feat(distribution): add platform-independent Maister installer

.codex/agents/advisor.toml

@@ -0,0 +1,18 @@
+name = "advisor"
+description = "Read-only Maister gate advisor. Returns a structured recommendation and never edits project files."
+model = "gpt-5.6-sol"
+model_reasoning_effort = "medium"
+sandbox_mode = "read-only"
+developer_instructions = """
+Analyze one Maister orchestrator gate at a time. Return only valid YAML with
+selected_option, rationale, confidence, and escalate_to_user. Never edit files,
+write orchestrator-state.yml or reports, invoke user-question tools, inject a
+synthetic user answer, or bypass the hard safety denylist. The Codex host
+adapter invokes this agent only for the primary recommendation; disagreements
+are delegated to the separate read-only arbiter profile.
+The user gate is a plain-text user question; state writes and resume reads use
+orchestrator-state.yml. For a valid non-denylisted fully_automatic result, the
+orchestrator continues through phase_continue(selected_option) after terminal
+state and report persistence; it does not synthesize input into a user prompt.
+The denylist and implementation-approval gate always remain manual.
+"""

.codex/agents/arbiter.toml

@@ -0,0 +1,14 @@
+name = "arbiter"
+description = "Read-only Maister gate arbiter. Resolves one disagreement between recommendations and never edits project files."
+model = "gpt-5.6-sol"
+model_reasoning_effort = "high"
+sandbox_mode = "read-only"
+developer_instructions = """
+Arbitrate one Maister orchestrator gate disagreement at a time. Return only
+valid YAML with selected_option, rationale, confidence, and escalate_to_user.
+Choose exactly one of the two supplied competing recommendations or escalate
+to the user. Never invent a third option, edit files, write orchestrator-state.yml
+or reports, invoke user-question tools, inject a synthetic user answer, bypass
+the hard safety denylist, or start another Advisor/Arbiter loop. The denylist
+and implementation-approval gate always remain manual.
+"""

.cursor/rules/maister-docs.mdc

@@ -0,0 +1,10 @@
+---
+description: Read Maister project documentation before coding
+alwaysApply: true
+---
+
+# Maister Documentation
+
+Before starting any task, read `.maister/docs/INDEX.md` first. It indexes coding standards, project vision, tech stack, and architecture decisions.
+
+Follow standards in `.maister/docs/standards/` when writing code. If standards conflict with the task, ask the user.

.github/workflows/cursor-cli-smoke.yml

@@ -0,0 +1,47 @@
+name: Cursor CLI Evidence (provisional)
+
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: cursor-cli-evidence
+  cancel-in-progress: true
+
+jobs:
+  evidence:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+      - name: Validate Cursor overlay
+        run: make test-overlay TARGET=cursor
+      - name: Probe preinstalled Cursor Agent CLI
+        run: |
+          set -euo pipefail
+          export PATH="$HOME/.cursor/bin:$HOME/.local/bin:$PATH"
+          node --input-type=module <<'EOF' | tee cursor-evidence.json
+          import { probeCursor } from './plugins/maister/lib/distribution/host-probes/cursor.mjs';
+          const result = probeCursor();
+          process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+          EOF
+          if grep -q '"result": "unavailable"' cursor-evidence.json; then
+            echo "::notice title=Cursor evidence unavailable::No preinstalled Cursor Agent CLI was found; this run is packaging/provisional evidence only."
+          else
+            echo "::notice title=Cursor evidence collected::Native evidence was collected from the preinstalled runtime; review the artifact before making a support claim."
+          fi
+      - name: Validate evidence contract
+        run: make test-evidence
+      - name: Upload Cursor evidence record
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: cursor-cli-evidence-${{ github.run_id }}
+          path: cursor-evidence.json
+          if-no-files-found: warn

.github/workflows/release.yml

@@ -1,17 +1,72 @@
 name: Release
+
 on:
   push:
-    tags: ['v*']
+    tags: ["v*"]
 
 jobs:
-  release:
+  validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Build and validate
-        run: make build && make validate
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+      - name: Validate source, overlays, evidence, and topology
+        run: make validate
+      - name: Run reviewed three-target parity release gate
+        run: |
+          mkdir -p dist
+          make test-parity-release PARITY_REPORT=dist/parity-release.json
+      - name: Run portable core tests before generating E3
+        run: make test-core
+      - name: Generate deterministic portable-core E3 attestation
+        run: |
+          make generate-e3-attestation \
+            E3_OUTPUT=dist/e3-portable-core.json \
+            E3_RESULT=passed \
+            E3_TEST_COMMAND="make test-core" \
+            SOURCE_COMMIT="$GITHUB_SHA" \
+            SOURCE_VERSION="${GITHUB_REF_NAME#v}" \
+            SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)"
+      - name: Package target overlays
+        run: |
+          SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)" E3_ATTESTATION=dist/e3-portable-core.json make package TARGET=codex SOURCE_COMMIT="$GITHUB_SHA" SOURCE_VERSION="${GITHUB_REF_NAME#v}"
+          SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)" E3_ATTESTATION=dist/e3-portable-core.json make package TARGET=cursor SOURCE_COMMIT="$GITHUB_SHA" SOURCE_VERSION="${GITHUB_REF_NAME#v}"
+          SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)" E3_ATTESTATION=dist/e3-portable-core.json make package TARGET=kiro-cli SOURCE_COMMIT="$GITHUB_SHA" SOURCE_VERSION="${GITHUB_REF_NAME#v}"
+      - name: Smoke extracted target archives
+        env:
+          MAISTER_PACKAGE_DIR: dist
+        run: node --test tests/platform-independent/release-package.test.mjs
+      - name: Generate package checksums
+        run: (cd dist && sha256sum maister-*.tar.gz > SHA256SUMS)
+      - name: Generate release provenance and SBOM metadata
+        run: |
+          node plugins/maister/bin/release-metadata.mjs \
+            --archive-dir dist \
+            --output-dir dist \
+            --source-commit "$GITHUB_SHA" \
+            --source-version "${GITHUB_REF_NAME#v}" \
+            --parity-report dist/parity-release.json \
+            --source-date-epoch "$(git log -1 --format=%ct)"
+      - name: Verify release metadata
+        run: node plugins/maister/bin/release-metadata.mjs --archive-dir dist --output-dir dist --check
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: maister-target-packages
+          path: dist/*
 
-      - uses: softprops/action-gh-release@v2
+  publish:
+    needs: validate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: maister-target-packages
+          path: dist
+      - uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
         with:
           generate_release_notes: true
+          files: dist/*

.github/workflows/validate-generated-variants.yml

@@ -0,0 +1,39 @@
+name: Validate Portable Distribution
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - "plugins/maister/**"
+      - "tests/platform-independent/**"
+      - "Makefile"
+      - ".github/workflows/**"
+  pull_request:
+    branches: [master]
+    paths:
+      - "plugins/maister/**"
+      - "tests/platform-independent/**"
+      - "Makefile"
+      - ".github/workflows/**"
+
+jobs:
+  core:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+      - name: Validate all overlays
+        run: |
+          make test-overlay TARGET=codex
+          make test-overlay TARGET=cursor
+          make test-overlay TARGET=kiro-cli
+      - name: Run portable and distribution tests
+        run: make test-core test-evidence
+      - name: Verify repository topology
+        run: make test-topology
+      - name: Run reviewed three-target parity release gate
+        run: make test-parity-release

.gitignore

@@ -7,6 +7,6 @@
 # Claude local settings
 .claude/settings.local.json
 
-# Maister task tracking (generated per-project, not part of plugin source)
-.maister/
+
 /.worktrees/
+/.maister-kiro-build.lock.d/

.maister/config.yml

@@ -0,0 +1,28 @@
+# Maister project configuration.
+# html_output — generate the operator dashboard (dashboard.html + dashboard-data.js,
+# auto-opened in your browser) and the HTML companion reports (.html twins of spec,
+# implementation plan, verification, and research/design outputs). Set to false for
+# markdown-only runs. Markdown artifacts, their TL;DR summary blocks, and
+# orchestrator-state.yml are produced regardless. Default: true.
+html_output: true
+
+# Advisor gate policy is opt-in. Gate types accept manual, advisor, or
+# fully_automatic. The hard safety denylist in orchestrator-patterns.md cannot
+# be overridden by this configuration.
+advisor:
+  enabled: true
+  gate_policies:
+    phase-exit: fully_automatic
+    optional-phase: fully_automatic
+    clarify: fully_automatic
+    convergence: fully_automatic
+    verify-matrix: fully_automatic
+  advisor_agent: advisor
+  advisor_model: gpt-5.6-sol
+  arbiter_agent: arbiter
+  arbiter_model: gpt-5.6-sol
+  arbiter_enabled_on_disagreement: true
+  retry:
+    advisor_attempts: 3
+    arbiter_attempts: 3
+    backoff: exponential