stays free, with GitHub Sponsors, ECC Tools Pro, and consulting as the
+  funding surface.
+
+Do not frame the launch as a rename, pivot, config pack, or Claude-only package.
+
+## Private Inputs
+
+Do not commit raw footage, transcript JSON, or timeline exports.
+
+Operators should point the validator at local media using environment variables:
+
+```bash
+ECC_VIDEO_SOURCE_ROOT=/path/to/ecc_2_raws \
+ECC_VIDEO_RELEASE_SUITE_ROOT=/path/to/ecc_2_release_suite \
+npm run release:video-suite -- --format json
+```
+
+`ECC_VIDEO_SOURCE_ROOT` should contain proof images and may contain an `_edited/`
+subdirectory with edited source clips. `ECC_VIDEO_RELEASE_SUITE_ROOT` should
+contain `edl/`, `segments/`, `renders/`, `timelines/`, and `transcripts/`.
+
+## Source Inventory
+
+These basenames are the required local inputs for the release suite validator.
+
+| Asset | Lane | Proof |
+| --- | --- | --- |
+| `longform-full-wide.mp4` | Primary launch video | operator system, control-plane direction, closing proof |
+| `sf-longform-full.mp4` | Primary launch video | structured context opener |
+| `sf-thread-2-whatisecc.mp4` | What is ECC | category clarity and GitHub App explanation |
+| `sf-thread-4-security.mp4` | Security proof | AgentShield, hooks, MCP, permission risk |
+| `thread-2-ghapp-money.mp4` | Money/proof clip | OSS plus paid hosting and services |
+| `architecture-2-wide.mp4` | B-roll | harness-native architecture |
+| `terminal-scan-2-wide.mp4` | Install proof | terminal workflow and install confidence |
+| `new_site_raw.mp4` | B-roll | site and product surface |
+| `coverage-montage-wide.mp4` | Coverage/social proof | distribution and social proof |
+| `metrics-ticker-2-wide.mp4` | Money/proof clip | traction and funnel proof |
+| `growth-timeline-2-wide.mp4` | Coverage/social proof | release momentum timeline |
+| `gh_app_1.png` | Money/proof clip | hosted GitHub App surface |
+| `star_history.png` | Coverage/social proof | OSS adoption chart |
+| `x_analytics.png` | Coverage/social proof | social distribution proof |
+| `100k.png` | Coverage/social proof | reach milestone proof |
+
+## Deliverables
+
+| Deliverable | Length | Aspect | Output |
+| --- | ---: | --- | --- |
+| Primary launch video | 90-150s | 16:9 | `ecc-2-primary-launch.mp4` |
+| Install proof clip | 25-35s | 16:9 and 9:16 | `ecc-2-install-proof-*` |
+| What is ECC clip | 45-60s | 16:9 and 9:16 | `ecc-2-what-is-ecc-*` |
+| Security proof clip | 45-60s | 16:9 and 9:16 | `ecc-2-security-proof-*` |
+| Money/proof clip | 30-45s | 16:9 and 9:16 | `ecc-2-money-proof-*` |
+| Coverage/social proof clip | 30-45s | 16:9 and 9:16 | `ecc-2-social-proof-*` |
+
+## Primary Launch Video
+
+The rough v1 primary launch assembly is the current spine. It should stay
+speech-led, with product proof covering jump cuts and older wording.
+
+| Order | Source | In | Out | Use |
+| --- | --- | ---: | ---: | --- |
+| 01 | `sf-longform-full.mp4` | 161.12 | 177.68 | Cleaner opener: ECC as structured context with skills, commands, agents, hooks, and project setup. |
+| 02 | `thread-2-ghapp-money.mp4` | 21.84 | 30.40 | Direct product thesis: agentic harness optimization. |
+| 03 | `thread-2-ghapp-money.mp4` | 41.00 | 59.72 | Not another harness; ECC is the layer and tooling on top of harnesses. |
+| 04 | `longform-full-wide.mp4` | 254.60 | 271.20 | Agentic IDE, observability, tracing, and multi-agent control-plane direction. |
+| 05 | `sf-thread-2-whatisecc.mp4` | 40.08 | 60.60 | GitHub App analyzes repos and injects project-specific skills, prompts, and hooks. |
+| 06 | `sf-thread-4-security.mp4` | 17.60 | 32.72 | Security risk setup: hooks, MCP servers, permissions. |
+| 07 | `sf-thread-4-security.mp4` | 37.28 | 51.32 | AgentShield proof: rules, categories, grades, secrets, injection, exfiltration. |
+| 08 | `thread-2-ghapp-money.mp4` | 59.72 | 75.96 | OSS-first business model plus managed GitHub App surface. |
+| 09 | `longform-full-wide.mp4` | 507.34 | 525.62 | Close on workflows, tested shipping, and secure daily agent work. |
+
+Required local rough v1 artifacts:
+
+- `edl/primary-launch.edl.md`
+- `timelines/primary-launch-v1.timeline.json`
+- `renders/ecc-2-primary-launch-rough-v1.mp4`
+- `renders/ecc-2-primary-launch-rough-v1.captions.srt`
+- `segments/primary-launch-v1/01-structured-context.mp4`
+- `segments/primary-launch-v1/02-agentic-harness-optimization.mp4`
+- `segments/primary-launch-v1/03-not-another-harness.mp4`
+- `segments/primary-launch-v1/04-agentic-ide-surface.mp4`
+- `segments/primary-launch-v1/05-github-app-proof.mp4`
+- `segments/primary-launch-v1/06-security-risk.mp4`
+- `segments/primary-launch-v1/07-agentshield-proof.mp4`
+- `segments/primary-launch-v1/08-oss-paid-model.mp4`
+- `segments/primary-launch-v1/09-close-shipping-system.mp4`
+
+## Publish-Candidate Outputs
+
+The release validator also expects the current publish-candidate set under
+`renders/publish-candidates/`. These are still local review files, not public
+uploads or committed media.
+
+| Output | Target |
+| --- | --- |
+| `ecc-2-primary-launch.mp4` | 90-150s, 1920x1080, audio |
+| `ecc-2-primary-launch.captions.srt` | primary captions |
+| `ecc-2-install-proof-wide.mp4` | 25-35s, 1920x1080, audio |
+| `ecc-2-install-proof-vertical.mp4` | 25-35s, 1080x1920, audio |
+| `ecc-2-what-is-ecc-wide.mp4` | 45-60s, 1920x1080, audio |
+| `ecc-2-what-is-ecc-vertical.mp4` | 45-60s, 1080x1920, audio |
+| `ecc-2-security-proof-wide.mp4` | 45-60s, 1920x1080, audio |
+| `ecc-2-security-proof-vertical.mp4` | 45-60s, 1080x1920, audio |
+| `ecc-2-money-proof-wide.mp4` | 30-45s, 1920x1080, audio |
+| `ecc-2-money-proof-vertical.mp4` | 30-45s, 1080x1920, audio |
+| `ecc-2-social-proof-wide.mp4` | 30-45s, 1920x1080, audio |
+| `ecc-2-social-proof-vertical.mp4` | 30-45s, 1080x1920, audio |
+
+## video-use compatible workflow
+
+Use the same production shape as Video Use while keeping the ECC-specific media
+stack intact:
+
+1. Treat transcript and timeline data as the editing surface.
+2. Keep visual inspection on demand: filmstrips, waveform/timeline composites,
+   or frame samples only at ambiguous cut points.
+3. Propose the edit strategy and EDL before rendering.
+4. Cut deterministically with FFmpeg.
+5. Add proof overlays with Remotion or Manim where product claims need visual
+   evidence.
+6. Export the MP4 plus editable timeline and caption state.
+7. Run cut-boundary, audio, caption, black-frame, and product-claim self-eval
+   before any upload or social post.
+
+Do not dump frames into the repo. Frame samples used for self-eval belong in the
+local release suite workspace.
+
+## Browser Capture Plan
+
+Use Browser or equivalent desktop capture only for proof footage that must be
+current on release day:
+
+| Surface | Capture |
+| --- | --- |
+| GitHub repo | README hero, install block, sponsor links, release notes |
+| Codex plugin | repo marketplace install path and local plugin README |
+| OpenCode package | package install and plugin banner |
+| ECC Tools Pro | billing/product page only after live readback confirms claims |
+| AgentShield | CLI output, policy category view, supply-chain gate |
+| `ecc2/` | alpha control-plane/TUI surface with alpha framing |
+
+If a surface is not live, use a local browser capture and label it as local or
+release-candidate proof. Do not claim marketplace, billing, or official
+directory availability before evidence exists.
+
+## Self-Eval Gate
+
+Run the validator:
+
+```bash
+ECC_VIDEO_SOURCE_ROOT=/path/to/ecc_2_raws \
+ECC_VIDEO_RELEASE_SUITE_ROOT=/path/to/ecc_2_release_suite \
+npm run release:video-suite -- --format json
+```
+
+Then manually check the final render for:
+
+- validator self-eval passes for the primary render: 90-150 seconds, at least
+  1280x720, video stream present, audio stream present, and non-empty output;
+- validator self-eval passes for the publish-candidate set: primary MP4 plus
+  captions and five short clips in both wide and vertical formats;
+- validator visual QA reports zero detected black-frame segments for every
+  publish-candidate MP4;
+- no blank frames or accidental desktop exposure;
+- no stale repo name, pivot, rename, or Claude-only framing in captions;
+- no captions that rewrite speech into a false claim;
+- no stale URLs, old install commands, or pre-rename repository links;
+- no internal MRR numbers unless the post explicitly needs them;
+- audio continuity across every cut;
+- first 10 seconds clearly say what ECC is;
+- final CTA routes to repo, sponsor, Pro, or consulting without clutter.
+
+## Do Not Publish If
+
+- `npm run release:video-suite` is not ready for the local source roots.
+- The primary launch render is outside the 90-150 second target.
+- Captions mention the old repository name.
+- Product proof relies on private screens, secrets, customer data, or raw local
+  paths.
+- The release URL, npm, plugin, billing, or marketplace claims outrun the
+  evidence in `publication-readiness.md`.
@@ -71,13 +71,13 @@ The deeper local integrations stay local until they are sanitized, and publicati
 11/ Start here:

 Repo:
-<https://github.com/affaan-m/everything-claude-code>
+<https://github.com/affaan-m/ECC>

 Hermes x ECC setup:
-<https://github.com/affaan-m/everything-claude-code/blob/main/docs/HERMES-SETUP.md>
+<https://github.com/affaan-m/ECC/blob/main/docs/HERMES-SETUP.md>

 12/ Release notes:
-<https://github.com/affaan-m/everything-claude-code/blob/main/docs/releases/2.0.0-rc.1/release-notes.md>
+<https://github.com/affaan-m/ECC/blob/main/docs/releases/2.0.0-rc.1/release-notes.md>

 URL ledger:
-<https://github.com/affaan-m/everything-claude-code/blob/main/docs/releases/2.0.0-rc.1/release-url-ledger-2026-05-18.md>
+<https://github.com/affaan-m/ECC/blob/main/docs/releases/2.0.0-rc.1/release-url-ledger-2026-05-19.md>
@@ -0,0 +1,179 @@
+# ECC 2.0 Hypergrowth Release Command Center
+
+Snapshot date: 2026-05-19.
+
+This is the execution map for turning ECC 2.0 into a complete public release,
+partner funnel, sponsor funnel, consulting surface, and content launch. It is
+written for operators. Use it to decide what ships, what gets announced, and
+what stays blocked until evidence exists.
+
+## Release Claim
+
+ECC 2.0 is the harness-native operator system for agentic work.
+
+The public proof must show the actual system:
+
+- reusable skills, rules, hooks, MCP conventions, and release gates;
+- Claude Code, Codex, OpenCode, Cursor, Gemini, Zed, GitHub Copilot, and
+  terminal-only workflows as supported execution surfaces;
+- `ecc2/` as the alpha control-plane/TUI direction;
+- Hermes as the optional operator shell for chat, cron, handoffs, and daily
+  work routing;
+- ECC Tools Pro, GitHub Sponsors, and consulting as the business surface that
+  funds the OSS layer.
+
+Avoid language that frames this as a rename or a retreat from the old project.
+The release copy should show the 2.0 product shape directly.
+
+## Current Growth Baseline
+
+| Metric | Current | Target | Gap |
+| --- | ---: | ---: | ---: |
+| MRR | `$1,728/mo` | `$10,000/mo` | `$8,272/mo` |
+| Sponsor motion | Active GitHub Sponsors plus open inbound | Repeatable sponsor close loop | Approval-gated outbound |
+| Consulting motion | Open, non-primary | Partner-ready packages | Public proof, talks, and intake |
+| Content motion | Release video publish candidates ready | Weekly launch clips and founder proof | Owner approval, upload, and public URLs |
+| Community motion | Discord exists | Useful coding/operator community | Invite, channels, pins, moderation |
+
+MRR growth should come from four lanes at once:
+
+- GitHub Sponsors and OSS partner sponsors;
+- ECC Tools Pro subscriptions;
+- consulting and implementation contracts;
+- talks, podcasts, conference demos, and partner webinars that create inbound.
+
+## Second Hypergrowth Phase
+
+The release should behave like a proof engine, not a name-change announcement.
+Every public surface should make the product obvious in the first screen,
+clip, paragraph, or demo:
+
+| Workstream | Public proof | Revenue path |
+| --- | --- | --- |
+| Product category | ECC as the harness-native operator system, not a Claude-only config pack | Converts confused OSS traffic into install, Pro, and sponsor intent |
+| Harness coverage | Claude Code, Codex, OpenCode, Cursor, Gemini, Zed, GitHub Copilot, and terminal workflows shown as execution surfaces | Partner conversations with tools, IDEs, model providers, and platform teams |
+| Control plane | `ecc2/` alpha dashboard/status/session surface and Hermes operator shell clearly framed as directionally live | Consulting and team implementation sprints |
+| Enterprise trust | AgentShield, supply-chain, release, observability, and CI gates shown as repeatable evidence | Security vendors, code-review vendors, platform sponsors, and enterprise pilots |
+| Media engine | Primary launch video, five proof clips, browser captures, transcripts, EDLs, captions, and editable timelines | Social reach, podcast/talk booking, sponsor proof, partner demos |
+| Community funnel | GitHub Discussions, Discord once approved, sponsor tiers, Pro, and consulting CTAs routed without clutter | Repeatable inbound, not one-off launch spikes |
+
+The operating rhythm after launch should be weekly:
+
+1. one product proof clip;
+2. one security or release-discipline proof clip;
+3. one partner/sponsor/talk outreach batch after owner approval;
+4. one public discussion or community prompt;
+5. one measurable funnel readback covering repo traffic, sponsor clicks, Pro
+   conversions, MRR movement, and inbound replies.
+
+## Release Gates
+
+| Lane | Done when | Current action |
+| --- | --- | --- |
+| Repo identity | README, package metadata, plugin metadata, release docs, workflows, and launch copy all use `affaan-m/ECC` where public URLs are needed | Canonical URL sweep |
+| Package and plugin publication | `ecc-universal@2.0.0-rc.1` dry-runs clean, npm `next` is approved, Claude plugin tag dry-runs, Codex repo marketplace smoke passes, OpenCode build passes | Refresh publication evidence from final commit |
+| Product proof | Quickstart, cross-harness architecture, demo prompts, `ecc2/` alpha boundary, AgentShield safety proof, and hosted ECC Tools links are consistent | Keep proof surfaces concrete |
+| Revenue proof | Sponsor tiers, Pro pricing, consulting CTA, partner CTA, and billing-readback language are current | Do not announce billing claims before live readback |
+| Content proof | Launch video, short-form clips, screenshots, release notes, GitHub Discussion, X, LinkedIn, and longform post are aligned | Pick final video cuts, upload after approval, and attach public URLs |
+| Community proof | Discord invite, rules, channels, onboarding, and sponsor/community routing are ready | Needs invite/token decision before public links |
+
+## Video Suite
+
+The video lane should use the existing ECC video-editing skill plus the
+`browser-use/video-use` model where useful: transcript as the editing surface,
+strategy approval before render, deterministic cuts, timeline/project output
+when available, and self-eval before publication.
+
+Reference pattern: <https://github.com/browser-use/video-use>
+
+Primary source classes already exist in the local ECC media library. Keep raw
+absolute paths out of public docs; use basenames or a private production
+manifest when handing work to an editor or agent.
+
+| Deliverable | Length | Source material | Proof goal |
+| --- | ---: | --- | --- |
+| Primary launch video | 90-150s | `longform-full-wide.mp4`, `sf-longform-full.mp4`, `architecture-2-wide.mp4`, `terminal-scan-2-wide.mp4`, `new_site_raw.mp4` | ECC 2.0 as the operator system |
+| Install proof | 30s | README install, terminal scan, quickstart, plugin install | Fewer-click adoption |
+| What is ECC | 45-60s | `sf-thread-2-whatisecc.mp4`, `vertical-2-whatisecc.mp4`, `architecture-2-*` | Product category clarity |
+| Security proof | 45-60s | `sf-thread-4-security.mp4`, AgentShield evidence, supply-chain gates | Enterprise trust |
+| Money/proof clip | 30-45s | `thread-2-ghapp-money.mp4`, `metrics-ticker-2-*`, `gh_app_*.png` | Sponsor, Pro, and partner credibility |
+| Coverage/social proof | 30-45s | `coverage-montage-wide.mp4`, `100k.png`, `star_history.png`, `x_analytics.png`, coverage screenshots | Distribution leverage |
+
+Production steps:
+
+1. Generate transcripts for the longform and shortform raw clips.
+2. Build an edit decision list with hook, proof, demo, business CTA, and final
+   CTA segments.
+3. Cut deterministically with FFmpeg.
+4. Add overlays and data motion in Remotion or Manim.
+5. Add captions, light color correction, audio normalization, and platform
+   reframes.
+6. Run a self-eval pass for blank frames, bad captions, jump cuts, weak hook,
+   missing product proof, and stale URLs.
+7. Export final MP4s plus the editable timeline/project state.
+
+## Distribution Plan
+
+| Channel | Asset | CTA |
+| --- | --- | --- |
+| GitHub Release | release notes, quickstart, launch video, sponsor link | star, install, sponsor |
+| GitHub Discussion | short announcement and proof bullets | questions, feedback, sponsors |
+| X | launch thread, 30s install clip, proof clips | repo, sponsor, Pro |
+| LinkedIn | partner-friendly product proof, consulting CTA | sponsors, consulting, talks |
+| YouTube/Shorts/Reels/TikTok | primary launch video and clips | repo, site, newsletter/community |
+| Podcasts/talks | one-page pitch, demo outline, founder proof | bookings, partners |
+| Sponsor outbound | direct sponsor note and tier table | GitHub Sponsors or Pro |
+
+The source of truth for sponsor, partner, consulting, conference, podcast, and
+GitHub Discussion copy is
+`docs/releases/2.0.0-rc.1/partner-sponsor-talks-pack.md`.
+The source of truth for owner approval across release, package, plugin, video,
+billing, social, and outbound actions is
+`docs/releases/2.0.0-rc.1/owner-approval-packet-2026-05-19.md`.
+
+## Copy Rules
+
+Use direct product language:
+
+- `ECC 2.0 is the harness-native operator system for agentic work.`
+- `One reusable layer across Claude Code, Codex, OpenCode, Cursor, Gemini, Zed, GitHub Copilot, and terminal workflows.`
+- `OSS stays free. Sponsors and Pro fund the work.`
+- `Use ECC for skills, hooks, rules, MCP conventions, release gates, and operator workflows.`
+
+Avoid:
+
+- `we renamed the repo`;
+- `pivot`;
+- legacy config-pack framing;
+- `Claude-only`;
+- generic founder-journey language;
+- claims about billing, marketplace payments, or official directory listings
+  before live evidence exists.
+
+## First Build Order
+
+1. Land the public repo identity fixes.
+2. Refresh package, plugin, workflow, release, and launch-copy URLs.
+3. Record final publication evidence from the exact release commit.
+4. Keep the video suite manifest, transcripts, publish candidates, and visual QA
+   current with `npm run release:video-suite -- --format json`.
+5. Browser-capture the README, ECC Tools app, install flow, and relevant proof
+   surfaces for b-roll.
+6. Choose the owner-approved primary launch video and five short clips, then
+   upload and attach final public URLs.
+7. Finalize GitHub release, X thread, LinkedIn post, Discussion announcement,
+   sponsor email copy, consulting intro, partner DM, and podcast/talk pitch.
+8. Publish only after npm, plugin, release URL, and billing-readback gates are
+   either live or explicitly marked blocked.
+
+## Owner Approvals
+
+These actions need a human approval or credential before they move:
+
+- sending annual-upgrade or sponsor emails;
+- updating LinkedIn profile text;
+- wiring Discord with a bot token and guild ID;
+- publishing npm or creating plugin tags;
+- announcing billing/native payments;
+- sending partner, consulting, conference, podcast, or sponsor outreach;
+- posting final social copy from personal accounts.
@@ -26,8 +26,9 @@ credentials:
  with historical malicious `node-ipc` versions also blocked by ECC because
  they carried destructive or unauthorized file-writing behavior.
 - The live IOC set includes persistence through Claude Code
-  `.claude/settings.json`, VS Code `.vscode/tasks.json`, and OS-level
-  `gh-token-monitor` LaunchAgent/systemd services. Some variants add
+  `.claude/settings.json`, VS Code `.vscode/tasks.json`, Zed
+  `.zed/tasks.json`, and OS-level `gh-token-monitor` LaunchAgent/systemd
+  services. Some variants add
  `~/.config/gh-token-monitor/token` plus a dead-man-switch token description
  `IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner`, malicious workflow
  files such as `.github/workflows/codeql_analysis.yml`, and Python runtime
@@ -179,7 +180,7 @@ Escalate to a maintainer security review before any release or merge if:

 - a dependency lockfile references a package named in an active advisory;
 - `node scripts/ci/scan-supply-chain-iocs.js --home` finds Claude Code,
-  VS Code, or OS-level persistence indicators;
+  VS Code, Zed, or OS-level persistence indicators;
 - a workflow combines `pull_request_target` with dependency installation,
  cache restore/save, PR-head checkout, or write permissions;
 - a release workflow combines `id-token: write` with shared cache usage;