[houlianpi]

Requirement

Closes #28.

User-visible result

The root README presents AutoGenesis 1.1.1 Skills Preview as one canonical autogenesis Agent Skill plus the existing standard stdio MCP Runtimes. Public users are told to wait for accepted immutable Release assets; there is no executable public Candidate path before publication. Maintainers and assigned independent acceptors receive exact Candidate provenance, checksum, isolation, source-secrecy, rollback, and support-tier guidance.

Direct natural-language execution and exact BDD execution remain visible. Explicit recording may return a read-only generated-code preview but cannot write or commit generated files.

Scope

• Replace superseded multi-Skill onboarding in root README.md.
• Preserve the approved product story, logo, and scoped Edge deployment evidence.
• Restrict exact-head Candidate use to maintainers and assigned independent acceptors.
• Require service-reported artifact-digest verification before extraction, then complete internal checksum verification.
• Align Candidate isolation, package-source secrecy, project-Skill scope, and cleanup with merged [Security]: Harden generated install prompts and checksum closure #74.
• Record evidence-bound OMP/macOS, experimental client, Windows, Pi, and Linux/WSL support tiers.
• Keep exact public installation commands blocked until immutable public coordinates and digests exist.

Non-goals

• No Agent Contract, Runtime, manifest, workflow, package, or Registry behavior change.
• No package publication, GitHub Release creation, merge, or protected-branch change.
• No generated-file writes, commit approval, replay claim, client-specific Skill, wrapper, or compatibility adapter.
• No qualification based on source-tree, editable-install, schema-only, or experimental-client evidence.

Interface changes

None. This PR documents the existing generic Agent Skills discovery plus standard stdio MCP interface. It inherits merged main commit 24c8b26798c5b308993d724e8ec8209972ba844b, including the safe read-only Preview boundary and hardened Candidate/public install prompts.

Acceptance scenarios

Scenario: Honest pre-publication path
  Given immutable public Release assets have not been published and accepted
  When a public user reads the root README
  Then the user is told to wait for the immutable Release
  And no executable Candidate installation path is offered to the public
  And only the canonical Skill name "autogenesis" appears

Scenario: Authenticated Candidate acceptance
  Given an assigned acceptor selects the successful Candidate for the exact trusted head
  When the archive is acquired
  Then its bytes are verified against the service-reported digest before interpretation
  And complete internal checksums are verified in a private disposable transaction
  And package sources, project Skill state, MCP state, and rollback follow the merged #74 contract

Scenario: Safe recording and evidence-bound support
  Given a reader inspects Preview behavior and support
  Then direct and exact BDD execution remain available
  And explicit recording stops at a read-only preview
  And OMP/native macOS is the sole qualified baseline
  And Copilot CLI, Codex, Windows, Pi, Linux, and WSL retain their evidence-bound tiers

Verification evidence

Exact head: aeeb42fe6784f98f4c988b45d99925fd090bb39d.

Check	Result	Evidence
Targeted documentation checks	Pass	14/14 repository-local README links resolve; focused onboarding assertions pass; git diff --check passes
Build/type checks	Pass	PR #29 Quality Gates run 43043654485: Candidate channel, documentation, extension, and Python syntax all pass
Rendered UI	Pass	GitHub GFM render visually inspected for warning, Candidate provenance, source isolation, rollback, checksum closure, and support table
Independent correctness/security review	APPROVE + SECURITY_APPROVE	PR comment 6799222036; initial two findings remediated and focused re-review found no remaining issue
Fresh merged-main Candidate build	Pass	run 43041771738, artifact 13865373311, service digest sha256:3a61ae9164bed87cdcbb899f167041d74156992396a9fa3f7b95882f547c1eec
Clean Candidate acceptance	Blocked before installation	Issue #28 comments 6799221981 and 6799348848: pypi.org timed out twice; TUNA lacked a locked distribution; artifact/checksum identity and cleanup passed; business scenarios were not reached

Agent roles and review gate

• Implementer: Onboarding.
• Independent combined correctness/security reviewer: OnboardingReview — APPROVE + SECURITY_APPROVE at exact head content, no remaining findings.
• Separate acceptor: required for clean Candidate and public-artifact acceptance.
• Acceptance-gate reason: public onboarding must be exercised from authenticated built/public artifacts, not editable source or unauthenticated downloads.

Security review

• Secrets and sensitive inputs are not written to logs, generated code, or tracked configuration.
• File writes are scoped and atomic.
• Command/process inputs are not shell-interpolated.
• Package downloads and remote instructions are pinned or verified.

Candidate guidance forbids ambient pip/uv configuration and credential reads, uses an independently approved opaque source/auth interface, requires isolated null-config hash-locked staging/install, and removes only still-matching prompt-created environment, cache, project-Skill, and MCP state.

Compatibility impact

OMP 18.18.3 on native macOS remains the sole qualified baseline. GitHub Copilot CLI and Codex CLI remain experimental/unqualified. Stock Pi remains unsupported because it has no MCP. Native Windows Skills remains unqualified pending final-artifact acceptance. Linux and WSL remain unsupported.

Rollback

Revert this PR's README/media commits. Candidate rollback removes only still-matching prompt-created transaction, project-Skill, and MCP state; mismatched, substituted, pre-existing, and unrelated state is preserved. No package, Runtime, MCP configuration, generated business file, or user data is changed by merging the documentation itself.

Known limitations

• Public immutable Release assets are not published; the public installation warning remains.
• Fresh clean Candidate acceptance is blocked before installation after two approved source paths failed: pypi.org timed out and TUNA lacked a locked distribution. No business journey is called passed; no further source hopping is attempted.
• Exact post-publication URLs and digests cannot be inserted until every public surface is published and accepted.

Definition of Done

• The issue met Definition of Ready before implementation began.
• Scope and non-goals were preserved.
• All acceptance scenarios pass in their required environments; clean-environment evidence is present.
• Required exact-head CI checks pass.
• One independent reviewer approved the change.
• A separate acceptor posts clean-environment evidence.
• Security coverage passed.
• Documentation and machine-readable configuration agree for the current pre-publication state.

[houlianpi]

README redesign evidence for commit ce18d59 / PR #29

Independent code review: APPROVE.

• Confirmed package names, versions, entrypoints, Skill role split, readiness conditions, status disclosures, links, and exact gated CLI sequence.
• Initial findings for Windows status, bootstrap approval, and physical-iPhone readiness were remediated and re-reviewed.

Independent security review: APPROVE.

• Agent Install Prompt now requires exact-plan approval before process execution, network access, or filesystem writes, with fresh approval after any change.
• It preserves conflicting existing content and fails closed on shadowing, ambiguity, transformed bytes, digest/Contract mismatch, or inability to prove the discovered path and identity.
• The unpublished public package coordinate is explicitly prohibited; exact future CLI commands remain inline documentation, not a runnable shell block.

Prompt eval comparison

• Harness: same session slow model for baseline and candidate; independent structured grading.
• Fixed cases: approval before fetch, conflicting shadow Skill, changed plan, and unprovable discovery resolution.
• Baseline (c7ff16e): 3/4.
• Candidate (ce18d59): 4/4.
• Regressions: 0.
• Candidate improvement: an agent unable to prove the resolved Skill path/digest/version stops instead of reporting installation success.
• Raw local evidence: /tmp/autogenesis-readme-prompt-eval.json (synthetic paths only; no credentials).

Verification

• Agent Contract Skill/release tests: 18 passed.
• Generated Agent Install Prompt matches the README block byte-for-byte.
• GitHub GFM render completed successfully.
• All 11 repository-relative links resolve.
• autogenesis --help and autogenesis install --help matched the documented interface in an isolated verifier environment.
• git diff --check passed.

Human Product Owner acceptance remains pending through OMP, Codex CLI, Pi, and GitHub Copilot CLI. Public package/release publication and native Windows acceptance remain gated.

[houlianpi]

README product redesign update — commit b66da16

The first candidate was rejected by the Human Product Owner. The revised README now leads with the approved product position:

Write the behavior. Watch AI record it. Replay without AI.

Observable changes:

• Leads with BDD → exact real-app execution → observed MCP recording → preview approval → Behave replay.
• Explains the development/QA/CI collaboration model before installation.
• Makes Agent-first onboarding primary; CLI, package, Runtime, and trust mechanics are lower-level content.
• Covers Windows, macOS, iOS, and Android without presenting pending acceptance as complete.
• Removes the stale repository template and does not route onboarding through the old clone-based documentation site.
• Keeps the full verified Agent Install Prompt in a collapsed reference.
• Explicitly qualifies model-backed visual assertions: replay does not require the Coding Agent, while recorded visual-model checks retain their configured model dependency.
• Describes actual preview bindings and arbitrary-secret detection limitations without overstating protection.
• A real Hero Demo remains intentionally deferred by Product Owner decision; no fake placeholder was added.

Independent review:

• Product/correctness review ReadmeProductReviewV2: APPROVE.
• Security review ReadmeSecurityReviewV2: APPROVE.

Verification:

• GitHub GFM and Mermaid rendering succeeded.
• Every repository-relative link resolves.
• The collapsed Agent Install Prompt matches generated release output byte-for-byte.
• git diff --check passed.

PR: #29

[houlianpi]

FSQ-style README refinement — commit 7860e26

Human Product Owner direction: learn from https://github.com/FSQ-lab/FSQ and leave unavailable media blank until approved assets arrive.

Changes:

• Adopted FSQ's product-first hierarchy: centered position, badges and navigation, complete-test position, evidence sequence, then Quick Start.
• Moved Agent-first setup immediately after product proof.
• Added user-facing "Go further" and contribution sections.
• Reserved invisible blank slots for the approved logo, complete-test video, scenario card, execution capture, and replay evidence. No broken links, invented screenshots, or fake placeholders were added.
• Preserved AutoGenesis-specific BDD, preview approval, replay/model exception, pre-release, unsupported-host, credential, and trust-boundary contracts.

Verification:

• Published branch rendered on GitHub; Mermaid rendered and all four badges loaded.
• Every repository-relative link resolves.
• Canonical Agent Install Prompt still matches generated release output byte-for-byte.
• git diff --check passed.
• Independent product review: FSQReadmeProductReview — APPROVE.
• Independent security review: FSQReadmeSecurityReview — APPROVE.

PR: #29

[houlianpi]

AutoGenesis brand logo — commit 07e66a6

Added original responsive light/dark SVG wordmarks and installed them in the README using <picture> color-scheme selection.

Concept:

• Three nodes represent readable BDD behavior steps.
• Their paths converge into the generated executable test.
• The surrounding arrow represents approved replay and the regression loop.
• Typography, loop silhouette, and neutral palette relate the mark to the FSQ family without copying FSQ's shield/check symbol.

Verification:

• Both SVGs parse as standalone 520×120 assets.
• No scripts, external images, links, or embedded raster data.
• Published GitHub README selected the dark variant correctly; image loaded with 420×96.9 rendered bounds and useful alt text.
• Independent design review AutoGenesisLogoReview: APPROVE; desktop/mobile/260 px legibility and contrast checked.

Remaining media intentionally blank: complete-test video, Scenario editorial card, execution capture, and preview/replay evidence.

[houlianpi]

Scoped Edge deployment evidence — commit ba850ef

Human Product Owner confirmed the authoritative public figures and scope. README now presents only:

• 2.30M test steps executed in the reported 30-day period.
• 3,193 hours saved in the monthly operating period.
• 4 platforms: Windows, macOS, iOS, and Android.
• 99.7% pass-rate consistency.

The section explicitly attributes these to application of the approach on the Microsoft Edge browser product line and states that they are observed deployment results, not projected savings or a universal benchmark. Conflicting draft figures and all other internal PDF claims were excluded.

Verification:

• Published GitHub README renders the four-column table and Edge results navigation anchor correctly.
• Search confirmed no excluded 1.70M / 2,342 / 107 issues / 700+ / 413 PR / pipeline / flakiness claims.
• git diff --check passed.
• Independent EdgeMetricsReadmeReview: APPROVE against the supplied PDF and Human Product Owner correction.

PR: #29

[houlianpi]

Edge deployment proof redesign — commit 58eabb4

Replaced the plain metric table with a high-impact production-scale panel:

• 2.30M and 3,193 are the dominant first-tier results.
• 4 platforms and 99.7% consistency form a supporting second tier.
• Blue/violet/green accents tie the Edge deployment proof to the AutoGenesis visual system.
• An original browser/deployment glyph establishes context without copying the trademarked Microsoft Edge product icon.
• README retains truthful Microsoft Edge text and the Microsoft trademark notice.

Responsive delivery:

• Desktop asset: 1120×480; GitHub rendered at 838×359.
• Mobile asset: dedicated stacked 720×950 composition selected below 480 px; GitHub rendered at 324×428 with no overflow.
• Both variants contain no scripts, external resources, links, raster data, or event handlers.
• Complete metric prose and descriptive alt text remain outside/alongside the graphic.

Independent EdgeImpactPanelReview: initial mobile microcopy blocker fixed; final verdict APPROVE.

PR: #29

[houlianpi]

Edge proof glyph visibility fix — commit 3e21a10

The browser/deployment glyph is the top-left mark inside the Edge results panel, immediately before “PROVEN AT PRODUCTION SCALE.” It was too subtle at the original 64/72 px source sizes.

Updated source sizes:

• Desktop: 96 px, rendered at approximately 72 px in the GitHub README.
• Mobile: 104 px, rendered at approximately 47 px.

Stroke weight, contrast, and header clear space were increased. Published GitHub desktop rendering loads the updated asset at 838×359. Independent EdgeImpactPanelReview: APPROVE; glyph is now immediately perceptible with no clipping or confusion with the official Edge swirl.

[houlianpi]

README integration update — 090dcb2

Completed:

• rebased/integrated current origin/main (7bc9af2);
• corrected onboarding for published Contract 2.0.0 / CLI 0.1.0 / Runtime 0.4.0 coordinates;
• all package commands retain the machine-configured package index and do not bypass its mirror/trust policy;
• removed the link to the older v2.0.0 release prompt; the strengthened inline prompt is the sole Agent-first copy source;
• added mandatory post-CLI Skill enumeration, shadow/conflict rejection, and resolved path/bytes/Contract proof;
• updated macOS, mobile, and Windows Runtime references so local wheels are maintainer-only;
• agent-contract/tests/test_skills.py: 18 passed;
• generated prompt matches the inline README block byte-for-byte;
• all 11 repository-relative links resolve;
• pushed GitHub render verified: logo, Mermaid, Edge panels, navigation, collapsed prompt, configured-index warning, and CLI identity checks are present.

Independent final product/code review: APPROVE.

Independent security review: REQUEST_CHANGES on one release-integrity blocker. The official immutable agent-contract-v2.0.0 release still contains the older prompt bytes, while the branch generator now emits the strengthened prompt under that same release identity. Unlinking and warning in README mitigates the primary path but cannot revoke or reproduce the existing official asset.

Required before merge: publish the strengthened prompt under a new immutable identity (prompt-only version or new Contract release), update README/generator/workflow/tests to that identity, and explicitly mark the old prompt superseded. This is a Human Product Owner release decision; PR #29 remains unmerged.

[houlianpi]

Post-#61 integration audit: this PR is not mergeable in its current form and is returned to Draft. The product narrative, logo, Edge evidence, and visual assets remain useful, but onboarding is bound to obsolete interfaces: AutoGenesis 1.1, Contract 2.0.0, CLI 0.1.0, autogenesis-setup/autogenesis-run, and the superseded immutable Setup prompt. The accepted interface is now one canonical autogenesis Skill with Contract 2.1.0 identity 89ec8f67dfbb9522eb3138488fbaf2b823abf5ed42b3140a82abfc45a883e98a. #61 did not publish packages or an immutable release asset, so the prior security blocker is not resolved by inventing a URL or reusing an old identity. Before this PR can return to review: rebase onto the integrated branch, rewrite onboarding for the one-Skill route, use only actually published immutable coordinates, preserve configured package-index policy, accurately disclose #51 generated-write enforcement limitations, regenerate the install prompt from its single source, and repeat product/security review plus link/render/identity verification.

[houlianpi]

Post-#74 onboarding integration

Exact branch head: aeeb42fe6784f98f4c988b45d99925fd090bb39d (includes merged main commit 24c8b26798c5b308993d724e8ec8209972ba844b).

Changes:

• records [Security]: Harden generated install prompts and checksum closure #74 as merged and forbids superseded Candidate run 42843125727;
• requires complete Candidate checksum verification before interpretation;
• aligns acceptance with [Security]: Harden generated install prompts and checksum closure #74 source isolation: no ambient pip/uv configuration or credential reads, platform null pip configuration, isolated transaction-owned staging/cache, and offline strict-hash installation;
• scopes acceptance to project Skill state and identity/marker-matched cleanup of prompt-created environment, download, extraction, staging, cache, Skill, and MCP state;
• preserves the pre-publication warning and evidence-bound support tiers.

Verification:

• 14/14 repository-local README links resolve;
• focused onboarding contract assertions pass;
• GitHub GFM render was visually inspected, including the warning, Candidate provenance, source-isolation, rollback, checksum, and support sections;
• git diff --check passes;
• independent combined verdict after remediation: APPROVE + SECURITY_APPROVE, no remaining findings.

Fresh merged-main Candidate build also passes at run 43041771738, artifact 13865373311; clean native acceptance is separate and remains pending. No package, GitHub Release, MCP Registry entry, protected-branch change, or PR merge occurred.

[houlianpi]

Clean Candidate retry — BLOCKED on approved mirror completeness

The Human Product Owner approved one source-only retry with a fresh exact 128-bit random transaction root and unauthenticated host pypi.tuna.tsinghua.edu.cn, class user-approved. All other Candidate identities, isolation controls, and acceptance scenarios remained unchanged.

Independent acceptor evidence:

• exact artifact 13865373311 was authenticated and downloaded again;
• archive size 411926 and SHA-256 3a61ae9164bed87cdcbb899f167041d74156992396a9fa3f7b95882f547c1eec reverified before extraction;
• complete nine-asset checksum closure passed again; SHA256SUMS SHA-256 4725fd1c071816dbbf1705ddfbfd537276d452df6cc7d412741ade11286e3919;
• fresh root reservation, exclusive lock, identity, and private ownership marker passed;
• Python 3.11.8 isolated environment created;
• pip used null configuration, minimal environment, transaction-owned download/cache roots, and the strict third-party hash lock; no ambient package/proxy configuration or credentials were read or used.

Observed blocker: the approved mirror provided no matching locked distribution for the environment. Zero final dependency artifacts were downloaded; no first-party package resolved from an index. No package, Skill, MCP, Appium, or application installation occurred. Calculator and all five acceptance scenarios were not reached. Identity-bound cleanup passed; the fresh root is absent, no transaction process remains, and the parent identity is unchanged.

This is the second approved source-path failure (pypi.org timed out; TUNA lacked a locked distribution). Per the no-repeat rule, no further source hopping is attempted. Candidate acceptance, PR #29 merge, publication, and public-artifact acceptance remain blocked. The recommended next design decision is a separately reviewed same-run Candidate dependency-wheelhouse contract so native acceptance consumes authenticated complete bytes rather than depending on local live-index reachability; this is not inferred into #28 or #70 without a Ready issue and Product Owner approval.