Add Firefox and Zen extension support

.agents/README.md

@@ -0,0 +1,37 @@
+# .agents
+
+Canonical shared runtime for Delano.
+
+## Source-of-truth map
+
+- Root agent workflow and boundaries: `AGENTS.md`
+- Process and operator handbook: `HANDBOOK.md`
+- Delivery contracts and evidence: `.project/`
+- Runtime scripts: `.agents/scripts/`
+- Shared rules: `.agents/rules/`
+- Hooks: `.agents/hooks/`
+- Skills: `.agents/skills/`
+- Logs: `.agents/logs/`
+- Shared adapter utilities: `.agents/common/`
+- Agent-specific adapter notes: `.agents/adapters/<agent>/`
+
+The compatibility path `.claude/` may mirror this runtime for agents that still expect Claude-style paths.
+
+## Required first-turn behavior
+
+Every adapter should start from `AGENTS.md`, inspect the relevant `.project` contract and current git state, then use the adapter note only for runtime-specific differences.
+
+## Core validation commands
+
+- `bash .agents/scripts/pm/validate.sh`
+- `npm test`
+- `npm run build:assets`
+- `npm run check:package-manifest`
+
+## Completion rule
+
+Do not report a task as done until the change is present, evidence is recorded, validation has passed or been explicitly marked not run, and blockers are named.
+
+## Safety boundaries
+
+Keep logs privacy-safe, avoid absolute path leaks in docs/contracts/hook output, and do not perform destructive git or remote-write operations without an explicit task instruction.

.agents/adapters/claude/README.md

@@ -0,0 +1,24 @@
+# Claude adapter
+
+## Start here
+
+1. Read root `AGENTS.md` first.
+2. Use this note only for Claude-specific path behavior.
+3. Inspect `git status --short --branch` and the assigned `.project` contract before editing.
+
+## Runtime paths
+
+- Canonical runtime: `.agents/`
+- Claude compatibility path: `.claude/` mirrors `.agents/` where available
+- Delivery contracts: `.project/`
+
+## Commands
+
+- `bash .agents/scripts/pm/validate.sh`
+- `npm test`
+- `npm run build:assets`
+- `npm run check:package-manifest`
+
+## Completion and safety
+
+Record evidence in the task or update log before marking work done. Do not rely on `.claude/` as a separate source of truth, do not commit unsafe logs, and do not leak local absolute paths in output.

.agents/adapters/codex/README.md

@@ -0,0 +1,24 @@
+# Codex adapter
+
+## Start here
+
+1. Read root `AGENTS.md` first.
+2. Use this note only for Codex-specific execution reminders.
+3. Inspect `git status --short --branch` and the assigned `.project` contract before editing.
+
+## Runtime paths
+
+- Delivery contracts: `.project/`
+- Canonical runtime scripts, hooks, rules, and skills: `.agents/`
+- Compatibility path if needed: `.claude/`
+
+## Commands
+
+- `bash .agents/scripts/pm/validate.sh`
+- `npm test`
+- `npm run build:assets`
+- `npm run check:package-manifest`
+
+## Completion and safety
+
+Keep changes task-scoped, record evidence before marking done, and report exactly which validation commands passed or were not run. Do not force-push, apply remote writes, commit unsafe logs, or expose local absolute paths unless an explicit task instruction requires it.

.agents/adapters/manifest.schema.json

@@ -0,0 +1,103 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://delano.dev/schemas/adapter-manifest.schema.json",
+  "title": "Delano Adapter Manifest",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "id",
+    "name",
+    "type",
+    "owner",
+    "status",
+    "summary",
+    "commands",
+    "generated_files",
+    "validation",
+    "install",
+    "limits"
+  ],
+  "properties": {
+    "id": {
+      "type": "string",
+      "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$"
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1
+    },
+    "type": {
+      "type": "string",
+      "enum": ["agent", "authoring-tool", "sync-tool", "workflow"]
+    },
+    "owner": {
+      "type": "string",
+      "minLength": 1
+    },
+    "status": {
+      "type": "string",
+      "enum": ["proposed", "experimental", "stable", "deprecated"]
+    },
+    "summary": {
+      "type": "string",
+      "minLength": 1
+    },
+    "commands": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["name", "description", "input", "output", "writes", "validation"],
+        "properties": {
+          "name": { "type": "string", "minLength": 1 },
+          "description": { "type": "string", "minLength": 1 },
+          "input": { "type": "array", "items": { "type": "string" } },
+          "output": { "type": "array", "items": { "type": "string" } },
+          "writes": { "type": "array", "items": { "type": "string" } },
+          "validation": { "type": "array", "items": { "type": "string" } }
+        }
+      }
+    },
+    "generated_files": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "owner", "mode", "conflict_behavior", "fold_forward"],
+        "properties": {
+          "path": { "type": "string", "minLength": 1 },
+          "owner": { "type": "string", "minLength": 1 },
+          "mode": { "type": "string", "enum": ["create-only", "update-owned", "proposal-only", "never-overwrite"] },
+          "conflict_behavior": { "type": "string", "enum": ["abort", "diff-required", "operator-approval-required"] },
+          "fold_forward": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    "validation": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "type": "string" }
+    },
+    "install": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["categories", "conflict_policy"],
+      "properties": {
+        "categories": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "conflict_policy": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "limits": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "type": "string" }
+    }
+  }
+}

.agents/adapters/opencode/README.md

@@ -0,0 +1,24 @@
+# OpenCode adapter
+
+## Start here
+
+1. Read root `AGENTS.md` first.
+2. Use this note only for OpenCode-specific execution reminders.
+3. Inspect `git status --short --branch` and the assigned `.project` contract before editing.
+
+## Runtime paths
+
+- Delivery contracts: `.project/`
+- Canonical runtime scripts, hooks, rules, and skills: `.agents/`
+- Compatibility path if needed: `.claude/`
+
+## Commands
+
+- `bash .agents/scripts/pm/validate.sh`
+- `npm test`
+- `npm run build:assets`
+- `npm run check:package-manifest`
+
+## Completion and safety
+
+Keep changes task-scoped, record evidence before marking done, and report exactly which validation commands passed or were not run. Do not force-push, apply remote writes, commit unsafe logs, or expose local absolute paths unless an explicit task instruction requires it.

.agents/adapters/pi/README.md

@@ -0,0 +1,24 @@
+# Pi adapter
+
+## Start here
+
+1. Read root `AGENTS.md` first.
+2. Use this note only for Pi-specific execution reminders.
+3. Inspect `git status --short --branch` and the assigned `.project` contract before editing.
+
+## Runtime paths
+
+- Delivery contracts: `.project/`
+- Canonical runtime scripts, hooks, rules, and skills: `.agents/`
+- Compatibility path if needed: `.claude/`
+
+## Commands
+
+- `bash .agents/scripts/pm/validate.sh`
+- `npm test`
+- `npm run build:assets`
+- `npm run check:package-manifest`
+
+## Completion and safety
+
+Keep changes task-scoped, record evidence before marking done, and report exactly which validation commands passed or were not run. Do not force-push, apply remote writes, commit unsafe logs, or expose local absolute paths unless an explicit task instruction requires it.

.agents/adapters/spec-kit/adapter.json

@@ -0,0 +1,71 @@
+{
+  "id": "spec-kit",
+  "name": "Spec Kit Interop",
+  "type": "authoring-tool",
+  "owner": "delano-team",
+  "status": "experimental",
+  "summary": "Imports Spec Kit-style intent artifacts into Delano-governed delivery projects.",
+  "commands": [
+    {
+      "name": "delano import-spec-kit",
+      "description": "Create a planned Delano project from a supported Spec Kit-style markdown artifact.",
+      "input": ["slug", "source-md", "--name", "--owner", "--lead", "--json"],
+      "output": ["human summary", "JSON result with ok, command, project, source, validation"],
+      "writes": [".project/projects/<slug>/"],
+      "validation": ["delano validate"]
+    },
+    {
+      "name": "delano research",
+      "description": "Open repo-native research intake for unclear imported intent.",
+      "input": ["project-slug", "research-slug", "--title", "--question", "--json"],
+      "output": ["human summary", "JSON result with ok, command, project, research, files, validation"],
+      "writes": [".project/projects/<project-slug>/research/<research-slug>/"],
+      "validation": ["delano validate"]
+    }
+  ],
+  "generated_files": [
+    {
+      "path": ".project/projects/<slug>/spec.md",
+      "owner": "spec-kit adapter",
+      "mode": "create-only",
+      "conflict_behavior": "abort",
+      "fold_forward": "canonical spec"
+    },
+    {
+      "path": ".project/projects/<slug>/plan.md",
+      "owner": "spec-kit adapter",
+      "mode": "create-only",
+      "conflict_behavior": "abort",
+      "fold_forward": "canonical plan"
+    },
+    {
+      "path": ".project/projects/<slug>/tasks/*.md",
+      "owner": "spec-kit adapter",
+      "mode": "create-only",
+      "conflict_behavior": "abort",
+      "fold_forward": "canonical tasks with evidence gates"
+    },
+    {
+      "path": ".project/projects/<project-slug>/research/<research-slug>/",
+      "owner": "research intake",
+      "mode": "create-only",
+      "conflict_behavior": "abort",
+      "fold_forward": "spec, plan, decisions, workstreams, tasks, or updates"
+    }
+  ],
+  "validation": [
+    "delano validate",
+    "npm run check:text-safety for Delano repo changes",
+    "fixture import smoke before release"
+  ],
+  "install": {
+    "categories": ["agent-runtime", "project-templates", "skills"],
+    "conflict_policy": "Use existing Delano install allowlist behavior; abort on generated project collisions unless an operator approves a diff-backed change."
+  },
+  "limits": [
+    "Does not replace Spec Kit.",
+    "Does not execute imported tasks automatically.",
+    "Does not write Linear or GitHub state directly.",
+    "Does not depend on Obsidian, OpenClaw, or private local paths."
+  ]
+}

.agents/common/README.md

@@ -0,0 +1,3 @@
+# Common adapter guidance
+
+All adapters must operate against `.project/` contracts and follow `HANDBOOK.md` gates.

.agents/common/log-safety.js

@@ -0,0 +1,55 @@
+const crypto = require('crypto');
+
+const SECRET_PATTERNS = [
+  /\b(sk-[A-Za-z0-9_-]{12,})\b/g,
+  /\b(github_pat_[A-Za-z0-9_]{20,})\b/g,
+  /\b(gh[pousr]_[A-Za-z0-9_]{20,})\b/g,
+  /\b(xox[baprs]-[A-Za-z0-9-]{10,})\b/g,
+  /\b([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,})\b/g,
+  /\b(password|passwd|pwd|secret|token|api[_-]?key)\s*[:=]\s*([^\s"']+)/gi
+];
+
+function sha256Hex(value) {
+  return crypto.createHash('sha256').update(String(value || '')).digest('hex');
+}
+
+function envFlag(name, defaultValue = false) {
+  const value = process.env[name];
+  if (value === undefined || value === '') return defaultValue;
+  return ['1', 'true', 'yes', 'on'].includes(String(value).toLowerCase());
+}
+
+function redactString(value) {
+  let output = String(value || '');
+  let replacements = 0;
+
+  for (const pattern of SECRET_PATTERNS) {
+    output = output.replace(pattern, (...args) => {
+      replacements += 1;
+      const match = args[0];
+      if (/^(password|passwd|pwd|secret|token|api[_-]?key)/i.test(match)) {
+        return match.replace(/[:=]\s*[^\s"']+/i, ': [REDACTED]');
+      }
+      return '[REDACTED]';
+    });
+  }
+
+  return { value: output, replacements };
+}
+
+function redactObject(value) {
+  if (typeof value === 'string') return redactString(value).value;
+  if (Array.isArray(value)) return value.map(redactObject);
+  if (!value || typeof value !== 'object') return value;
+
+  return Object.fromEntries(
+    Object.entries(value).map(([key, nested]) => [key, redactObject(nested)])
+  );
+}
+
+module.exports = {
+  envFlag,
+  redactObject,
+  redactString,
+  sha256Hex
+};

.agents/eval-fixtures/skill-output/invalid/missing-evidence/output.json

@@ -0,0 +1,6 @@
+{
+  "schema_version": 1,
+  "skill": "learning-skill",
+  "outcome": "claims success without evidence",
+  "privacy": "metadata-only"
+}

.agents/eval-fixtures/skill-output/valid/summary/output.json

@@ -0,0 +1,7 @@
+{
+  "schema_version": 1,
+  "skill": "learning-skill",
+  "outcome": "summary-only delivery metrics recorded",
+  "evidence": ["scripts/summarize-project-metrics.mjs", ".project/registry/linear-map.json"],
+  "privacy": "metadata-only"
+}

.agents/fixtures/github/status-snapshot.json

@@ -0,0 +1,6 @@
+{
+  "schema_version": 1,
+  "source": "mock-github-status-snapshot",
+  "generated_at": "2026-04-30T00:55:00Z",
+  "repositories": []
+}