feat: land P7 crunch carry (plugins)

.github/ROADMAP.md

@@ -2,7 +2,7 @@
 
 This document tracks planned features and upcoming releases across the nSelf ecosystem. It is updated after each sprint cycle.
 
-**Current version:** v1.0.11 LTS  
+**Current version:** see the latest release on GitHub.  
 **Legend:** ✅ Done | 🚧 In Progress | 🔲 Planned | 🚫 Deferred
 
 ---
@@ -14,8 +14,6 @@ Target: Q2 2026
 | Feature | Repo | Status | Notes |
 |---------|------|--------|-------|
 | nFamily social app | nfamily | 🔲 Planned | Family social media, private; bundle $0.99/mo |
-| ClawDE bundle launch | clawde | 🔲 Planned | cloud sync, mobile twin, team features at $0.99/mo |
-| nTV full media server | ntv | 🔲 Planned | Full media server + multi-platform (Roku, Apple TV, Android TV) |
 | Admin multi-user support | admin | 🔲 Planned | Multi-operator via `NSELF_ADMIN_MULTIUSER`. Single-operator in v1.x |
 | nCloud managed hosting | web/cloud | 🔲 Planned | Dedicated Hetzner VPS, $2/mo margin + at-cost infra |
 | Plugin SDK public release | cli/sdk | 🔲 Planned | plugin-sdk-go + plugin-sdk-ts as standalone packages |

.github/scripts/check-doc-commands.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+# Usage: bash .github/scripts/check-doc-commands.sh <page.md>...
+exec env CGO_ENABLED=0 GOFLAGS=-mod=vendor DOCCMDS_CALLER_DIR="$PWD" \
+  go -C "$(dirname "$0")/../../free/ci" run ./tools/doccmds "$@"

.github/truth/repo.yaml

@@ -0,0 +1,18 @@
+# plugins truth rules (planned configuration, Epic TRUTH D17; draft by P7-TRUTH-04, copied by the sweep Ticket P7-TRUTH-10, P7-TRUTH-32).
+# Includes the vendored org and claim rules (scripts/truth/vendor-rules.sh) and exempts, with a reason,
+# every path the sweep Tickets do not own. The sweep Tickets delete an exemption as they fix its file.
+version: 1
+include: [.github/truth/org.yaml, .github/truth/claims.yaml]
+allow:
+  - rule: "*"
+    paths: [".github/RELEASE-v*.md", "**/CHANGELOG*", "**/Changelog*"]
+    reason: "release notes keep the names and counts that were true when they shipped"
+  - rule: "*"
+    paths: [".workers/**/evidence/**"]
+    reason: "worker evidence files record what was true when the worker ran"
+  - rule: "claims.*"
+    paths: [".github/ISSUE_TEMPLATE/v1-1-1-api-changes.md", ".github/wiki/CI-Scope.md", ".github/wiki/Installation.md", ".github/wiki/Plugin-Conformance.md", ".github/wiki/Security.md", ".github/wiki/architecture/Plugin-System.md", ".github/wiki/getting-started/Quick-Start.md", ".github/wiki/plugins/AI-CLI.md", ".github/wiki/plugins/AI-Studio.md", ".github/wiki/plugins/API.md", ".github/wiki/plugins/Alerts.md", ".github/wiki/plugins/Audit-Analytics.md", ".github/wiki/plugins/Audit.md", ".github/wiki/plugins/Auth-Enterprise.md", ".github/wiki/plugins/BYOK.md", ".github/wiki/plugins/CDC.md", ".github/wiki/plugins/CI.md", ".github/wiki/plugins/CRDT.md", ".github/wiki/plugins/Claw-CLI.md", ".github/wiki/plugins/Compliance.md", ".github/wiki/plugins/Content-Safety.md", ".github/wiki/plugins/Costs.md", ".github/wiki/plugins/Cron.md", ".github/wiki/plugins/DLQ.md", ".github/wiki/plugins/DR.md", ".github/wiki/plugins/Dogfood.md", ".github/wiki/plugins/Donorbox.md", ".github/wiki/plugins/E2EE.md", ".github/wiki/plugins/Email.md", ".github/wiki/plugins/Encryption.md", ".github/wiki/plugins/Event-Bus.md", ".github/wiki/plugins/Family-Ancestry.md", ".github/wiki/plugins/Family-FamilySearch.md", ".github/wiki/plugins/Family-GEDCOM.md", ".github/wiki/plugins/Family-MyHeritage.md", ".github/wiki/plugins/Family-WikiTree.md", ".github/wiki/plugins/Federation.md", ".github/wiki/plugins/Flags.md", ".github/wiki/plugins/Forgejo.md", ".github/wiki/plugins/Functions-V8.md", ".github/wiki/plugins/Functions.md", ".github/wiki/plugins/GDPR.md", ".github/wiki/plugins/Gateway.md", ".github/wiki/plugins/Gauth.md", ".github/wiki/plugins/GitHub-Runner.md", ".github/wiki/plugins/HIPAA.md", ".github/wiki/plugins/Home.md", ".github/wiki/plugins/Infra.md", ".github/wiki/plugins/Job-Queue.md", ".github/wiki/plugins/K8s.md", ".github/wiki/plugins/LinkedIn.md", ".github/wiki/plugins/MLflow.md", ".github/wiki/plugins/Mail.md", ".github/wiki/plugins/Maintenance.md", ".github/wiki/plugins/Model.md", ".github/wiki/plugins/Monitor.md", ".github/wiki/plugins/Monitoring.md", ".github/wiki/plugins/Notify.md", ".github/wiki/plugins/Ollama.md", ".github/wiki/plugins/PayPal.md", ".github/wiki/plugins/Payments.md", ".github/wiki/plugins/Pentest-Kit.md", ".github/wiki/plugins/Pentest.md", ".github/wiki/plugins/Plugin-ClawDE.md", ".github/wiki/plugins/Plugin-Gauth.md", ".github/wiki/plugins/Plugin-LLM-Gateway.md", ".github/wiki/plugins/Plugin-PTY.md", ".github/wiki/plugins/Plugin-Retrieval.md", ".github/wiki/plugins/Post.md", ".github/wiki/plugins/Push.md", ".github/wiki/plugins/Queue.md", ".github/wiki/plugins/Region.md", ".github/wiki/plugins/Release.md", ".github/wiki/plugins/SIEM.md", ".github/wiki/plugins/SMS.md", ".github/wiki/plugins/Sentry-CLI.md", ".github/wiki/plugins/Shared-Utils.md", ".github/wiki/plugins/Soak.md", ".github/wiki/plugins/Sports.md", ".github/wiki/plugins/Storage.md", ".github/wiki/plugins/Stripe.md", ".github/wiki/plugins/Tenant-Controller.md", ".github/wiki/plugins/Tenant.md", ".github/wiki/plugins/Transactional-Email.md", ".github/wiki/plugins/WAF.md", ".github/wiki/plugins/Watchdog.md", ".github/wiki/plugins/Web3.md", ".github/wiki/plugins/nSelf-Cloud.md", ".github/wiki/plugins/nSelf-Eval-Gate.md", ".github/wiki/plugins/nSelf-Geo.md", ".github/wiki/plugins/nSelf-Image.md", ".github/wiki/plugins/nSelf-PDF.md", ".github/wiki/plugins/nSelf-Scan.md", ".github/wiki/plugins/nSelf-Sync.md", ".github/wiki/plugins/nSelf-Vault.md", "free/access-controls/MANIFEST.md", "free/access-controls/VERIFICATION.md", "free/analytics/IMPLEMENTATION_SUMMARY.md", "free/backup/third_party/sdk/README.md", "free/content-acquisition/third_party/sdk/README.md", "free/content-progress/third_party/sdk/README.md", "free/cron/third_party/sdk/README.md", "free/donorbox/third_party/sdk/README.md", "free/github-runner/README.md", "free/github-runner/third_party/sdk/README.md", "free/idme/QUICKSTART.md", "free/invitations/third_party/sdk/README.md", "free/link-preview/third_party/sdk/README.md", "free/mdns/third_party/sdk/README.md", "free/mlflow/third_party/sdk/README.md", "free/notify/third_party/sdk/README.md", "free/paypal/third_party/sdk/README.md", "free/push/third_party/sdk/README.md", "free/shopify/third_party/sdk/README.md", "free/subtitle-manager/third_party/sdk/README.md", "free/torrent-manager/third_party/sdk/README.md", "free/vpn/third_party/sdk/README.md"]
+    reason: "prose outside every sweep write scope of P7-TRUTH-10, P7-TRUTH-32; a real finding the lead can fold into a sweep Ticket, then delete this entry"
+  - rule: "vocab.*"
+    paths: ["free/backup/third_party/sdk/COMPATIBILITY.md", "free/content-acquisition/third_party/sdk/COMPATIBILITY.md", "free/content-progress/third_party/sdk/COMPATIBILITY.md", "free/cron/third_party/sdk/COMPATIBILITY.md", "free/donorbox/third_party/sdk/COMPATIBILITY.md", "free/github-runner/third_party/sdk/COMPATIBILITY.md", "free/invitations/third_party/sdk/COMPATIBILITY.md", "free/link-preview/third_party/sdk/COMPATIBILITY.md", "free/mdns/third_party/sdk/COMPATIBILITY.md", "free/mlflow/third_party/sdk/COMPATIBILITY.md", "free/notify/third_party/sdk/COMPATIBILITY.md", "free/paypal/third_party/sdk/COMPATIBILITY.md", "free/plugin-dev/internal/surface/help/init.txt", "free/plugin-dev/internal/surface/help/new.txt", "free/push/third_party/sdk/COMPATIBILITY.md", "free/shopify/third_party/sdk/COMPATIBILITY.md", "free/subtitle-manager/third_party/sdk/COMPATIBILITY.md", "free/torrent-manager/third_party/sdk/COMPATIBILITY.md", "free/vpn/third_party/sdk/COMPATIBILITY.md"]
+    reason: "prose outside every sweep write scope of P7-TRUTH-10, P7-TRUTH-32; a real finding the lead can fold into a sweep Ticket, then delete this entry"

.github/wiki/Contributing.md

@@ -4,7 +4,7 @@ Thanks for your interest in contributing to the nSelf plugin ecosystem.
 
 ## What This Is
 
-Free MIT plugins for the nSelf CLI. There are 25 free plugins available to everyone.
+Free MIT plugins for the nSelf CLI. The free plugins are available to everyone; the live list is in `registry.json`.
 
 ## Prerequisites
 

.github/wiki/Home.md

@@ -35,8 +35,8 @@ Command pages include action/subcommand syntax, argument shapes, and option flag
 
 ### Plugin Documentation
 
-<!-- Registry has 129 free plugins across 14 categories, generated via `jq '.plugins|length' registry.json` — the table below (64 rows) is a partial sample pending full regen (P6-E9-W4-S3-T2 tracks the related F03 SPORT regen); see `_Sidebar.md` § All Free Plugins or `.github/wiki/plugins/` for the complete 129-plugin list. -->
-See [[All Plugins|#plugin-directory-64-of-129-shown]] below for a sample; the full catalog is 129 free plugins across 14 categories (see `_Sidebar.md` § All Free Plugins for the complete alphabetical list, or `registry.json`).
+<!-- The plugin count and categories are generated from `registry.json` (`jq '.plugins|length' registry.json`); this page does not type them. The table below is a partial sample. -->
+See [[All Plugins|#plugin-directory-sample]] below for a sample; the full catalog is in `_Sidebar.md` § All Free Plugins and in `registry.json`.
 
 **Popular Plugins:**
 - [[Stripe|plugins/Stripe]] - Payment processing and subscription management
@@ -63,7 +63,8 @@ See [[All Plugins|#plugin-directory-64-of-129-shown]] below for a sample; the fu
 - [[Deployment|guides/Deployment]]
 - [[Migration|guides/Migration]]
 - [[Best Practices|guides/Best-Practices]]
-- [[Adopting the nself-ci Gate|guides/Nself-CI-Adoption]]
+- [[Getting started with nself ci|guides/ci/Getting-Started]]
+- [[Migrating to the new CI engine|guides/ci/Migration]]
 - [[CI trust, security and privacy|guides/ci/Trust-Security-and-Privacy]]
 - [[Troubleshooting FAQ|troubleshooting/FAQ]]
 
@@ -101,10 +102,10 @@ Legacy `docs/` is retired. Public docs belong in `.github/wiki/` only.
 2. Commands in `Commands.md` and `commands/*.md` must match action/CLI source files.
 3. Any drift between code and docs is treated as a defect.
 
-## Plugin Directory (64 of 129 Shown)
+## Plugin Directory (Sample)
 
-<!-- Registry (129 plugins) uses 14 canonical categories per registry.json; this sample table's category column is synced to those values. -->
-This is a partial sample (64 of 129 free plugins). Registry categories (14, from `registry.json`): **authentication**, **automation**, **commerce**, **communication**, **compliance**, **content**, **data**, **development**, **infrastructure**, **integrations**, **media**, **social**, **sports**, **streaming**.
+<!-- Categories come from registry.json; this sample table's category column is synced to those values. -->
+This is a partial sample of the free plugins. Registry categories, from `registry.json`: **authentication**, **automation**, **commerce**, **communication**, **compliance**, **content**, **data**, **development**, **infrastructure**, **integrations**, **media**, **social**, **sports**, **streaming**.
 
 | Plugin | Port | Category | Description |
 |--------|------|----------|-------------|

.github/wiki/Plugin-Development.md

@@ -1,6 +1,6 @@
 # Plugin Development
 
-This page walks through building a new nSelf plugin from empty directory to shipped service. It targets free + pro plugins written in Go against [`plugin-sdk-go`](https://github.com/nself-org/plugin-sdk-go).
+This page walks through building a new nSelf plugin from empty directory to shipped service. It targets free and licensed plugins written in Go against [`plugin-sdk-go`](https://github.com/nself-org/plugin-sdk-go).
 
 See also:
 - [[Home]]
@@ -219,11 +219,11 @@ log.Error("upstream 5xx", "err", err, "retry", 2)
 
 ---
 
-## 6. License (Pro Plugins Only)
+## 6. License (Licensed Plugins Only)
 
 Free plugins: skip this section.
 
-Pro plugins rely on the CLI loader to gate install. At runtime, use `sdk/license` only if you need to re-check a long-running entitlement (e.g. a daily cron):
+Licensed plugins rely on the CLI loader to gate install. At runtime, use `sdk/license` only if you need to re-check a long-running entitlement (e.g. a daily cron):
 
 ```go
 import "github.com/nself-org/plugin-sdk-go/license"
@@ -300,7 +300,7 @@ Minimum fields:
 }
 ```
 
-Pro plugins additionally set:
+Licensed plugins additionally set:
 
 ```json
 {
@@ -329,7 +329,7 @@ nself plugin verify my-notifier
 # Package it
 nself plugin package my-notifier
 
-# Submit (free plugins → plugins repo PR; pro plugins → plugins-pro via invite)
+# Submit (free plugins → plugins repo PR; licensed plugins → the Bundles repo via invite)
 nself plugin submit my-notifier
 ```
 

.github/wiki/Plugin-Marketplace.md

@@ -1,6 +1,6 @@
 # Plugin Marketplace
 
-The nSelf plugin marketplace is the catalog of free and pro plugins that extend a nSelf backend. It is served by the Cloudflare Worker at `plugins.nself.org` and consumed by three surfaces:
+The nSelf plugin marketplace is the catalog of free and licensed plugins that extend a nSelf backend. It is served by the Cloudflare Worker at `plugins.nself.org` and consumed by three surfaces:
 
 - **Admin UI** — `ɳSelf Admin` runs locally at `http://localhost:3021/plugins/marketplace`
 - **CLI** — `nself plugin marketplace {list,search,info}`
@@ -16,7 +16,7 @@ Base URL: `https://plugins.nself.org`
 |--------|------|---------|
 | GET | `/marketplace` | Categorized plugin list with ratings, bundles, and filters |
 | GET | `/marketplace?tier=free` | Only free plugins |
-| GET | `/marketplace?tier=pro` | Only pro plugins |
+| GET | `/marketplace?tier=pro` | Only licensed plugins |
 | GET | `/marketplace?category=media` | Filter by category |
 | GET | `/marketplace?bundle=nclaw` | Filter by bundle slug |
 | GET | `/marketplace?q=stripe` | Full-text search over name, description, display name, tags |

.github/wiki/Preflight.md

@@ -65,3 +65,22 @@ Details: `scripts/preflight/README.md`.
 
 The licensed tier is measured separately (P7-PLUG-39). The latest evidence is
 kept in the hq plan evidence folder (`PLUG-02-preflight.md`).
+
+## Licensed tier
+
+`scripts/preflight/licensed.sh` measures the licensed entries of
+`$NSELF/plugins-pro/registry.json` against what `ping.nself.org` serves, using
+the scoped, expiring, revocable CI licence from the environment variable
+`NSELF_CI_LICENSE_KEY`. It runs on the owner's machine only; the registry data
+and tarballs are never committed.
+
+```bash
+bash scripts/preflight/licensed.sh --out "$TMPDIR/licensed.json" --strict
+```
+
+Same stages and classes as the free tier, plus `entitlement`: the download
+answered 401 or 403 for an entry the CI licence should cover (reported, never
+skipped). The key is sent only on the first hop, never to a redirect target,
+and is never printed. `--no-build` records skips, and a skip is not a pass.
+The offline test is `free/ci/internal/preflight/licensed_test.go`; the live
+run is P7-PLUG-88.

.github/wiki/Standards.md

@@ -280,7 +280,7 @@ GOOGLE_KEY=...
 - Media: 3700-3799
 - Streaming: 3800-3899
 - Development: 3900-3999
-- Integrations: 4000-4099
+- Integration services: 4000-4099
 
 **Note**: Port ranges are guidelines only. Existing ports should not be changed without coordination.
 

.github/wiki/Truth-Rules.md

@@ -67,6 +67,7 @@ generated_regions:
 
 Unknown region ids exempt nothing. A header saying `GENERATED BY` also exempts nothing; use declared region markers or a reasoned path exemption instead.
 
+<!-- truth: exempt names the labelled-count example the shipped rule catches -->
 Binary, UTF-16 and files over 4 MiB still run through dead-host matching up to a bounded 16 MiB read. Unscannable prose in a claim rule's scope produces `truth.unscanned-file`; a file above the host limit produces the same finding when any rule applies. NUL bytes anywhere in a file trigger this handling. Only explicitly excluded paths bypass it. Finding paths and matches that contain a dead host are redacted. Zero-width spaces, joiners, word joiners and BOMs cannot hide matches. Claims can span two adjacent lines, and the shipped count rule also catches labelled counts such as `Plugins: 62`.
 
 Known limits: claims split over more than two lines, full-width digits, `all 62 free and paid plugins` and `62 <b>plugins</b>` are outside the count pattern. Astro `<script>` and `<style>` blocks and dynamic expressions in Astro/MDX remain exempt.

.github/wiki/_Sidebar.md

@@ -38,7 +38,7 @@
 - [[Realtime|plugins/Realtime]]
 - [[Analytics|plugins/Analytics]]
 
-**View All:** [[Home|Home#plugin-directory-64-of-129-shown]] (or see the full alphabetical list below — 129/129 synced with `registry.json`)
+**View All:** [[Home|Home#plugin-directory-sample]] (or see the full alphabetical list below, synced with `registry.json`)
 
 ### All Free Plugins
 - [[Access-Controls|plugins/Access-Controls]]
@@ -162,14 +162,37 @@
 - [[Tokens|plugins/Tokens]]
 - [[Torrent-Manager|plugins/Torrent-Manager]]
 - [[Traefik|plugins/Traefik]]
-- [[Transactional-Email|plugins/Transactional-Email]]
 - [[VPN|plugins/VPN]]
 - [[WAF|plugins/WAF]]
 - [[Watchdog|plugins/Watchdog]]
 - [[Web3|plugins/Web3]]
 - [[Webhooks|plugins/Webhooks]]
 - [[Workflows|plugins/Workflows]]
 
+<!-- BEGIN GENERATED:guides-ci -->
+### CI
+- [[Getting started with nself ci|guides/ci/Getting-Started]]
+- [[CI architecture|guides/ci/Architecture]]
+- [[CI configuration and policy|guides/ci/Configuration-and-Policy]]
+- [[Evidence and machine output|guides/ci/Evidence-and-Machine-Output]]
+- [[Nodes and Runners|guides/ci/Nodes-and-Runners]]
+- [[CI trust, security and privacy|guides/ci/Trust-Security-and-Privacy]]
+- [[CI scheduling and cost|guides/ci/Scheduling-and-Cost]]
+- [[Hosted providers|guides/ci/Hosted-Providers]]
+- [[Cache and artifacts|guides/ci/Cache-and-Artifacts]]
+- [[Walkthrough: a home lab|guides/ci/Walkthrough-Home-Lab]]
+- [[Walkthrough: several projects on one fleet|guides/ci/Walkthrough-Multiple-Projects]]
+- [[Walkthrough: a team|guides/ci/Walkthrough-Team]]
+- [[Walkthrough: agents|guides/ci/Walkthrough-Agents]]
+- [[Migrating to the new CI engine|guides/ci/Migration]]
+- [[CI troubleshooting|guides/ci/Troubleshooting]]
+- [[CI reference|guides/ci/Reference]]
+- [[CI agent reference|guides/ci/Agent-Reference]]
+- [[Auto placement and pools|guides/ci/Auto-Placement-and-Pools]]
+- [[Watch and services|guides/ci/Watch-and-Services]]
+- [[macOS node ownership checks|guides/ci/macOS-Nodes]]
+<!-- END GENERATED:guides-ci -->
+
 ### Guides
 - [[Configuration|guides/Configuration]]
 - [[Best Practices|guides/Best-Practices]]
@@ -191,5 +214,5 @@
 
 **Related**
 - [nSelf CLI Wiki](https://github.com/nself-org/cli/wiki)
-- [Pro Plugins](https://github.com/nself-org/plugins-pro)
+- [Licensed Plugins (Bundles)](https://github.com/nself-org/bundles)
 - [nself.org Plugin Catalog](https://nself.org/plugins)

.github/wiki/architecture/CI-Matrix.md

@@ -11,7 +11,7 @@ How free plugins get tested automatically, and what does not.
 
 ## The 59 / 1 split
 
-As of P6, `free/` holds 60 plugin directories. 59 of them have a `go.mod` and
+`free/` holds one directory per free plugin; those with a `go.mod` (the count comes from `scripts/plugin-counts.sh` output, not this page) are
 are built, vetted, and unit-tested by `build-test.yml`'s loop
 (`for d in free/*/; if [ -f "$d/go.mod" ]; then ... fi`). Adding a new Go
 plugin needs no workflow edit — drop a `go.mod` in `free/<name>/` and the
@@ -52,7 +52,7 @@ sibling) to compare the free and pro registries against disk. It has two
 modes, selected automatically by whether the `PLUGINS_PRO_CHECKOUT_TOKEN`
 secret is set:
 
-- **Mode A** (secret present): checks out `nself-org/plugins-pro` and
+- **Mode A** (secret present): checks out `nself-org/bundles` and
   `nself-org/cli` as siblings, then runs the full script — free + pro counts,
   and the pro disk-vs-registry drift check.
 - **Mode B** (secret absent, current default): the pro-repo checkout is

.github/wiki/guides/Configuration.md

@@ -23,7 +23,7 @@
 
 ## Overview
 
-All nself plugins are configured via environment variables, typically stored in `.env` files. This guide provides a complete reference for all configuration options across all 8 plugins.
+All nself plugins are configured via environment variables, typically stored in `.env` files. This guide provides a complete reference for all configuration options across the plugins covered here.
 
 ### Configuration Principles
 
@@ -1188,7 +1188,7 @@ If environment variables aren't loading:
 ls -la plugins/stripe/ts/.env
 
 # Check permissions
-chmod 600 plugins/stripe/ts/.env
+chmod 0600 plugins/stripe/ts/.env
 
 # Validate syntax (no spaces around =)
 # WRONG: STRIPE_API_KEY = sk_test_123