1.0: rebrand coherence — canonical npm scope, PROTO_* env aliasing, stale CHANGELOG/CONTRIBUTING

[mabry1985]

From the 1.0-readiness audit. The dominant 1.0 theme: an unfinished Qwen/Gemini→proto rebrand leaking into the surface that a 1.0 would freeze under semver. The trivial leftovers already shipped in #471 (v0.71.3); this issue covers the parts that need a decision.

1. Canonical package identity — needs a call

Package	Name today
workspace root	@protolabsai/proto
packages/cli	@protolabs/proto ← different npm org (missing "ai")
packages/core	@qwen-code/qwen-code-core
packages/sdk-typescript	@protolabsai/sdk
also	@qwen-code/qwen-code-test-utils, @qwen-code/web-templates, @qwen-code/webui

Note docs/architecture/divergence-from-upstream.md:45-54 documents keeping @qwen-code/qwen-code-core deliberately (renaming touches every fork-unique import and widens upstream-backport merge conflicts). That trade-off is real — but 1.0 is the moment to decide, since the published name is a semver-frozen contract. Decide: one scope (@protolabsai?) or keep the split and document it as intentional.

2. PROTO_* env vars that no code reads (broken contract)

PROTO_ENABLE_CRON was fixed in #471. Still outstanding:

• Docs reference PROTO_SYSTEM_SETTINGS_PATH / PROTO_SYSTEM_DEFAULTS_PATH (docs/reference/settings.md:95-96) but code reads QWEN_CODE_SYSTEM_SETTINGS_PATH / QWEN_CODE_SYSTEM_DEFAULTS_PATH (packages/cli/src/config/settings.ts:139,152).
• Doc-only with no reader: PROTO_SANDBOX*, PROTO_TELEMETRY_*, PROTO_PROJECT_DIR.
• PROTO_STREAM_STALL_TIMEOUT_MS documented default 300000 (docs/reference/settings.md:94) vs actual 660000 (packages/core/src/core/turn.ts:46).

Proposal: add a prefix-aliasing layer — PROTO_* primary, QWEN_*/GEMINI_* accepted for one deprecation cycle (the pattern used for PROTO_ENABLE_CRON in #471) — plus a central env-var registry. There is no constants file today; ~40 inline process.env['...'] literals, only 2 symbolic names (token-storage/index.ts:13, hybrid-token-storage.ts:12).

Other split-brand pairs: PROTO_CLI_FORCE_ENCRYPTED_FILE_STORAGE vs QWEN_CODE_FORCE_FILE_STORAGE (one subsystem, two brands). PROTO_LEGACY_ERASE_LINES (terminalRedrawOptimizer.ts:124) — don't freeze a LEGACY_-named var into a 1.0.

Undocumented ad-hoc hatches to either document or drop: PROTO_SYNCHRONIZED_OUTPUT (+_FORCE_/_DISABLE_), PROTO_MAX_RETRIES, QWEN_SYSTEM_MD/QWEN_WRITE_SYSTEM_MD, QWEN_CODE_TOOL_CALL_STYLE, QWEN_CODE_NO_RELAUNCH.

3. Stale user/contributor docs

• CHANGELOG.md — frozen at Qwen-era 0.0.15 (DashScope/Gemini content) while shipping 0.71.3; ~70 versions of proto history missing and not surfaced to users. Marketing sites/marketing/data/changelog.json also stale (newest v0.62.1). → backfill or auto-generate from conventional commits.
• CONTRIBUTING.md — tells contributors to git clone https://github.com/QwenLM/qwen-code.git; uses QWEN_SANDBOX, .qwen-code/.env, DEBUG=1 qwen-code; has a "Sandboxing > TBD" placeholder; and a "Manual Publish" section calling scripts that don't exist (npm run auth, npm run prerelease:dev). Refs: CONTRIBUTING.md:84,104,116,262,265,296,300-307.
• Minor: package.json:18 homepage: https://protolabs.sh vs canonical protolabs.studio everywhere else; PROTO.md:53,63 documents packages as @qwen-code/*; dead Homebrew detection greps for a ^qwen-code$ formula (packages/cli/src/utils/installationInfo.ts:83); stray 14MB protolabsai-proto-0.16.3.tgz in the working tree.

Effort: M–L (mostly mechanical once the scope decision is made).

[mabry1985]

Descoped. protoCLI is an in-house tool + reference pattern, not a shipped product — the whole 1.0 hardening project was over-scoped (product thinking for a "use it, hack it, break it" tool). Dropping the project entirely.

The findings themselves stay preserved here (closed, searchable) and in session memory. The few that are real bugs regardless of product-vs-pattern — #476 (prompt hooks / getCustomExcludes silently no-op) and #479 (SIGTERM swallows cleanup, LSP orphans, unbounded shell output) — are the ones worth reopening/cherry-picking if they ever bite. Reopen any of these if it becomes worth doing.