Merge pull request #1 from Coding-Autopilot-System/docs/portfolio-hardening-20260610

docs: sharpen Promptimprover portfolio proof

Author: OgeonX-Ai

.gemini/memory.json

@@ -0,0 +1,26 @@
+# Dependencies and generated outputs
+**/node_modules/
+**/dist/
+*.tgz
+
+# Runtime state and local databases
+.refiner/
+**/.refiner/
+.gemini/memory.json
+**/.gemini/memory.json
+**/.gemini/blackboard.json
+*.db
+*.db-shm
+*.db-wal
+*.log
+
+# Local configuration and environment
+.env
+.env.*
+!.env.example
+
+# Editor and OS artifacts
+.vscode/
+.idea/
+.DS_Store
+Thumbs.db

.gitignore

@@ -27,5 +27,12 @@
 ### Blockers
 - None.
 
+### Quick Tasks Completed
+
+| # | Description | Date | Commit | Status | Directory |
+|---|-------------|------|--------|--------|-----------|
+| 260610-pps | Fix PR #1 review blocker: README and build_and_install.ps1 must accurately document the globally exposed gemini-prompt-refiner command | 2026-06-10 | this commit | Verified | [260610-pps-fix-pr-1-review-blocker-readme-and-build](./quick/260610-pps-fix-pr-1-review-blocker-readme-and-build/) |
+
 ## Session Continuity
+Last activity: 2026-06-10 - Completed quick task 260610-pps: Fix PR #1 command documentation blocker.
 The project is set up with a clear 3-phase roadmap. Next step is to begin planning Phase 1.

.planning/STATE.md

@@ -0,0 +1,39 @@
+# GSD Audit-Fix: Promptimprover Enterprise Readiness
+
+**Date:** 2026-06-10
+**Invocation:** `$gsd-audit-fix --severity all --max 8`
+**Source:** Direct repository evidence fallback; no `.planning/phases` UAT artifacts exist.
+
+## Classification and Results
+
+| ID | Finding | Severity | Classification | Result |
+|---|---|---|---|---|
+| F-01 | Correlation behavior fails the full test suite | High | Auto-fixable | Fixed in `726200b` |
+| F-02 | npm audit reports vulnerable transitive dependencies | High | Auto-fixable | Fixed in `c4dc532` |
+| F-03 | npm tarball leaks local state, planning, source, tests, and nested archive | High | Auto-fixable | Fixed in `a216215` |
+| F-04 | Build uses Windows-only shell commands | High | Auto-fixable | Fixed in `6420017` |
+| F-05 | CI skips a test and does not validate build/package or Windows | High | Auto-fixable, push-blocked | Fixed locally in `audit/promptimprover-full-enterprise-local`; GitHub rejected workflow push because OAuth lacks `workflow` scope |
+| F-06 | Git tracks dependencies, generated outputs, runtime memory, and archives | High | Auto-fixable | Fixed in `69561f8` |
+| F-07 | Dashboard network binding is not explicitly loopback-only | High | Auto-fixable | Fixed in `9806a26` |
+| F-08 | Installer is Windows-only and lacks fail-fast validation | Medium | Auto-fixable | Fixed in `77c8de3` |
+
+## Verification
+
+- `npm ci --no-fund`: passed
+- `npm audit --omit=dev --audit-level=high`: 0 vulnerabilities
+- `npx tsc --noEmit`: passed
+- `npm test`: 15 files, 43 tests passed
+- `npm run build`: passed
+- `npm pack --dry-run`: 25 runtime-only entries
+- Windows installer: passed end-to-end
+- POSIX installer: shell syntax passed
+- Installed command: dashboard HTTP 200 on `127.0.0.1`
+- Git hygiene: 13,566 generated/runtime/dependency files removed from tracking
+
+## Manual-Only Follow-Up
+
+- Push the prepared CI workflow commit using a GitHub token with `workflow` scope.
+- Decide whether to retire or independently maintain duplicated `gemini-extension` and legacy `mcp-server` packages.
+- Design production remote HTTP MCP deployment with OAuth 2.1 or managed identity; current runtime is local stdio plus loopback dashboard.
+- Add release provenance, signed GitHub releases, SBOM generation, and a versioning policy.
+- Replace `universal-refiner/register-global.ps1` hard-coded paths and direct configuration mutation with an idempotent registration command.

.planning/audits/260610-promptimprover-enterprise-audit-fix.md

@@ -0,0 +1,30 @@
+---
+quick_id: 260610-pps
+status: ready
+mode: quick-full
+description: "Fix PR #1 review blocker: README and build_and_install.ps1 must accurately document the globally exposed gemini-prompt-refiner command"
+---
+
+# Quick Task 260610-pps Plan
+
+## Goal
+
+Make the root README and install script accurately identify the global executable exposed by `universal-refiner/package.json`.
+
+## Must Haves
+
+- `README.md` tells users to configure `gemini-prompt-refiner`, matching the package manifest's `bin` key.
+- `build_and_install.ps1` reports and recommends `gemini-prompt-refiner` after global installation.
+- The task remains documentation-only and does not alter package behavior.
+
+## Tasks
+
+1. Update inaccurate `prompt-refiner` command references in `README.md` and `build_and_install.ps1`.
+2. Verify the package manifest and both user-facing files agree on `gemini-prompt-refiner`.
+3. Run `git diff --check`, record validation evidence, update GSD state, and commit the complete quick task atomically.
+
+## Validation
+
+- Inspect `universal-refiner/package.json` and confirm `bin` contains `gemini-prompt-refiner`.
+- Search `README.md` and `build_and_install.ps1` for command references and confirm no inaccurate `prompt-refiner` executable remains.
+- Run `git diff --check`.

.planning/quick/260610-pps-fix-pr-1-review-blocker-readme-and-build/260610-pps-PLAN.md

@@ -0,0 +1,21 @@
+---
+quick_id: 260610-pps
+status: complete
+completed: 2026-06-10
+---
+
+# Quick Task 260610-pps Summary
+
+Updated every user-facing executable reference in `README.md` and `build_and_install.ps1` to `gemini-prompt-refiner`, matching the sole `bin` key in `universal-refiner/package.json`.
+
+## Changes
+
+- Corrected the README architecture label and MCP client configuration instruction.
+- Corrected the install script's success and usage messages.
+- Left package behavior unchanged.
+
+## Validation
+
+- Parsed `universal-refiner/package.json` and confirmed `bin=gemini-prompt-refiner`.
+- Inspected all `prompt-refiner` references in `README.md` and `build_and_install.ps1`.
+- Ran `git diff --check`.

.planning/quick/260610-pps-fix-pr-1-review-blocker-readme-and-build/260610-pps-SUMMARY.md

@@ -0,0 +1,17 @@
+---
+quick_id: 260610-pps
+status: passed
+verified: 2026-06-10
+---
+
+# Quick Task 260610-pps Verification
+
+## Result
+
+Passed. `README.md` and `build_and_install.ps1` consistently identify `gemini-prompt-refiner` as the globally exposed command defined by `universal-refiner/package.json`.
+
+## Evidence
+
+- Manifest inspection found exactly one `bin` key: `gemini-prompt-refiner`.
+- Targeted inspection found no standalone stale `prompt-refiner` command references in the blocked files.
+- `git diff --check` completed without errors.