Harden M9: Ed25519 attestation, full SHA-256 integrity, locked-by-default, prompt improvements, registry verification

README.md

@@ -123,6 +123,7 @@ Opens the graphical interface where you can create and manage tools visually. Fe
 - **My Tools** - Browse, create, edit, and delete tools organized by category
 - **Registry** - Search and install community tools from the CmdForge registry
 - **Providers** - Manage AI provider configurations
+- **Reuse & Discovery** - Compare similar tools and preview safe extraction of reusable steps
 
 ### CLI Mode
 
@@ -178,10 +179,26 @@ cmdforge settings mytool diff         # Show changes from defaults
 cmdforge config show                  # Show current config
 cmdforge config connect username      # Connect to registry account
 cmdforge config disconnect            # Disconnect from registry
+
+# Private, local pipeline suggestions (disabled by default)
+cmdforge usage enable                 # Begin recording tool names in shell pipes
+cmdforge usage suggestions            # Show frequent pipelines
+cmdforge usage clear                  # Delete all local usage history
+
+# Model Context Protocol (optional: pip install -e ".[mcp]")
+cmdforge mcp add local --command npx --arg=-y --arg @scope/server
+cmdforge mcp add remote --transport streamable-http --url https://example.com/mcp
+cmdforge mcp connect remote
+cmdforge mcp serve                    # Expose approved tools over stdio
+cmdforge mcp serve --transport streamable-http  # Loopback-only HTTP by default
 ```
 
 `cf` searches the public registry when no local tool matches. Registry results
 show available relevance and quality evidence and install on selection.
+When local pipeline discovery is explicitly enabled, `cf` also suggests
+frequently repeated pipe pairs. Only tool names, anonymous pipe identifiers,
+counts, and timestamps are kept in `~/.cmdforge/usage.json`; command arguments
+and input/output content are never recorded or transmitted.
 
 ### Running Tools
 
@@ -664,6 +681,9 @@ cmdforge registry search --owner official --min-downloads 100
 # Connect your account (opens browser for authentication)
 cmdforge config connect yourusername
 
+# Create an Ed25519 release key and register its public half
+cmdforge registry signing-key init
+
 # Publish a tool
 cmdforge registry publish mytool
 
@@ -678,6 +698,51 @@ cmdforge registry status --sync
 ```
 
 Published tools go through moderation before appearing publicly. You'll receive feedback if changes are requested.
+Once a signing key is registered, publishing signs the transitive content
+identity automatically. The registry rejects unsigned or invalid releases and
+clients verify the signature before installing. The private key remains in
+`~/.cmdforge/release-signing-key.json` with `0600` permissions.
+
+### Prompt Optimization
+
+Generate local deterministic prompt variations without contacting a provider:
+
+```bash
+cmdforge optimize summarize -n 5
+```
+
+Structural contract checks cannot rank prompt meaning, so CmdForge will not
+claim a winning variation unless explicit behavioral cases are supplied:
+
+```json
+[
+  {"input": "A long input", "contains": "summary"},
+  {"input": "Another input", "expected": {"result": "expected value"}}
+]
+```
+
+```bash
+cmdforge optimize summarize --behavior-tests behavior.json \
+  --test-provider opencode-pickle
+```
+
+Behavior tests execute every candidate and may incur provider cost. Use
+`--provider NAME` separately when you explicitly want a provider to generate a
+rephrased candidate.
+
+### Community Improvements
+
+```bash
+cmdforge registry improve owner/tool 1.0.0 0 proposed-prompt.txt \
+  --rationale "Clearer output requirement"
+cmdforge registry review-improvement 42 approve --notes "Tests pass"
+# Apply the approved text, bump the tool version, then publish it:
+cmdforge registry publish mytool --improvement-id 42
+```
+
+Submissions are auto-tested before review. Contributor credit and the
+`optimized`/`community-reviewed` badges are awarded only when a published
+version actually contains the approved change.
 
 ### Tool Documentation
 
@@ -750,6 +815,10 @@ The graphical interface provides a modern desktop experience:
 
 ### Tool Builder
 - Visual form for creating and editing tools
+- Reuse & Discovery panel with asynchronous registry similarity results,
+  exact local reuse evidence, and opt-in pipeline suggestions
+- Extraction creates a separate tool only after showing a unified diff; the
+  current draft is never rewritten automatically
 - Add arguments with flags and default values
 - Add prompt steps (AI calls) with profile selection
 - Add code steps with **AI-assisted code generation**: