docs: audit pass — stale claims fixed, missing reference + nav gaps filled

CHANGELOG.md

@@ -11,6 +11,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Docs
+- **Documentation audit — stale claims fixed, missing reference material added.** The docs
+  landing no longer claims Discord/Google ship first-party (they're official external
+  installs) or that cost-v1 rides a DataPart (it's the artifact metadata map); the README
+  points plugin publishers at `config/plugin-directory.yaml` instead of the generated
+  overlay; the desktop README's retired `PROTOAGENT_CONFIG_DIR` → `PROTOAGENT_HOME`; the
+  releasing guide's branch-protection table lists the real seven CI checks (incl. the
+  changelog gate) instead of three; `tools.hidden` + `settings.hidden` are documented in
+  the configuration reference at last; the ADR index gains its five missing rows
+  (0079/0086/0087/0088/0092), corrects eight shipped ADRs still marked Proposed, and is
+  re-sorted; the orphaned `protoagent` CLI guide joins the sidebar and the guides overview
+  (with four other unlisted guides); and the plugins/fleet/desktop guides pick up the
+  Installed table, archetype `requires`, and launch-time update check.
+
 ### Changed
 - **Plugin views now receive the console's full theme, not six curated colors (#2225).**
   The ADR 0026 theming bridge — `consoleTheme()`, carried by the `protoagent:init` and

README.md

@@ -126,7 +126,7 @@ deprecated alias for `console`. See [Run headless](./docs/guides/headless.md).
 ┌──────────────┐     A2A JSON-RPC + SSE      ┌─────────────────┐
 │   Consumer   │ ──────────────────────────▶ │  A2A handler    │
 │  (any A2A    │                             │  (FastAPI)      │
-│   client)    │ ◀──── cost-v1 DataPart ─────│                 │
+│   client)    │ ◀─── cost-v1 (metadata) ────│                 │
 └──────────────┘                             └────────┬────────┘
                                                       │
                                                       ▼
@@ -188,8 +188,11 @@ you. See [Build a communication plugin](./docs/guides/communication-plugins.md)
 ([ADR 0029](./docs/adr/0029-communication-plugins-standard.md)).
 
 **Publish your own:** tag your repo with the [`protoagent-plugin`](https://github.com/topics/protoagent-plugin)
-GitHub topic, then open a PR adding it to [`plugins.json`](./sites/marketing/data/plugins.json)
-to list it on the directory. See [Install & publish plugins](./docs/guides/plugin-registry.md),
+GitHub topic, then open a PR adding an entry to
+[`config/plugin-directory.yaml`](./config/plugin-directory.yaml) and run
+`python scripts/plugin_directory.py build` — that one entry drives both the in-app
+Discover catalog and the website directory (the JSON files are generated; CI fails on
+drift). See [Install & publish plugins](./docs/guides/plugin-registry.md),
 [Plugins](./docs/guides/plugins.md), [Console views](./docs/guides/plugin-views.md).
 
 ## A2A extensions shipped by default

ROADMAP.md

@@ -13,7 +13,7 @@ In-progress ref points at a closed issue — rotate shipped work into `## Shippe
 - **Multi-window desktop chat** — "Open in New Window" spawns a real second desktop window with its own chat surface. (#1706)
 - **Federation token follow-ups** — management UI, peer rotation, and fleet integration for ADR 0066 tokens. (#1504)
 - **Backend-agnostic tracing** — generic OTLP / OpenInference trace export instead of hard-coding the Langfuse SDK. (#1884)
-- **Ollama & Hugging Face listings** — register protoAgent as an Ollama community integration and a Hugging Face "Use this model" local app. (#1833, #1834)
+- **Ollama & Hugging Face listings** — register protoAgent as an Ollama community integration and a Hugging Face "Use this model" local app. (#1990)
 
 ## In progress
 

TEMPLATE.md

@@ -223,9 +223,10 @@ After forking, review the skill loop lifecycle:
    drop them in by hand; the agent can also distill a proven workflow into a new
    one via `/distill`. All land in the skill index (`/sandbox/skills.db`, SQLite
    + FTS5) as `source=disk`.
-2. **Retrieval** — `KnowledgeMiddleware` injects the top-k most relevant skills
-   before each LLM call (shown as a "skills loaded" chip in chat), so the agent
-   reuses proven workflows.
+2. **Retrieval** — progressive disclosure (ADR 0060): `KnowledgeMiddleware`
+   keeps an always-on `<available_skills>` index of every skill's name + summary
+   (most-recently-used first), and the agent pulls a full procedure on demand
+   with `load_skill` — full skill bodies are never bulk-injected.
 3. **Curation** — run `python -m graph.skills.curator` periodically (or via
    cron) to deduplicate near-identical skills, apply the 90-day confidence
    half-life decay, and prune stale non-pinned entries below confidence 0.2.

apps/desktop/README.md

@@ -24,7 +24,7 @@ npm run desktop:dev
 The app **bundles and launches the protoAgent server itself** as a Tauri sidecar — no separately-running server required.
 
 - `apps/desktop/sidecar/build_sidecar.py` freezes the server into a single binary via PyInstaller, named `binaries/protoagent-server-<target-triple>` (the `externalBin` Tauri bundles). The React console is the UI, so the binary stays lean (~60 MB) rather than carrying a heavier server-rendered UI stack.
-- On launch the Rust shell (`src-tauri/src/lib.rs`) spawns the sidecar on the **fixed port 7870** with `--ui console --port 7870` (the console UI tier — API + A2A + console; ADR 0010), sets `PROTOAGENT_CONFIG_DIR` to the per-user app-config dir (so the read-only binary still persists setup/secrets), drains its output to the log, and kills it on app exit. (The dynamic-free-port + window-injection handoff proved unreliable across Tauri v2 webview contexts, so the port is pinned to the web client's fallback — see the comment in `lib.rs`.)
+- On launch the Rust shell (`src-tauri/src/lib.rs`) spawns the sidecar on the **fixed port 7870** with `--ui console --port 7870` (the console UI tier — API + A2A + console; ADR 0010), sets `PROTOAGENT_HOME` to the per-user app-config dir (so the read-only binary still persists setup/secrets), drains its output to the log, and kills it on app exit. (The dynamic-free-port + window-injection handoff proved unreliable across Tauri v2 webview contexts, so the port is pinned to the web client's fallback — see the comment in `lib.rs`.)
 - The shell creates the window itself and injects `window.__PROTOAGENT_API_BASE__` (the chosen `http://127.0.0.1:<port>`) before any page script runs; the webview's React build reads it (`apps/web/src/lib/api.ts`) and calls the sidecar's `/api`, `/a2a`, and `/v1`. The console probes with backoff on startup so the few-second cold start doesn't surface as an error.
 
 The sidecar binary is gitignored — it's a build artifact produced per platform by step 1 (locally or in CI before `tauri build`).
@@ -43,7 +43,7 @@ The app updates itself in place (tauri-plugin-updater): a silent check at launch
 (release builds only) plus a tray "Check for Updates…" item. It polls
 `latest.json` on the GitHub Release, verifies the bundle's minisign signature
 against the org public key baked into `tauri.conf.json`, installs, and
-relaunches — agent data (`PROTOAGENT_CONFIG_DIR`, workspaces) is untouched.
+relaunches — agent data (`PROTOAGENT_HOME`, workspaces) is untouched.
 
 - Updater bundles are only produced in CI when the org `TAURI_SIGNING_PRIVATE_KEY`
   is present; a release without them simply has no in-app update (the `latest.json`

docs/.vitepress/config.mts

@@ -152,6 +152,7 @@ export default defineConfig({
           text: "Operate & deploy",
           collapsed: true,
           items: [
+            { text: "The protoagent command (CLI)", link: "/guides/cli" },
             { text: "Deploy via GHCR", link: "/guides/deploy" },
             { text: "Deploy in Docker (seed + UI override)", link: "/guides/deploy-docker" },
             { text: "Deploy on Proxmox (reusable LXC template)", link: "/guides/deploy-proxmox" },

docs/adr/0057-command-palette.md

@@ -1,6 +1,6 @@
 # ADR 0057 — Command palette (⌘K): plugin-extensible quick command
 
-- **Status:** Proposed (2026-06-18)
+- **Status:** Accepted (proposed 2026-06-18; shipped v0.48.0)
 - **Date:** 2026-06-18
 - **Deciders:** Josh Mabry; protoAgent maintainers
 - **Tags:** ux, command-palette, plugins, desktop, navigation, extensibility, ds

docs/adr/0058-runtime-plugin-install-frozen-app.md

@@ -1,6 +1,6 @@
 # 0058 — Runtime plugin install in the frozen desktop app (Discord as the first external comms plugin)
 
-Status: **Proposed**
+Status: **Accepted** (shipped v0.48.0)
 
 ## Context
 

docs/adr/0059-unified-plugin-manager.md

@@ -1,6 +1,6 @@
 # 0059 — Unified plugin manager: in-app directory (Discover) + folded config (Installed)
 
-Status: **Proposed**
+Status: **Accepted** (shipped v0.48.0; extended through v0.112.0)
 
 ## Context
 

docs/adr/0068-developer-flags-and-panel.md

@@ -1,6 +1,6 @@
 # 0068 — Developer flags & the Developer panel (gating pre-release functionality)
 
-Status: **Proposed**
+Status: **Accepted** (shipped — #1506, Developer panel + flag backend)
 
 > Resolves #1506. Features pass through stages — internal-testing → opt-in preview → GA — but
 > the repo has **no first-class way to gate a half-built feature**. Today it either ships

docs/adr/0076-managed-git-acp-delegates.md

@@ -1,6 +1,6 @@
 # 0076 — Managed git for `acp` delegates: framework-owned branch/commit/push/PR
 
-- Status: Proposed
+- Status: Accepted (shipped #1845/#1846/#1847)
 - Date: 2026-07-05
 - Builds on: ADR 0024 (spawn CLI coding agents over ACP — superseded; ACP lives on as
   the `acp` delegate), ADR 0025 (unified delegate registry — `delegate_to`), ADR 0033

docs/adr/0077-adversarial-code-review-workflow.md

@@ -1,6 +1,6 @@
 # 0077 — Adversarial code-review workflow + the findings convention
 
-- Status: Proposed
+- Status: Accepted (recipe live — the /code-review findings engine)
 - Date: 2026-07-06
 - Builds on: ADR 0002 (declarative workflow engine — the DAG this recipe runs on),
   ADR 0011 (deep-research adversarial roles — the reviewed-by-strangers pattern this