Fix/npm audit vulnerabilities

.github/workflows/ci.yml

@@ -231,6 +231,10 @@ jobs:
         run: npm run command-registry:check
         continue-on-error: false
 
+      - name: Validate discovery index
+        run: npm run discovery:check
+        continue-on-error: false
+
       - name: Check unicode safety
         run: node scripts/ci/check-unicode-safety.js
         continue-on-error: false

.github/workflows/supply-chain-watch.yml

@@ -28,10 +28,12 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20.x'
+          cache: 'npm'
 
       - name: Install dependencies without lifecycle scripts
         run: npm ci --ignore-scripts
 
+
       - name: Verify registry signatures and advisories
         run: |
           npm audit signatures
@@ -62,4 +64,4 @@ jobs:
           path: |
             artifacts/supply-chain-ioc-report.json
             artifacts/supply-chain-advisory-sources.json
-          retention-days: 14
+          retention-days: 14

ADOPTERS.md

@@ -0,0 +1,47 @@
+# Adopters
+
+Teams and projects that run ECC in real work. Seeing who else uses a tool is
+usually the last thing someone checks before adopting it, so this page is worth
+keeping current.
+
+Listing is opt-in and self-reported. Nobody is added without asking.
+
+## How to add yourself
+
+Open a pull request that adds one row to the table below, or use the
+[quick feedback form](https://github.com/affaan-m/ECC/issues/new?template=quick-feedback.yml)
+and say you want to be listed.
+
+One row, this shape:
+
+```markdown
+| Organisation or project | Harness | How ECC is used | Contact |
+```
+
+- **Harness** — Claude Code, Codex, Cursor, OpenCode, or several.
+- **How ECC is used** — one sentence. What it replaced is more useful than what it is.
+- **Contact** — a GitHub handle, or `—` if you would rather not.
+
+Only add an organisation you are authorised to speak for.
+
+## Adopters
+
+<!-- Add new rows at the end. Keep them alphabetical by first column. -->
+
+| Organisation or project | Harness | How ECC is used | Contact |
+| ----------------------- | ------- | --------------- | ------- |
+| _Your team could be first._ | | | |
+
+## Partners and sponsors
+
+Distinct from adopters: these organisations fund or partner with the project.
+They are listed in the [README](README.md) and in [SPONSORS.md](SPONSORS.md).
+Sponsorship is not an endorsement of production use, and production use is not
+sponsorship.
+
+## Case studies
+
+Longer write-ups of ECC in a real codebase. If you have published one, link it
+here in the same pull request that adds your row.
+
+- _None yet. If you write one, it will be linked from the README too._

CITATION.cff

@@ -0,0 +1,27 @@
+cff-version: 1.2.0
+title: "ECC: The Agent Harness Operating System"
+message: "If you use ECC in research, writing, or a derived tool, please cite it."
+type: software
+authors:
+  - family-names: Mustafa
+    given-names: Affaan
+    website: "https://x.com/affaan"
+repository-code: "https://github.com/affaan-m/ECC"
+url: "https://ecc.tools"
+abstract: >-
+  ECC is an MIT-licensed agent harness operating system for coding agents such
+  as Claude Code, Codex, Cursor, and OpenCode. It installs a repeatable
+  engineering loop - plan, test, implement, review, verify, remember, improve -
+  as skills, agents, commands, hooks, and rules, together with the AgentShield
+  scanner for prompts, hooks, MCP configuration, permissions, and secrets.
+keywords:
+  - ai-agents
+  - agent-harness
+  - claude-code
+  - developer-tools
+  - llm
+  - mcp
+  - software-engineering
+license: MIT
+version: 2.2.0
+date-released: "2026-08-28"

CONTRIBUTING.md

@@ -5,6 +5,7 @@ Thanks for wanting to contribute! This repo is a community resource for Claude C
 ## Table of Contents
 
 - [What We're Looking For](#what-were-looking-for)
+- [Your First Contribution](#your-first-contribution)
 - [Quick Start](#quick-start)
 - [Contributing Skills](#contributing-skills)
 - [Skill Adaptation Policy](#skill-adaptation-policy)
@@ -48,6 +49,33 @@ Slash commands that invoke useful workflows:
 
 ---
 
+## Your First Contribution
+
+You do not need to understand the whole repository to help. These are scoped so
+that reading one directory is enough.
+
+- **[good first issue](https://github.com/affaan-m/ECC/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22)** — scoped on purpose. Comment on one to claim it.
+- **A missing test.** Anything in `scripts/lib/` without a matching file in `tests/lib/` is fair game.
+- **A translation.** `docs/<locale>/` pages drift behind the English ones.
+- **An adopter row.** If you run ECC, add yourself to [ADOPTERS.md](ADOPTERS.md).
+- **A broken instruction.** If a step in the README failed for you, the fix to that step is a real contribution.
+
+### What to expect after you open a pull request
+
+- Triage within one business week: merged, changes requested, or closed with a
+  reason. Security reports are handled first and jump the queue.
+- Automated checks run first. A red build is the most common reason a review
+  stalls, so run `node tests/run-all.js` locally before pushing.
+- If a week passes with no response, comment on the thread. That is a useful
+  nudge, not noise.
+
+Questions that are not yet a pull request belong in
+[Q&A discussions](https://github.com/affaan-m/ECC/discussions/categories/q-a) or
+[Discord](https://discord.gg/36yGMHGFbR). See [SUPPORT.md](SUPPORT.md) for the
+full routing.
+
+---
+
 ## Quick Start
 
 ```bash