chore: finalize CapGlyph naming and land product gates

.carryctx/config.toml

@@ -2,12 +2,19 @@ schema_version = 1
 
 [project]
 id = "01M0094ARQJD79NQ9M0P1YSWPZ"
-name = "sigil"
-task_prefix = "CTX"
+name = "capglyph-cli"
+task_prefix = "CGCLI"
 
 [git]
 main_branch = "main"
-branch_template = "ctx-{task_id}/{slug}"
+branch_template = "carryctx/{task_id}-{slug}"
+
+[worktree.cleanup]
+on_task_completed = "when_idle"
+on_task_cancelled = "keep"
+require_clean = true
+require_no_active_session = true
+delete_branch = "never"
 
 [session]
 stale_after = "2h"
@@ -16,6 +23,7 @@ single_active_session_per_agent = true
 [task]
 single_active_task_per_agent = true
 strict_completion = false
+list_limit = 200
 
 [context]
 default_mode = "compact"

.carryctx/personas/c2pa-engineer.md

@@ -1,5 +1,5 @@
 ---
-name: Sigil C2PA Engineer
+name: CapGlyph C2PA Engineer
 role: Content credentials specialist
 strictness: high
 description: Owns C2PA manifest integration with pure-Rust crypto.

.carryctx/personas/commander.md

@@ -1,5 +1,5 @@
 ---
-name: Sigil Commander
+name: CapGlyph Commander
 role: Dependency-aware planning and integration owner
 strictness: high
 description: Coordinates scoped specialists through durable CarryCtx state and independent acceptance.

.carryctx/personas/performance-engineer.md

@@ -1,5 +1,5 @@
 ---
-name: Sigil Performance Engineer
+name: CapGlyph Performance Engineer
 role: Throughput and fidelity budget specialist
 strictness: high
 description: Turns watermark robustness vs fidelity into measurable budgets.

.carryctx/personas/security-reviewer.md

@@ -1,5 +1,5 @@
 ---
-name: Sigil Security Reviewer
+name: CapGlyph Security Reviewer
 role: Trust-boundary and adversarial-review specialist
 strictness: critical
 description: Reviews P0 controls, capabilities, keying, and C2PA.

.carryctx/personas/signal-engineer.md

@@ -1,5 +1,5 @@
 ---
-name: Sigil Signal Engineer
+name: CapGlyph Signal Engineer
 role: Signal, keying and spread-spectrum specialist
 strictness: high
 description: Owns keying, spread_spectrum, geometry and batch placement.

.carryctx/personas/test-engineer.md

@@ -1,5 +1,5 @@
 ---
-name: Sigil Test Engineer
+name: CapGlyph Test Engineer
 role: Verification architecture specialist
 strictness: high
 description: Builds layered, adversarial and cross-platform evidence.

.carryctx/personas/wasm-engineer.md

@@ -1,5 +1,5 @@
 ---
-name: Sigil WASM Engineer
+name: CapGlyph WASM Engineer
 role: Browser bridge and in-memory API specialist
 strictness: high
 description: Owns wasm_api.rs, wasm32 feature isolation, and in-memory embed/verify.

.carryctx/personas/watermark-engineer.md

@@ -1,5 +1,5 @@
 ---
-name: Sigil Watermark Engineer
+name: CapGlyph Watermark Engineer
 role: Embedding mode and detector specialist
 strictness: high
 description: Owns alpha, dct, dwt, and learned (TrustMark ONNX) modes plus verify/extract/strip.
@@ -11,7 +11,7 @@ You embed invisibly and detect reliably.
 
 ## Directives
 
-1. Keep 4 modes (alpha/dct/dwt/learned) in `sigil/src/{dct,dwt,learned,embed,verify}.rs` isolated; `dct` uses 8×8 F[2,3]+16 with self-sync seed blocks, `dwt` uses Haar LH geometry-free extraction, `learned` is feature-gated.
+1. Keep 4 modes (alpha/dct/dwt/learned) in `capglyph-cli/src/{dct,dwt,learned,embed,verify}.rs` isolated; `dct` uses 8×8 F[2,3]+16 with self-sync seed blocks, `dwt` uses Haar LH geometry-free extraction, `learned` is feature-gated.
 2. Preserve embed→verify→extract→strip contract across modes; geometry-free extraction for dwt must remain true.
 3. Validate detectors against attack matrix (JPEG q30, blur σ2, scale 0.5×, etc.) and record ROC/fidelity (PSNR/SSIM/LPIPS) evidence.
 4. Guard keying (`keying.rs` HMAC → differential pairs) and spread spectrum (`spread_spectrum.rs`) isolation.

.carryctx/rules/delivery.md

@@ -8,7 +8,7 @@ Lifecycle (normative): GitHub Issue → CarryCtx task (team/dependencies/scopes)
 4. Before the first commit, worktree/branch/commit/PR stages are unavailable. The commander may authorize shared-checkout work only with disjoint scopes and CI-equivalent local gates. End this exception after repository initialization.
 5. A pull request links its Issue and CarryCtx task and states contract outcome, security/performance impact, affected docs, validation, dependencies/merge order, and follow-up. Title follows `type(scope): subject (CTX-XXXX)` (see workflow §5).
 6. Independent review is required for every delivery task before merge. The reviewer must be a different agent than the implementer, must not self-accept, and must record an explicit `APPROVE` (or `REQUEST_CHANGES`) in the PR and in CarryCtx. The reviewer inspects authoritative contracts, diff, edge cases, synchronized docs, and reproducible evidence; reruns relevant checks; and records findings or acceptance in CarryCtx progress/risk. Defects and observations are recorded durably and converted to follow-up `CTX-XXXX` tasks with team/priority/dependencies — required findings block merge.
-7. Documentation synchronization is part of Definition of Done. Update affected canonical `sigil-docs` material (architecture, security, public behavior, configuration, compatibility, reference, developer workflows) in the same PR as the code; stale affected documentation keeps the implementation task incomplete and blocks `APPROVE`. Link the exact docs revision in the PR and verify synchronization after merge. Repository-owned docs are English-only; `sigil-docs` is canonical (see `documentation.md`).
+7. Documentation synchronization is part of Definition of Done. Update affected canonical `capglyph-docs` material (architecture, security, public behavior, configuration, compatibility, reference, developer workflows) in the same PR as the code; stale affected documentation keeps the implementation task incomplete and blocks `APPROVE`. Link the exact docs revision in the PR and verify synchronization after merge. Repository-owned docs are English-only; `capglyph-docs` is canonical (see `documentation.md`).
 8. Merge only after independent `APPROVE`, required CI (fmt/clippy/test/wasm where applicable) passing, synchronized docs, and cross-repository ordering are satisfied. After merge, record the merged revision, verify docs synchronization, checkpoint, complete the task, and close the Issue. Preserve follow-up work as linked `CTX-XXXX` tasks.
-9. Maintain a continuous findings log at `findings/review-log.md` (canonical in `sigil` repo) and mirror to `sigil-docs/findings/review-log.md` when docs are affected. Every review appends date, task, reviewer, scope, verdict, and follow-up tasks. Defects from reviews are also recorded in CarryCtx progress/risk.
+9. Maintain a continuous findings log at `findings/review-log.md` (canonical in `capglyph-cli` repo) and mirror to `capglyph-docs/findings/review-log.md` when docs are affected. Every review appends date, task, reviewer, scope, verdict, and follow-up tasks. Defects from reviews are also recorded in CarryCtx progress/risk.
 10. Do not commit, push, merge, release, publish, or change remote state without explicit authority. Verify external side-effects by reading back the result before confirming success.

.carryctx/rules/documentation.md

@@ -1,9 +1,9 @@
 # Documentation rules
 
 1. Repository-owned documentation is English-only.
-2. `sigil-docs` is the canonical design and governance corpus. This repository owns implementation evidence and repository-local developer instructions.
+2. `capglyph-docs` is the canonical design and governance corpus. This repository owns implementation evidence and repository-local developer instructions.
 3. Distinguish normative requirements, accepted decisions, candidates, open questions, and implemented behavior. A file or plan is not implementation.
-4. Synchronize affected `sigil-docs` architecture, security, public behavior, configuration, compatibility, reference, developer, risk, and decision documents in the same delivery.
+4. Synchronize affected `capglyph-docs` architecture, security, public behavior, configuration, compatibility, reference, developer, risk, and decision documents in the same delivery.
 5. Link to one authoritative definition instead of copying a divergent contract into source comments, tests, or local documents.
 6. Public commands, fields, templates, errors, defaults, and limits require implementation and test evidence from the owning revision.
 7. Documentation status must stay honest throughout implementation. Candidate text cannot authorize code by itself.

.carryctx/workflows/issue-to-merge.md

@@ -29,7 +29,7 @@ Use this workflow for repository changes after a GitHub Issue identifies the out
 
 1. Adopt the assigned persona and applicable delivery, documentation, security, and performance rules (see `.carryctx/rules/`).
 2. Implement only the accepted contract in scope. Add focused tests first where practical, then cover errors, bounds, denial, cleanup, and recovery.
-3. Update affected canonical `sigil-docs` material for architecture, security, public behavior, configuration, compatibility, and developer workflows **in the same PR**. Documentation synchronization is part of Definition of Done — stale docs block `APPROVE`. Prefer linking to one authoritative definition instead of copying contracts into comments/tests.
+3. Update affected canonical `capglyph-docs` material for architecture, security, public behavior, configuration, compatibility, and developer workflows **in the same PR**. Documentation synchronization is part of Definition of Done — stale docs block `APPROVE`. Prefer linking to one authoritative definition instead of copying contracts into comments/tests.
 4. Run focused checks and the repository integration gate. Minimum local gates before PR: `cargo fmt -- --check`, `cargo clippy --workspace --all-targets -- -D warnings`, `cargo test --workspace`, plus `yamllint -d relaxed .` where YAML exists and `carryctx doctor`. Where WASM is touched, also `cargo check --target wasm32-unknown-unknown` and `cargo tree --target wasm32-unknown-unknown`. Record exact commands, environment, results, and residual gaps in CarryCtx progress.
 5. Checkpoint a coherent milestone before handoff or task switching (`carryctx checkpoint create`).
 
@@ -38,13 +38,13 @@ Use this workflow for repository changes after a GitHub Issue identifies the out
 1. Review the diff for scope, generated artifacts, secrets, accidental API expansion, and stale documentation. Ensure `findings/review-log.md` will be updated post-review if findings exist.
 2. Create coherent commits linked to the Issue and CarryCtx task when commit authority exists. Commit messages reference `CTX-XXXX` and use `type(scope): subject` (e.g. `chore(review): establish continuous review hygiene (CTX-0029)`).
 3. Open a pull request that states outcome, contracts, security/performance impact, docs synchronization, verification, dependencies, and merge order. PR description links the GitHub Issue (`Closes #NNN`) and CarryCtx task, and states the branch name (`ctx-XXXX/<type>-<slug>`). Include validation evidence and the exact docs revision.
-4. Link affected cross-repository pull requests and the exact `sigil-docs` revision where applicable. CI must be green before review can `APPROVE`.
+4. Link affected cross-repository pull requests and the exact `capglyph-docs` revision where applicable. CI must be green before review can `APPROVE`.
 
 ## 6. Independent review and CI
 
 1. Move the task to review; the implementer does not self-accept. Reviewer must be a **different agent** than the implementer.
 2. The reviewer reads the authoritative contracts, inspects the diff, reruns relevant checks (fmt/clippy/test/wasm), and records findings or explicit `APPROVE` / `REQUEST_CHANGES` in the PR and in CarryCtx progress/risk. Required geometry, signal, wasm, c2pa, performance, test, and docs owners review changes crossing their boundaries.
-3. Defects, observations, and risks are recorded durably in CarryCtx progress/risk **and** appended to `findings/review-log.md` (and `sigil-docs/findings/review-log.md` when docs are affected). Each entry notes date, task, reviewer, scope, verdict, and disposition. Blocking findings are converted to follow-up `CTX-XXXX` tasks with team/priority/dependencies before merge; non-blocking observations may be tracked as `informational` follow-ups.
+3. Defects, observations, and risks are recorded durably in CarryCtx progress/risk **and** appended to `findings/review-log.md` (and `capglyph-docs/findings/review-log.md` when docs are affected). Each entry notes date, task, reviewer, scope, verdict, and disposition. Blocking findings are converted to follow-up `CTX-XXXX` tasks with team/priority/dependencies before merge; non-blocking observations may be tracked as `informational` follow-ups.
 4. Resolve every blocking finding and CI failure before merge. Re-request review after fixes; the same independence rule applies to re-review.
 
 ## 7. Merge and close

.github/workflows/ci.yml

@@ -11,6 +11,30 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
+  package-metadata:
+    name: Native package metadata
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          path: capglyph-cli
+
+      - name: Install nFPM
+        working-directory: capglyph-cli
+        run: |
+          set -euo pipefail
+          mkdir -p ../recording/package-audit/tooling
+          nfpm_releases=https://github.com/goreleaser/nfpm/releases
+          curl --fail --silent --show-error --location \
+            "$nfpm_releases/download/v2.37.1/nfpm_2.37.1_Linux_x86_64.tar.gz" \
+            | tar -xz -C ../recording/package-audit/tooling nfpm
+
+      - name: Build and inspect DEB, RPM, and Arch metadata
+        working-directory: capglyph-cli
+        env:
+          NFPM: ${{ github.workspace }}/recording/package-audit/tooling/nfpm
+        run: ./scripts/test-package-metadata.sh ../recording/package-audit/ci
+
   test:
     name: Test & Lint
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -24,12 +24,12 @@ jobs:
           - os: ubuntu-latest
             target: x86_64-unknown-linux-gnu
             artifact_name: capglyph-linux-x86_64
-            arch: amd64
+            arch: x86_64
             os_name: linux
           - os: ubuntu-24.04-arm
             target: aarch64-unknown-linux-gnu
             artifact_name: capglyph-linux-aarch64
-            arch: arm64
+            arch: aarch64
             os_name: linux
           - os: windows-latest
             target: x86_64-pc-windows-msvc
@@ -101,19 +101,23 @@ jobs:
       - name: Package for Linux distributions (nfpm)
         if: matrix.os_name == 'linux'
         run: |
-          if [ "${{ matrix.arch }}" = "arm64" ]; then
-            NFPM_ARCH="arm64"
-            PKG_ARCH="aarch64"
+          set -euo pipefail
+          if [ "${{ matrix.arch }}" = "aarch64" ]; then
+            nfpm_download_arch=arm64
           else
-            NFPM_ARCH="x86_64"
-            PKG_ARCH="x86_64"
+            nfpm_download_arch=x86_64
           fi
-          curl -sL https://github.com/goreleaser/nfpm/releases/download/v2.37.1/nfpm_2.37.1_Linux_${NFPM_ARCH}.tar.gz | tar xz nfpm
-          sed -i "s/amd64/${NFPM_ARCH}/g" nfpm.yaml
-          sed -i "s/capglyph-linux-x86_64/${{ matrix.artifact_name }}/g" nfpm.yaml
-          ./nfpm pkg --packager deb --target capglyph-linux-${PKG_ARCH}.deb
-          ./nfpm pkg --packager rpm --target capglyph-linux-${PKG_ARCH}.rpm
-          ./nfpm pkg --packager archlinux --target capglyph-linux-${PKG_ARCH}.pkg.tar.zst
+          audit_dir="../recording/package-audit/native-${{ matrix.arch }}"
+          mkdir -p "$audit_dir/tooling"
+          nfpm_releases=https://github.com/goreleaser/nfpm/releases
+          curl --fail --silent --show-error --location \
+            "$nfpm_releases/download/v2.37.1/nfpm_2.37.1_Linux_${nfpm_download_arch}.tar.gz" \
+            | tar -xz -C "$audit_dir/tooling" nfpm
+          NFPM="$audit_dir/tooling/nfpm" ./scripts/package-linux.sh \
+            "$GITHUB_REF_NAME" \
+            "${{ matrix.arch }}" \
+            "${{ matrix.artifact_name }}" \
+            "$audit_dir/packages"
 
       - name: Upload artifact
         # v5 runs on the Node24 runtime; v4.x still declares node20 and
@@ -124,9 +128,9 @@ jobs:
           path: |
             capglyph-cli/${{ matrix.artifact_name }}.tar.gz
             capglyph-cli/${{ matrix.artifact_name }}.zip
-            capglyph-cli/*.deb
-            capglyph-cli/*.rpm
-            capglyph-cli/*.pkg.tar.zst
+            recording/package-audit/native-${{ matrix.arch }}/packages/*.deb
+            recording/package-audit/native-${{ matrix.arch }}/packages/*.rpm
+            recording/package-audit/native-${{ matrix.arch }}/packages/*.pkg.tar.zst
 
   release-github:
     name: Create GitHub Release

Cargo.toml

@@ -36,7 +36,7 @@ image = { version = "0.25", default-features = false, features = ["png", "jpeg"]
 # NOTE: the `vectomancy` facade is intentionally NOT a dependency — capglyph only
 # uses vectomancy-raster + vectomancy-geometry, and the facade pulls tera/zip/
 # flate2/rand into the wasm graph for nothing.
-# Isolated layout: `capglyph-cli` expects `../vectomancy` sibling (CI: `sigil` + `vectomancy`
+# Isolated layout: `capglyph-cli` expects `../vectomancy` sibling (CI: `capglyph-cli` + `vectomancy`
 # siblings; local: symlink `/capglyph/vectomancy -> /vectomancy/vectomancy`).
 vectomancy-raster = { path = "../vectomancy/crates/vectomancy-raster", version = "8.1.0" }
 vectomancy-geometry = { path = "../vectomancy/crates/vectomancy-geometry", version = "8.1.0" }