Prompt-To-Artifact Execution Checklist

This table keeps the long operator prompt tied to concrete artifacts. A status is not complete unless the evidence column exists and has been freshly verified.

Prompt requirement	Required artifact or gate	Current evidence	Status
Keep public PRs below 20	Repo-family PR recheck	0 open PRs across ECC, AgentShield, JARVIS, ECC-Tools/ECC-Tools, and ECC-Tools/ECC-website on the late 2026-05-19 platform audit after merging ECC PR #2013, ECC-Tools PR #79, JARVIS PR #15, and JARVIS PR #16	Complete
Keep public issues below 20	Repo-family issue recheck	0 open issues across ECC, AgentShield, JARVIS, ECC-Tools/ECC-Tools, and ECC-Tools/ECC-website on 2026-05-19 after the live platform audit refresh	Complete
Manage repository discussions	Repo-family discussion recheck plus response playbook	Platform audit reports 0 discussion maintainer-touch gaps and 0 answerable Q&A missing accepted answers; trunk has 59 total discussions after #2003 was routed with a maintainer response; docs/architecture/discussion-response-playbook.md distinguishes support, maintainer coordination, stale/concluded, release, informational, and security-sensitive response paths	Complete
Manage PR discussions	PR review/comment closure plus merge/close state	ECC #1990-#2013 merged through the harness audit, canonical identity, release video suite, growth outreach, evidence refresh, visual QA, suite-count, owner-approval packet, owner-approval dashboard gate, Linear readiness evidence, supply-chain evidence gate, per-project Claude Code adapter, continuous-learning project-registry hygiene, GateGuard quoted git introspection, and deterministic release-approval gate batch; ECC-Tools #79 and JARVIS #15/#16 also merged; no open tracked PRs remain	Complete
Salvage useful stale work	docs/stale-pr-salvage-ledger.md plus docs/legacy-artifact-inventory.md	Ledger records salvaged, superseded, skipped, and manual-review tails; #1815-#1818 added cost tracking, skill scout, frontend design guidance, code-reviewer false-positive guardrails, and the May 12 gap pass; #1687, #1609, #1563, #1564, and #1565 localization tails are attached to Linear ITO-55 for language-owner review and no automatic import remains release-blocking	Complete; repeat legacy scan before release
ECC 2.0 preview pack ready	Release docs, quickstart, publication readiness, release notes	docs/releases/2.0.0-rc.1/ and readiness docs are in-tree; May 19/20 evidence records queue-zero state, canonical ECC identity, release video suite, growth outreach pack, owner approval packet, local 2568-test suite, PR #2001 merge and GitHub Actions run 26102500291, PR #2002 owner-approval dashboard gate refresh and GitHub Actions run 26103853507, PR #2004 Linear readiness evidence sync and GitHub Actions run 26105012698, PR #2008 supply-chain evidence gate CI run 26108473648, post-PR #2006 main CI run 26109953093, PR #2009 project-registry hygiene GitHub Actions run 26111313938, post-PR #2009 main CI run 26111946778, post-PR #2011 GateGuard main CI run 26113695068, post-PR #2013 release-approval main CI run 26128749863, post-PR #2019 main CI run 26135974576, post-PR #2020 main CI run 26136949698, ECC-Tools #91 main CI run 26137280847, May 20 operator dashboard, owner-approval-packet-2026-05-19.md, release-approval-gate.js, and preview-pack smoke digest eebb8a66c33e	Needs final release approval
Hermes specialized skills included safely	Hermes setup/import docs and sanitized skill surface	Hermes setup and import playbook are public; secrets stay local	Needs final release review
Naming and rename readiness	Naming matrix across package/plugin/docs/social surfaces	docs/releases/2.0.0-rc.1/naming-and-publication-matrix.md records current package, repo, Claude plugin, Codex plugin, OpenCode, and npm availability evidence	Complete for rc.1; post-rc rename remains future work
Claude and Codex plugin publication	Contact/submission path with required artifacts and status	Publication readiness, naming matrix, and May 12 dry-run evidence document plugin validation, clean-checkout Claude tag/install smoke, and Codex marketplace CLI shape	Needs explicit approval for real tag/push and marketplace submission
Articles, tweets, and announcements	X thread, LinkedIn copy, GitHub release copy, push checklist, partner/sponsor/talk pack	Draft launch collateral and approval-gated outreach copy exist under rc.1 release docs	Needs URL-backed refresh and human approval before posting or sending
AgentShield enterprise iteration	Policy gates, SARIF, packs, provenance, corpus, HTML reports, exception lifecycle audit, baseline drift Action/CLI surfaces, evidence-pack redaction, harness adapter registry, editor-native Zed/VS Code adapter coverage, Dependabot alert closure, enterprise research roadmap, supply-chain hardened release path, CI-safe baseline fingerprints, corpus accuracy recommendations, remediation workflow phases, env proxy hijack corpus coverage, Mini Shai-Hulud full-campaign package IOCs, CI-provenance evidence packs, plugin-cache runtime-confidence triage, evidence-pack consumer readback, fleet-level evidence-pack routing, fleet review items, fleet review ticket payloads, checksum-backed policy export, checksum-verified policy promotion, policy promotion review items, package-manager hardening drift detection, npm age-gate guidance correction, workflow action-runtime pin refresh, package-manager hardening Action outputs, policy-promotion Action outputs, ECC-Tools hosted consumption of promotion Action outputs, ECC-Tools operator-visible promotion output values, and ECC-Tools hosted promotion judge audit traces	PRs #53, #55-#64, #67-#69, #78-#92, #94, and #95 landed with test evidence, ECC-Tools #76 consumes the fleet-summary output in hosted security review, #77 surfaces source evidence paths in hosted finding output, and #78 links fleet routes to harness owner review; AgentShield #91 adds agentshield policy export bundles for branch-protection review and downstream promotion; AgentShield #92 adds agentshield policy promote with digest verification, tamper rejection, explicit pack selection, dry-run review, and JSON output before writing active policy; AgentShield #94 adds Zed/VS Code adapter detection, .zed/settings.json and .zed/tasks.json scan discovery, and .zed/setup.mjs AI-tool persistence IOC coverage; AgentShield #95 clears the brace-expansion Dependabot alert with a patched lockfile and 0 open Dependabot alerts after merge; AgentShield commit 87aec47 adds reviewItems for digest evidence, owner review, protected rollout PR handoff, and runtime smoke testing with green local and remote CI; AgentShield commit 28d08c7 adds package-manager hardening drift detection for plaintext registry credentials, lifecycle-script enablement, and weak pnpm/Yarn release-age cooldowns with green local and remote CI; AgentShield commit 659f569 refreshes all workflow action runtime pins to SHA-pinned checkout v6.0.2 and setup-node v6.4.0 with green remote CI and no remaining action-runtime deprecation annotation; AgentShield commit ee585cd corrects npm release-age guidance by flagging unsupported npm age keys and keeping enforceable cooldown findings on pnpm/Yarn with green local and remote CI; AgentShield commit 1124535 exposes package-manager hardening status/count outputs and a redacted job-summary section for registry credentials, lifecycle scripts, and release-age gates with green local and remote CI; AgentShield commit 1593925 exposes policy-promotion status/count/digest outputs plus job-summary review items for owner approval, protected rollout, and runtime smoke, and marks runtime smoke verified when the same Action job scans with the promoted policy; AgentShield commit 840952a adds Linear/operator-ready fleet review ticket payloads and expands current Mini Shai-Hulud IOC breadcrumbs with green local and remote CI; ECC-Tools commit 8658951 routes those policy-promotion Action outputs into hosted security review findings and Hosted Promotion Readiness scoring; ECC-Tools commit 16c537f renders policy-promotion status, pack, review item count, action-required count, and digest in hosted security job comments/check-runs; ECC-Tools commit 05d4e82 renders hosted promotion judge request fingerprints and allowed-citation counts without raw provider output; native PDF export deferred in favor of self-contained HTML plus print-to-PDF until explicit enterprise demand appears; docs/architecture/agentshield-enterprise-research-roadmap.md now has baseline drift, evidence-pack bundle, redaction, adapter-registry, supply-chain hardening, hashed baseline fingerprints, corpus accuracy recommendation, remediation workflow, env proxy hijack corpus, Mini Shai-Hulud full-campaign package-table, ci-context.json provenance, plugin-cache confidence, evidence-pack inspect readback, evidence-pack fleet routing, fleet reviewItems, fleet review ticket payloads, policy export, policy promotion, policy promotion reviewItems, package-manager hardening Action outputs, policy-promotion Action outputs, hosted consumption of promotion Action outputs, operator-visible promotion output values, hosted promotion judge audit traces, editor-native adapter coverage, and Dependabot closure landed	Next workflow automation should deepen live operator approval/readback after Marketplace/payment gates
ECC Tools next-level app	Billing audit, PR checks, deep analyzer, sync backlog, evaluator/RAG corpus, hosted promotion judge audit trace, native-payments readback, ready Marketplace Pro target selection, selected-target announcement gate, billing gate env-file operator path, hosted observability, AgentShield fleet-summary hosted routing, hosted finding evidence paths, harness-route policy linking, policy-promotion Action-output hosted telemetry, and operator-visible promotion output values	PRs #26-#43 plus #53-#93 landed with test evidence across hosted analysis, hosted promotion readiness, model-judge execution, native-payments announcement gating, AgentShield evidence consumption, hosted remediation/Linear sync, hosted observability readback, ready Marketplace Pro target selection, selected-target official announcement gating, and env-file operator loading; ECC-Tools #89 merged as 512bca6 after Verify, Security Audit, and Workers Builds passed, and the 2026-05-20 production Wrangler OAuth readback found ready-like Marketplace Pro records with webhook provenance, selected a target with both key families, and reported 0 blockers without printing the login; ECC-Tools #90 merged as 16a5bb3 after Verify, Security Audit, and Workers Builds passed, and production preflight now requests /api/billing/readiness?selectReadyTarget=1 without a raw login; ECC-Tools #91 merged as 72119a1 with --env-file support for ignored local billing credentials and sentinel no-secret/no-login output tests; ECC-Tools #92 merged as 18d8019, deployed the non-breaking INTERNAL_OPERATOR_API_SECRET path to api.ecc.tools, and the 2026-05-20 live selected-target gate returned announcementGateReady: true with 0 required actions and 0 blockers; ECC-Tools #93 merged as d3d62df to record the live billing evidence in the app launch checklist and roadmap	Repeat KV readback and selected-target announcement gate immediately before launch; keep native-payments copy behind final release, plugin, live URL, and owner-approval gates
GitGuardian/Dependabot/CodeRabbit-style checks	Non-blocking taxonomy, deterministic follow-up checks, and local supply-chain gates	ECC-Tools risk taxonomy check plus follow-up signals landed, including Skill Quality, Deep Analyzer Evidence, Analyzer Corpus Evidence, RAG/Evaluator Evidence, PR Review/Salvage Evidence, and AgentShield evidence-pack evidence; #1846 added npm registry signature gates; #1848 added the supply-chain incident-response playbook and pull_request_target cache-poisoning validator guard; #1851 added the privileged checkout credential-persistence guard; AgentShield #78, JARVIS #13, and ECC-Tools #53 applied the same hardening outside trunk	Current supply-chain gate complete; deeper hosted review features remain future
Harness-agnostic learning system	Audit, adapter matrix, observability, traces, promotion loop	Audit/adapters/observability gates plus docs/architecture/evaluator-rag-prototype.md, examples/evaluator-rag-prototype/, and ECC-Tools PR #40 define read-only stale-salvage, billing-readiness, CI-failure-diagnosis, harness-config-quality, AgentShield policy-exception, skill-quality evidence, deep-analyzer evidence, and RAG/evaluator comparison scenarios with trace, report, playbook, verifier, and predictive-check artifacts; ECC-Tools PRs #68-#72 now turn that corpus into a deterministic PR check-run gate with cached hosted-output scoring, ranked retrieval candidates, a model prompt seed, a fail-closed hosted model-judge request contract, and opt-in live model execution behind strict hosted-evidence gates	Deterministic hosted PR check, cached output scoring, retrieval planning, judge contract, and gated model execution integrated
Linear roadmap is detailed	Linear project document/comments plus repo mirror	Repo mirror exists and issue creation works again; the May 19 sync adds post-PR #2002 document ecc-may-19-post-pr-2002-sync-64cef8f668e0, project comment a6411e3a-8c8e-4a58-adba-687e77d4c543, ITO-44/47/48/49/51/54/56 issue comments, and In Progress state for ITO-47, ITO-48, ITO-49, ITO-51, ITO-54, and ITO-56; the late-pass batch adds document ecc-may-19-late-queue-zero-and-release-gate-sync-1c26f65e6b3f, project comment d42bf0e2-7a8e-4934-9f3f-e281498ee805, and ITO-44/50/54/56/61 comments for PR #2013, ECC-Tools #79, and JARVIS #15/#16 because project status updates are disabled in the workspace	Needs recurring document/comment updates after each significant merge batch
Flow separation and progress tracking	Flow lanes with owner artifacts and update cadence	This roadmap defines lanes below and docs/architecture/progress-sync-contract.md makes GitHub/Linear/handoff/roadmap sync part of the readiness gate	Active
Realtime Linear sync	Project documents/comments plus issue comments for lane updates	ECC-Tools #39 implements opt-in Linear API sync for deferred follow-up backlog items, and ECC-Tools #54 adds copy-ready PR drafts to that backlog when draft PR shells are not opened; docs/architecture/progress-sync-contract.md defines the local file-backed realtime boundary; May 18 and May 19 live connector comments were posted to the ECC platform project and lane issues after project status updates returned disabled	Needs workspace config/product rollout for hosted issue sync
Observability for self-use	Local readiness gate, traces, status snapshots, HUD/status contract, risk ledger, progress-sync contract	npm run observability:ready reports 21/21	Complete for local gate
Proper release and notifications	Release tag, npm publish state, plugin state, social posts	Publication readiness gate exists with May 12 dry-run and May 13 readiness evidence	Not complete; approval/live URLs required