Keesan12 · Keesan12 · May 17, 2026 · May 17, 2026 · May 18, 2026 · May 21, 2026
diff --git a/.github/workflows/publish-mcp.yml b/.github/workflows/publish-mcp.yml
@@ -107,7 +107,7 @@ jobs:
       - name: Publish MCP to npm
         if: steps.npm-version.outputs.exists != 'true'
         working-directory: packages/mcp
-        run: npm publish --access public --provenance
+        run: npm publish --provenance --access public
 
       - name: Skip duplicate MCP publish
         if: steps.npm-version.outputs.exists == 'true'

diff --git a/.gitignore b/.gitignore
@@ -21,16 +21,32 @@ coverage/
 # Cache directories
 .npm-cache/
 .cache/
+.deepsec/
+.tmp/
+.qwen/
+.tools/
 
 # Test output
 vitest-results.json
 *.sqlite
 
 # Runtime artifacts
 artifacts/
+.artifacts/
 output/
 /cm*.md
 /cmp*.md
+audit-pack-gate-audit-run/
+case-study-results.json
+gate-check-results.json
+.codex-root-build.log
+.codex-root-lint.log
+
+# Private or internal-only workspace residue
+apps/
+packages/formal-proof/
+docs/handoffs/
+docs/release/audit-handoff/
 
 # OS files
 .DS_Store

diff --git a/AGENTS.md b/AGENTS.md
@@ -3,7 +3,6 @@
 ## Project Overview
 
 Martin Loop OSS is the public local-first runtime, CLI, and MCP workspace for governed AI coding loops.
-
 This repository is a public surface. Keep all docs, release notes, PRs, package metadata, examples, screenshots, comments, and changelogs suitable for public users and external review.
 
 ## Setup And Commands
@@ -24,15 +23,54 @@ This repository is a public surface. Keep all docs, release notes, PRs, package
 - Guardrail: keep publishable articles under `docs/posts/` if they belong in the public repo at all; otherwise keep them in the outreach workspace, not in the package/release surface.
 - Verification: `pnpm oss:validate` and `scripts/tests/oss-boundary.test.mjs` must stay green after any content move.
 
-## Release Workflow
+## Release Defaults
 
+- Reload the release-memory docs before making MCP version or publish-path assumptions: `docs/release/VERSION-LEDGER.md`, `docs/release/MCP-DELIVERY-SLICE-MAP.md`, and `docs/release/MCP-PUBLISHING.md`.
 - Publish public packages through GitHub Actions release workflows by default.
 - When npm trusted publishing is connected, use GitHub Actions trusted publishing/OIDC only. Do not add, use, prefer, or fall back to npm publish tokens (`NPM_TOKEN`, `NODE_AUTH_TOKEN`, token selection, or local `npm publish`) unless Keesan explicitly approves an exception after trusted publishing is proven unavailable.
 - If trusted publishing fails, debug the trusted-publisher setup, workflow identity, tag/ref trigger, package mapping, runner Node/npm version, and live npm/GitHub release state before changing release mechanics.
 - Do not publish locally unless the workflow path is unavailable and the user explicitly approves a fallback.
 - Keep the root `martin-loop` package version separate from the standalone `@martinloop/mcp` package version.
 - For MCP releases, keep `packages/mcp/package.json`, `packages/mcp/server.json`, release docs, and published package smoke tests aligned.
 
+## Public Repo Surface Standard
+
+- Rule: every public-facing repo file, release note, package README, GitHub release, npm metadata entry, public PR description, doc, example, screenshot, and changelog must be clean client-facing copy.
+- Guardrail: preserve internal work and ideas in private handoffs, planning docs, release playbooks, or internal repos. Before publishing, editing, merging, or summarizing public material, scan for and remove internal repo names, local machine paths, private roadmap language, removed-branch/process notes, workflow plumbing, paid-tier plans, private implementation commentary, customer-sensitive details, and workspace chatter.
+- Verification: final public-surface status must name the surface checked and the guardrail used, such as `pnpm exec node --test scripts/tests/mcp-release-docs.test.mjs`, a forbidden-term scan, `gh release view`, `npm view`, `rg`, or `pnpm oss:validate`.
+
+## Operating Memory Schema
+
+- Treat remembered operating constraints as incomplete unless they include all three parts:
+- `Rule = policy`
+- `Guardrail = enforcement`
+- `Verification = proof`
+
+### Release-Memory Activation
+
+- Rule: do not start OSS release work in blank-slate mode.
+- Guardrail: read the release-memory docs and the closest instruction layer before touching workflows, tags, versions, or publish paths.
+- Verification: the first execution step and release lane must visibly follow those docs instead of ad hoc assumptions.
+
+### Browser Cleanup
+
+- Rule: if browser tabs are used during repo work, cleanup is part of done.
+- Guardrail: before claiming completion on browser-involved work, explicitly check whether extra tabs opened for the run should be closed.
+- Verification: either the extra tabs are closed, or the final status states why they were intentionally left open.
+
+### Public Repo Boundary
+
+- Rule: keep this repository's public docs, release notes, package metadata, examples, and workflow files free of non-public workspace names, local paths, and internal mirror details.
+- Guardrail: use relative repo paths in public instructions, and keep private handoffs or mirror coordination in private planning docs outside this public repo.
+- Verification: before public release, run a forbidden-term scan across public docs, package metadata, scripts, workflows, and examples.
+
+## MCP Registry Guardrails
+
+- Do not call `packages/mcp` registry-ready unless `packages/mcp/package.json` includes `mcpName` and `packages/mcp/server.json` exists with matching `name`, `version`, and npm package `identifier`.
+- npm publication happens before official MCP Registry publication.
+- The official MCP Registry flow runs from `packages/mcp`: `mcp-publisher login github`, then `mcp-publisher publish`.
+- The current official registry server name for the public MCP package is `io.github.Keesan12/martin-loop`.
+
 ## Code Style
 
 - Prefer small, auditable changes.

diff --git a/CONTEXT.md b/CONTEXT.md
@@ -0,0 +1,90 @@
+# Martin Loop OSS Context
+
+## Purpose
+
+This repository is the public OSS execution repo for Martin Loop:
+
+- Repo path: `./`
+- Git remote: `https://github.com/Keesan12/martin-loop.git`
+
+Use this tree for OSS-safe package, docs, and verification work only.
+
+## Public Tree
+
+The canonical public surface in this repo is:
+
+- `packages/contracts`
+- `packages/core`
+- `packages/adapters`
+- `packages/cli`
+- `packages/mcp`
+- `docs/oss`
+- `docs/release`
+- `docs/assets`
+- `benchmarks`
+- `demo/seeded-workspace`
+- `scripts`
+- root packaging and workspace config files
+
+If a folder is not needed to ship or verify the OSS runtime, it does not belong here by default.
+
+## Public Release Lines
+
+Keep the root package and standalone MCP package release lines separate:
+
+- root `martin-loop`: CLI and SDK facade
+- standalone `@martinloop/mcp`: MCP server package
+
+Current public package versions are recorded in:
+
+- `package.json`
+- `packages/mcp/package.json`
+- `docs/release/VERSION-LEDGER.md`
+
+Keep non-public service, roadmap, and operations details out of this repo.
+
+## Non-Public Work Boundary
+
+Archive, handoff, and internal coordination notes belong outside this public repo.
+
+Keep these materials out of tracked public files:
+
+- handoffs and execution notes
+- quarantine or archive material moved out of the OSS repo
+- non-public app, audit, or release-pack work
+- internal-only plans or review packs
+
+Do not reintroduce non-public residue into this OSS repo.
+
+## MCP Work Lane
+
+The active public MCP package lives in:
+
+- `packages/mcp`
+
+Default verification lane:
+
+```powershell
+pnpm install --frozen-lockfile
+pnpm --filter @martinloop/mcp lint
+pnpm --filter @martinloop/mcp test
+pnpm --filter @martinloop/mcp build
+pnpm --filter @martinloop/mcp smoke:pack
+pnpm --filter @martinloop/mcp smoke:published:pack
+```
+
+If packaging or publish-surface files change, also run:
+
+```powershell
+pnpm --filter @martinloop/mcp verify:release
+```
+
+## Handoff Discipline
+
+Durable handoff notes for this repo should be updated outside this public repo.
+
+## Cleanup Rules
+
+- Quarantine first, delete later only with explicit confirmation.
+- Keep generated build, audit, and local experiment artifacts out of normal `git status`.
+- Before syncing across folders, classify contamination rather than bulk-removing by keyword.
diff --git a/README.md b/README.md
@@ -4,7 +4,7 @@
 
 ### Governed AI coding loops with budgets, verifier gates, rollback evidence, and receipts.
 
-[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue?logo=apache)](./LICENSE)
+[![License: MIT](https://img.shields.io/badge/license-MIT-7c3aed?style=flat-square)](./LICENSE)
 [![TypeScript](https://img.shields.io/badge/TypeScript-strict-3178c6?style=flat-square&logo=typescript&logoColor=white)](./tsconfig.base.json)
 [![Node](https://img.shields.io/badge/node-%3E%3D20-3c873a?style=flat-square&logo=nodedotjs&logoColor=white)](#quick-start)
 [![npm](https://img.shields.io/badge/npm-martin--loop-cc3534?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/martin-loop)
@@ -133,7 +133,7 @@ If the problem is familiar, star the repo so other builders can find the runtime
 npm install -g martin-loop
 ```
 
-This installs the public `martin-loop` CLI package. This README is synced for `martin-loop@0.1.7`.
+This installs the public `martin-loop` CLI and SDK package. This README is synced for `martin-loop@0.1.7`.
 
 Want a safe sandbox first? Run `npx martin-loop demo` and MartinLoop will copy a disposable local workspace into `./martin-loop-demo`.
 
@@ -144,13 +144,21 @@ The public package surface is:
 - Install target: `npm install martin-loop`
 - CLI target: `npx martin-loop`
 - SDK target: `import { MartinLoop } from "martin-loop"`
-- MCP target: `npx -y @martinloop/mcp`
+- MCP package: `@martinloop/mcp@0.2.5`
+- MCP launch target: `npx -y @martinloop/mcp`
 
 `martin-loop` and `@martinloop/mcp` are published separately. The root package is for CLI and SDK use; the MCP package is for MCP hosts.
 
 ### MCP server
 
-`@martinloop/mcp@0.2.0` exposes ten stdio tools plus read-only resources, resource templates, and prompts. `martin_run` remains the only tool that can execute work; the newer cockpit tools are read-only review helpers for recent runs, dossiers, attempts, and verifier results.
+`@martinloop/mcp@0.2.5` exposes ten stdio tools plus read-only resources, resource templates, and prompts. `martin_run` remains the only tool that can execute work; the cockpit tools are read-only helpers for recent runs, dossiers, attempts, verifier results, and triage.
+
+MCP package proof before publishing includes:
+
+- `pnpm --filter @martinloop/mcp smoke:published:pack`
+- `pnpm --filter @martinloop/mcp verify:release`
+
+MCP server identifier: `io.github.Keesan12/martin-loop`
 
 Recommended first-use flow:
 
@@ -159,20 +167,27 @@ Recommended first-use flow:
 3. `martin_run`
 4. `martin_list_runs`, `martin_run_dossier`, `martin_inspect`, or `martin_status`
 
-### MCP install
+### Claude Code MCP install
 
 Use the published MCP package directly:
 
-- Codex: `codex mcp add martin-loop -- npx -y @martinloop/mcp`
-- Claude Code macOS/Linux: `claude mcp add --transport stdio --scope user martin-loop -- npx -y @martinloop/mcp`
-- Claude Code Windows PowerShell/cmd: `claude mcp add --transport stdio --scope user martin-loop -- cmd /c npx -y @martinloop/mcp`
+- macOS/Linux: `claude mcp add --transport stdio --scope user martin-loop -- npx -y @martinloop/mcp`
+- Windows PowerShell/cmd: `claude mcp add --transport stdio --scope user martin-loop -- cmd /c npx -y @martinloop/mcp`
 
 If you just want to launch the server manually, the one-line command is:
 
 ```sh
 npx -y @martinloop/mcp
 ```
 
+### Other MCP host installs
+
+- Codex: `codex mcp add martin-loop -- npx -y @martinloop/mcp`
+- Gemini CLI and generic wrapper hosts: generate the exact local or remote profile with `martin mcp print-config --host gemini|generic --transport stdio|remote --profile starter|full`
+- Claude, Codex, Gemini, and generic hosts all support generated starter/full profiles through `martin mcp print-config` and `martin mcp install`
+
+Martin Loop keeps the public package local-first and stdio-first. Remote profile generation is configuration output only; the published packages launch the local CLI, SDK, and stdio MCP surfaces described above.
+
 ### Run a governed task
 
 ```sh
@@ -189,13 +204,11 @@ npx martin-loop run --objective "fix the auth regression" --budget 3.00 --verify
 
 For a no-spend repo-local dry run, use the stub adapter:
 
-```powershell
-$env:MARTIN_LIVE='false'
-npx martin-loop run --objective "Summarize the current runtime state" --verify "pnpm --filter @martin/core test"
-Remove-Item Env:MARTIN_LIVE
+```sh
+MARTIN_LIVE=false npx martin-loop run --objective "Summarize the current runtime state" --verify "pnpm --filter @martin/core test"
 ```
 
-### Inspect or resume runs
+### Inspect, triage, or resume runs
 
 ```sh
 npx martin-loop inspect --file ~/.martin/runs/<workspaceId>.jsonl
@@ -209,7 +222,7 @@ npx martin-loop resume <loopId>
 ## CLI
 
 ```text
-martin-loop run <objective> [options]
+npx martin-loop run <objective> [options]
 
   --objective <text>      The task to accomplish, or pass it as the first positional arg
   --budget <n>            Hard cost cap in USD
@@ -232,6 +245,22 @@ martin-loop run <objective> [options]
 
 The public CLI also includes `demo`, `inspect`, and `resume`.
 
+New operator-first workflows are available through:
+
+```text
+npx martin-loop doctor
+npx martin-loop preflight <objective> [options]
+npx martin-loop triage [options]
+npx martin-loop dossier (--loop-id <id> | --file <path> | --latest)
+npx martin-loop runs list|get|attempt|verify ...
+npx martin-loop mcp print-config --host codex|claude|gemini|generic --transport stdio|remote --profile starter|full
+npx martin-loop mcp install --host codex|claude|gemini|generic --scope user|project [--dry-run]
+```
+
+Use `--json` for stable machine-readable output and `--quiet` for script-friendly minimal output.
+
+The public package remains local-first and stdio-first.
+
 <div align="center">
   <img src="./docs/assets/cli-static.svg" alt="MartinLoop CLI terminal output" width="720">
 </div>
@@ -312,16 +341,16 @@ The lower-level `runMartin` function is also exported for callers that want to a
 
 ---
 
-## Package Map
+## Workspace Map
 
 | Package or app | Role |
 |---|---|
 | `martin-loop` | Root public npm facade that vendors the runtime, CLI, adapters, and contracts into `dist/`. |
 | `@martin/contracts` | Shared types for loops, policy, governance, budget, telemetry, and rollback. |
 | `@martin/core` | Runtime controller, policy engine, safety leash, grounding, persistence, and rollback logic. |
 | `@martin/adapters` | Claude CLI, Codex CLI, direct-provider, and stub adapter surfaces. |
-| `@martin/cli` | CLI implementation for `run`, `demo`, `inspect`, and `resume`. |
-| `@martinloop/mcp` | MCP server with governed execution plus read-only run review tools. |
+| `@martin/cli` | Local CLI implementation for `run`, `demo`, `inspect`, `resume`, and operator helper commands. |
+| `@martinloop/mcp` | Governed execution cockpit over MCP: doctor, preflight, run, inspection tools, resources, and prompts. |
 
 Users install the root `martin-loop` package for the CLI and SDK, or the standalone `@martinloop/mcp` package for MCP hosts.
 
@@ -351,10 +380,9 @@ pnpm oss:validate
 pnpm public:smoke
 pnpm rc:validate
 pnpm release:matrix:local
-pnpm --filter @martinloop/mcp verify:release
 ```
 
-> **Caution:** This package is live on npm. Public releases should use the guarded GitHub Actions release workflow, with versioning and public copy verified before publishing.
+> **Caution:** This package is live on npm. Treat every publish as a guarded release step: verify the RC gate commands, confirm semantic versioning, and document breaking changes before publishing.
 
 Helpful docs:
 
@@ -387,7 +415,7 @@ Conventional commit prefixes: `feat:`, `fix:`, `chore:`, `docs:`, `refactor:`, a
 
 **⭐Give the repo a star⭐** if you think AI coding needs budgets, brakes, and receipts.
 
-**APACHE 2.0 Licensed** · [martinloop.com](https://martinloop.com) · [keesan@martinloop.com](mailto:support@martinloop.com)
+**MIT Licensed** · [martinloop.com](https://martinloop.com) · [keesan@martinloop.com](mailto:keesan@martinloop.com)
 
 *"AI coding accountability: completes good work, refuses unsafe work, stops uneconomical work."*