diff --git a/.empirical/capabilities/plugin-git-distribution/spec.md b/.empirical/capabilities/plugin-git-distribution/spec.md
new file mode 100644
index 0000000..4c9acc3
--- /dev/null
+++ b/.empirical/capabilities/plugin-git-distribution/spec.md
@@ -0,0 +1,52 @@
+# Plugin Git Distribution Specification
+
+## Purpose
+
+Define the shared active distribution boundary for repository plugins whose
+installable releases live in Git rather than the npm registry.
+
+## Requirements
+
+### Requirement: Active Git-only install surfaces
+
+Taskboard and Usage Tracker SHALL expose only BB Community and immutable Git
+release sources in current user-facing documentation, automation, and
+marketplace metadata. Their workspaces SHALL be private and SHALL omit npm
+publication configuration and hooks.
+
+#### Scenario: Audit current distribution surfaces
+
+- **WHEN** active README, changelog, manifest, CI, config, and marketplace files
+  are searched for either plugin's former registry source
+- **THEN** no npm package badge, package URL, `npm:` plugin source, publish or
+  unpublish command, publishing token/config, or npm marketplace source remains
+- **AND** both documented install paths resolve through BB Community or the
+  plugin's public Git tag range
+
+### Requirement: Preserve Git-build package tooling
+
+Git-only distribution SHALL retain the package manifests, stable package names,
+workspace/lockfile dependency graph, source entry points, and package-manager
+development commands required to install dependencies, build, test, and derive
+BB plugin identity.
+
+#### Scenario: Distinguish tooling from distribution
+
+- **WHEN** an active audit encounters `package.json`, lockfile package records,
+  `@get-bb/plugin-sdk`, or npm install/run development commands
+- **THEN** those build and identity contracts remain intact
+- **AND** none is treated as evidence that either plugin is published to npm
+
+### Requirement: Preserve distribution history
+
+Historical Empirical records SHALL retain their accurate npm attempt,
+publication, failure, deletion, and migration evidence while current install
+surfaces remain Git-only.
+
+#### Scenario: Complete a current cleanup
+
+- **WHEN** stale active distribution copy is removed
+- **THEN** immutable historical specifications, receipts, and release artifacts
+  remain byte-valid
+- **AND** the current repository clearly separates history from supported
+  installation paths
diff --git a/.empirical/capabilities/taskboard-distribution/spec.md b/.empirical/capabilities/taskboard-distribution/spec.md
index 43ffa61..d34ef7f 100644
--- a/.empirical/capabilities/taskboard-distribution/spec.md
+++ b/.empirical/capabilities/taskboard-distribution/spec.md
@@ -6,32 +6,28 @@ Define reproducible, immutable Taskboard release and marketplace provenance.
 
 ## Requirements
 
-### Requirement: Immutable npm release
+### Requirement: Marketplace range alignment
 
-Every Taskboard release SHALL bind one package version, reviewed Git commit,
-plugin-specific annotated Git tag, verified npm archive, and GitHub release
-without moving or replacing an existing version or tag. The real archive SHALL
-be created with scripts disabled, inspected, identified by a recorded SHA-256,
-rechecked immediately before publishing that exact file with lifecycle scripts
-disabled, and published with credentials scoped to that one process.
+The BB Community Taskboard entry SHALL reference the public Git repository,
+plugin subdirectory, semver range, and Taskboard tag prefix that resolve the
+current immutable Git release while preserving listing identity.
 
-#### Scenario: Prepare Taskboard 0.3.0 after review fixes
+#### Scenario: Resolve the marketplace release
 
-- **WHEN** the final product source differs from an earlier candidate archive
-- **THEN** Taskboard rebuilds and replaces the local candidate with a newly
-  inspected archive derived from the final source
-- **AND** exact-version npm absence, archive SHA-256, and Git tag absence are
-  reconfirmed before remote approval
+- **WHEN** the marketplace validates Taskboard range `^0.3.0`
+- **THEN** it resolves `taskboard/v0.3.0` from the public repository
+- **AND** marketplace build and Git-source liveness checks pass without npm
 
-### Requirement: Marketplace range alignment
+### Requirement: Immutable Git release
 
-The BB Community Taskboard entry SHALL reference a published npm semver range
-that resolves the current release while preserving listing identity. Before a
-marketplace push, verification SHALL assert the exact package version is public
-in addition to running the marketplace's package-level liveness check.
+Every Taskboard release SHALL bind one reviewed Git commit, one immutable
+`taskboard/vX.Y.Z` annotated tag, and one GitHub Release. A Taskboard workspace
+SHALL be marked private/non-publishable and SHALL omit npm publication,
+packaging, and prepack configuration.
 
-#### Scenario: Publish before marketplace submission
+#### Scenario: Install Taskboard 0.3.0 directly
 
-- **WHEN** `bb-plugin-taskboard@0.3.0` is published
-- **THEN** an exact-version registry query returns `0.3.0`
-- **AND** marketplace build/liveness checks pass before its branch is pushed
+- **WHEN** a user installs Git range `^0.3.0` with subdirectory
+  `plugins/taskboard` and tag prefix `taskboard/`
+- **THEN** BB resolves public tag `taskboard/v0.3.0` and its immutable commit
+- **AND** builds the plugin from the reviewed Git source
diff --git a/.empirical/context/architecture.md b/.empirical/context/architecture.md
index 0a9f099..9349f27 100644
--- a/.empirical/context/architecture.md
+++ b/.empirical/context/architecture.md
@@ -2,7 +2,7 @@
 
 ## Components and ownership
 
-- The root npm workspace fans build, typecheck, test, and check scripts into all
+- The root workspace fans build, typecheck, test, and check scripts into all
   leaf plugins while keeping one lockfile and dependency installation.
 - `plugins/taskboard/server.ts` is the backend composition root. It wires typed
   RPC handlers, project-scoped configuration and credentials, the local cache,
@@ -17,6 +17,9 @@
   `sources/` contains the GitHub, Linear, and Jira adapters behind one interface.
 - `plugins/usage-tracker` is independent and owns its own server, app, provider
   usage model, tests, and assets.
+- Both plugin manifests remain workspace/build manifests but are private.
+  BB resolves releases from the monorepo's plugin-specific Git tags and the
+  corresponding `plugins/taskboard` or `plugins/usage-tracker` subdirectory.
 
 ## Data and control flow
 
diff --git a/.empirical/context/commands.md b/.empirical/context/commands.md
index e9f02fb..a18860e 100644
--- a/.empirical/context/commands.md
+++ b/.empirical/context/commands.md
@@ -8,7 +8,11 @@ Commands below are verified from workspace and plugin manifests.
   or dependency/lockfile change.
 - `bb plugin install ./plugins/taskboard` — register the local Taskboard path in
   BB for live verification.
+- `bb plugin install git:https://github.com/MateoCerquetella/bb-plugins.git@^0.3.0 --subdirectory plugins/taskboard --tag-prefix taskboard/`
+  — install the released Taskboard Git range directly.
 - `bb plugin install ./plugins/usage-tracker` — register Usage Tracker locally.
+- `bb plugin install git:https://github.com/MateoCerquetella/bb-plugins.git@^0.1.2 --subdirectory plugins/usage-tracker --tag-prefix usage-tracker/`
+  — install the released Usage Tracker Git range directly.
 
 ## Run, test, and build
 
@@ -21,7 +25,7 @@ Commands below are verified from workspace and plugin manifests.
 - `npm run typecheck --workspace bb-plugin-taskboard` and
   `npm test --workspace bb-plugin-taskboard` — focused Taskboard iteration.
 - `npm run check --workspace bb-plugin-taskboard` — Taskboard SDK-type check,
-  typecheck, tests, build, and packed-output verification.
+  typecheck, tests, build, and build-metadata verification.
 - `npm run types:refresh --workspace bb-plugin-taskboard` followed by
   `npm install` — deliberate SDK declaration pin refresh when the minimum BB
   release changes.
diff --git a/.empirical/context/conventions.md b/.empirical/context/conventions.md
index bb52ada..116b435 100644
--- a/.empirical/context/conventions.md
+++ b/.empirical/context/conventions.md
@@ -3,7 +3,7 @@
 ## Code and structure
 
 - New independently installable plugins live at `plugins/<id>` and must be
-  added to the root npm workspaces, `.bb/plugins.json`, and README catalog.
+  added to the root workspaces, `.bb/plugins.json`, and README catalog.
 - Keep plugin IDs, package names, CLI commands, realtime channels, persisted
   keys, schemas, tests, and documentation aligned.
 - Manifest `bb.server` and `bb.app` entries point to source files. Never repoint
diff --git a/.empirical/context/index.md b/.empirical/context/index.md
index b8a4ece..83eb5eb 100644
--- a/.empirical/context/index.md
+++ b/.empirical/context/index.md
@@ -4,9 +4,9 @@
 Generated from bounded repository metadata.
 
 - Repository: bb-plugins-taskboard-dev
-- Source fingerprint: sha256:7eec076fe90c5cbc57984cfab992ac000553c42d3a1d7cc5242ae43e45775857
-- Included files: 95
-- Roots: .agents, .bb, .claude, .codex, .cursor, .gemini, .github, ., .windsurf, demos, plugins
+- Source fingerprint: sha256:ff6a92e5f69bcf805c3c47999eac4debf8e23d0aac79020c98063858c6f4107a
+- Included files: 96
+- Roots: .agents, .bb, .claude, .codex, .cursor, .gemini, ., .github, .windsurf, demos, plugins
 - Manifests: package.json, plugins/taskboard/package.json, plugins/usage-tracker/package.json
 - Primary docs: README.md, plugins/taskboard/README.md, plugins/usage-tracker/README.md
 
diff --git a/.empirical/context/manifest.json b/.empirical/context/manifest.json
index eaf3401..d30e1e2 100644
--- a/.empirical/context/manifest.json
+++ b/.empirical/context/manifest.json
@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "generator": "empirical-0.28.0",
-  "sourceDigest": "sha256:7eec076fe90c5cbc57984cfab992ac000553c42d3a1d7cc5242ae43e45775857",
+  "sourceDigest": "sha256:ff6a92e5f69bcf805c3c47999eac4debf8e23d0aac79020c98063858c6f4107a",
   "files": [
     {
       "path": ".agents/skills/empirical/SKILL.md",
@@ -33,6 +33,11 @@
       "size": 137,
       "digest": "sha256:58b7bc1fef265b214425ef17eeb67f9f9ad687e049cc8d65c368c01ef5bb8780"
     },
+    {
+      "path": ".gitattributes",
+      "size": 46,
+      "digest": "sha256:cf68cdd8225ec7d3dd5a0f92ac62c7e328f87c47f09786c55b46d114c9611879"
+    },
     {
       "path": ".github/workflows/ci.yml",
       "size": 868,
@@ -48,11 +53,6 @@
       "size": 119,
       "digest": "sha256:a4d50e5110c610d398e04657e81a2c2db9328cd131f5c28995aaf4e213a9c90b"
     },
-    {
-      "path": ".npmrc.publish",
-      "size": 46,
-      "digest": "sha256:38f7c43d9982d5d29e3c1cd7e2ab727600c75c2e0530cbf1e18c21629b48915a"
-    },
     {
       "path": ".windsurf/skills/empirical/SKILL.md",
       "size": 5967,
@@ -80,13 +80,13 @@
     },
     {
       "path": "README.md",
-      "size": 4888,
-      "digest": "sha256:578f6f3a02396d20ee6bcfbdff2ba2370f1086e2fc1c893e3e25340b4a0becb0"
+      "size": 5086,
+      "digest": "sha256:2b01d7ec7cc19e0200f5395e6a24b2166bae872b7ee2b53701c1a883ebe2d681"
     },
     {
       "path": "THIRD_PARTY_NOTICES.md",
-      "size": 887,
-      "digest": "sha256:35749c2f47e8a002ea1a8738113450a53645887ab66acdb9b136109eec4b54fa"
+      "size": 895,
+      "digest": "sha256:5e95975f6ee89b0997521cecdad9d8045000b87077dbd9f8cf3282bf0b227f0c"
     },
     {
       "path": "demos/taskboard-create-issue.html",
@@ -96,7 +96,7 @@
     {
       "path": "package-lock.json",
       "size": 211341,
-      "digest": "sha256:23d8b8c9d50bf1c22df8756b246d40a282837bbe18c9bdf972e982387bba1bb4"
+      "digest": "sha256:92dbb8a6582ff3b1116f6056c03f163bbc42f8dce3d0695ce0b68716e7891a58"
     },
     {
       "path": "package.json",
@@ -110,13 +110,13 @@
     },
     {
       "path": "plugins/taskboard/README.md",
-      "size": 10574,
-      "digest": "sha256:0ece1a7aa70f7f4f9c914a4698d77ce3669f8765b148f8a5b0864f1d505f929d"
+      "size": 10657,
+      "digest": "sha256:e49d179da5fc15f6b7ba2bf7c654a4ee4d0f0b2a042311258c8d2e8545f8db47"
     },
     {
       "path": "plugins/taskboard/THIRD_PARTY_NOTICES.md",
-      "size": 373,
-      "digest": "sha256:41c73319f93c7df72d2ea21252836cdb7656b4944c6b4dd0805233ae98399f90"
+      "size": 381,
+      "digest": "sha256:fdf9fd8a0a3b50d2cc0d637dbb2422fd09c49db8bdebd00ae6bf4bdf5e30020d"
     },
     {
       "path": "plugins/taskboard/app.css",
@@ -125,8 +125,8 @@
     },
     {
       "path": "plugins/taskboard/app.tsx",
-      "size": 216129,
-      "digest": "sha256:9fd7f5200b442a04b977d4ce679a90828205737955867f03e7e279060daa249b"
+      "size": 216411,
+      "digest": "sha256:d9ff669f5363b241fc38f6cfdb374f2779fdd3048b4b774fd2528ab0b3a368f2"
     },
     {
       "path": "plugins/taskboard/assets/icon.svg",
@@ -140,8 +140,8 @@
     },
     {
       "path": "plugins/taskboard/browse-preferences.ts",
-      "size": 18960,
-      "digest": "sha256:9d43c41f07dd7816c0ed7219425b44f352cf1fb0b3a4844553ee200d29bf5a3b"
+      "size": 18911,
+      "digest": "sha256:8bb6f6cf35e500430dfe21e10bd15db68d2543d52fe10e3d4041991f59899a26"
     },
     {
       "path": "plugins/taskboard/browse.ts",
@@ -250,13 +250,13 @@
     },
     {
       "path": "plugins/taskboard/contract.ts",
-      "size": 15611,
-      "digest": "sha256:be526fef6ac969c5a5bf1c238e2876afc9cfe57c6e5c8e42b8edb3ef4004356c"
+      "size": 16418,
+      "digest": "sha256:58ab4008601b064136962ebcf4573f6f19b60b7c44ce97bb19f8aed1a727e38b"
     },
     {
       "path": "plugins/taskboard/create-issue.ts",
-      "size": 1183,
-      "digest": "sha256:73dcb0b4bc8c997e0c6bce8342e79a22b21b5d8a6becdb044bf1d23dde2dccf3"
+      "size": 1553,
+      "digest": "sha256:a8890400be739b897eebee623b5b67a37cb7075b091193ce6c6eef026d1c5018"
     },
     {
       "path": "plugins/taskboard/hooks/useBrowserDimmingModal.ts",
@@ -280,8 +280,8 @@
     },
     {
       "path": "plugins/taskboard/package.json",
-      "size": 2947,
-      "digest": "sha256:ad4de5e4ae2ed389927ebff98c69c189a495f3c2a5de85fe71e6c948a44044f0"
+      "size": 2292,
+      "digest": "sha256:9e8baf16c8ec46d1ef6c2a51e2b30d1ac802ad77ef7ed2e94e940dd025ab42b6"
     },
     {
       "path": "plugins/taskboard/project-selection.ts",
@@ -295,13 +295,13 @@
     },
     {
       "path": "plugins/taskboard/server.ts",
-      "size": 80994,
-      "digest": "sha256:a3c0435ffbd6d26cf9e45b8907937e1de1d172b3b03edb8972b56bde6b4b8c2a"
+      "size": 81420,
+      "digest": "sha256:489f0d029402698304d23467e1b81a1630f9afcd775347ad584132bce736cfb5"
     },
     {
       "path": "plugins/taskboard/sources/github.ts",
-      "size": 17057,
-      "digest": "sha256:a9c64f03a2b06d36061e78deb05fa1213626b5265956c8b45db97cd1f131354c"
+      "size": 17116,
+      "digest": "sha256:b187d990a7ad8b4fe3791ae4158b49d1501d307951ae0566d77c23b1f95ef6ac"
     },
     {
       "path": "plugins/taskboard/sources/jira-scope.ts",
@@ -310,18 +310,18 @@
     },
     {
       "path": "plugins/taskboard/sources/jira.ts",
-      "size": 22925,
-      "digest": "sha256:b6be203edb6225003ce0dbf3c6ce11732fa2157a4a04e6b0553a77fcb2ef724f"
+      "size": 23194,
+      "digest": "sha256:17e1173a20a7ef7ec9ac5f070cb81a0d4e104563d630343c2a2b80540b96fc93"
     },
     {
       "path": "plugins/taskboard/sources/linear.ts",
-      "size": 19580,
-      "digest": "sha256:e83f97802cfb2ec9d706deee4b3802a708592b098ea85dc06da4ebbc7a1f94a7"
+      "size": 19640,
+      "digest": "sha256:83437de923c42a81dcc446b587dfe21bf04fa49edd8109d52ebf484e420a5265"
     },
     {
       "path": "plugins/taskboard/sources/types.ts",
-      "size": 1662,
-      "digest": "sha256:23ec12606c18e596319b8c0903dfabe041631c75c5b20b983a8ac716a08c642f"
+      "size": 1694,
+      "digest": "sha256:879ad494bea24aedeb102fd9dc5ff0e581168e297dda2e41971f2b0dfd98dc17"
     },
     {
       "path": "plugins/taskboard/store.ts",
@@ -330,13 +330,13 @@
     },
     {
       "path": "plugins/taskboard/test/app-ui.test.ts",
-      "size": 6669,
-      "digest": "sha256:f706051aef557110cefbb0194dcff2f83b0a585b929849b989512e711549d185"
+      "size": 6827,
+      "digest": "sha256:b30785467f38c82749a7e7efab5fa67c1d43985da086517c2a96994bf95c9ce0"
     },
     {
       "path": "plugins/taskboard/test/browse-preferences.test.ts",
-      "size": 15921,
-      "digest": "sha256:af281ad81fbabe93d355541ddcc0ac4eae0a20ed48e9b1851417bd104ec759f8"
+      "size": 16704,
+      "digest": "sha256:f71c5ffdbb0870f86832a7a3b577c217f71aadc2dff49e83117cdcad65c9d540"
     },
     {
       "path": "plugins/taskboard/test/browse.test.ts",
@@ -345,13 +345,18 @@
     },
     {
       "path": "plugins/taskboard/test/contract.test.ts",
-      "size": 11252,
-      "digest": "sha256:449dd9fc28c9eea7d3c9963ceedb9002a815bc8ffbde3392c156d157372a9413"
+      "size": 12579,
+      "digest": "sha256:5a169c5fef534c957845fa960674a28034a5fcead794c4f28aedf54b9e0d038e"
     },
     {
       "path": "plugins/taskboard/test/create-metadata.test.ts",
-      "size": 42871,
-      "digest": "sha256:ba6de4d8a73dc99c5c4db4232747de1aabc9e556d0d4e32901ed75afd3edd6af"
+      "size": 49321,
+      "digest": "sha256:1b9a2dd3421057117ff6a3df284c1fbffb7f281d29259260dc64b3931bbcffd8"
+    },
+    {
+      "path": "plugins/taskboard/test/distribution.test.ts",
+      "size": 5738,
+      "digest": "sha256:f38909df86e53a0851c06b3f14842050ea0b0f9c664151fda62bf04d96bfd3d7"
     },
     {
       "path": "plugins/taskboard/test/issue-draft.test.ts",
@@ -365,8 +370,8 @@
     },
     {
       "path": "plugins/taskboard/test/source-types.test.ts",
-      "size": 3505,
-      "digest": "sha256:3f0641b5835fe438faee98b361b4d6ce0a54b2f9c2c37f0a46c09af338dd48b7"
+      "size": 4509,
+      "digest": "sha256:5438a37d364f00d136bf087085e300757a21d697c6137fefbb5e382995e5a6cc"
     },
     {
       "path": "plugins/taskboard/test/theme-css.test.ts",
@@ -380,8 +385,8 @@
     },
     {
       "path": "plugins/usage-tracker/CHANGELOG.md",
-      "size": 967,
-      "digest": "sha256:74f3089728634423b3429ed71880066025fb5d68a10fa692a7731bb3ee668afd"
+      "size": 979,
+      "digest": "sha256:7482a3514bb1ff745b689c622f7c9d928fde1ced493dfd8b1bf049dcb0918bc6"
     },
     {
       "path": "plugins/usage-tracker/LICENSE",
@@ -390,8 +395,8 @@
     },
     {
       "path": "plugins/usage-tracker/README.md",
-      "size": 4335,
-      "digest": "sha256:f6c82295efbd5459c1c38d70d3ab9c4d3d9ef292770e37e8c5d5aac290089014"
+      "size": 4365,
+      "digest": "sha256:3edf3d931c5d3c40d4a712ad0797ae8d960cf51a7e0f32af4524e86725b429e2"
     },
     {
       "path": "plugins/usage-tracker/THIRD_PARTY_NOTICES.md",
@@ -455,8 +460,8 @@
     },
     {
       "path": "plugins/usage-tracker/package.json",
-      "size": 2147,
-      "digest": "sha256:4e07623474e9d32249a6f8976c7629eec2991a45aa3bb5a5966bc10fb273edc1"
+      "size": 1761,
+      "digest": "sha256:4f4e93a16a6726067f6fe150cdf6b518205d4bd769c2c812a7057d588049bb11"
     },
     {
       "path": "plugins/usage-tracker/server.ts",
@@ -491,10 +496,10 @@
         ".codex/config.toml",
         ".cursor/mcp.json",
         ".gemini/settings.json",
+        ".gitattributes",
         ".github/workflows/ci.yml",
         ".gitignore",
         ".mcp.json",
-        ".npmrc.publish",
         ".windsurf/skills/empirical/SKILL.md",
         "AGENTS.md",
         "CLAUDE.md",
@@ -555,6 +560,7 @@
         "plugins/taskboard/test/browse.test.ts",
         "plugins/taskboard/test/contract.test.ts",
         "plugins/taskboard/test/create-metadata.test.ts",
+        "plugins/taskboard/test/distribution.test.ts",
         "plugins/taskboard/test/issue-draft.test.ts",
         "plugins/taskboard/test/project-selection.test.ts",
         "plugins/taskboard/test/source-types.test.ts",
@@ -581,8 +587,8 @@
         "plugins/usage-tracker/tsconfig.json",
         "plugins/usage-tracker/types/css-modules.d.ts"
       ],
-      "sourceDigest": "sha256:7eec076fe90c5cbc57984cfab992ac000553c42d3a1d7cc5242ae43e45775857",
-      "digest": "sha256:12c14036c9907ab37a5b3d0f4fa5b986ca6b9df0d91fde06e566855bce230217",
+      "sourceDigest": "sha256:ff6a92e5f69bcf805c3c47999eac4debf8e23d0aac79020c98063858c6f4107a",
+      "digest": "sha256:c5c71cc34993e8da9519edf65b1699450f8c87ffda5c6e2dc6e543d76318c0c7",
       "freshness": "fresh"
     },
     {
@@ -599,8 +605,8 @@
         "plugins/usage-tracker/README.md",
         "plugins/usage-tracker/package.json"
       ],
-      "sourceDigest": "sha256:a19baf68e7a7d58b3ae8fa51ea2ff9df02c66aeeb94685f80cd0782cfe11d058",
-      "digest": "sha256:c1bfd20add5828cd50b53af55ddb5b64d4267a18fe767fe9f295823a4768b97b",
+      "sourceDigest": "sha256:8139ea0e7f2220d2a16e15bf5b31768dd145c32611c66aeb93ecb96501e5b2fd",
+      "digest": "sha256:a9bd0fd5e0b162e48c773426b0c9961f9167f9f8d0ee03cfb382a0654813bb8d",
       "freshness": "fresh"
     },
     {
@@ -612,8 +618,8 @@
         "plugins/taskboard/package.json",
         "plugins/usage-tracker/package.json"
       ],
-      "sourceDigest": "sha256:b1bbe01d3cb944ea4b43931db78b78ee36088535f631bd8629e41491c0d9375c",
-      "digest": "sha256:cf35569f39859940f71f035ff9e93a78f5221e0329dc3e93731f3382dc6bd6a2",
+      "sourceDigest": "sha256:8e005d80d64134d5f78533f6002ac5644f1f40fa86c48f9bdbc416bd2510f3d5",
+      "digest": "sha256:cf82e0cf94d6cb2044468bd950f9805bab3ab4b1347561692d336010e7591b5f",
       "freshness": "fresh"
     },
     {
@@ -626,8 +632,8 @@
         "plugins/taskboard/package.json",
         "plugins/usage-tracker/package.json"
       ],
-      "sourceDigest": "sha256:341e22cf930ff184c0baf4d28afb25385cfceb248e47bf853b8a4f06d7c8ab19",
-      "digest": "sha256:6237386d2e8cd12ac314b621773f434a70b4d5baefe6f9a986912243839f1bb5",
+      "sourceDigest": "sha256:b00902a698009e18b58a42805310a896f4ea4f9c1d21042b30d489ec633fd42b",
+      "digest": "sha256:601da84236499161d67caf1b277f1d516c110e7397572a9e51e850e805946152",
       "freshness": "fresh"
     },
     {
@@ -640,10 +646,10 @@
         "plugins/usage-tracker/tsconfig.json"
       ],
       "sourceDigest": "sha256:3355168fffc08f9379e8832a2a5f1119125404c150234121c20c70691ad41720",
-      "digest": "sha256:da6fa0c52984a71d3f6cb1f78c3872950be99c05e999f93b21154d4e4c45d2f8",
+      "digest": "sha256:d5f54a7cb973d3ce0a2177cbe28318ad7ff76b3d5a29a0108eb5f1cc99b30f9b",
       "freshness": "fresh"
     }
   ],
   "truncated": false,
-  "digest": "sha256:0cb67d1dfa79d9bdca15e0dd6c4f0514470a8847183008c9e44a7a5d27712f5d"
+  "digest": "sha256:083e970c517a9dabaffe1d580ab2eda48ebb9f54ce4e20084c2c6d599b8127d0"
 }
diff --git a/.empirical/context/overview.md b/.empirical/context/overview.md
index e78a82c..da2be38 100644
--- a/.empirical/context/overview.md
+++ b/.empirical/context/overview.md
@@ -2,7 +2,7 @@
 
 ## Purpose
 
-- This npm workspace contains focused plugins for BB, the agent IDE.
+- This workspace contains focused plugins for BB, the agent IDE.
 - Taskboard gives each BB project one GitHub, Linear, or Jira-backed List/Kanban
   board with cached browsing, live detail, status changes, issue creation,
   mentions, CLI access, and agent handoff.
@@ -19,6 +19,9 @@
 - Taskboard selects exactly one external tracker per BB project. Provider APIs
   remain authoritative; Taskboard stores project configuration, credentials,
   cached summaries, sync state, and board preferences.
+- Taskboard and Usage Tracker are private/non-publishable workspaces. They
+  release through immutable plugin-specific Git tags plus the BB Community
+  marketplace.
 - Generated `dist/` and `node_modules/` are build/install products, not authored
   source and are not committed.
 - Empirical tracker integration is explicitly disabled in this checkout, so
@@ -31,5 +34,7 @@
 - Taskboard behavior and package contract: `plugins/taskboard/README.md`,
   `plugins/taskboard/package.json`, `plugins/taskboard/server.ts`, and
   `plugins/taskboard/app.tsx`.
+- Taskboard distribution contract:
+  `.empirical/capabilities/taskboard-distribution/spec.md`.
 - Usage Tracker behavior: `plugins/usage-tracker/README.md` and its manifest.
 - Hosted verification: `.github/workflows/ci.yml`.
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/code-review.md b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/code-review.md
new file mode 100644
index 0000000..db1c2ad
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/code-review.md
@@ -0,0 +1,134 @@
+# Independent Code Review
+
+- Reviewer: code-review
+- Verdict: advisory
+- Source base: `ecc13bee4a275772ac7ac19207056d719da9057a`
+- Scope: complete active Git-only cleanup diff, accepted decisions D-001 through
+  D-003, signed verification, security consult, immutable Empirical history,
+  and the separately prepared marketplace worktree
+
+## Criterion dispositions
+
+### AC-1 — Pass for the reviewed source candidate
+
+The root, Taskboard, and Usage Tracker READMEs contain no npm package badge,
+package URL, `npm:` plugin source, registry install/update command, or registry
+release wording for either plugin. All three document direct Git installation
+with the correct repository, plugin subdirectory, compatible semver floor, and
+plugin-specific tag prefix; BB Community shorthand is explicitly conditional
+on marketplace PR #126 becoming live. Remaining `npm install` and `npm run`
+examples occur only in development/build sections. Taskboard's `^0.3.0` floor
+intentionally admits the prepared 0.3.1 patch release and preserves the already
+public 0.3.0 fallback until the new tag is approved and created.
+
+### AC-2 — Pass
+
+The active Usage Tracker changelog, third-party notices, and generated context
+describe private workspaces, generic third-party dependencies, and Git releases
+without claiming registry distribution. A repository-wide classified search
+found only legitimate npm build/dependency facts in contributor commands, CI
+dependency installation, lockfile records, and focused negative tests. The
+exact `@get-bb/plugin-sdk` development pins remain intact.
+
+### AC-3 — Pass
+
+The root and both plugin manifests are private. Both plugin manifests omit
+`publishConfig`, `files`, and every publication/packing lifecycle hook while
+retaining their source entries and build contracts. No active script invokes
+`npm publish` or `npm unpublish`; `.npmrc.publish` is absent; the local
+credential file is absent; and the sole CI workflow has read-only contents
+permission with no registry URL, publish command, or npm credential variable.
+The deny-only `.npm-publish.env` ignore entry remains appropriate protection
+for legacy clones and is not an active credential or release path.
+
+### AC-4 — Pass for local preparation; remote delivery remains pending
+
+Independent inspection of the marketplace worktree confirms Taskboard uses
+`plugins/taskboard`, range `^0.3.0`, and prefix `taskboard/`, while Usage
+Tracker uses `plugins/usage-tracker`, range `^0.1.2`, and prefix
+`usage-tracker/`; both point at the public monorepo and neither local entry has
+an npm source object. The Usage Tracker entry is still an uncommitted local
+change, remote PR #126 has not yet been expanded to include it, and the live
+catalog remains stale. The verification report states that distinction
+honestly. D-003 and the approved non-goals make source tags, Releases,
+marketplace push, hosted validation, and live catalog correction post-review
+remote gates requiring exact approval; none is claimed as already delivered.
+
+### AC-5 — Pass
+
+Both stable package names, package manifests, root workspaces, lockfile
+workspace/dependency records, source `bb.server`/`bb.app` entries, runtime and
+development dependencies, and npm-backed contributor/CI commands remain
+present. Taskboard stays at 0.3.1 and Usage Tracker at 0.1.2. The cleanup
+therefore removes registry distribution without breaking the package identity
+or dependency installation BB's Git source flow requires.
+
+### AC-6 — Pass
+
+No pre-existing `.empirical/specs/**` path differs from source base
+`ecc13bee4a275772ac7ac19207056d719da9057a`. Independent digest validation of
+every artifact referenced by prior features' final attached collected receipts
+checked 50 artifacts with zero mismatches. Earlier npm publication, failure,
+and deletion records remain accurate immutable history rather than active
+instructions.
+
+### AC-7 — Pass
+
+Signed receipt `executed-780cb49e0b3da2700c7f3e9a`, bound to final product
+tree digest `98f0021522923a8a14a9fb38c650d4123db07b17b0676ffe5babf18c98d0a5b6`,
+records the final root `npm run check`: Taskboard passes SDK checks,
+TypeScript, 89/89 tests, build, and build-metadata validation; Usage Tracker
+passes SDK checks, TypeScript, 13/13 tests, and build. Independent review reran
+the four focused distribution tests and `git diff --check`; both pass. The
+document guard now includes both third-party notices as well as READMEs,
+changelog, and active context. The guards assert semantic manifest,
+documentation, credential/config, and CI invariants while deliberately
+preserving stable build commands and package identity, rather than banning the
+word npm indiscriminately.
+
+## Decision consistency
+
+D-001 is preserved by classifying npm dependency/build tooling separately from
+registry distribution. D-002 is preserved by leaving all prior Empirical
+feature records untouched. D-003 is preserved by reporting the local
+marketplace candidate separately from the stale remote PR and live catalog. No
+implementation choice contradicts an accepted decision or requires a
+superseding entry.
+
+## Finding CR-001: Git release immutability is not enforced
+
+- Severity: medium
+- Category: supply-chain integrity
+- Location: `README.md` Git release statement; `.empirical/context/overview.md`;
+  `design.md` Marketplace boundary; `deltas/plugin-git-distribution.md` Active
+  Git-only install surfaces
+- Recommendation: Before describing the released tags as immutable, add GitHub
+  tag rulesets that block update and deletion for `taskboard/v*` and
+  `usage-tracker/v*`, minimize bypass principals, and make the release procedure
+  fail if an existing remote tag peels to any commit other than the reviewed
+  commit. Until that remote control exists, treat the tags as versioned and
+  annotated but operationally mutable.
+
+This is the same advisory supply-chain risk recorded by the security consult.
+It does not reintroduce an npm distribution path or block integrating the local
+cleanup, but it remains a mandatory release-hardening decision before claiming
+host-enforced immutability.
+
+## Required post-review gates
+
+- Integrate the accepted capability delta and commit the exact reviewed tree.
+  Do not tag source base `ecc13bee4a275772ac7ac19207056d719da9057a`, because
+  the current README, changelog, context, and regression-guard cleanup is still
+  uncommitted on top of it.
+- Obtain exact remote-mutation approval before pushing/merging the source PR,
+  creating `taskboard/v0.3.1` or `usage-tracker/v0.1.2`, creating Releases, or
+  updating marketplace PR #126.
+- After both tags exist, require each peeled tag commit to equal the final
+  reviewed source commit, run full marketplace Git-source liveness, push both
+  Git entries, update the PR title/body and evidence, require hosted validation,
+  and verify the live catalog no longer references either deleted registry
+  package.
+
+No additional blocking, high, medium, or low correctness, documentation,
+manifest identity, buildability, credential, CI/CD, immutable-history, test, or
+npm-distribution finding remains in the reviewed local candidate.
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/security.md b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/security.md
new file mode 100644
index 0000000..e7e84e8
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/security.md
@@ -0,0 +1,11 @@
+# Security Consult
+
+- Specialist: security
+- Verdict: advisory
+
+## Finding SEC-001: Git release immutability is asserted but not enforced
+
+- Severity: medium
+- Category: supply-chain integrity
+- Location: `design.md` Marketplace boundary; `deltas/plugin-git-distribution.md` Active Git-only install surfaces
+- Recommendation: Before treating either Git source as immutable, add a GitHub tag ruleset that blocks updates and deletion for `taskboard/v*` and `usage-tracker/v*`, restrict bypass to the minimum release principal, and make the release procedure fail when an existing remote tag resolves to a different commit. This is the smallest control that prevents a compromised or mistaken maintainer from silently retargeting a version already selected by BB or the marketplace.
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/decisions.md b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/decisions.md
new file mode 100644
index 0000000..d6a2eeb
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/decisions.md
@@ -0,0 +1,104 @@
+# Decisions: Active Git-only Distribution Audit
+
+Record concise, externally reviewable evidence and choices here. Do not store
+private chain-of-thought, prompts, credentials, secrets, or scratchpad text.
+
+## D-001: Separate build tooling from plugin distribution
+
+Status: Accepted
+
+### Evidence
+
+Both plugin manifests are required for BB identity and Git builds. Git installs
+run dependency installation/builds, and the repository's verified development
+commands use npm workspaces. The removed registry packages are not required for
+any of those operations.
+
+### Options
+
+- Delete every npm string, manifest, workspace record, and package command.
+- Remove only registry distribution surfaces while retaining build/identity
+  tooling.
+
+### Chosen approach
+
+Classify by behavior. Remove badges, URLs, `npm:` plugin sources, publishing
+hooks/config/credentials, registry marketplace sources, and distribution copy;
+retain manifests, package names, lockfile records, dependencies, and contributor
+commands.
+
+### Trade-offs and risks
+
+Active files still contain `npm install` and `npm run` because those commands
+are real. Focused guards and clear Git-first install sections prevent that
+tooling from being mistaken for a supported registry source.
+
+### Verification
+
+Repository-wide classified search, manifest/CI assertions, direct Git install
+assertions, private-workspace publish refusals, and root checks.
+
+## D-002: Keep immutable history intact
+
+Status: Accepted
+
+### Evidence
+
+Earlier Empirical specifications, receipts, and release artifacts accurately
+record npm publication, a later EOTP failure, and the user's final website
+deletions. Existing collected receipts bind those files by digest.
+
+### Options
+
+- Rewrite history so no npm reference exists anywhere.
+- Preserve historical records and remove references only from active surfaces.
+
+### Chosen approach
+
+Preserve all prior feature records byte-for-byte. The new shared living
+capability documents the current Git-only boundary without falsifying history.
+
+### Trade-offs and risks
+
+A raw unscoped search still finds historical npm text. Audits must explicitly
+separate immutable history from supported current behavior.
+
+### Verification
+
+Compare tracked historical specification files with the base commit and
+recalculate every historical collected-receipt artifact digest.
+
+## D-003: Treat marketplace deployment as a separate approval gate
+
+Status: Accepted
+
+### Evidence
+
+The local marketplace entries are Git-only, but the remote PR still covers only
+Taskboard and the live catalog still points both entries at deleted registry
+packages. Usage Tracker's Git source cannot pass liveness before its namespaced
+tag exists.
+
+### Options
+
+- Claim the marketplace is fixed from the local edit.
+- Keep local preparation verified, then perform source/tags/Releases and the PR
+  update only after exact remote approval.
+
+### Chosen approach
+
+Keep the remote gate explicit. This feature verifies local source and catalog
+metadata; the approved release sequence must create immutable public tags,
+rerun marketplace liveness, push the catalog change, and update PR #126.
+
+### Trade-offs and risks
+
+Until the PR merges, the public marketplace remains stale even though direct Git
+installation is prepared. Reporting must distinguish local readiness, open PR,
+and live catalog state.
+
+### Verification
+
+Before remote work, record exact account, repository, release commit, versions,
+tags, and commands. After approval, verify peeled tags, Releases, marketplace
+build/check, PR CI, and final live catalog sources.
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/deltas/plugin-git-distribution.md b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/deltas/plugin-git-distribution.md
new file mode 100644
index 0000000..77969c5
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/deltas/plugin-git-distribution.md
@@ -0,0 +1,52 @@
+# Plugin Git Distribution Delta
+
+## Purpose
+
+Define the shared active distribution boundary for repository plugins whose
+installable releases live in Git rather than the npm registry.
+
+## ADDED Requirements
+
+### Requirement: Active Git-only install surfaces
+
+Taskboard and Usage Tracker SHALL expose only BB Community and immutable Git
+release sources in current user-facing documentation, automation, and
+marketplace metadata. Their workspaces SHALL be private and SHALL omit npm
+publication configuration and hooks.
+
+#### Scenario: Audit current distribution surfaces
+
+- **WHEN** active README, changelog, manifest, CI, config, and marketplace files
+  are searched for either plugin's former registry source
+- **THEN** no npm package badge, package URL, `npm:` plugin source, publish or
+  unpublish command, publishing token/config, or npm marketplace source remains
+- **AND** both documented install paths resolve through BB Community or the
+  plugin's public Git tag range
+
+### Requirement: Preserve Git-build package tooling
+
+Git-only distribution SHALL retain the package manifests, stable package names,
+workspace/lockfile dependency graph, source entry points, and package-manager
+development commands required to install dependencies, build, test, and derive
+BB plugin identity.
+
+#### Scenario: Distinguish tooling from distribution
+
+- **WHEN** an active audit encounters `package.json`, lockfile package records,
+  `@get-bb/plugin-sdk`, or npm install/run development commands
+- **THEN** those build and identity contracts remain intact
+- **AND** none is treated as evidence that either plugin is published to npm
+
+### Requirement: Preserve distribution history
+
+Historical Empirical records SHALL retain their accurate npm attempt,
+publication, failure, deletion, and migration evidence while current install
+surfaces remain Git-only.
+
+#### Scenario: Complete a current cleanup
+
+- **WHEN** stale active distribution copy is removed
+- **THEN** immutable historical specifications, receipts, and release artifacts
+  remain byte-valid
+- **AND** the current repository clearly separates history from supported
+  installation paths
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/design.md b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/design.md
new file mode 100644
index 0000000..ed47c68
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/design.md
@@ -0,0 +1,62 @@
+# Active Git-only Distribution Audit Design
+
+## Audit boundary
+
+Treat a reference as stale distribution only when it advertises or automates
+Taskboard or Usage Tracker through the npm registry: package badges and URLs,
+`npm:` plugin sources, publish/unpublish commands, publish credentials/config,
+registry-backed marketplace entries, or copy claiming the plugins ship there.
+
+Retain package manifests, stable package names, workspace and lockfile records,
+`npm install`/`npm run` contributor commands, and the pinned
+`@get-bb/plugin-sdk` dependency. BB derives plugin identity from the package
+name, and Git installs still install dependencies and build source.
+
+## Active documentation cleanup
+
+The root and plugin READMEs already lead with Git semver and conditional BB
+Community installation and contain no former package badge, URL, or `npm:`
+install. Remove the remaining explanatory prose that names npm as a former
+distribution channel where it adds no user value, while retaining explicit
+development commands. Reword Usage Tracker's changelog to describe the SDK as
+a pinned development dependency rather than a "published package" so current
+copy cannot be confused with plugin publication.
+
+Generated Empirical context should describe private workspaces and Git releases
+without calling either plugin an npm package. Command examples remain because
+they are the verified development interface.
+
+## Automation and manifest guard
+
+Extend the focused distribution test to cover the Usage Tracker changelog,
+active context, root manifest, and CI workflow. It should prove both plugin
+manifests are private and publish-hook-free; the root is private; no active
+document contains either retired package URL/source; `.npmrc.publish` is
+absent; CI contains no publish command/token; and both direct Git plus
+marketplace shorthand installs remain documented.
+
+The deny-only `.npm-publish.env` ignore line remains protective hygiene for old
+clones and is not a credential or publication path.
+
+## Marketplace boundary
+
+The narrow marketplace worktree already has both entries converted locally to
+Git sources. Taskboard tracks `^0.3.0` with `taskboard/`; that compatible range
+selects v0.3.1 once public. Usage Tracker tracks `^0.1.2` with
+`usage-tracker/`. The live catalog and PR cannot be fully corrected until exact
+remote approval permits the source PR, immutable tags, Releases, marketplace
+validation, and PR update. No local cleanup pretends that deployment occurred.
+
+## Historical boundary
+
+Do not edit older `.empirical/specs/**` features, their receipts, or publication
+artifacts. They record the true earlier npm workflow and deletion timeline.
+Audit their artifact digests independently and keep current install surfaces
+separate from that immutable history.
+
+## Verification
+
+Run the focused distribution test and root check, repeat the active-file search,
+assert private publish refusals, validate historical artifact digests, and run
+the marketplace schema build. Full marketplace source liveness remains a
+post-tag approval gate.
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/events/00000013.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/events/00000013.json
new file mode 100644
index 0000000..449f3d9
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/events/00000013.json
@@ -0,0 +1,53 @@
+{
+  "schemaVersion": 1,
+  "sequence": 13,
+  "previousDigest": "sha256:e7ead8c744d8d085ce908bd5e885ea515bdf88d5dd8bdee6fb9cc76158681d7e",
+  "actor": "empirical-integrate",
+  "type": "compaction-boundary",
+  "summary": "Compacted through journal event 12",
+  "createdAt": "2026-08-27T00:01:41.254Z",
+  "stateBeforeDigest": "sha256:811aee53b22d8ad90adc714a8ca84665b8e3126b453b35b19bed01f65f081555",
+  "stateAfterDigest": "sha256:811aee53b22d8ad90adc714a8ca84665b8e3126b453b35b19bed01f65f081555",
+  "state": {
+    "schemaVersion": 5,
+    "revision": 12,
+    "activeFeature": "both-npm-packages-have-been-removed-audit-the-entire-active",
+    "request": "Both npm packages have been removed. Audit the entire active repository and remove any remaining npm-distribution references for Taskboard and Usage Tracker from README files and all other active docs, manifests, CI/CD, release scripts, badges, package links, install/update commands, credential/config paths, changelogs, and marketplace-facing metadata, while preserving npm only as build/dependency tooling and preserving immutable historical Empirical records.",
+    "profile": "complex",
+    "workflow": "complex",
+    "mode": "normal",
+    "phase": "done",
+    "status": "done",
+    "repairAttempts": 0,
+    "message": "Integrated capability changes: plugin-git-distribution",
+    "implementationActor": "agent",
+    "specDigest": "sha256:a96a0699d6cf79f628dc59b1ede0dc18589995e7b57c488e6c4cbe91eec3d53b",
+    "approvedSpecRevision": 2,
+    "capabilityArchiveRequired": true,
+    "capabilityDeltaDigest": "sha256:8a20476f30eb171dd9b8f03d402381249d1fdef4ccf77a077b57b6b8baa5f693",
+    "impactDigest": "sha256:0ef2490ec0f0e93898cd2a2844c877df03835199d8011d5476417ab6fdbda821",
+    "capabilityClaimId": "both-npm-packages-have-been-removed-audit-the-entire-active-59becfd36252",
+    "authorizationDigest": null,
+    "evidence": [],
+    "evidenceReceiptIds": [
+      "executed-780cb49e0b3da2700c7f3e9a",
+      "collected-7b1297d79281a01eac8d7751",
+      "collected-d2d38591f510f4ac7e28acad"
+    ],
+    "legacyEvidenceCount": 0,
+    "completion": {
+      "implemented": true,
+      "verified": true,
+      "integrated": true,
+      "delivered": false,
+      "published": false,
+      "highest": "integrated",
+      "reasons": {
+        "delivered": "delivered has not been proven by a durable receipt.",
+        "published": "published has not been proven by a durable receipt."
+      }
+    },
+    "updatedAt": "2026-08-27T00:01:41.238Z"
+  },
+  "digest": "sha256:91b2579b3abfd5da2dbf3cd4f9ecb2acd329750e5c18e475b41f54e347c37c84"
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/events/snapshot.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/events/snapshot.json
new file mode 100644
index 0000000..60009b1
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/events/snapshot.json
@@ -0,0 +1,50 @@
+{
+  "schemaVersion": 1,
+  "feature": "both-npm-packages-have-been-removed-audit-the-entire-active",
+  "lastSequence": 12,
+  "lastEventDigest": "sha256:e7ead8c744d8d085ce908bd5e885ea515bdf88d5dd8bdee6fb9cc76158681d7e",
+  "stateDigest": "sha256:811aee53b22d8ad90adc714a8ca84665b8e3126b453b35b19bed01f65f081555",
+  "state": {
+    "schemaVersion": 5,
+    "revision": 12,
+    "activeFeature": "both-npm-packages-have-been-removed-audit-the-entire-active",
+    "request": "Both npm packages have been removed. Audit the entire active repository and remove any remaining npm-distribution references for Taskboard and Usage Tracker from README files and all other active docs, manifests, CI/CD, release scripts, badges, package links, install/update commands, credential/config paths, changelogs, and marketplace-facing metadata, while preserving npm only as build/dependency tooling and preserving immutable historical Empirical records.",
+    "profile": "complex",
+    "workflow": "complex",
+    "mode": "normal",
+    "phase": "done",
+    "status": "done",
+    "repairAttempts": 0,
+    "message": "Integrated capability changes: plugin-git-distribution",
+    "implementationActor": "agent",
+    "specDigest": "sha256:a96a0699d6cf79f628dc59b1ede0dc18589995e7b57c488e6c4cbe91eec3d53b",
+    "approvedSpecRevision": 2,
+    "capabilityArchiveRequired": true,
+    "capabilityDeltaDigest": "sha256:8a20476f30eb171dd9b8f03d402381249d1fdef4ccf77a077b57b6b8baa5f693",
+    "impactDigest": "sha256:0ef2490ec0f0e93898cd2a2844c877df03835199d8011d5476417ab6fdbda821",
+    "capabilityClaimId": "both-npm-packages-have-been-removed-audit-the-entire-active-59becfd36252",
+    "authorizationDigest": null,
+    "evidence": [],
+    "evidenceReceiptIds": [
+      "executed-780cb49e0b3da2700c7f3e9a",
+      "collected-7b1297d79281a01eac8d7751",
+      "collected-d2d38591f510f4ac7e28acad"
+    ],
+    "legacyEvidenceCount": 0,
+    "completion": {
+      "implemented": true,
+      "verified": true,
+      "integrated": true,
+      "delivered": false,
+      "published": false,
+      "highest": "integrated",
+      "reasons": {
+        "delivered": "delivered has not been proven by a durable receipt.",
+        "published": "published has not been proven by a durable receipt."
+      }
+    },
+    "updatedAt": "2026-08-27T00:01:41.238Z"
+  },
+  "compactedAt": "2026-08-27T00:01:41.254Z",
+  "digest": "sha256:ba723f19eab93debc25816e6b0f6f013d49ee875e19965361bf7d1b86e7c50ac"
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipt-input.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipt-input.json
new file mode 100644
index 0000000..b73da6c
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipt-input.json
@@ -0,0 +1,16 @@
+{
+  "criteria": ["AC-1", "AC-2", "AC-3", "AC-4", "AC-5", "AC-6", "AC-7"],
+  "evidenceKinds": ["test"],
+  "summary": "Verified the complete active Git-only cleanup across README/changelog/context, private manifests, structural publication-hook denial, CI and credential surfaces, both local Git marketplace entries, retained build tooling, final plugin checks, and immutable historical evidence.",
+  "collector": "codex",
+  "artifacts": [
+    {
+      "path": ".empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/verification.md",
+      "mediaType": "text/markdown"
+    },
+    {
+      "path": ".empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/security.md",
+      "mediaType": "text/markdown"
+    }
+  ]
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/collected-737a56e7a1a92ac239ff0425.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/collected-737a56e7a1a92ac239ff0425.json
new file mode 100644
index 0000000..3a09fab
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/collected-737a56e7a1a92ac239ff0425.json
@@ -0,0 +1,45 @@
+{
+  "schemaVersion": 1,
+  "id": "collected-737a56e7a1a92ac239ff0425",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-4",
+    "AC-5",
+    "AC-6",
+    "AC-7"
+  ],
+  "evidenceKinds": [
+    "test"
+  ],
+  "summary": "Verified the complete active Git-only cleanup across README/changelog/context, private manifests, structural publication-hook denial, CI and credential surfaces, both local Git marketplace entries, retained build tooling, final plugin checks, and immutable historical evidence.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:51:36.686Z",
+  "completedAt": "2026-08-26T23:51:36.686Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "both-npm-packages-have-been-removed-audit-the-entire-active",
+    "specRevision": 2,
+    "specDigest": "sha256:a96a0699d6cf79f628dc59b1ede0dc18589995e7b57c488e6c4cbe91eec3d53b",
+    "treeDigest": "sha256:4e24882a31f994c0e6ebb6c84e318f4601788cf09e7444c7f465035d5ae13afb",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:2cbf5c22282aa087f37353a9ef0fba3b01caa4ec0592b452483d718662a3b2bf",
+  "kind": "collected",
+  "collector": "codex",
+  "artifacts": [
+    {
+      "path": ".empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/security.md",
+      "mediaType": "text/markdown",
+      "bytes": 780,
+      "digest": "sha256:164f98c7190570b09dfbf3878c2afd7a0c5b7fbf2d9df96b26016c378c483638"
+    },
+    {
+      "path": ".empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/verification.md",
+      "mediaType": "text/markdown",
+      "bytes": 4215,
+      "digest": "sha256:db7b011233993c695ffe3fcf740eb3d093a498f8450d88d7fa51e473160e18d9"
+    }
+  ]
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/collected-7b1297d79281a01eac8d7751.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/collected-7b1297d79281a01eac8d7751.json
new file mode 100644
index 0000000..3500293
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/collected-7b1297d79281a01eac8d7751.json
@@ -0,0 +1,45 @@
+{
+  "schemaVersion": 1,
+  "id": "collected-7b1297d79281a01eac8d7751",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-4",
+    "AC-5",
+    "AC-6",
+    "AC-7"
+  ],
+  "evidenceKinds": [
+    "test"
+  ],
+  "summary": "Verified the complete active Git-only cleanup across README/changelog/context, private manifests, structural publication-hook denial, CI and credential surfaces, both local Git marketplace entries, retained build tooling, final plugin checks, and immutable historical evidence.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:59:02.750Z",
+  "completedAt": "2026-08-26T23:59:02.750Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "both-npm-packages-have-been-removed-audit-the-entire-active",
+    "specRevision": 2,
+    "specDigest": "sha256:a96a0699d6cf79f628dc59b1ede0dc18589995e7b57c488e6c4cbe91eec3d53b",
+    "treeDigest": "sha256:98f0021522923a8a14a9fb38c650d4123db07b17b0676ffe5babf18c98d0a5b6",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:734afdfb157a45e7d48c3e54140268f16fff049c413e1762fe7a0606c0331514",
+  "kind": "collected",
+  "collector": "codex",
+  "artifacts": [
+    {
+      "path": ".empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/security.md",
+      "mediaType": "text/markdown",
+      "bytes": 780,
+      "digest": "sha256:164f98c7190570b09dfbf3878c2afd7a0c5b7fbf2d9df96b26016c378c483638"
+    },
+    {
+      "path": ".empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/verification.md",
+      "mediaType": "text/markdown",
+      "bytes": 4215,
+      "digest": "sha256:dd4f4b28c3f1696f1a8f07af845476d310881eb4ae57f6e77e552479662b5f1c"
+    }
+  ]
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/collected-d2d38591f510f4ac7e28acad.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/collected-d2d38591f510f4ac7e28acad.json
new file mode 100644
index 0000000..7bc8e39
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/collected-d2d38591f510f4ac7e28acad.json
@@ -0,0 +1,45 @@
+{
+  "schemaVersion": 1,
+  "id": "collected-d2d38591f510f4ac7e28acad",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-4",
+    "AC-5",
+    "AC-6",
+    "AC-7"
+  ],
+  "evidenceKinds": [
+    "review"
+  ],
+  "summary": "Independent final review passes all active Git-only cleanup criteria at the final tree, confirms registry distribution is absent while required build tooling and historical evidence remain intact, and records only the separate advisory to add host-enforced Git tag rulesets before claiming enforced immutability.",
+  "passed": true,
+  "startedAt": "2026-08-27T00:00:19.031Z",
+  "completedAt": "2026-08-27T00:00:19.031Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "both-npm-packages-have-been-removed-audit-the-entire-active",
+    "specRevision": 2,
+    "specDigest": "sha256:a96a0699d6cf79f628dc59b1ede0dc18589995e7b57c488e6c4cbe91eec3d53b",
+    "treeDigest": "sha256:98f0021522923a8a14a9fb38c650d4123db07b17b0676ffe5babf18c98d0a5b6",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:938249fd30222dc8c801178bfa336efca9b4facdc085c35ad8623fb99904123d",
+  "kind": "collected",
+  "collector": "codex",
+  "artifacts": [
+    {
+      "path": ".empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/code-review.md",
+      "mediaType": "text/markdown",
+      "bytes": 7096,
+      "digest": "sha256:f6ea0d348bd259ec6a84b986f454e50e0d739970a33bea185808e6081b3909f0"
+    },
+    {
+      "path": ".empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/security.md",
+      "mediaType": "text/markdown",
+      "bytes": 780,
+      "digest": "sha256:164f98c7190570b09dfbf3878c2afd7a0c5b7fbf2d9df96b26016c378c483638"
+    }
+  ]
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/collected-e17c917744146d22aac0d315.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/collected-e17c917744146d22aac0d315.json
new file mode 100644
index 0000000..e70e1f1
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/collected-e17c917744146d22aac0d315.json
@@ -0,0 +1,45 @@
+{
+  "schemaVersion": 1,
+  "id": "collected-e17c917744146d22aac0d315",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-4",
+    "AC-5",
+    "AC-6",
+    "AC-7"
+  ],
+  "evidenceKinds": [
+    "test"
+  ],
+  "summary": "Verified the complete active Git-only cleanup across README/changelog/context, private manifests, structural publication-hook denial, CI and credential surfaces, both local Git marketplace entries, retained build tooling, final plugin checks, and immutable historical evidence.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:50:14.490Z",
+  "completedAt": "2026-08-26T23:50:14.490Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "both-npm-packages-have-been-removed-audit-the-entire-active",
+    "specRevision": 2,
+    "specDigest": "sha256:a96a0699d6cf79f628dc59b1ede0dc18589995e7b57c488e6c4cbe91eec3d53b",
+    "treeDigest": "sha256:4e24882a31f994c0e6ebb6c84e318f4601788cf09e7444c7f465035d5ae13afb",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:21cedd0817a1b0df41b2ce4675532abc86452d593f3a69a1c1b2e4497908f8ca",
+  "kind": "collected",
+  "collector": "codex",
+  "artifacts": [
+    {
+      "path": ".empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/security.md",
+      "mediaType": "text/markdown",
+      "bytes": 780,
+      "digest": "sha256:164f98c7190570b09dfbf3878c2afd7a0c5b7fbf2d9df96b26016c378c483638"
+    },
+    {
+      "path": ".empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/verification.md",
+      "mediaType": "text/markdown",
+      "bytes": 4215,
+      "digest": "sha256:3cac31d7facdbb6046e3f0377e08cd0f3c3eac8eb656b3b5286c485f86eeb6b1"
+    }
+  ]
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/executed-588c38e316d68fe797bca754.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/executed-588c38e316d68fe797bca754.json
new file mode 100644
index 0000000..dba3f9b
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/executed-588c38e316d68fe797bca754.json
@@ -0,0 +1,54 @@
+{
+  "schemaVersion": 1,
+  "id": "executed-588c38e316d68fe797bca754",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-5",
+    "AC-6",
+    "AC-7"
+  ],
+  "evidenceKinds": [
+    "test"
+  ],
+  "summary": "Run the final root check after the repository-wide active Git-only cleanup: documentation/CI/manifest distribution guards, Taskboard 0.3.1 tests and build metadata, Usage Tracker 0.1.2 tests and build, and preservation of required package tooling.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:49:08.674Z",
+  "completedAt": "2026-08-26T23:49:20.687Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "both-npm-packages-have-been-removed-audit-the-entire-active",
+    "specRevision": 2,
+    "specDigest": "sha256:a96a0699d6cf79f628dc59b1ede0dc18589995e7b57c488e6c4cbe91eec3d53b",
+    "treeDigest": "sha256:4e24882a31f994c0e6ebb6c84e318f4601788cf09e7444c7f465035d5ae13afb",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:eb4570f7a13792eedf797ce0452d572aa6751c42f06ca4b1550d62cc9b309151",
+  "kind": "executed",
+  "command": {
+    "argv": [
+      "npm",
+      "run",
+      "check"
+    ],
+    "cwd": ".",
+    "timeoutMs": 900000,
+    "maxOutputBytes": 1048576,
+    "environmentKeys": [
+      "NO_COLOR",
+      "PATH"
+    ]
+  },
+  "result": {
+    "exitCode": 0,
+    "signal": null,
+    "timedOut": false,
+    "stdoutDigest": "sha256:934d2815a36062792c07cafb3d7e7b02af1713f8090963bff2c4966ac2bde150",
+    "stderrDigest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "stdoutTail": "n_ms: 0.75165\n  type: 'test'\n  ...\n# Subtest: keeps Usage Tracker private and documents its Git release too\nok 66 - keeps Usage Tracker private and documents its Git release too\n  ---\n  duration_ms: 8.011799\n  type: 'test'\n  ...\n# Subtest: has no active registry publication automation or credential path\nok 67 - has no active registry publication automation or credential path\n  ---\n  duration_ms: 0.585778\n  type: 'test'\n  ...\n# Subtest: parses a tagged model response into a ticket draft\nok 68 - parses a tagged model response into a ticket draft\n  ---\n  duration_ms: 2.16058\n  type: 'test'\n  ...\n# Subtest: rejects malformed or incomplete model output\nok 69 - rejects malformed or incomplete model output\n  ---\n  duration_ms: 0.829933\n  type: 'test'\n  ...\n# Subtest: builds a read-only repository-aware worker prompt\nok 70 - builds a read-only repository-aware worker prompt\n  ---\n  duration_ms: 0.249294\n  type: 'test'\n  ...\n# Subtest: keeps the original prompt as an editable fallback\nok 71 - keeps the original prompt as an editable fallback\n  ---\n  duration_ms: 0.233025\n  type: 'test'\n  ...\n# Subtest: selects the active thread project only when it still exists\nok 72 - selects the active thread project only when it still exists\n  ---\n  duration_ms: 0.52102\n  type: 'test'\n  ...\n# Subtest: treats a different thread in the same project as new context\nok 73 - treats a different thread in the same project as new context\n  ---\n  duration_ms: 0.150915\n  type: 'test'\n  ...\n# Subtest: reads the project and thread from a BB project route\nok 74 - reads the project and thread from a BB project route\n  ---\n  duration_ms: 0.568536\n  type: 'test'\n  ...\n# Subtest: uses only the immediately previous navigation entry as source context\nok 75 - uses only the immediately previous navigation entry as source context\n  ---\n  duration_ms: 0.171373\n  type: 'test'\n  ...\n# Subtest: never replaces an explicit Taskboard project selection with route context\nok 76 - never replaces an explicit Taskboard project selection with route context\n  ---\n  duration_ms: 0.108177\n  type: 'test'\n  ...\n# Subtest: writes project credentials atomically with owner-only permissions\nok 77 - writes project credentials atomically with owner-only permissions\n  ---\n  duration_ms: 5.037295\n  type: 'test'\n  ...\n# Subtest: deleting a missing credential is harmless\nok 78 - deleting a missing credential is harmless\n  ---\n  duration_ms: 1.05306\n  type: 'test'\n  ...\n# Subtest: cached summaries never retain provider comments\nok 79 - cached summaries never retain provider comments\n  ---\n  duration_ms: 0.925989\n  type: 'test'\n  ...\n# Subtest: provider creation results carry strict native assignee confirmation\nok 80 - provider creation results carry strict native assignee confirmation\n  ---\n  duration_ms: 0.155384\n  type: 'test'\n  ...\n# Subtest: metadata failures expose only a fixed server-safe message\nok 81 - metadata failures expose only a fixed server-safe message\n  ---\n  duration_ms: 0.25231\n  type: 'test'\n  ...\n# Subtest: finds Jira project keys from common configured JQL scopes\nok 82 - finds Jira project keys from common configured JQL scopes\n  ---\n  duration_ms: 0.541578\n  type: 'test'\n  ...\n# Subtest: binds issue creation to the tracker reviewed in the modal\nok 83 - binds issue creation to the tracker reviewed in the modal\n  ---\n  duration_ms: 0.327988\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after successful issue creation\nok 84 - refreshes authoritative provider data after successful issue creation\n  ---\n  duration_ms: 0.217176\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after ambiguous issue creation failure\nok 85 - refreshes authoritative provider data after ambiguous issue creation failure\n  ---\n  duration_ms: 0.192821\n  type: 'test'\n  ...\n# Subtest: keeps structural headers on neutral host theme surfaces\nok 86 - keeps structural headers on neutral host theme surfaces\n  ---\n  duration_ms: 0.700628\n  type: 'test'\n  ...\n# Subtest: uses restrained state glyph, focus, and conversation treatments\nok 87 - uses restrained state glyph, focus, and conversation treatments\n  ---\n  duration_ms: 0.203391\n  type: 'test'\n  ...\n# Subtest: keeps constrained filter values inside the vertical menu measure\nok 88 - keeps constrained filter values inside the vertical menu measure\n  ---\n  duration_ms: 0.133874\n  type: 'test'\n  ...\n# Subtest: keeps assignee avatars compact with six theme-safe identity tones\nok 89 - keeps assignee avatars compact with six theme-safe identity tones\n  ---\n  duration_ms: 0.223878\n  type: 'test'\n  ...\n1..89\n# tests 89\n# suites 0\n# pass 89\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 253.134323\n\n> bb-plugin-taskboard@0.3.1 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n\n> bb-plugin-taskboard@0.3.1 verify:build\n> node scripts/verify-build.mjs\n\nTaskboard build metadata is valid.\n\n> bb-plugin-usage-tracker@0.1.2 check\n> npm run types:check && npm run typecheck && npm test && npm run build\n\n\n> bb-plugin-usage-tracker@0.1.2 types:check\n> env -u BB_CLI bb plugin types --check .\n\nThis plugin uses the npm package @get-bb/plugin-sdk; pin is 0.4.6, host is 0.4.6.\nThe declarations are in node_modules/@get-bb/plugin-sdk/bundled-types/ — read them for exact signatures.\n\n> bb-plugin-usage-tracker@0.1.2 typecheck\n> tsc --noEmit\n\n\n> bb-plugin-usage-tracker@0.1.2 test\n> node --test --experimental-strip-types test/*.test.ts\n\nTAP version 13\n# Subtest: enables sidebar providers independently in display order\nok 1 - enables sidebar providers independently in display order\n  ---\n  duration_ms: 0.964759\n  type: 'test'\n  ...\n# Subtest: normalizes providers in stable order with every usage window\nok 2 - normalizes providers in stable order with every usage window\n  ---\n  duration_ms: 0.479995\n  type: 'test'\n  ...\n# Subtest: normalizes not-installed and provider-error states\nok 3 - normalizes not-installed and provider-error states\n  ---\n  duration_ms: 1.076683\n  type: 'test'\n  ...\n# Subtest: clamps progress geometry and rejects non-finite values\nok 4 - clamps progress geometry and rejects non-finite values\n  ---\n  duration_ms: 0.446844\n  type: 'test'\n  ...\n# Subtest: formats reset, update, percentage, and cost copy safely\nok 5 - formats reset, update, percentage, and cost copy safely\n  ---\n  duration_ms: 16.104765\n  type: 'test'\n  ...\n# Subtest: projects five-hour and weekly windows into the compact sidebar copy\nok 6 - projects five-hour and weekly windows into the compact sidebar copy\n  ---\n  duration_ms: 0.377558\n  type: 'test'\n  ...\n# Subtest: keeps last-known sidebar windows through partial and failed refreshes\nok 7 - keeps last-known sidebar windows through partial and failed refreshes\n  ---\n  duration_ms: 0.7952\n  type: 'test'\n  ...\n# Subtest: resolves the thread environment host\nok 8 - resolves the thread environment host\n  ---\n  duration_ms: 0.144173\n  type: 'test'\n  ...\n# Subtest: falls back when a thread has no environment or lookup fails\nok 9 - falls back when a thread has no environment or lookup fails\n  ---\n  duration_ms: 0.268519\n  type: 'test'\n  ...\n# Subtest: loads usage for the resolved host and tolerates missing host metadata\nok 10 - loads usage for the resolved host and tolerates missing host metadata\n  ---\n  duration_ms: 0.414195\n  type: 'test'\n  ...\n# Subtest: omits host override for primary-machine fallback\nok 11 - omits host override for primary-machine fallback\n  ---\n  duration_ms: 0.209733\n  type: 'test'\n  ...\n# Subtest: loads the primary machine directly for the sidebar strip\nok 12 - loads the primary machine directly for the sidebar strip\n  ---\n  duration_ms: 0.188403\n  type: 'test'\n  ...\n# Subtest: propagates thread and request-level usage failures\nok 13 - propagates thread and request-level usage failures\n  ---\n  duration_ms: 0.256999\n  type: 'test'\n  ...\n1..13\n# tests 13\n# suites 0\n# pass 13\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 86.715476\n\n> bb-plugin-usage-tracker@0.1.2 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n",
+    "stderrTail": "",
+    "stdoutTruncated": false,
+    "stderrTruncated": false
+  }
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/executed-7209195c1d328ead07181135.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/executed-7209195c1d328ead07181135.json
new file mode 100644
index 0000000..088dff6
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/executed-7209195c1d328ead07181135.json
@@ -0,0 +1,54 @@
+{
+  "schemaVersion": 1,
+  "id": "executed-7209195c1d328ead07181135",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-5",
+    "AC-6",
+    "AC-7"
+  ],
+  "evidenceKinds": [
+    "test"
+  ],
+  "summary": "Run the final root check after the repository-wide active Git-only cleanup: documentation/CI/manifest distribution guards, Taskboard 0.3.1 tests and build metadata, Usage Tracker 0.1.2 tests and build, and preservation of required package tooling.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:47:22.150Z",
+  "completedAt": "2026-08-26T23:47:35.202Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "both-npm-packages-have-been-removed-audit-the-entire-active",
+    "specRevision": 2,
+    "specDigest": "sha256:a96a0699d6cf79f628dc59b1ede0dc18589995e7b57c488e6c4cbe91eec3d53b",
+    "treeDigest": "sha256:2cc617ddfab1666875354a0f27d2ec77e5ece882ab4a9abe1c0896d556b58389",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:bdac2f18587c6acbdc37c47a75b497490c0555321816181a934719d8f249b201",
+  "kind": "executed",
+  "command": {
+    "argv": [
+      "npm",
+      "run",
+      "check"
+    ],
+    "cwd": ".",
+    "timeoutMs": 900000,
+    "maxOutputBytes": 1048576,
+    "environmentKeys": [
+      "NO_COLOR",
+      "PATH"
+    ]
+  },
+  "result": {
+    "exitCode": 0,
+    "signal": null,
+    "timedOut": false,
+    "stdoutDigest": "sha256:75a533de9c933155b0e535a86b5135f620660a8736fefa7282c91faad253c647",
+    "stderrDigest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "stdoutTail": "s: 0.692323\n  type: 'test'\n  ...\n# Subtest: keeps Usage Tracker private and documents its Git release too\nok 66 - keeps Usage Tracker private and documents its Git release too\n  ---\n  duration_ms: 7.17325\n  type: 'test'\n  ...\n# Subtest: has no active registry publication automation or credential path\nok 67 - has no active registry publication automation or credential path\n  ---\n  duration_ms: 0.601427\n  type: 'test'\n  ...\n# Subtest: parses a tagged model response into a ticket draft\nok 68 - parses a tagged model response into a ticket draft\n  ---\n  duration_ms: 1.94721\n  type: 'test'\n  ...\n# Subtest: rejects malformed or incomplete model output\nok 69 - rejects malformed or incomplete model output\n  ---\n  duration_ms: 1.78832\n  type: 'test'\n  ...\n# Subtest: builds a read-only repository-aware worker prompt\nok 70 - builds a read-only repository-aware worker prompt\n  ---\n  duration_ms: 0.229678\n  type: 'test'\n  ...\n# Subtest: keeps the original prompt as an editable fallback\nok 71 - keeps the original prompt as an editable fallback\n  ---\n  duration_ms: 0.278107\n  type: 'test'\n  ...\n# Subtest: selects the active thread project only when it still exists\nok 72 - selects the active thread project only when it still exists\n  ---\n  duration_ms: 0.563678\n  type: 'test'\n  ...\n# Subtest: treats a different thread in the same project as new context\nok 73 - treats a different thread in the same project as new context\n  ---\n  duration_ms: 0.216976\n  type: 'test'\n  ...\n# Subtest: reads the project and thread from a BB project route\nok 74 - reads the project and thread from a BB project route\n  ---\n  duration_ms: 0.609371\n  type: 'test'\n  ...\n# Subtest: uses only the immediately previous navigation entry as source context\nok 75 - uses only the immediately previous navigation entry as source context\n  ---\n  duration_ms: 0.141929\n  type: 'test'\n  ...\n# Subtest: never replaces an explicit Taskboard project selection with route context\nok 76 - never replaces an explicit Taskboard project selection with route context\n  ---\n  duration_ms: 0.100353\n  type: 'test'\n  ...\n# Subtest: writes project credentials atomically with owner-only permissions\nok 77 - writes project credentials atomically with owner-only permissions\n  ---\n  duration_ms: 11.723456\n  type: 'test'\n  ...\n# Subtest: deleting a missing credential is harmless\nok 78 - deleting a missing credential is harmless\n  ---\n  duration_ms: 1.920512\n  type: 'test'\n  ...\n# Subtest: cached summaries never retain provider comments\nok 79 - cached summaries never retain provider comments\n  ---\n  duration_ms: 0.94344\n  type: 'test'\n  ...\n# Subtest: provider creation results carry strict native assignee confirmation\nok 80 - provider creation results carry strict native assignee confirmation\n  ---\n  duration_ms: 0.118546\n  type: 'test'\n  ...\n# Subtest: metadata failures expose only a fixed server-safe message\nok 81 - metadata failures expose only a fixed server-safe message\n  ---\n  duration_ms: 0.237743\n  type: 'test'\n  ...\n# Subtest: finds Jira project keys from common configured JQL scopes\nok 82 - finds Jira project keys from common configured JQL scopes\n  ---\n  duration_ms: 0.545074\n  type: 'test'\n  ...\n# Subtest: binds issue creation to the tracker reviewed in the modal\nok 83 - binds issue creation to the tracker reviewed in the modal\n  ---\n  duration_ms: 0.297642\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after successful issue creation\nok 84 - refreshes authoritative provider data after successful issue creation\n  ---\n  duration_ms: 0.168187\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after ambiguous issue creation failure\nok 85 - refreshes authoritative provider data after ambiguous issue creation failure\n  ---\n  duration_ms: 0.176021\n  type: 'test'\n  ...\n# Subtest: keeps structural headers on neutral host theme surfaces\nok 86 - keeps structural headers on neutral host theme surfaces\n  ---\n  duration_ms: 0.808915\n  type: 'test'\n  ...\n# Subtest: uses restrained state glyph, focus, and conversation treatments\nok 87 - uses restrained state glyph, focus, and conversation treatments\n  ---\n  duration_ms: 0.212658\n  type: 'test'\n  ...\n# Subtest: keeps constrained filter values inside the vertical menu measure\nok 88 - keeps constrained filter values inside the vertical menu measure\n  ---\n  duration_ms: 0.141147\n  type: 'test'\n  ...\n# Subtest: keeps assignee avatars compact with six theme-safe identity tones\nok 89 - keeps assignee avatars compact with six theme-safe identity tones\n  ---\n  duration_ms: 0.263611\n  type: 'test'\n  ...\n1..89\n# tests 89\n# suites 0\n# pass 89\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 266.102746\n\n> bb-plugin-taskboard@0.3.1 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n\n> bb-plugin-taskboard@0.3.1 verify:build\n> node scripts/verify-build.mjs\n\nTaskboard build metadata is valid.\n\n> bb-plugin-usage-tracker@0.1.2 check\n> npm run types:check && npm run typecheck && npm test && npm run build\n\n\n> bb-plugin-usage-tracker@0.1.2 types:check\n> env -u BB_CLI bb plugin types --check .\n\nThis plugin uses the npm package @get-bb/plugin-sdk; pin is 0.4.6, host is 0.4.6.\nThe declarations are in node_modules/@get-bb/plugin-sdk/bundled-types/ — read them for exact signatures.\n\n> bb-plugin-usage-tracker@0.1.2 typecheck\n> tsc --noEmit\n\n\n> bb-plugin-usage-tracker@0.1.2 test\n> node --test --experimental-strip-types test/*.test.ts\n\nTAP version 13\n# Subtest: enables sidebar providers independently in display order\nok 1 - enables sidebar providers independently in display order\n  ---\n  duration_ms: 0.984595\n  type: 'test'\n  ...\n# Subtest: normalizes providers in stable order with every usage window\nok 2 - normalizes providers in stable order with every usage window\n  ---\n  duration_ms: 0.476098\n  type: 'test'\n  ...\n# Subtest: normalizes not-installed and provider-error states\nok 3 - normalizes not-installed and provider-error states\n  ---\n  duration_ms: 0.167746\n  type: 'test'\n  ...\n# Subtest: clamps progress geometry and rejects non-finite values\nok 4 - clamps progress geometry and rejects non-finite values\n  ---\n  duration_ms: 0.266246\n  type: 'test'\n  ...\n# Subtest: formats reset, update, percentage, and cost copy safely\nok 5 - formats reset, update, percentage, and cost copy safely\n  ---\n  duration_ms: 11.129674\n  type: 'test'\n  ...\n# Subtest: projects five-hour and weekly windows into the compact sidebar copy\nok 6 - projects five-hour and weekly windows into the compact sidebar copy\n  ---\n  duration_ms: 0.304706\n  type: 'test'\n  ...\n# Subtest: keeps last-known sidebar windows through partial and failed refreshes\nok 7 - keeps last-known sidebar windows through partial and failed refreshes\n  ---\n  duration_ms: 0.310897\n  type: 'test'\n  ...\n# Subtest: resolves the thread environment host\nok 8 - resolves the thread environment host\n  ---\n  duration_ms: 0.14273\n  type: 'test'\n  ...\n# Subtest: falls back when a thread has no environment or lookup fails\nok 9 - falls back when a thread has no environment or lookup fails\n  ---\n  duration_ms: 0.257159\n  type: 'test'\n  ...\n# Subtest: loads usage for the resolved host and tolerates missing host metadata\nok 10 - loads usage for the resolved host and tolerates missing host metadata\n  ---\n  duration_ms: 0.470879\n  type: 'test'\n  ...\n# Subtest: omits host override for primary-machine fallback\nok 11 - omits host override for primary-machine fallback\n  ---\n  duration_ms: 0.198041\n  type: 'test'\n  ...\n# Subtest: loads the primary machine directly for the sidebar strip\nok 12 - loads the primary machine directly for the sidebar strip\n  ---\n  duration_ms: 0.122864\n  type: 'test'\n  ...\n# Subtest: propagates thread and request-level usage failures\nok 13 - propagates thread and request-level usage failures\n  ---\n  duration_ms: 0.215743\n  type: 'test'\n  ...\n1..13\n# tests 13\n# suites 0\n# pass 13\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 80.796967\n\n> bb-plugin-usage-tracker@0.1.2 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n",
+    "stderrTail": "",
+    "stdoutTruncated": false,
+    "stderrTruncated": false
+  }
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/executed-780cb49e0b3da2700c7f3e9a.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/executed-780cb49e0b3da2700c7f3e9a.json
new file mode 100644
index 0000000..1b7eb79
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/executed-780cb49e0b3da2700c7f3e9a.json
@@ -0,0 +1,55 @@
+{
+  "schemaVersion": 1,
+  "id": "executed-780cb49e0b3da2700c7f3e9a",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-4",
+    "AC-5",
+    "AC-6",
+    "AC-7"
+  ],
+  "evidenceKinds": [
+    "test"
+  ],
+  "summary": "Run the final root check after the repository-wide active Git-only cleanup and locally validated Git marketplace entries: documentation/CI/manifest distribution guards, Taskboard 0.3.1 tests and build metadata, Usage Tracker 0.1.2 tests and build, and preservation of required package tooling.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:58:18.118Z",
+  "completedAt": "2026-08-26T23:58:45.657Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "both-npm-packages-have-been-removed-audit-the-entire-active",
+    "specRevision": 2,
+    "specDigest": "sha256:a96a0699d6cf79f628dc59b1ede0dc18589995e7b57c488e6c4cbe91eec3d53b",
+    "treeDigest": "sha256:98f0021522923a8a14a9fb38c650d4123db07b17b0676ffe5babf18c98d0a5b6",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:d7e537a011250c6544754c298f9f22b13c6dd2f43e0e7a6b117d6fe5a4bdb750",
+  "kind": "executed",
+  "command": {
+    "argv": [
+      "npm",
+      "run",
+      "check"
+    ],
+    "cwd": ".",
+    "timeoutMs": 900000,
+    "maxOutputBytes": 1048576,
+    "environmentKeys": [
+      "NO_COLOR",
+      "PATH"
+    ]
+  },
+  "result": {
+    "exitCode": 0,
+    "signal": null,
+    "timedOut": false,
+    "stdoutDigest": "sha256:ef18f2454332be3b25e4527a46e78d69c90d018a081b3f247c21fedc86f2ce20",
+    "stderrDigest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "stdoutTail": "0.849497\n  type: 'test'\n  ...\n# Subtest: keeps Usage Tracker private and documents its Git release too\nok 66 - keeps Usage Tracker private and documents its Git release too\n  ---\n  duration_ms: 6.475855\n  type: 'test'\n  ...\n# Subtest: has no active registry publication automation or credential path\nok 67 - has no active registry publication automation or credential path\n  ---\n  duration_ms: 0.457834\n  type: 'test'\n  ...\n# Subtest: parses a tagged model response into a ticket draft\nok 68 - parses a tagged model response into a ticket draft\n  ---\n  duration_ms: 1.564579\n  type: 'test'\n  ...\n# Subtest: rejects malformed or incomplete model output\nok 69 - rejects malformed or incomplete model output\n  ---\n  duration_ms: 0.568706\n  type: 'test'\n  ...\n# Subtest: builds a read-only repository-aware worker prompt\nok 70 - builds a read-only repository-aware worker prompt\n  ---\n  duration_ms: 0.168186\n  type: 'test'\n  ...\n# Subtest: keeps the original prompt as an editable fallback\nok 71 - keeps the original prompt as an editable fallback\n  ---\n  duration_ms: 0.190016\n  type: 'test'\n  ...\n# Subtest: selects the active thread project only when it still exists\nok 72 - selects the active thread project only when it still exists\n  ---\n  duration_ms: 0.770714\n  type: 'test'\n  ...\n# Subtest: treats a different thread in the same project as new context\nok 73 - treats a different thread in the same project as new context\n  ---\n  duration_ms: 0.136629\n  type: 'test'\n  ...\n# Subtest: reads the project and thread from a BB project route\nok 74 - reads the project and thread from a BB project route\n  ---\n  duration_ms: 0.60982\n  type: 'test'\n  ...\n# Subtest: uses only the immediately previous navigation entry as source context\nok 75 - uses only the immediately previous navigation entry as source context\n  ---\n  duration_ms: 0.162366\n  type: 'test'\n  ...\n# Subtest: never replaces an explicit Taskboard project selection with route context\nok 76 - never replaces an explicit Taskboard project selection with route context\n  ---\n  duration_ms: 0.111473\n  type: 'test'\n  ...\n# Subtest: writes project credentials atomically with owner-only permissions\nok 77 - writes project credentials atomically with owner-only permissions\n  ---\n  duration_ms: 6.004716\n  type: 'test'\n  ...\n# Subtest: deleting a missing credential is harmless\nok 78 - deleting a missing credential is harmless\n  ---\n  duration_ms: 0.942787\n  type: 'test'\n  ...\n# Subtest: cached summaries never retain provider comments\nok 79 - cached summaries never retain provider comments\n  ---\n  duration_ms: 1.163499\n  type: 'test'\n  ...\n# Subtest: provider creation results carry strict native assignee confirmation\nok 80 - provider creation results carry strict native assignee confirmation\n  ---\n  duration_ms: 0.171082\n  type: 'test'\n  ...\n# Subtest: metadata failures expose only a fixed server-safe message\nok 81 - metadata failures expose only a fixed server-safe message\n  ---\n  duration_ms: 0.289247\n  type: 'test'\n  ...\n# Subtest: finds Jira project keys from common configured JQL scopes\nok 82 - finds Jira project keys from common configured JQL scopes\n  ---\n  duration_ms: 0.580818\n  type: 'test'\n  ...\n# Subtest: binds issue creation to the tracker reviewed in the modal\nok 83 - binds issue creation to the tracker reviewed in the modal\n  ---\n  duration_ms: 0.324461\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after successful issue creation\nok 84 - refreshes authoritative provider data after successful issue creation\n  ---\n  duration_ms: 0.19232\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after ambiguous issue creation failure\nok 85 - refreshes authoritative provider data after ambiguous issue creation failure\n  ---\n  duration_ms: 0.227565\n  type: 'test'\n  ...\n# Subtest: keeps structural headers on neutral host theme surfaces\nok 86 - keeps structural headers on neutral host theme surfaces\n  ---\n  duration_ms: 0.752881\n  type: 'test'\n  ...\n# Subtest: uses restrained state glyph, focus, and conversation treatments\nok 87 - uses restrained state glyph, focus, and conversation treatments\n  ---\n  duration_ms: 0.227154\n  type: 'test'\n  ...\n# Subtest: keeps constrained filter values inside the vertical menu measure\nok 88 - keeps constrained filter values inside the vertical menu measure\n  ---\n  duration_ms: 0.149142\n  type: 'test'\n  ...\n# Subtest: keeps assignee avatars compact with six theme-safe identity tones\nok 89 - keeps assignee avatars compact with six theme-safe identity tones\n  ---\n  duration_ms: 0.243012\n  type: 'test'\n  ...\n1..89\n# tests 89\n# suites 0\n# pass 89\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 269.505212\n\n> bb-plugin-taskboard@0.3.1 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n\n> bb-plugin-taskboard@0.3.1 verify:build\n> node scripts/verify-build.mjs\n\nTaskboard build metadata is valid.\n\n> bb-plugin-usage-tracker@0.1.2 check\n> npm run types:check && npm run typecheck && npm test && npm run build\n\n\n> bb-plugin-usage-tracker@0.1.2 types:check\n> env -u BB_CLI bb plugin types --check .\n\nThis plugin uses the npm package @get-bb/plugin-sdk; pin is 0.4.6, host is 0.4.6.\nThe declarations are in node_modules/@get-bb/plugin-sdk/bundled-types/ — read them for exact signatures.\n\n> bb-plugin-usage-tracker@0.1.2 typecheck\n> tsc --noEmit\n\n\n> bb-plugin-usage-tracker@0.1.2 test\n> node --test --experimental-strip-types test/*.test.ts\n\nTAP version 13\n# Subtest: enables sidebar providers independently in display order\nok 1 - enables sidebar providers independently in display order\n  ---\n  duration_ms: 1.254154\n  type: 'test'\n  ...\n# Subtest: normalizes providers in stable order with every usage window\nok 2 - normalizes providers in stable order with every usage window\n  ---\n  duration_ms: 0.562855\n  type: 'test'\n  ...\n# Subtest: normalizes not-installed and provider-error states\nok 3 - normalizes not-installed and provider-error states\n  ---\n  duration_ms: 0.246849\n  type: 'test'\n  ...\n# Subtest: clamps progress geometry and rejects non-finite values\nok 4 - clamps progress geometry and rejects non-finite values\n  ---\n  duration_ms: 0.612445\n  type: 'test'\n  ...\n# Subtest: formats reset, update, percentage, and cost copy safely\nok 5 - formats reset, update, percentage, and cost copy safely\n  ---\n  duration_ms: 28.186014\n  type: 'test'\n  ...\n# Subtest: projects five-hour and weekly windows into the compact sidebar copy\nok 6 - projects five-hour and weekly windows into the compact sidebar copy\n  ---\n  duration_ms: 0.464466\n  type: 'test'\n  ...\n# Subtest: keeps last-known sidebar windows through partial and failed refreshes\nok 7 - keeps last-known sidebar windows through partial and failed refreshes\n  ---\n  duration_ms: 0.930656\n  type: 'test'\n  ...\n# Subtest: resolves the thread environment host\nok 8 - resolves the thread environment host\n  ---\n  duration_ms: 0.188193\n  type: 'test'\n  ...\n# Subtest: falls back when a thread has no environment or lookup fails\nok 9 - falls back when a thread has no environment or lookup fails\n  ---\n  duration_ms: 0.304074\n  type: 'test'\n  ...\n# Subtest: loads usage for the resolved host and tolerates missing host metadata\nok 10 - loads usage for the resolved host and tolerates missing host metadata\n  ---\n  duration_ms: 0.529134\n  type: 'test'\n  ...\n# Subtest: omits host override for primary-machine fallback\nok 11 - omits host override for primary-machine fallback\n  ---\n  duration_ms: 0.246619\n  type: 'test'\n  ...\n# Subtest: loads the primary machine directly for the sidebar strip\nok 12 - loads the primary machine directly for the sidebar strip\n  ---\n  duration_ms: 0.141237\n  type: 'test'\n  ...\n# Subtest: propagates thread and request-level usage failures\nok 13 - propagates thread and request-level usage failures\n  ---\n  duration_ms: 0.236511\n  type: 'test'\n  ...\n1..13\n# tests 13\n# suites 0\n# pass 13\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 109.033175\n\n> bb-plugin-usage-tracker@0.1.2 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n",
+    "stderrTail": "",
+    "stdoutTruncated": false,
+    "stderrTruncated": false
+  }
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/executed-9e68b74ff6d3d7e4f3433f29.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/executed-9e68b74ff6d3d7e4f3433f29.json
new file mode 100644
index 0000000..1ff51c3
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/receipts/executed-9e68b74ff6d3d7e4f3433f29.json
@@ -0,0 +1,55 @@
+{
+  "schemaVersion": 1,
+  "id": "executed-9e68b74ff6d3d7e4f3433f29",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-4",
+    "AC-5",
+    "AC-6",
+    "AC-7"
+  ],
+  "evidenceKinds": [
+    "test"
+  ],
+  "summary": "Run the final root check after the repository-wide active Git-only cleanup and locally validated Git marketplace entries: documentation/CI/manifest distribution guards, Taskboard 0.3.1 tests and build metadata, Usage Tracker 0.1.2 tests and build, and preservation of required package tooling.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:51:12.881Z",
+  "completedAt": "2026-08-26T23:51:25.247Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "both-npm-packages-have-been-removed-audit-the-entire-active",
+    "specRevision": 2,
+    "specDigest": "sha256:a96a0699d6cf79f628dc59b1ede0dc18589995e7b57c488e6c4cbe91eec3d53b",
+    "treeDigest": "sha256:4e24882a31f994c0e6ebb6c84e318f4601788cf09e7444c7f465035d5ae13afb",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:e8b7aa7bddefae003b1ca839e8164ff319ce7811fbfd0c853e3db91ea41b2446",
+  "kind": "executed",
+  "command": {
+    "argv": [
+      "npm",
+      "run",
+      "check"
+    ],
+    "cwd": ".",
+    "timeoutMs": 900000,
+    "maxOutputBytes": 1048576,
+    "environmentKeys": [
+      "NO_COLOR",
+      "PATH"
+    ]
+  },
+  "result": {
+    "exitCode": 0,
+    "signal": null,
+    "timedOut": false,
+    "stdoutDigest": "sha256:3988ab77752d20e348552036a7617d06e26c69af9ddbbf428d0d48dea4142c09",
+    "stderrDigest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "stdoutTail": ": 0.72949\n  type: 'test'\n  ...\n# Subtest: keeps Usage Tracker private and documents its Git release too\nok 66 - keeps Usage Tracker private and documents its Git release too\n  ---\n  duration_ms: 6.418392\n  type: 'test'\n  ...\n# Subtest: has no active registry publication automation or credential path\nok 67 - has no active registry publication automation or credential path\n  ---\n  duration_ms: 0.381165\n  type: 'test'\n  ...\n# Subtest: parses a tagged model response into a ticket draft\nok 68 - parses a tagged model response into a ticket draft\n  ---\n  duration_ms: 1.515703\n  type: 'test'\n  ...\n# Subtest: rejects malformed or incomplete model output\nok 69 - rejects malformed or incomplete model output\n  ---\n  duration_ms: 0.561374\n  type: 'test'\n  ...\n# Subtest: builds a read-only repository-aware worker prompt\nok 70 - builds a read-only repository-aware worker prompt\n  ---\n  duration_ms: 0.157498\n  type: 'test'\n  ...\n# Subtest: keeps the original prompt as an editable fallback\nok 71 - keeps the original prompt as an editable fallback\n  ---\n  duration_ms: 0.185879\n  type: 'test'\n  ...\n# Subtest: selects the active thread project only when it still exists\nok 72 - selects the active thread project only when it still exists\n  ---\n  duration_ms: 0.641439\n  type: 'test'\n  ...\n# Subtest: treats a different thread in the same project as new context\nok 73 - treats a different thread in the same project as new context\n  ---\n  duration_ms: 0.146948\n  type: 'test'\n  ...\n# Subtest: reads the project and thread from a BB project route\nok 74 - reads the project and thread from a BB project route\n  ---\n  duration_ms: 0.545655\n  type: 'test'\n  ...\n# Subtest: uses only the immediately previous navigation entry as source context\nok 75 - uses only the immediately previous navigation entry as source context\n  ---\n  duration_ms: 0.150916\n  type: 'test'\n  ...\n# Subtest: never replaces an explicit Taskboard project selection with route context\nok 76 - never replaces an explicit Taskboard project selection with route context\n  ---\n  duration_ms: 0.108669\n  type: 'test'\n  ...\n# Subtest: writes project credentials atomically with owner-only permissions\nok 77 - writes project credentials atomically with owner-only permissions\n  ---\n  duration_ms: 8.683723\n  type: 'test'\n  ...\n# Subtest: deleting a missing credential is harmless\nok 78 - deleting a missing credential is harmless\n  ---\n  duration_ms: 1.010412\n  type: 'test'\n  ...\n# Subtest: cached summaries never retain provider comments\nok 79 - cached summaries never retain provider comments\n  ---\n  duration_ms: 1.451567\n  type: 'test'\n  ...\n# Subtest: provider creation results carry strict native assignee confirmation\nok 80 - provider creation results carry strict native assignee confirmation\n  ---\n  duration_ms: 0.139184\n  type: 'test'\n  ...\n# Subtest: metadata failures expose only a fixed server-safe message\nok 81 - metadata failures expose only a fixed server-safe message\n  ---\n  duration_ms: 0.331385\n  type: 'test'\n  ...\n# Subtest: finds Jira project keys from common configured JQL scopes\nok 82 - finds Jira project keys from common configured JQL scopes\n  ---\n  duration_ms: 0.793487\n  type: 'test'\n  ...\n# Subtest: binds issue creation to the tracker reviewed in the modal\nok 83 - binds issue creation to the tracker reviewed in the modal\n  ---\n  duration_ms: 0.865758\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after successful issue creation\nok 84 - refreshes authoritative provider data after successful issue creation\n  ---\n  duration_ms: 0.249655\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after ambiguous issue creation failure\nok 85 - refreshes authoritative provider data after ambiguous issue creation failure\n  ---\n  duration_ms: 0.240318\n  type: 'test'\n  ...\n# Subtest: keeps structural headers on neutral host theme surfaces\nok 86 - keeps structural headers on neutral host theme surfaces\n  ---\n  duration_ms: 0.742163\n  type: 'test'\n  ...\n# Subtest: uses restrained state glyph, focus, and conversation treatments\nok 87 - uses restrained state glyph, focus, and conversation treatments\n  ---\n  duration_ms: 0.219831\n  type: 'test'\n  ...\n# Subtest: keeps constrained filter values inside the vertical menu measure\nok 88 - keeps constrained filter values inside the vertical menu measure\n  ---\n  duration_ms: 0.140416\n  type: 'test'\n  ...\n# Subtest: keeps assignee avatars compact with six theme-safe identity tones\nok 89 - keeps assignee avatars compact with six theme-safe identity tones\n  ---\n  duration_ms: 0.242032\n  type: 'test'\n  ...\n1..89\n# tests 89\n# suites 0\n# pass 89\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 242.748349\n\n> bb-plugin-taskboard@0.3.1 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n\n> bb-plugin-taskboard@0.3.1 verify:build\n> node scripts/verify-build.mjs\n\nTaskboard build metadata is valid.\n\n> bb-plugin-usage-tracker@0.1.2 check\n> npm run types:check && npm run typecheck && npm test && npm run build\n\n\n> bb-plugin-usage-tracker@0.1.2 types:check\n> env -u BB_CLI bb plugin types --check .\n\nThis plugin uses the npm package @get-bb/plugin-sdk; pin is 0.4.6, host is 0.4.6.\nThe declarations are in node_modules/@get-bb/plugin-sdk/bundled-types/ — read them for exact signatures.\n\n> bb-plugin-usage-tracker@0.1.2 typecheck\n> tsc --noEmit\n\n\n> bb-plugin-usage-tracker@0.1.2 test\n> node --test --experimental-strip-types test/*.test.ts\n\nTAP version 13\n# Subtest: enables sidebar providers independently in display order\nok 1 - enables sidebar providers independently in display order\n  ---\n  duration_ms: 0.867131\n  type: 'test'\n  ...\n# Subtest: normalizes providers in stable order with every usage window\nok 2 - normalizes providers in stable order with every usage window\n  ---\n  duration_ms: 0.413164\n  type: 'test'\n  ...\n# Subtest: normalizes not-installed and provider-error states\nok 3 - normalizes not-installed and provider-error states\n  ---\n  duration_ms: 0.191399\n  type: 'test'\n  ...\n# Subtest: clamps progress geometry and rejects non-finite values\nok 4 - clamps progress geometry and rejects non-finite values\n  ---\n  duration_ms: 0.250096\n  type: 'test'\n  ...\n# Subtest: formats reset, update, percentage, and cost copy safely\nok 5 - formats reset, update, percentage, and cost copy safely\n  ---\n  duration_ms: 10.127115\n  type: 'test'\n  ...\n# Subtest: projects five-hour and weekly windows into the compact sidebar copy\nok 6 - projects five-hour and weekly windows into the compact sidebar copy\n  ---\n  duration_ms: 0.266606\n  type: 'test'\n  ...\n# Subtest: keeps last-known sidebar windows through partial and failed refreshes\nok 7 - keeps last-known sidebar windows through partial and failed refreshes\n  ---\n  duration_ms: 0.26899\n  type: 'test'\n  ...\n# Subtest: resolves the thread environment host\nok 8 - resolves the thread environment host\n  ---\n  duration_ms: 0.144874\n  type: 'test'\n  ...\n# Subtest: falls back when a thread has no environment or lookup fails\nok 9 - falls back when a thread has no environment or lookup fails\n  ---\n  duration_ms: 0.256718\n  type: 'test'\n  ...\n# Subtest: loads usage for the resolved host and tolerates missing host metadata\nok 10 - loads usage for the resolved host and tolerates missing host metadata\n  ---\n  duration_ms: 0.369644\n  type: 'test'\n  ...\n# Subtest: omits host override for primary-machine fallback\nok 11 - omits host override for primary-machine fallback\n  ---\n  duration_ms: 0.183766\n  type: 'test'\n  ...\n# Subtest: loads the primary machine directly for the sidebar strip\nok 12 - loads the primary machine directly for the sidebar strip\n  ---\n  duration_ms: 0.111794\n  type: 'test'\n  ...\n# Subtest: propagates thread and request-level usage failures\nok 13 - propagates thread and request-level usage failures\n  ---\n  duration_ms: 0.207358\n  type: 'test'\n  ...\n1..13\n# tests 13\n# suites 0\n# pass 13\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 79.65453\n\n> bb-plugin-usage-tracker@0.1.2 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n",
+    "stderrTail": "",
+    "stdoutTruncated": false,
+    "stderrTruncated": false
+  }
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/review-receipt-input.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/review-receipt-input.json
new file mode 100644
index 0000000..483b184
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/review-receipt-input.json
@@ -0,0 +1,16 @@
+{
+  "criteria": ["AC-1", "AC-2", "AC-3", "AC-4", "AC-5", "AC-6", "AC-7"],
+  "evidenceKinds": ["review"],
+  "summary": "Independent final review passes all active Git-only cleanup criteria at the final tree, confirms registry distribution is absent while required build tooling and historical evidence remain intact, and records only the separate advisory to add host-enforced Git tag rulesets before claiming enforced immutability.",
+  "collector": "codex",
+  "artifacts": [
+    {
+      "path": ".empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/code-review.md",
+      "mediaType": "text/markdown"
+    },
+    {
+      "path": ".empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/consults/security.md",
+      "mediaType": "text/markdown"
+    }
+  ]
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/test-receipt-input.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/test-receipt-input.json
new file mode 100644
index 0000000..08d4d73
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/test-receipt-input.json
@@ -0,0 +1,6 @@
+{
+  "commandId": "workspace-check",
+  "criteria": ["AC-1", "AC-2", "AC-3", "AC-4", "AC-5", "AC-6", "AC-7"],
+  "evidenceKinds": ["test"],
+  "summary": "Run the final root check after the repository-wide active Git-only cleanup and locally validated Git marketplace entries: documentation/CI/manifest distribution guards, Taskboard 0.3.1 tests and build metadata, Usage Tracker 0.1.2 tests and build, and preservation of required package tooling."
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/verification.md b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/verification.md
new file mode 100644
index 0000000..245dd07
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/evidence/verification.md
@@ -0,0 +1,85 @@
+# Active Git-only distribution audit verification
+
+## Active documentation
+
+- Root, Taskboard, and Usage Tracker READMEs lead with immutable Git semver
+  installs and conditional BB Community shorthand.
+- A classified active-file search found no `npm:` source for either plugin, npm
+  package badge/URL, publish/unpublish command, registry auth URL, publishing
+  token name, `publishConfig`, or tracked publish config in current README,
+  changelog, context, manifest, CI, or collection files.
+- Root README and generated context no longer carry unnecessary prose describing
+  the workspace or plugins as npm-distributed. Usage Tracker's changelog now
+  calls `@get-bb/plugin-sdk` a pinned development dependency.
+- Contributor `npm install` and `npm run` commands remain intentionally because
+  they install dependencies, test, and build Git source.
+
+## Manifests, automation, and credentials
+
+- Root, Taskboard, and Usage Tracker manifests are `private: true`.
+- Structural guards reject `publishConfig`, package `files`, and
+  `prepublish`, `prepublishOnly`, `publish`, `postpublish`, `prepack`, or
+  `postpack` hooks across all three manifests, plus publish/unpublish command
+  text in every script.
+- `.npmrc.publish` and the local credential file are absent. The deny-only
+  `.npm-publish.env` ignore line remains protective hygiene for legacy clones.
+- The sole GitHub workflow has read-only contents permission and no registry,
+  auth-token, publish, or unpublish path. Read-only GitHub checks report no
+  Actions secrets, no Actions variables, zero deployment environments, and one
+  active CI workflow.
+- Final private dry runs emit the exact skip warning for both
+  `bb-plugin-taskboard` and `bb-plugin-usage-tracker`.
+
+## Tests and builds
+
+- Signed receipt `executed-780cb49e0b3da2700c7f3e9a` records root
+  `npm run check` passing at the final tree.
+- Taskboard 0.3.1 passes SDK checking, TypeScript, 89/89 tests, production
+  build, and build-metadata verification.
+- Usage Tracker 0.1.2 passes SDK checking, TypeScript, 13/13 tests, and
+  production build.
+- `git diff --check` passes.
+
+## Marketplace and public state
+
+- The local Taskboard marketplace entry is Git-backed at
+  `plugins/taskboard`, range `^0.3.0`, tag prefix `taskboard/`.
+- The local Usage Tracker entry is Git-backed at `plugins/usage-tracker`, range
+  `^0.1.2`, tag prefix `usage-tracker/`; it contains no npm source object.
+- Marketplace schema build passes and produces 82 entries.
+- Remote PR #126 and the live catalog are still stale until the separately
+  approved source release creates `taskboard/v0.3.1` and
+  `usage-tracker/v0.1.2`, after which full source liveness, the marketplace
+  commit/PR update, and hosted validation remain mandatory.
+
+## Historical integrity and registry state
+
+- All prior tracked Empirical feature files remain unchanged from release
+  commit `ecc13bee4a275772ac7ac19207056d719da9057a`.
+- Every collected artifact referenced by a prior feature's final attached
+  evidence receipts validates: 50 artifacts checked, zero mismatches.
+- Registry tombstones retain the final deletion times for all earlier versions:
+  Usage Tracker `2026-08-26T23:00:13.963Z` and Taskboard
+  `2026-08-26T23:00:34.123Z`; exact deleted versions return 404.
+
+## Security review
+
+- The structural manifest/CI finding is resolved by the expanded distribution
+  guard.
+- The security consult remains advisory about adding GitHub tag rulesets to
+  prevent tag update/deletion. No ruleset is claimed or changed locally; it is
+  a separate remote release control requiring explicit approval.
+
+## Acceptance coverage
+
+- AC-1/AC-2: current READMEs, changelog, and context are Git-first and free of
+  retired registry distribution copy.
+- AC-3: private manifests, structural hook denial, clean CI/config/credential
+  surfaces.
+- AC-4: both local marketplace entries use correct Git sources; public
+  deployment remains explicitly gated.
+- AC-5: package identity, workspaces, dependencies, lockfile, entry points, and
+  build commands remain intact.
+- AC-6: historical files unchanged and attached artifacts digest-valid.
+- AC-7: final root check, classified audit, private refusals, marketplace build,
+  and diff checks pass.
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/impact.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/impact.json
new file mode 100644
index 0000000..259f932
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/impact.json
@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "classification": "behavioral",
+  "capabilities": [
+    "plugin-git-distribution"
+  ],
+  "surfaces": [
+    "workflow"
+  ],
+  "regressionRationale": null,
+  "digest": "sha256:0ef2490ec0f0e93898cd2a2844c877df03835199d8011d5476417ab6fdbda821"
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/integration-receipt.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/integration-receipt.json
new file mode 100644
index 0000000..842c20d
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/integration-receipt.json
@@ -0,0 +1,23 @@
+{
+  "schemaVersion": 1,
+  "feature": "both-npm-packages-have-been-removed-audit-the-entire-active",
+  "claimId": "both-npm-packages-have-been-removed-audit-the-entire-active-59becfd36252",
+  "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+  "baseCommit": "ecc13bee4a275772ac7ac19207056d719da9057a",
+  "baseTree": "a73ef5b52a99a62e6fdf10d6756ff79a7e96301f",
+  "featureTree": "sha256:98f0021522923a8a14a9fb38c650d4123db07b17b0676ffe5babf18c98d0a5b6",
+  "targetCommit": "ecc13bee4a275772ac7ac19207056d719da9057a",
+  "targetTree": "a73ef5b52a99a62e6fdf10d6756ff79a7e96301f",
+  "capabilityBaseDigests": {
+    "plugin-git-distribution": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+  },
+  "deltaDigest": "sha256:c4b09649542e0762c0afa8b147b77a2fbaf8adaf8b5ed354dfae6b6d453e6d8c",
+  "resultDigests": {
+    "plugin-git-distribution": "sha256:e7e622159eaf9e1ded9347c230a21de069d474af95dd7c591db58924a09a9535"
+  },
+  "verificationReceiptDigests": [
+    "sha256:433f398ba1d2719fb6903b74e39f8678beac5d51df32ba8255470b0ddcb57351"
+  ],
+  "integratedAt": "2026-08-27T00:01:41.221Z",
+  "digest": "sha256:cd48a1930dc140fbf4330cbd4be03ffb2f6bfc3dbb0649a764214edf16161900"
+}
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/plan.md b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/plan.md
new file mode 100644
index 0000000..dc0fcd3
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/plan.md
@@ -0,0 +1,33 @@
+# Plan: Active Git-only Distribution Audit
+
+## 1. Tighten current documentation
+
+- Remove unnecessary npm-distribution explanatory prose from the root README
+  and active context while keeping real development commands.
+- Reword the Usage Tracker changelog's SDK dependency note so it cannot be read
+  as plugin publication.
+- Preserve the exact Git semver and BB Community install paths.
+
+## 2. Expand preventive guards
+
+- Extend the distribution test across root/plugin docs, changelog, active
+  context, root/plugin manifests, CI, and publish-config absence.
+- Assert both workspaces/root are private, publish hooks/config/tokens are
+  absent, and Git install sources remain complete.
+
+## 3. Verify active and historical boundaries
+
+- Run focused tests and the signed root check.
+- Repeat the classified repository-wide search and both private publish dry
+  runs.
+- Audit historical tracked files and collected-receipt artifact digests.
+- Validate the locally prepared marketplace schema; retain full liveness as a
+  post-tag release gate.
+
+## 4. Review and integrate
+
+- Obtain an independent code/supply-chain review of the final diff.
+- Integrate the new shared plugin Git-distribution capability against the
+  approved detached worktree.
+- Amend the existing local release commit only after checks pass; perform no
+  remote mutation without exact approval.
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/spec.md b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/spec.md
new file mode 100644
index 0000000..bb0870b
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/spec.md
@@ -0,0 +1,67 @@
+# Active Git-only Distribution Audit
+
+## Request
+
+> Both npm packages have been removed. Audit the entire active repository and remove any remaining npm-distribution references for Taskboard and Usage Tracker from README files and all other active docs, manifests, CI/CD, release scripts, badges, package links, install/update commands, credential/config paths, changelogs, and marketplace-facing metadata, while preserving npm only as build/dependency tooling and preserving immutable historical Empirical records.
+
+## Goal
+
+Make every current user-facing and automated distribution surface consistently
+Git-only for Taskboard and Usage Tracker after both registry packages were
+removed, without deleting the package manifests or JavaScript tooling BB Git
+installs still require.
+
+## Acceptance Criteria
+
+- [ ] [AC-1] The root, Taskboard, and Usage Tracker READMEs contain no npm
+  package badge, npm package URL, `npm:` plugin source, registry installation,
+  registry update, or registry-release wording for either plugin; their primary
+  installation paths are BB Community shorthand and immutable Git ranges.
+- [ ] [AC-2] Other active documentation and generated repository context contain
+  no stale claim that either plugin distributes through npm. Legitimate
+  development commands and the pinned `@get-bb/plugin-sdk` dependency remain
+  clearly build-only facts.
+- [ ] [AC-3] Both plugin manifests remain private and omit `publishConfig`,
+  `files`, and `prepack`; the root has no npm publish credential config, token,
+  publish/unpublish script, or publishing CI job.
+- [ ] [AC-4] Marketplace-facing Taskboard and Usage Tracker entries use the
+  public Git repository, correct plugin subdirectories, semver ranges, and
+  plugin-specific tag prefixes, with no npm source object.
+- [ ] [AC-5] Plugin package names, package manifests, workspaces, lockfile
+  dependency records, npm install/run development commands, and source entry
+  points remain intact because BB Git installation and local builds require
+  them.
+- [ ] [AC-6] Immutable historical Empirical specifications, receipts, and
+  release artifacts remain byte-valid and are not rewritten to erase the
+  accurate earlier npm timeline.
+- [ ] [AC-7] A repository-wide active-file audit and root plugin checks pass,
+  including focused regression guards for both packages.
+
+## Scope
+
+- Current root/plugin READMEs, Usage Tracker changelog, generated Empirical
+  context, manifests, CI, scripts, config, tests, and marketplace entries.
+- Clear classification of registry distribution references versus necessary
+  package/build tooling.
+
+## Non-goals
+
+- Removing Node/npm as the dependency and build runner.
+- Deleting or renaming `package.json`, plugin package names, workspace entries,
+  lockfile dependency records, or `@get-bb/plugin-sdk`.
+- Rewriting historical `.empirical/specs/**` records or existing Git tags.
+- Performing any GitHub push, tag, Release, PR merge, or marketplace remote
+  update without the separate exact release approval.
+
+## Verification
+
+- Repository-wide `rg` audit excluding generated bundles, dependencies, and
+  immutable historical Empirical records.
+- Focused distribution tests and root `npm run check`.
+- Manifest/CI/config assertions plus private-workspace publish refusals.
+- Marketplace schema build and, after public tags exist, Git-source liveness.
+- Historical receipt-artifact digest audit.
+
+## Capability Deltas
+
+- `deltas/plugin-git-distribution.md`
diff --git a/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/state.json b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/state.json
new file mode 100644
index 0000000..8ccc1f9
--- /dev/null
+++ b/.empirical/specs/both-npm-packages-have-been-removed-audit-the-entire-active/state.json
@@ -0,0 +1,41 @@
+{
+  "schemaVersion": 5,
+  "revision": 12,
+  "activeFeature": "both-npm-packages-have-been-removed-audit-the-entire-active",
+  "request": "Both npm packages have been removed. Audit the entire active repository and remove any remaining npm-distribution references for Taskboard and Usage Tracker from README files and all other active docs, manifests, CI/CD, release scripts, badges, package links, install/update commands, credential/config paths, changelogs, and marketplace-facing metadata, while preserving npm only as build/dependency tooling and preserving immutable historical Empirical records.",
+  "profile": "complex",
+  "workflow": "complex",
+  "mode": "normal",
+  "phase": "done",
+  "status": "done",
+  "repairAttempts": 0,
+  "message": "Integrated capability changes: plugin-git-distribution",
+  "implementationActor": "agent",
+  "specDigest": "sha256:a96a0699d6cf79f628dc59b1ede0dc18589995e7b57c488e6c4cbe91eec3d53b",
+  "approvedSpecRevision": 2,
+  "capabilityArchiveRequired": true,
+  "capabilityDeltaDigest": "sha256:8a20476f30eb171dd9b8f03d402381249d1fdef4ccf77a077b57b6b8baa5f693",
+  "impactDigest": "sha256:0ef2490ec0f0e93898cd2a2844c877df03835199d8011d5476417ab6fdbda821",
+  "capabilityClaimId": "both-npm-packages-have-been-removed-audit-the-entire-active-59becfd36252",
+  "authorizationDigest": null,
+  "evidence": [],
+  "evidenceReceiptIds": [
+    "executed-780cb49e0b3da2700c7f3e9a",
+    "collected-7b1297d79281a01eac8d7751",
+    "collected-d2d38591f510f4ac7e28acad"
+  ],
+  "legacyEvidenceCount": 0,
+  "completion": {
+    "implemented": true,
+    "verified": true,
+    "integrated": true,
+    "delivered": false,
+    "published": false,
+    "highest": "integrated",
+    "reasons": {
+      "delivered": "delivered has not been proven by a durable receipt.",
+      "published": "published has not been proven by a durable receipt."
+    }
+  },
+  "updatedAt": "2026-08-27T00:01:41.238Z"
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/consults/code-review.md b/.empirical/specs/taskboard-git-only-distribution/consults/code-review.md
new file mode 100644
index 0000000..0ea4522
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/consults/code-review.md
@@ -0,0 +1,110 @@
+# Independent Code Review
+
+- Reviewer: code-review
+- Verdict: advisory
+- Source base: `3cbd919bcce696131b1cc16480c54f3049401ea9`
+- Scope: complete Git-only distribution working-tree diff, accepted
+  supersessions D-004 through D-006, signed verification, security consult,
+  immutable Empirical history, and the locally prepared marketplace sources
+
+## Criterion dispositions
+
+### AC-1 — Pass
+
+Taskboard is `bb-plugin-taskboard@0.3.1`, is marked `private: true`, and has no
+`publishConfig`, `files`, or `prepack` field. Its package name, BB name and
+branding, source app/server entries, engines, dependencies, and build, dev,
+typecheck, test, and check scripts remain intact. The signed root check proves
+SDK validation, TypeScript, 88/88 tests, production build, and Taskboard build
+metadata against the changed manifest.
+
+### AC-2 — Pass
+
+The root and Taskboard READMEs no longer advertise the npm package, npm badge,
+npm URL, or `npm:bb-plugin-taskboard` installation. Both contain the exact
+direct Git command with range `^0.3.0`, subdirectory `plugins/taskboard`, and
+tag prefix `taskboard/`; community shorthand is explicitly conditional on
+marketplace PR #126 becoming live. Managed Git update/remove commands remain
+correctly documented.
+
+### AC-3 — Superseded; current two-plugin requirement passes
+
+D-005 records the user's later explicit instruction and supersedes D-002,
+AC-3, and the original Usage Tracker non-goal without rewriting the historical
+approved specification. Usage Tracker remains
+`bb-plugin-usage-tracker@0.1.2` with its BB identity, runtime dependencies, and
+build scripts intact, but is now private and has no npm publication fields or
+hook. Its root/plugin documentation has the parallel `^0.1.2`,
+`plugins/usage-tracker`, and `usage-tracker/` Git install contract and no active
+npm distribution copy. npm workspaces and registry-resolved third-party
+dependencies remain only as required build tooling.
+
+### AC-4 — Pass for the reviewed delta; integration remains a workflow gate
+
+The capability delta removes Taskboard's immutable npm-release requirement and
+adds the general immutable Git tag, reviewed commit, GitHub Release, and
+marketplace-range requirements. Its v0.3.0 scenarios retain the already-public
+baseline; D-006 governs adding v0.3.1 without moving that baseline, and the
+`^0.3.0` range tracks the highest compatible tag. All 135 Empirical
+specification files tracked at the source base hash byte-identically to HEAD.
+The historical npm publication wrapper and receipts remain only as immutable
+audit artifacts; no active manifest, CI workflow, root script, or documentation
+invokes them. Applying the accepted delta in Empirical integration is still
+required before source commit.
+
+### AC-5 — Pass for local verification; public release gates remain
+
+Signed receipt `executed-f19eb7b3790a9c40e46b8d5e` records the final root
+check at Taskboard 0.3.1 and Usage Tracker 0.1.2. Independent review also
+confirmed `git diff --check`, all focused distribution assertions, and exact
+private-workspace dry-run warnings for both plugin names. Public annotated tag
+`taskboard/v0.3.0` still peels to
+`3cbd919bcce696131b1cc16480c54f3049401ea9`; it has not moved.
+
+The marketplace Taskboard entry is Git-backed with repository, subdirectory,
+`^0.3.0`, and `taskboard/` prefix preserved. The local Usage Tracker entry
+replaces its now-dead npm source with the same repository,
+`plugins/usage-tracker`, `^0.1.2`, and `usage-tracker/`. Full remote liveness is
+intentionally pending the reviewed source commit and public
+`taskboard/v0.3.1` and `usage-tracker/v0.1.2` tags; this is a post-approval
+release gate, not evidence already claimed by the candidate.
+
+### AC-6 — Superseded external conclusion; current timeline passes
+
+D-004 preserves the initial Taskboard CLI `EOTP` failure and separately records
+the user's later website deletion. Independent cache-bypassed registry queries
+return `E404 Unpublished` for Taskboard at
+`2026-08-26T23:00:34.123Z` and Usage Tracker at
+`2026-08-26T23:00:13.963Z`. No active repository operation stores or retries an
+unpublish command, OTP, token, or npm credential.
+
+## Publication and credential boundary
+
+The shared tracked `.npmrc.publish` is deleted and the local
+`.npm-publish.env` is absent. Retaining the deny-only `.npm-publish.env` ignore
+line is appropriate credential hygiene for legacy clones and does not preserve
+a publication path. The CI workflow performs dependency installation and
+checks only; there is no registry publish job or npm release script. Both
+private dry runs emit `Skipping workspace ... marked as private`, which is the
+authoritative refusal despite npm returning exit zero.
+
+## Required post-review gates
+
+- Integrate the accepted capability delta, then commit the exact reviewed
+  source tree and re-run immutable receipt-artifact validation.
+- Obtain exact remote-mutation approval before pushing or merging the source
+  PR, creating tags/releases, or updating marketplace PR #126.
+- Create new annotated `taskboard/v0.3.1` and
+  `usage-tracker/v0.1.2` tags at the same reviewed commit; never move
+  `taskboard/v0.3.0`. Publish the required Taskboard v0.3.1 GitHub Release.
+- After both tags are public, require their peeled commits to match the reviewed
+  source, run full marketplace build/liveness checks for both Git subdirectories,
+  update PR #126's scope, and require its hosted validation to pass.
+
+## Findings
+
+None. No blocking, high, medium, or low correctness, manifest-identity,
+buildability, documentation, credential, CI/CD, immutable-history, or
+distribution-path finding remains in the reviewed local candidate. The public
+tags, release, marketplace liveness, and remote approval above are explicit
+completion gates rather than pre-integration code defects.
diff --git a/.empirical/specs/taskboard-git-only-distribution/consults/security.md b/.empirical/specs/taskboard-git-only-distribution/consults/security.md
new file mode 100644
index 0000000..9fa0999
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/consults/security.md
@@ -0,0 +1,50 @@
+# Security Consultation
+
+- Specialist: security
+- Verdict: advisory
+
+## Review boundary
+
+This is a design-level supply-chain review of the current Git-only distribution
+spec, design, and capability delta. The accepted D-005 user supersession is
+authoritative; the original Taskboard-only request and acceptance text remain
+historical context rather than the current mutation boundary.
+
+The two-plugin Git-only design closes the identified supply-chain gaps. Both
+workspaces are private and stripped of npm publication contracts, the shared
+publish configuration and local credential are removed, and the deny-only
+`.npm-publish.env` ignore entry remains guarded solely to prevent legacy-clone
+token disclosure. Direct Git commands use distinct subdirectories and tag
+prefixes; community shorthand remains conditional on PR #126. The release
+evidence, private-workspace refusal checks, historical-receipt comparison, and
+ordered `EOTP`-then-`E404` registry timeline provide appropriate verification.
+
+## Findings
+
+None.
+
+## Residual risks
+
+- Taskboard's peeled commit evidence and BB tag-move detection make rewrites
+  detectable, and Usage Tracker receives the same namespaced-tag rule. GitHub
+  administrator control remains an explicit availability and first-install
+  trust assumption rather than an undeletable-tag guarantee.
+- Completion evidence must resolve `usage-tracker/v0.1.2` from the public remote,
+  retain its peeled reviewed commit, and build the marketplace source from
+  `plugins/usage-tracker`; a local working-tree build alone does not establish
+  Git-source integrity.
+- The `^0.3.0` and `^0.1.2` ranges intentionally trust future authorized tags in
+  their respective namespaces. Users requiring fully reproducible installs need
+  an exact-version or commit policy.
+- A monorepo subdirectory narrows plugin selection but root build scripts,
+  lockfiles, and transitive source used by that subdirectory remain part of the
+  trusted reviewed commit.
+- npm's private-workspace dry run exits zero. Guards must continue matching the
+  skip warning for both exact workspace names and fail if either warning
+  disappears; exit status alone is not a publication denial.
+- The retained credential ignore entry prevents accidental staging but does not
+  revoke copies of old tokens. Existing-clone owners should still delete the
+  legacy file and revoke any credential whose confidentiality is uncertain.
+- Registry `E404` is point-in-time evidence. The append-only timeline must keep
+  the initial `EOTP` failure and later website completion distinct, and future
+  documentation must not assume the npm names can never reappear.
diff --git a/.empirical/specs/taskboard-git-only-distribution/decisions.md b/.empirical/specs/taskboard-git-only-distribution/decisions.md
new file mode 100644
index 0000000..555e63f
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/decisions.md
@@ -0,0 +1,189 @@
+# Decisions: Taskboard Git Only Distribution
+
+Record concise, externally reviewable evidence and choices here. Do not store
+private chain-of-thought, prompts, credentials, secrets, or scratchpad text.
+
+## D-001: Keep npm as tooling, remove it as Taskboard distribution
+
+Status: Accepted
+
+### Evidence
+
+BB derives the plugin ID/version from `package.json`, Git installs run dependency
+installation and builds, and the monorepo uses npm workspaces. The user wants
+Taskboard removed from npm distribution, not a broken Git checkout.
+
+### Options
+
+- Delete Taskboard's package manifest and npm dependencies.
+- Keep the build manifest but mark it private and remove publish-only fields.
+
+### Chosen approach
+
+Keep the manifest/tooling and make Taskboard private with no publication,
+packaging allowlist, or prepack hook.
+
+### Trade-offs and risks
+
+The file remains npm-compatible because npm is still the build tool. `private`
+and focused guards prevent accidental registry publication.
+
+### Verification
+
+Manifest assertions, full workspace checks, and a direct Git install contract.
+
+## D-002: Preserve Usage Tracker npm distribution
+
+Status: Superseded
+
+Superseded by: D-005
+
+### Evidence
+
+The user selected destructive removal of `bb-plugin-taskboard`; no instruction
+authorized changing `bb-plugin-usage-tracker`.
+
+### Options
+
+- Remove shared npm infrastructure and affect both plugins.
+- Remove only Taskboard-specific publication surfaces.
+
+### Chosen approach
+
+Leave Usage Tracker's manifest, badges, install instructions, and shared root
+npm support unchanged.
+
+### Trade-offs and risks
+
+Root npm configuration remains because it still serves Usage Tracker. Active
+copy must clearly avoid implying Taskboard also publishes there.
+
+### Verification
+
+Byte-/field-level assertions for Usage Tracker plus root documentation review.
+
+## D-003: Report npm unpublish as blocked
+
+Status: Superseded
+
+Superseded by: D-004
+
+### Evidence
+
+The registry accepted authentication but rejected full-package unpublish with
+`EOTP`; public versions `0.1.0` through `0.2.0` remain queryable.
+
+### Options
+
+- Claim deletion based on intent.
+- Record the external blocker and complete Git-only code removal honestly.
+
+### Chosen approach
+
+Record npm deletion as externally blocked until the registry itself confirms
+absence.
+
+### Trade-offs and risks
+
+Historical npm installs remain available temporarily. New Taskboard releases and
+the marketplace use Git only.
+
+### Verification
+
+Registry query remains explicit and no code/docs advertise npm installation.
+
+## D-004: Supersede the blocked registry status after external deletion
+
+Status: Accepted
+
+Supersedes: D-003
+
+### Evidence
+
+After the CLI `EOTP` rejection, the user completed npm deletion externally.
+Fresh registry responses now return `E404 Unpublished` for Taskboard at
+`2026-08-26T23:00:34.123Z` and Usage Tracker at
+`2026-08-26T23:00:13.963Z`.
+
+### Options
+
+- Preserve the earlier blocked status after it becomes stale.
+- Record the attempt and later external completion as separate timeline facts.
+
+### Chosen approach
+
+Record both facts. The later accepted scope decision removes stale distribution
+surfaces for both externally deleted packages in this feature.
+
+### Trade-offs and risks
+
+Historical npm versions cannot be restored under the same version numbers.
+Git tags and the marketplace are now the live distribution source.
+
+### Verification
+
+Use read-only registry queries and never store/retry an unpublish command.
+
+## D-005: Supersede the Taskboard-only code boundary
+
+Status: Accepted
+
+Supersedes: D-002
+
+### Evidence
+
+The user's latest explicit instruction is to remove both npm packages and their
+active code paths immediately. The registry confirms both packages unpublished,
+and marketplace liveness now fails on Usage Tracker's stale npm source.
+
+### Options
+
+- Preserve stale Usage Tracker npm instructions despite external deletion.
+- Convert both plugins to private Git-only workspaces and marketplace sources.
+
+### Chosen approach
+
+Convert both. Preserve npm only as the monorepo dependency/build tool.
+This accepted user supersession also replaces AC-3 and the Usage Tracker
+non-goal in the original approved specification without rewriting that
+historical contract.
+
+### Trade-offs and risks
+
+Usage Tracker needs a plugin-specific Git tag and marketplace source update.
+Historical npm receipts remain immutable timeline evidence.
+
+### Verification
+
+Private-publish skips for both manifests, no active npm install URLs, public
+plugin-specific tags, and marketplace Git liveness for both entries.
+
+## D-006: Cut a Taskboard patch tag for the Git-only manifest
+
+Status: Accepted
+
+### Evidence
+
+`taskboard/v0.3.0` is immutable and predates the private manifest. The
+marketplace/direct range `^0.3.0` can select a compatible patch release.
+
+### Options
+
+- Move v0.3.0 to the new commit.
+- Leave installs on the old manifest indefinitely.
+- Bump to 0.3.1 and create a new tag.
+
+### Chosen approach
+
+Release `taskboard/v0.3.1` and `usage-tracker/v0.1.2` from the reviewed Git-only
+commit.
+
+### Trade-offs and risks
+
+Two plugin-specific tags point to one monorepo commit, with independent semver
+ranges and subdirectories. Existing immutable tags remain untouched.
+
+### Verification
+
+Check both manifest versions, annotated tag names, peeled commit equality, and
+marketplace liveness before push/PR completion.
diff --git a/.empirical/specs/taskboard-git-only-distribution/deltas/taskboard-distribution.md b/.empirical/specs/taskboard-git-only-distribution/deltas/taskboard-distribution.md
new file mode 100644
index 0000000..1f0dacf
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/deltas/taskboard-distribution.md
@@ -0,0 +1,45 @@
+# Taskboard Git-only Distribution Delta
+
+## REMOVED Requirements
+
+### Requirement: Immutable npm release
+
+Taskboard no longer publishes new versions to npm. The workspace SHALL retain
+npm-compatible package metadata only where BB Git installation, dependency
+resolution, and repository build tooling require it.
+
+#### Scenario: Retire npm distribution
+
+- **WHEN** Taskboard adopts Git-only releases
+- **THEN** no active manifest, documentation, or release process offers npm
+  publication for Taskboard
+
+## ADDED Requirements
+
+### Requirement: Immutable Git release
+
+Every Taskboard release SHALL bind one reviewed Git commit, one immutable
+`taskboard/vX.Y.Z` annotated tag, and one GitHub Release. A Taskboard workspace
+SHALL be marked private/non-publishable and SHALL omit npm publication,
+packaging, and prepack configuration.
+
+#### Scenario: Install Taskboard 0.3.0 directly
+
+- **WHEN** a user installs Git range `^0.3.0` with subdirectory
+  `plugins/taskboard` and tag prefix `taskboard/`
+- **THEN** BB resolves public tag `taskboard/v0.3.0` and its immutable commit
+- **AND** builds the plugin from the reviewed Git source
+
+## MODIFIED Requirements
+
+### Requirement: Marketplace range alignment
+
+The BB Community Taskboard entry SHALL reference the public Git repository,
+plugin subdirectory, semver range, and Taskboard tag prefix that resolve the
+current immutable Git release while preserving listing identity.
+
+#### Scenario: Resolve the marketplace release
+
+- **WHEN** the marketplace validates Taskboard range `^0.3.0`
+- **THEN** it resolves `taskboard/v0.3.0` from the public repository
+- **AND** marketplace build and Git-source liveness checks pass without npm
diff --git a/.empirical/specs/taskboard-git-only-distribution/design.md b/.empirical/specs/taskboard-git-only-distribution/design.md
new file mode 100644
index 0000000..ea9b2bb
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/design.md
@@ -0,0 +1,73 @@
+# Taskboard Git-only Distribution Design
+
+## Manifest boundary
+
+Set `plugins/taskboard/package.json` to `private: true`. Remove only Taskboard's
+`publishConfig`, npm `files` allowlist, and `prepack` hook. Keep the package
+name/version because BB derives plugin identity and build metadata from them;
+keep dependencies, workspaces, package lock, and npm scripts because Git installs
+and local development still use npm to install/build/test the source.
+
+Advance Taskboard to patch version `0.3.1` so a new immutable
+`taskboard/v0.3.1` tag contains the Git-only manifest; never move the existing
+`taskboard/v0.3.0` release. Usage Tracker remains `0.1.2` and receives its first
+plugin-specific `usage-tracker/v0.1.2` tag at the same reviewed source commit.
+
+The user's later explicit instruction to remove both unpublished npm packages
+supersedes the initial Taskboard-only boundary. Usage Tracker is also private
+and loses publishConfig/files/prepack. Root `.npmrc.publish` and the local
+credential are removed because no plugin publishes to npm. The deny-only
+`.npm-publish.env` ignore entry remains so legacy credential files in other
+clones cannot become accidentally stageable; it is not a publication path.
+Root package-manager commands and registry lock entries remain because both Git
+installs still use npm to install dependencies and build source.
+
+## Installation documentation
+
+Remove Taskboard's npm badge, npm package link, and npm install/update wording.
+Document two supported paths:
+
+1. `bb plugin install taskboard` after the BB Community entry is merged.
+2. Direct Git tracking:
+   `bb plugin install git:https://github.com/MateoCerquetella/bb-plugins.git@^0.3.0 --subdirectory plugins/taskboard --tag-prefix taskboard/`.
+
+Usage Tracker receives the parallel direct command with range `^0.1.2`,
+subdirectory `plugins/usage-tracker`, and tag prefix `usage-tracker/`. Keep
+`bb plugin outdated`, `update`, `reload`, and `remove`; those commands also
+apply to managed Git ranges.
+
+## Guard and verification
+
+Add a focused source-level distribution test that proves Taskboard is private,
+has no publish/prepack/files contract, retains its BB manifest/build scripts,
+contains the exact Git install command, and exposes no Taskboard npm URL/install
+text in active root/plugin documentation. The same guard proves Usage Tracker is
+also private/Git-only and that shared npm publish credentials/config are absent.
+Actual `npm publish --dry-run --ignore-scripts` verification for both workspaces
+must emit npm's `Skipping workspace ... marked as private` refusal; npm currently
+returns exit zero for that skip, so the warning—not exit status—is authoritative.
+
+Run Taskboard and root checks, verify the public tag, and rerun marketplace Git
+build/liveness. Re-audit every immutable Empirical receipt artifact after active
+capability integration.
+
+## External npm registry status
+
+The explicitly approved `npm unpublish bb-plugin-taskboard --force` attempt is
+recorded operationally as rejected with `EOTP`. The user subsequently completed
+the destructive npm website action: cache-bypassed registry queries now report
+Taskboard unpublished at `2026-08-26T23:00:34.123Z` and Usage Tracker unpublished
+at `2026-08-26T23:00:13.963Z`. Active code/docs now remove both stale npm paths.
+
+## Git immutability trust boundary
+
+The project never moves or replaces `taskboard/v*` tags. BB records the resolved
+tag and commit for managed Git installs and refuses a tag that later points
+elsewhere; release evidence anchors `taskboard/v0.3.0` to peeled commit
+`3cbd919bcce696131b1cc16480c54f3049401ea9` and its GitHub Release. GitHub
+administrator control remains an explicit operational trust assumption rather
+than a claim that this change installs an undeletable hosting rule.
+
+Usage Tracker receives the same operational rule through a new annotated
+`usage-tracker/v0.1.2` tag anchored to the reviewed source commit and a Git
+marketplace range that records/resolves the tag commit.
diff --git a/.empirical/specs/taskboard-git-only-distribution/events/00000010.json b/.empirical/specs/taskboard-git-only-distribution/events/00000010.json
new file mode 100644
index 0000000..b5eec95
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/events/00000010.json
@@ -0,0 +1,53 @@
+{
+  "schemaVersion": 1,
+  "sequence": 10,
+  "previousDigest": "sha256:9e3f31ba24fdf93e720753225176d0ccb7e8bd20541221e1769297fb8e7b93ab",
+  "actor": "empirical-integrate",
+  "type": "compaction-boundary",
+  "summary": "Compacted through journal event 9",
+  "createdAt": "2026-08-26T23:36:55.541Z",
+  "stateBeforeDigest": "sha256:73c250c5242fcd9ca5704cf792865e3b45940103082ff6a2228850df01d557d1",
+  "stateAfterDigest": "sha256:73c250c5242fcd9ca5704cf792865e3b45940103082ff6a2228850df01d557d1",
+  "state": {
+    "schemaVersion": 5,
+    "revision": 9,
+    "activeFeature": "taskboard-git-only-distribution",
+    "request": "Remove Taskboard's npm distribution path now and make Taskboard Git-only without touching Usage Tracker: mark the Taskboard workspace private/non-publishable while retaining its package name, dependencies, and npm-as-build-tool scripts required by BB Git installs; remove Taskboard publishConfig, prepack/files packaging contract where safe, tracked npm publish config, local publish credential/ignore entry, npm badges/links/install/update instructions, and root claims that every plugin ships through npm; document BB Community and direct Git semver install commands using plugins/taskboard and taskboard/ tags; update the living Taskboard distribution capability to Git-only; preserve immutable historical Empirical receipts. Verify builds/tests and marketplace Git source. The external npm unpublish of bb-plugin-taskboard versions 0.1.0 through 0.2.0 was explicitly authorized but npm rejected it with EOTP, so record the registry deletion as externally blocked rather than pretending it succeeded. Do not modify or unpublish Usage Tracker.",
+    "profile": "complex",
+    "workflow": "complex",
+    "mode": "normal",
+    "phase": "done",
+    "status": "done",
+    "repairAttempts": 0,
+    "message": "Integrated capability changes: taskboard-distribution",
+    "implementationActor": "agent",
+    "specDigest": "sha256:54ed39d23680f882fe1fb9e0dcbbd671e48a40bdf759e86f4bd842c9d54e44a0",
+    "approvedSpecRevision": 2,
+    "capabilityArchiveRequired": true,
+    "capabilityDeltaDigest": "sha256:3d8cbd211af3ded962d5a578b1ad200d6c8d3a31c0e13897301d17b636f35ce6",
+    "impactDigest": "sha256:1fa6e66c5ce24725f2ade1a81eddec6859f67bd95e0816db2a8fca35c29fe005",
+    "capabilityClaimId": "taskboard-git-only-distribution-59becfd36252",
+    "authorizationDigest": null,
+    "evidence": [],
+    "evidenceReceiptIds": [
+      "executed-f19eb7b3790a9c40e46b8d5e",
+      "collected-1106d5804579d9b3edad6f44",
+      "collected-15d9242299950347a8c1b852"
+    ],
+    "legacyEvidenceCount": 0,
+    "completion": {
+      "implemented": true,
+      "verified": true,
+      "integrated": true,
+      "delivered": false,
+      "published": false,
+      "highest": "integrated",
+      "reasons": {
+        "delivered": "delivered has not been proven by a durable receipt.",
+        "published": "published has not been proven by a durable receipt."
+      }
+    },
+    "updatedAt": "2026-08-26T23:36:55.519Z"
+  },
+  "digest": "sha256:5dcfccad03b47001b3bb3c8e3cc5f97293420ebbfe1c03be4e05e70a63b769e4"
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/events/snapshot.json b/.empirical/specs/taskboard-git-only-distribution/events/snapshot.json
new file mode 100644
index 0000000..066eb1f
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/events/snapshot.json
@@ -0,0 +1,50 @@
+{
+  "schemaVersion": 1,
+  "feature": "taskboard-git-only-distribution",
+  "lastSequence": 9,
+  "lastEventDigest": "sha256:9e3f31ba24fdf93e720753225176d0ccb7e8bd20541221e1769297fb8e7b93ab",
+  "stateDigest": "sha256:73c250c5242fcd9ca5704cf792865e3b45940103082ff6a2228850df01d557d1",
+  "state": {
+    "schemaVersion": 5,
+    "revision": 9,
+    "activeFeature": "taskboard-git-only-distribution",
+    "request": "Remove Taskboard's npm distribution path now and make Taskboard Git-only without touching Usage Tracker: mark the Taskboard workspace private/non-publishable while retaining its package name, dependencies, and npm-as-build-tool scripts required by BB Git installs; remove Taskboard publishConfig, prepack/files packaging contract where safe, tracked npm publish config, local publish credential/ignore entry, npm badges/links/install/update instructions, and root claims that every plugin ships through npm; document BB Community and direct Git semver install commands using plugins/taskboard and taskboard/ tags; update the living Taskboard distribution capability to Git-only; preserve immutable historical Empirical receipts. Verify builds/tests and marketplace Git source. The external npm unpublish of bb-plugin-taskboard versions 0.1.0 through 0.2.0 was explicitly authorized but npm rejected it with EOTP, so record the registry deletion as externally blocked rather than pretending it succeeded. Do not modify or unpublish Usage Tracker.",
+    "profile": "complex",
+    "workflow": "complex",
+    "mode": "normal",
+    "phase": "done",
+    "status": "done",
+    "repairAttempts": 0,
+    "message": "Integrated capability changes: taskboard-distribution",
+    "implementationActor": "agent",
+    "specDigest": "sha256:54ed39d23680f882fe1fb9e0dcbbd671e48a40bdf759e86f4bd842c9d54e44a0",
+    "approvedSpecRevision": 2,
+    "capabilityArchiveRequired": true,
+    "capabilityDeltaDigest": "sha256:3d8cbd211af3ded962d5a578b1ad200d6c8d3a31c0e13897301d17b636f35ce6",
+    "impactDigest": "sha256:1fa6e66c5ce24725f2ade1a81eddec6859f67bd95e0816db2a8fca35c29fe005",
+    "capabilityClaimId": "taskboard-git-only-distribution-59becfd36252",
+    "authorizationDigest": null,
+    "evidence": [],
+    "evidenceReceiptIds": [
+      "executed-f19eb7b3790a9c40e46b8d5e",
+      "collected-1106d5804579d9b3edad6f44",
+      "collected-15d9242299950347a8c1b852"
+    ],
+    "legacyEvidenceCount": 0,
+    "completion": {
+      "implemented": true,
+      "verified": true,
+      "integrated": true,
+      "delivered": false,
+      "published": false,
+      "highest": "integrated",
+      "reasons": {
+        "delivered": "delivered has not been proven by a durable receipt.",
+        "published": "published has not been proven by a durable receipt."
+      }
+    },
+    "updatedAt": "2026-08-26T23:36:55.519Z"
+  },
+  "compactedAt": "2026-08-26T23:36:55.541Z",
+  "digest": "sha256:f92aa647ffea51767b9dfa12297ddc38d52a7ba5d469ebc7e6df515701abef1d"
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/evidence/receipt-input.json b/.empirical/specs/taskboard-git-only-distribution/evidence/receipt-input.json
new file mode 100644
index 0000000..2745028
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/evidence/receipt-input.json
@@ -0,0 +1,16 @@
+{
+  "criteria": ["AC-1", "AC-2", "AC-3", "AC-4", "AC-5", "AC-6"],
+  "evidenceKinds": ["test"],
+  "summary": "Verified both plugins' private Git-only manifests/docs, both private-publish skips, Taskboard 0.3.1 and Usage Tracker 0.1.2 root checks, existing peeled Taskboard tag/GitHub Release provenance, prepared Git marketplace sources, unchanged historical receipts, and the accurate EOTP-then-external-unpublish registry timeline.",
+  "collector": "codex",
+  "artifacts": [
+    {
+      "path": ".empirical/specs/taskboard-git-only-distribution/evidence/verification.md",
+      "mediaType": "text/markdown"
+    },
+    {
+      "path": ".empirical/specs/taskboard-git-only-distribution/consults/security.md",
+      "mediaType": "text/markdown"
+    }
+  ]
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/collected-1106d5804579d9b3edad6f44.json b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/collected-1106d5804579d9b3edad6f44.json
new file mode 100644
index 0000000..9655a2f
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/collected-1106d5804579d9b3edad6f44.json
@@ -0,0 +1,44 @@
+{
+  "schemaVersion": 1,
+  "id": "collected-1106d5804579d9b3edad6f44",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-4",
+    "AC-5",
+    "AC-6"
+  ],
+  "evidenceKinds": [
+    "test"
+  ],
+  "summary": "Verified both plugins' private Git-only manifests/docs, both private-publish skips, Taskboard 0.3.1 and Usage Tracker 0.1.2 root checks, existing peeled Taskboard tag/GitHub Release provenance, prepared Git marketplace sources, unchanged historical receipts, and the accurate EOTP-then-external-unpublish registry timeline.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:30:41.075Z",
+  "completedAt": "2026-08-26T23:30:41.075Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "taskboard-git-only-distribution",
+    "specRevision": 2,
+    "specDigest": "sha256:54ed39d23680f882fe1fb9e0dcbbd671e48a40bdf759e86f4bd842c9d54e44a0",
+    "treeDigest": "sha256:deac688b840095986c27daa51b40e8aa823627780822aa174a9fe1450894ecab",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:9e10cac9079b0f50517e22a50d763d9b2e1ef9ccb4951723290315d83de9e26c",
+  "kind": "collected",
+  "collector": "codex",
+  "artifacts": [
+    {
+      "path": ".empirical/specs/taskboard-git-only-distribution/consults/security.md",
+      "mediaType": "text/markdown",
+      "bytes": 2642,
+      "digest": "sha256:461f37e583dd50dbc0a80d81bee81086d422786876fcd1b077737a8a4fabd2f2"
+    },
+    {
+      "path": ".empirical/specs/taskboard-git-only-distribution/evidence/verification.md",
+      "mediaType": "text/markdown",
+      "bytes": 4074,
+      "digest": "sha256:8680367d0df022177e62971161a01651256015c629284bd80d5ab6d3dfeff3a6"
+    }
+  ]
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/collected-15d9242299950347a8c1b852.json b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/collected-15d9242299950347a8c1b852.json
new file mode 100644
index 0000000..4dcfc44
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/collected-15d9242299950347a8c1b852.json
@@ -0,0 +1,44 @@
+{
+  "schemaVersion": 1,
+  "id": "collected-15d9242299950347a8c1b852",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-4",
+    "AC-5",
+    "AC-6"
+  ],
+  "evidenceKinds": [
+    "review"
+  ],
+  "summary": "Independent review passes every current two-plugin Git-only distribution requirement, confirms the accepted D-004 through D-006 supersessions, finds no implementation or supply-chain defects, and preserves integration, immutable tag, GitHub Release, and marketplace liveness as explicit post-approval gates.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:36:13.365Z",
+  "completedAt": "2026-08-26T23:36:13.365Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "taskboard-git-only-distribution",
+    "specRevision": 2,
+    "specDigest": "sha256:54ed39d23680f882fe1fb9e0dcbbd671e48a40bdf759e86f4bd842c9d54e44a0",
+    "treeDigest": "sha256:deac688b840095986c27daa51b40e8aa823627780822aa174a9fe1450894ecab",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:99cba4fb45bbc23d5811e4bbf2f411574a138e4a8525068634a9e7d42f24408c",
+  "kind": "collected",
+  "collector": "codex",
+  "artifacts": [
+    {
+      "path": ".empirical/specs/taskboard-git-only-distribution/consults/code-review.md",
+      "mediaType": "text/markdown",
+      "bytes": 5795,
+      "digest": "sha256:04c467945d373c08e12f9eeae782e020ed888ff4de3b134c6eef0901511f57bd"
+    },
+    {
+      "path": ".empirical/specs/taskboard-git-only-distribution/consults/security.md",
+      "mediaType": "text/markdown",
+      "bytes": 2642,
+      "digest": "sha256:461f37e583dd50dbc0a80d81bee81086d422786876fcd1b077737a8a4fabd2f2"
+    }
+  ]
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/collected-6ca4f648bad41af2413d76fd.json b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/collected-6ca4f648bad41af2413d76fd.json
new file mode 100644
index 0000000..66e65de
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/collected-6ca4f648bad41af2413d76fd.json
@@ -0,0 +1,44 @@
+{
+  "schemaVersion": 1,
+  "id": "collected-6ca4f648bad41af2413d76fd",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-4",
+    "AC-5",
+    "AC-6"
+  ],
+  "evidenceKinds": [
+    "test"
+  ],
+  "summary": "Verified both plugins' private Git-only manifests/docs, both private-publish skips, Taskboard 0.3.1 and Usage Tracker 0.1.2 root checks, existing peeled Taskboard tag/GitHub Release provenance, prepared Git marketplace sources, unchanged historical receipts, and the accurate EOTP-then-external-unpublish registry timeline.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:30:21.680Z",
+  "completedAt": "2026-08-26T23:30:21.680Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "taskboard-git-only-distribution",
+    "specRevision": 2,
+    "specDigest": "sha256:54ed39d23680f882fe1fb9e0dcbbd671e48a40bdf759e86f4bd842c9d54e44a0",
+    "treeDigest": "sha256:deac688b840095986c27daa51b40e8aa823627780822aa174a9fe1450894ecab",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:d19cff8d6ed59ef6a0a2e61d6ed0feda5581bae3fddb699d6755161c44894e3b",
+  "kind": "collected",
+  "collector": "codex",
+  "artifacts": [
+    {
+      "path": ".empirical/specs/taskboard-git-only-distribution/consults/security.md",
+      "mediaType": "text/markdown",
+      "bytes": 2646,
+      "digest": "sha256:9a1a3b98761a4ce7825e9e7aa679fefc288ee91dbb65b87256e0ce5ad240d0b2"
+    },
+    {
+      "path": ".empirical/specs/taskboard-git-only-distribution/evidence/verification.md",
+      "mediaType": "text/markdown",
+      "bytes": 4074,
+      "digest": "sha256:8680367d0df022177e62971161a01651256015c629284bd80d5ab6d3dfeff3a6"
+    }
+  ]
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/executed-118f3142702e649f30a2316e.json b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/executed-118f3142702e649f30a2316e.json
new file mode 100644
index 0000000..9ce0128
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/executed-118f3142702e649f30a2316e.json
@@ -0,0 +1,54 @@
+{
+  "schemaVersion": 1,
+  "id": "executed-118f3142702e649f30a2316e",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-4",
+    "AC-5",
+    "AC-6"
+  ],
+  "evidenceKinds": [
+    "test"
+  ],
+  "summary": "Run the repository-authorized root check after both externally unpublished plugins become Git-only: Taskboard 0.3.1 and Usage Tracker 0.1.2 private distribution guards, SDK contracts, TypeScript, 88 Taskboard tests, 13 Usage Tracker tests, and both production builds/metadata checks.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:27:27.921Z",
+  "completedAt": "2026-08-26T23:27:40.301Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "taskboard-git-only-distribution",
+    "specRevision": 2,
+    "specDigest": "sha256:54ed39d23680f882fe1fb9e0dcbbd671e48a40bdf759e86f4bd842c9d54e44a0",
+    "treeDigest": "sha256:fabfb740220c2d88c364f7ff2be9c7def9b2d074350c292460125dd412d3211b",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:c6712d647b41cf365fe449102357d3adf4753a36d5adefb65fbc3037247f1267",
+  "kind": "executed",
+  "command": {
+    "argv": [
+      "npm",
+      "run",
+      "check"
+    ],
+    "cwd": ".",
+    "timeoutMs": 900000,
+    "maxOutputBytes": 1048576,
+    "environmentKeys": [
+      "NO_COLOR",
+      "PATH"
+    ]
+  },
+  "result": {
+    "exitCode": 0,
+    "signal": null,
+    "timedOut": false,
+    "stdoutDigest": "sha256:218b64db9346285b86af62ca7e771f2ded6184f70414f5edc57cc4cb02e3251b",
+    "stderrDigest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "stdoutTail": " type: 'test'\n  ...\n# Subtest: documents only BB Community and direct Git installation for Taskboard\nok 65 - documents only BB Community and direct Git installation for Taskboard\n  ---\n  duration_ms: 0.346001\n  type: 'test'\n  ...\n# Subtest: keeps Usage Tracker private and documents its Git release too\nok 66 - keeps Usage Tracker private and documents its Git release too\n  ---\n  duration_ms: 5.845226\n  type: 'test'\n  ...\n# Subtest: parses a tagged model response into a ticket draft\nok 67 - parses a tagged model response into a ticket draft\n  ---\n  duration_ms: 1.606791\n  type: 'test'\n  ...\n# Subtest: rejects malformed or incomplete model output\nok 68 - rejects malformed or incomplete model output\n  ---\n  duration_ms: 0.659453\n  type: 'test'\n  ...\n# Subtest: builds a read-only repository-aware worker prompt\nok 69 - builds a read-only repository-aware worker prompt\n  ---\n  duration_ms: 0.194685\n  type: 'test'\n  ...\n# Subtest: keeps the original prompt as an editable fallback\nok 70 - keeps the original prompt as an editable fallback\n  ---\n  duration_ms: 0.182853\n  type: 'test'\n  ...\n# Subtest: selects the active thread project only when it still exists\nok 71 - selects the active thread project only when it still exists\n  ---\n  duration_ms: 0.607258\n  type: 'test'\n  ...\n# Subtest: treats a different thread in the same project as new context\nok 72 - treats a different thread in the same project as new context\n  ---\n  duration_ms: 0.134084\n  type: 'test'\n  ...\n# Subtest: reads the project and thread from a BB project route\nok 73 - reads the project and thread from a BB project route\n  ---\n  duration_ms: 0.475047\n  type: 'test'\n  ...\n# Subtest: uses only the immediately previous navigation entry as source context\nok 74 - uses only the immediately previous navigation entry as source context\n  ---\n  duration_ms: 0.173236\n  type: 'test'\n  ...\n# Subtest: never replaces an explicit Taskboard project selection with route context\nok 75 - never replaces an explicit Taskboard project selection with route context\n  ---\n  duration_ms: 0.148962\n  type: 'test'\n  ...\n# Subtest: writes project credentials atomically with owner-only permissions\nok 76 - writes project credentials atomically with owner-only permissions\n  ---\n  duration_ms: 5.370379\n  type: 'test'\n  ...\n# Subtest: deleting a missing credential is harmless\nok 77 - deleting a missing credential is harmless\n  ---\n  duration_ms: 0.707371\n  type: 'test'\n  ...\n# Subtest: cached summaries never retain provider comments\nok 78 - cached summaries never retain provider comments\n  ---\n  duration_ms: 1.222671\n  type: 'test'\n  ...\n# Subtest: provider creation results carry strict native assignee confirmation\nok 79 - provider creation results carry strict native assignee confirmation\n  ---\n  duration_ms: 0.159601\n  type: 'test'\n  ...\n# Subtest: metadata failures expose only a fixed server-safe message\nok 80 - metadata failures expose only a fixed server-safe message\n  ---\n  duration_ms: 0.247161\n  type: 'test'\n  ...\n# Subtest: finds Jira project keys from common configured JQL scopes\nok 81 - finds Jira project keys from common configured JQL scopes\n  ---\n  duration_ms: 0.583354\n  type: 'test'\n  ...\n# Subtest: binds issue creation to the tracker reviewed in the modal\nok 82 - binds issue creation to the tracker reviewed in the modal\n  ---\n  duration_ms: 0.291361\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after successful issue creation\nok 83 - refreshes authoritative provider data after successful issue creation\n  ---\n  duration_ms: 0.155775\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after ambiguous issue creation failure\nok 84 - refreshes authoritative provider data after ambiguous issue creation failure\n  ---\n  duration_ms: 0.182323\n  type: 'test'\n  ...\n# Subtest: keeps structural headers on neutral host theme surfaces\nok 85 - keeps structural headers on neutral host theme surfaces\n  ---\n  duration_ms: 0.900514\n  type: 'test'\n  ...\n# Subtest: uses restrained state glyph, focus, and conversation treatments\nok 86 - uses restrained state glyph, focus, and conversation treatments\n  ---\n  duration_ms: 0.315144\n  type: 'test'\n  ...\n# Subtest: keeps constrained filter values inside the vertical menu measure\nok 87 - keeps constrained filter values inside the vertical menu measure\n  ---\n  duration_ms: 0.210684\n  type: 'test'\n  ...\n# Subtest: keeps assignee avatars compact with six theme-safe identity tones\nok 88 - keeps assignee avatars compact with six theme-safe identity tones\n  ---\n  duration_ms: 0.342805\n  type: 'test'\n  ...\n1..88\n# tests 88\n# suites 0\n# pass 88\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 299.537665\n\n> bb-plugin-taskboard@0.3.1 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n\n> bb-plugin-taskboard@0.3.1 verify:build\n> node scripts/verify-build.mjs\n\nTaskboard build metadata is valid.\n\n> bb-plugin-usage-tracker@0.1.2 check\n> npm run types:check && npm run typecheck && npm test && npm run build\n\n\n> bb-plugin-usage-tracker@0.1.2 types:check\n> env -u BB_CLI bb plugin types --check .\n\nThis plugin uses the npm package @get-bb/plugin-sdk; pin is 0.4.6, host is 0.4.6.\nThe declarations are in node_modules/@get-bb/plugin-sdk/bundled-types/ — read them for exact signatures.\n\n> bb-plugin-usage-tracker@0.1.2 typecheck\n> tsc --noEmit\n\n\n> bb-plugin-usage-tracker@0.1.2 test\n> node --test --experimental-strip-types test/*.test.ts\n\nTAP version 13\n# Subtest: enables sidebar providers independently in display order\nok 1 - enables sidebar providers independently in display order\n  ---\n  duration_ms: 0.891096\n  type: 'test'\n  ...\n# Subtest: normalizes providers in stable order with every usage window\nok 2 - normalizes providers in stable order with every usage window\n  ---\n  duration_ms: 0.473524\n  type: 'test'\n  ...\n# Subtest: normalizes not-installed and provider-error states\nok 3 - normalizes not-installed and provider-error states\n  ---\n  duration_ms: 0.170371\n  type: 'test'\n  ...\n# Subtest: clamps progress geometry and rejects non-finite values\nok 4 - clamps progress geometry and rejects non-finite values\n  ---\n  duration_ms: 0.256268\n  type: 'test'\n  ...\n# Subtest: formats reset, update, percentage, and cost copy safely\nok 5 - formats reset, update, percentage, and cost copy safely\n  ---\n  duration_ms: 9.932173\n  type: 'test'\n  ...\n# Subtest: projects five-hour and weekly windows into the compact sidebar copy\nok 6 - projects five-hour and weekly windows into the compact sidebar copy\n  ---\n  duration_ms: 0.285561\n  type: 'test'\n  ...\n# Subtest: keeps last-known sidebar windows through partial and failed refreshes\nok 7 - keeps last-known sidebar windows through partial and failed refreshes\n  ---\n  duration_ms: 0.692624\n  type: 'test'\n  ...\n# Subtest: resolves the thread environment host\nok 8 - resolves the thread environment host\n  ---\n  duration_ms: 0.171924\n  type: 'test'\n  ...\n# Subtest: falls back when a thread has no environment or lookup fails\nok 9 - falls back when a thread has no environment or lookup fails\n  ---\n  duration_ms: 0.256769\n  type: 'test'\n  ...\n# Subtest: loads usage for the resolved host and tolerates missing host metadata\nok 10 - loads usage for the resolved host and tolerates missing host metadata\n  ---\n  duration_ms: 0.399509\n  type: 'test'\n  ...\n# Subtest: omits host override for primary-machine fallback\nok 11 - omits host override for primary-machine fallback\n  ---\n  duration_ms: 0.226013\n  type: 'test'\n  ...\n# Subtest: loads the primary machine directly for the sidebar strip\nok 12 - loads the primary machine directly for the sidebar strip\n  ---\n  duration_ms: 0.133914\n  type: 'test'\n  ...\n# Subtest: propagates thread and request-level usage failures\nok 13 - propagates thread and request-level usage failures\n  ---\n  duration_ms: 0.211406\n  type: 'test'\n  ...\n1..13\n# tests 13\n# suites 0\n# pass 13\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 86.681099\n\n> bb-plugin-usage-tracker@0.1.2 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n",
+    "stderrTail": "",
+    "stdoutTruncated": false,
+    "stderrTruncated": false
+  }
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/executed-468341f61acc3e2c5823ab8d.json b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/executed-468341f61acc3e2c5823ab8d.json
new file mode 100644
index 0000000..6042347
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/executed-468341f61acc3e2c5823ab8d.json
@@ -0,0 +1,54 @@
+{
+  "schemaVersion": 1,
+  "id": "executed-468341f61acc3e2c5823ab8d",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-4",
+    "AC-5",
+    "AC-6"
+  ],
+  "evidenceKinds": [
+    "test"
+  ],
+  "summary": "Run the repository-authorized root check after Taskboard becomes Git-only: private distribution guard, SDK contracts, TypeScript, 88 Taskboard tests, production build/metadata verification, plus unchanged Usage Tracker TypeScript, 13 tests, and build.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:09:19.383Z",
+  "completedAt": "2026-08-26T23:09:32.080Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "taskboard-git-only-distribution",
+    "specRevision": 2,
+    "specDigest": "sha256:54ed39d23680f882fe1fb9e0dcbbd671e48a40bdf759e86f4bd842c9d54e44a0",
+    "treeDigest": "sha256:8ebc03f5044e0969feb50f685bda5611a79368ee8a1553e51c462c728b324531",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:2a5619b6679851e16e2ae20c24abac9e6eea430650b5894aa67c2926ccc6e988",
+  "kind": "executed",
+  "command": {
+    "argv": [
+      "npm",
+      "run",
+      "check"
+    ],
+    "cwd": ".",
+    "timeoutMs": 900000,
+    "maxOutputBytes": 1048576,
+    "environmentKeys": [
+      "NO_COLOR",
+      "PATH"
+    ]
+  },
+  "result": {
+    "exitCode": 0,
+    "signal": null,
+    "timedOut": false,
+    "stdoutDigest": "sha256:68c3c22036dd7fef04b792c535b47b7fd985fd9e0b537ab427960638fd8c2b80",
+    "stderrDigest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "stdoutTail": "tion_ms: 0.558007\n  type: 'test'\n  ...\n# Subtest: documents only BB Community and direct Git installation for Taskboard\nok 65 - documents only BB Community and direct Git installation for Taskboard\n  ---\n  duration_ms: 0.218088\n  type: 'test'\n  ...\n# Subtest: preserves Usage Tracker npm distribution independently\nok 66 - preserves Usage Tracker npm distribution independently\n  ---\n  duration_ms: 0.518655\n  type: 'test'\n  ...\n# Subtest: parses a tagged model response into a ticket draft\nok 67 - parses a tagged model response into a ticket draft\n  ---\n  duration_ms: 2.038104\n  type: 'test'\n  ...\n# Subtest: rejects malformed or incomplete model output\nok 68 - rejects malformed or incomplete model output\n  ---\n  duration_ms: 0.756178\n  type: 'test'\n  ...\n# Subtest: builds a read-only repository-aware worker prompt\nok 69 - builds a read-only repository-aware worker prompt\n  ---\n  duration_ms: 0.215643\n  type: 'test'\n  ...\n# Subtest: keeps the original prompt as an editable fallback\nok 70 - keeps the original prompt as an editable fallback\n  ---\n  duration_ms: 0.221935\n  type: 'test'\n  ...\n# Subtest: selects the active thread project only when it still exists\nok 71 - selects the active thread project only when it still exists\n  ---\n  duration_ms: 0.600564\n  type: 'test'\n  ...\n# Subtest: treats a different thread in the same project as new context\nok 72 - treats a different thread in the same project as new context\n  ---\n  duration_ms: 0.169118\n  type: 'test'\n  ...\n# Subtest: reads the project and thread from a BB project route\nok 73 - reads the project and thread from a BB project route\n  ---\n  duration_ms: 0.500552\n  type: 'test'\n  ...\n# Subtest: uses only the immediately previous navigation entry as source context\nok 74 - uses only the immediately previous navigation entry as source context\n  ---\n  duration_ms: 0.14241\n  type: 'test'\n  ...\n# Subtest: never replaces an explicit Taskboard project selection with route context\nok 75 - never replaces an explicit Taskboard project selection with route context\n  ---\n  duration_ms: 0.160142\n  type: 'test'\n  ...\n# Subtest: writes project credentials atomically with owner-only permissions\nok 76 - writes project credentials atomically with owner-only permissions\n  ---\n  duration_ms: 6.697998\n  type: 'test'\n  ...\n# Subtest: deleting a missing credential is harmless\nok 77 - deleting a missing credential is harmless\n  ---\n  duration_ms: 0.75699\n  type: 'test'\n  ...\n# Subtest: cached summaries never retain provider comments\nok 78 - cached summaries never retain provider comments\n  ---\n  duration_ms: 0.928903\n  type: 'test'\n  ...\n# Subtest: provider creation results carry strict native assignee confirmation\nok 79 - provider creation results carry strict native assignee confirmation\n  ---\n  duration_ms: 0.125569\n  type: 'test'\n  ...\n# Subtest: metadata failures expose only a fixed server-safe message\nok 80 - metadata failures expose only a fixed server-safe message\n  ---\n  duration_ms: 0.23592\n  type: 'test'\n  ...\n# Subtest: finds Jira project keys from common configured JQL scopes\nok 81 - finds Jira project keys from common configured JQL scopes\n  ---\n  duration_ms: 0.548609\n  type: 'test'\n  ...\n# Subtest: binds issue creation to the tracker reviewed in the modal\nok 82 - binds issue creation to the tracker reviewed in the modal\n  ---\n  duration_ms: 0.370746\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after successful issue creation\nok 83 - refreshes authoritative provider data after successful issue creation\n  ---\n  duration_ms: 0.174498\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after ambiguous issue creation failure\nok 84 - refreshes authoritative provider data after ambiguous issue creation failure\n  ---\n  duration_ms: 0.207648\n  type: 'test'\n  ...\n# Subtest: keeps structural headers on neutral host theme surfaces\nok 85 - keeps structural headers on neutral host theme surfaces\n  ---\n  duration_ms: 0.723729\n  type: 'test'\n  ...\n# Subtest: uses restrained state glyph, focus, and conversation treatments\nok 86 - uses restrained state glyph, focus, and conversation treatments\n  ---\n  duration_ms: 0.237283\n  type: 'test'\n  ...\n# Subtest: keeps constrained filter values inside the vertical menu measure\nok 87 - keeps constrained filter values inside the vertical menu measure\n  ---\n  duration_ms: 0.151896\n  type: 'test'\n  ...\n# Subtest: keeps assignee avatars compact with six theme-safe identity tones\nok 88 - keeps assignee avatars compact with six theme-safe identity tones\n  ---\n  duration_ms: 0.248282\n  type: 'test'\n  ...\n1..88\n# tests 88\n# suites 0\n# pass 88\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 261.175436\n\n> bb-plugin-taskboard@0.3.0 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n\n> bb-plugin-taskboard@0.3.0 verify:build\n> node scripts/verify-build.mjs\n\nTaskboard build metadata is valid.\n\n> bb-plugin-usage-tracker@0.1.2 check\n> npm run types:check && npm run typecheck && npm test && npm run build\n\n\n> bb-plugin-usage-tracker@0.1.2 types:check\n> env -u BB_CLI bb plugin types --check .\n\nThis plugin uses the npm package @get-bb/plugin-sdk; pin is 0.4.6, host is 0.4.6.\nThe declarations are in node_modules/@get-bb/plugin-sdk/bundled-types/ — read them for exact signatures.\n\n> bb-plugin-usage-tracker@0.1.2 typecheck\n> tsc --noEmit\n\n\n> bb-plugin-usage-tracker@0.1.2 test\n> node --test --experimental-strip-types test/*.test.ts\n\nTAP version 13\n# Subtest: enables sidebar providers independently in display order\nok 1 - enables sidebar providers independently in display order\n  ---\n  duration_ms: 0.904107\n  type: 'test'\n  ...\n# Subtest: normalizes providers in stable order with every usage window\nok 2 - normalizes providers in stable order with every usage window\n  ---\n  duration_ms: 0.451263\n  type: 'test'\n  ...\n# Subtest: normalizes not-installed and provider-error states\nok 3 - normalizes not-installed and provider-error states\n  ---\n  duration_ms: 0.163308\n  type: 'test'\n  ...\n# Subtest: clamps progress geometry and rejects non-finite values\nok 4 - clamps progress geometry and rejects non-finite values\n  ---\n  duration_ms: 0.258621\n  type: 'test'\n  ...\n# Subtest: formats reset, update, percentage, and cost copy safely\nok 5 - formats reset, update, percentage, and cost copy safely\n  ---\n  duration_ms: 9.696643\n  type: 'test'\n  ...\n# Subtest: projects five-hour and weekly windows into the compact sidebar copy\nok 6 - projects five-hour and weekly windows into the compact sidebar copy\n  ---\n  duration_ms: 0.590476\n  type: 'test'\n  ...\n# Subtest: keeps last-known sidebar windows through partial and failed refreshes\nok 7 - keeps last-known sidebar windows through partial and failed refreshes\n  ---\n  duration_ms: 1.393991\n  type: 'test'\n  ...\n# Subtest: resolves the thread environment host\nok 8 - resolves the thread environment host\n  ---\n  duration_ms: 0.149673\n  type: 'test'\n  ...\n# Subtest: falls back when a thread has no environment or lookup fails\nok 9 - falls back when a thread has no environment or lookup fails\n  ---\n  duration_ms: 0.271945\n  type: 'test'\n  ...\n# Subtest: loads usage for the resolved host and tolerates missing host metadata\nok 10 - loads usage for the resolved host and tolerates missing host metadata\n  ---\n  duration_ms: 0.412372\n  type: 'test'\n  ...\n# Subtest: omits host override for primary-machine fallback\nok 11 - omits host override for primary-machine fallback\n  ---\n  duration_ms: 0.19758\n  type: 'test'\n  ...\n# Subtest: loads the primary machine directly for the sidebar strip\nok 12 - loads the primary machine directly for the sidebar strip\n  ---\n  duration_ms: 0.113907\n  type: 'test'\n  ...\n# Subtest: propagates thread and request-level usage failures\nok 13 - propagates thread and request-level usage failures\n  ---\n  duration_ms: 0.214831\n  type: 'test'\n  ...\n1..13\n# tests 13\n# suites 0\n# pass 13\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 82.66797\n\n> bb-plugin-usage-tracker@0.1.2 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n",
+    "stderrTail": "",
+    "stdoutTruncated": false,
+    "stderrTruncated": false
+  }
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/executed-7ec09e583ac2fa48c42ddb48.json b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/executed-7ec09e583ac2fa48c42ddb48.json
new file mode 100644
index 0000000..1d7bbde
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/executed-7ec09e583ac2fa48c42ddb48.json
@@ -0,0 +1,54 @@
+{
+  "schemaVersion": 1,
+  "id": "executed-7ec09e583ac2fa48c42ddb48",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-4",
+    "AC-5",
+    "AC-6"
+  ],
+  "evidenceKinds": [
+    "test"
+  ],
+  "summary": "Run the repository-authorized root check after both externally unpublished plugins become Git-only: private distribution guards, SDK contracts, TypeScript, 88 Taskboard tests, 13 Usage Tracker tests, and both production builds/metadata checks.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:20:12.068Z",
+  "completedAt": "2026-08-26T23:20:24.530Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "taskboard-git-only-distribution",
+    "specRevision": 2,
+    "specDigest": "sha256:54ed39d23680f882fe1fb9e0dcbbd671e48a40bdf759e86f4bd842c9d54e44a0",
+    "treeDigest": "sha256:a5d5fe218dc4ef299e8403c2a774587bfc8baed99a0d0fbaccbd58d0dfe274eb",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:e4dc3274a36878b82e224e4fe8a415a559ce967f3bd0b0c2b4f0acac8de25e94",
+  "kind": "executed",
+  "command": {
+    "argv": [
+      "npm",
+      "run",
+      "check"
+    ],
+    "cwd": ".",
+    "timeoutMs": 900000,
+    "maxOutputBytes": 1048576,
+    "environmentKeys": [
+      "NO_COLOR",
+      "PATH"
+    ]
+  },
+  "result": {
+    "exitCode": 0,
+    "signal": null,
+    "timedOut": false,
+    "stdoutDigest": "sha256:63b56d0a276819d73c9d8c350bacb85b0dbde6f9d99fbfc0118cae71f2b5b727",
+    "stderrDigest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "stdoutTail": "98775\n  type: 'test'\n  ...\n# Subtest: documents only BB Community and direct Git installation for Taskboard\nok 65 - documents only BB Community and direct Git installation for Taskboard\n  ---\n  duration_ms: 0.322518\n  type: 'test'\n  ...\n# Subtest: keeps Usage Tracker private and documents its Git release too\nok 66 - keeps Usage Tracker private and documents its Git release too\n  ---\n  duration_ms: 5.850113\n  type: 'test'\n  ...\n# Subtest: parses a tagged model response into a ticket draft\nok 67 - parses a tagged model response into a ticket draft\n  ---\n  duration_ms: 1.82154\n  type: 'test'\n  ...\n# Subtest: rejects malformed or incomplete model output\nok 68 - rejects malformed or incomplete model output\n  ---\n  duration_ms: 1.19055\n  type: 'test'\n  ...\n# Subtest: builds a read-only repository-aware worker prompt\nok 69 - builds a read-only repository-aware worker prompt\n  ---\n  duration_ms: 0.249836\n  type: 'test'\n  ...\n# Subtest: keeps the original prompt as an editable fallback\nok 70 - keeps the original prompt as an editable fallback\n  ---\n  duration_ms: 0.23543\n  type: 'test'\n  ...\n# Subtest: selects the active thread project only when it still exists\nok 71 - selects the active thread project only when it still exists\n  ---\n  duration_ms: 0.702501\n  type: 'test'\n  ...\n# Subtest: treats a different thread in the same project as new context\nok 72 - treats a different thread in the same project as new context\n  ---\n  duration_ms: 0.135858\n  type: 'test'\n  ...\n# Subtest: reads the project and thread from a BB project route\nok 73 - reads the project and thread from a BB project route\n  ---\n  duration_ms: 0.500593\n  type: 'test'\n  ...\n# Subtest: uses only the immediately previous navigation entry as source context\nok 74 - uses only the immediately previous navigation entry as source context\n  ---\n  duration_ms: 0.135577\n  type: 'test'\n  ...\n# Subtest: never replaces an explicit Taskboard project selection with route context\nok 75 - never replaces an explicit Taskboard project selection with route context\n  ---\n  duration_ms: 0.098389\n  type: 'test'\n  ...\n# Subtest: writes project credentials atomically with owner-only permissions\nok 76 - writes project credentials atomically with owner-only permissions\n  ---\n  duration_ms: 5.735273\n  type: 'test'\n  ...\n# Subtest: deleting a missing credential is harmless\nok 77 - deleting a missing credential is harmless\n  ---\n  duration_ms: 0.988601\n  type: 'test'\n  ...\n# Subtest: cached summaries never retain provider comments\nok 78 - cached summaries never retain provider comments\n  ---\n  duration_ms: 0.968756\n  type: 'test'\n  ...\n# Subtest: provider creation results carry strict native assignee confirmation\nok 79 - provider creation results carry strict native assignee confirmation\n  ---\n  duration_ms: 0.140376\n  type: 'test'\n  ...\n# Subtest: metadata failures expose only a fixed server-safe message\nok 80 - metadata failures expose only a fixed server-safe message\n  ---\n  duration_ms: 0.248372\n  type: 'test'\n  ...\n# Subtest: finds Jira project keys from common configured JQL scopes\nok 81 - finds Jira project keys from common configured JQL scopes\n  ---\n  duration_ms: 0.528644\n  type: 'test'\n  ...\n# Subtest: binds issue creation to the tracker reviewed in the modal\nok 82 - binds issue creation to the tracker reviewed in the modal\n  ---\n  duration_ms: 0.324201\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after successful issue creation\nok 83 - refreshes authoritative provider data after successful issue creation\n  ---\n  duration_ms: 0.191519\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after ambiguous issue creation failure\nok 84 - refreshes authoritative provider data after ambiguous issue creation failure\n  ---\n  duration_ms: 0.196558\n  type: 'test'\n  ...\n# Subtest: keeps structural headers on neutral host theme surfaces\nok 85 - keeps structural headers on neutral host theme surfaces\n  ---\n  duration_ms: 0.678977\n  type: 'test'\n  ...\n# Subtest: uses restrained state glyph, focus, and conversation treatments\nok 86 - uses restrained state glyph, focus, and conversation treatments\n  ---\n  duration_ms: 0.202358\n  type: 'test'\n  ...\n# Subtest: keeps constrained filter values inside the vertical menu measure\nok 87 - keeps constrained filter values inside the vertical menu measure\n  ---\n  duration_ms: 0.134104\n  type: 'test'\n  ...\n# Subtest: keeps assignee avatars compact with six theme-safe identity tones\nok 88 - keeps assignee avatars compact with six theme-safe identity tones\n  ---\n  duration_ms: 0.232905\n  type: 'test'\n  ...\n1..88\n# tests 88\n# suites 0\n# pass 88\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 238.072005\n\n> bb-plugin-taskboard@0.3.0 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n\n> bb-plugin-taskboard@0.3.0 verify:build\n> node scripts/verify-build.mjs\n\nTaskboard build metadata is valid.\n\n> bb-plugin-usage-tracker@0.1.2 check\n> npm run types:check && npm run typecheck && npm test && npm run build\n\n\n> bb-plugin-usage-tracker@0.1.2 types:check\n> env -u BB_CLI bb plugin types --check .\n\nThis plugin uses the npm package @get-bb/plugin-sdk; pin is 0.4.6, host is 0.4.6.\nThe declarations are in node_modules/@get-bb/plugin-sdk/bundled-types/ — read them for exact signatures.\n\n> bb-plugin-usage-tracker@0.1.2 typecheck\n> tsc --noEmit\n\n\n> bb-plugin-usage-tracker@0.1.2 test\n> node --test --experimental-strip-types test/*.test.ts\n\nTAP version 13\n# Subtest: enables sidebar providers independently in display order\nok 1 - enables sidebar providers independently in display order\n  ---\n  duration_ms: 0.87772\n  type: 'test'\n  ...\n# Subtest: normalizes providers in stable order with every usage window\nok 2 - normalizes providers in stable order with every usage window\n  ---\n  duration_ms: 0.457885\n  type: 'test'\n  ...\n# Subtest: normalizes not-installed and provider-error states\nok 3 - normalizes not-installed and provider-error states\n  ---\n  duration_ms: 0.163608\n  type: 'test'\n  ...\n# Subtest: clamps progress geometry and rejects non-finite values\nok 4 - clamps progress geometry and rejects non-finite values\n  ---\n  duration_ms: 0.278638\n  type: 'test'\n  ...\n# Subtest: formats reset, update, percentage, and cost copy safely\nok 5 - formats reset, update, percentage, and cost copy safely\n  ---\n  duration_ms: 18.716094\n  type: 'test'\n  ...\n# Subtest: projects five-hour and weekly windows into the compact sidebar copy\nok 6 - projects five-hour and weekly windows into the compact sidebar copy\n  ---\n  duration_ms: 0.327187\n  type: 'test'\n  ...\n# Subtest: keeps last-known sidebar windows through partial and failed refreshes\nok 7 - keeps last-known sidebar windows through partial and failed refreshes\n  ---\n  duration_ms: 0.28533\n  type: 'test'\n  ...\n# Subtest: resolves the thread environment host\nok 8 - resolves the thread environment host\n  ---\n  duration_ms: 0.134034\n  type: 'test'\n  ...\n# Subtest: falls back when a thread has no environment or lookup fails\nok 9 - falls back when a thread has no environment or lookup fails\n  ---\n  duration_ms: 0.272778\n  type: 'test'\n  ...\n# Subtest: loads usage for the resolved host and tolerates missing host metadata\nok 10 - loads usage for the resolved host and tolerates missing host metadata\n  ---\n  duration_ms: 0.371998\n  type: 'test'\n  ...\n# Subtest: omits host override for primary-machine fallback\nok 11 - omits host override for primary-machine fallback\n  ---\n  duration_ms: 0.1867\n  type: 'test'\n  ...\n# Subtest: loads the primary machine directly for the sidebar strip\nok 12 - loads the primary machine directly for the sidebar strip\n  ---\n  duration_ms: 0.13724\n  type: 'test'\n  ...\n# Subtest: propagates thread and request-level usage failures\nok 13 - propagates thread and request-level usage failures\n  ---\n  duration_ms: 0.208841\n  type: 'test'\n  ...\n1..13\n# tests 13\n# suites 0\n# pass 13\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 88.798514\n\n> bb-plugin-usage-tracker@0.1.2 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n",
+    "stderrTail": "",
+    "stdoutTruncated": false,
+    "stderrTruncated": false
+  }
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/executed-f19eb7b3790a9c40e46b8d5e.json b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/executed-f19eb7b3790a9c40e46b8d5e.json
new file mode 100644
index 0000000..62cfdea
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/evidence/receipts/executed-f19eb7b3790a9c40e46b8d5e.json
@@ -0,0 +1,54 @@
+{
+  "schemaVersion": 1,
+  "id": "executed-f19eb7b3790a9c40e46b8d5e",
+  "criteria": [
+    "AC-1",
+    "AC-2",
+    "AC-3",
+    "AC-4",
+    "AC-5",
+    "AC-6"
+  ],
+  "evidenceKinds": [
+    "test"
+  ],
+  "summary": "Run the repository-authorized root check after both externally unpublished plugins become Git-only: Taskboard 0.3.1 and Usage Tracker 0.1.2 private distribution guards, SDK contracts, TypeScript, 88 Taskboard tests, 13 Usage Tracker tests, and both production builds/metadata checks.",
+  "passed": true,
+  "startedAt": "2026-08-26T23:29:40.602Z",
+  "completedAt": "2026-08-26T23:29:54.812Z",
+  "provenance": {
+    "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+    "feature": "taskboard-git-only-distribution",
+    "specRevision": 2,
+    "specDigest": "sha256:54ed39d23680f882fe1fb9e0dcbbd671e48a40bdf759e86f4bd842c9d54e44a0",
+    "treeDigest": "sha256:deac688b840095986c27daa51b40e8aa823627780822aa174a9fe1450894ecab",
+    "policyDigest": "sha256:7c18173a28be47b19532e93c96241fd9557e3ca63f1915ecdbf7a1de162f934e"
+  },
+  "digest": "sha256:70e0e77f2611597c6b789c4531c7a1f9798c5308fe8415b6e46d468846c00711",
+  "kind": "executed",
+  "command": {
+    "argv": [
+      "npm",
+      "run",
+      "check"
+    ],
+    "cwd": ".",
+    "timeoutMs": 900000,
+    "maxOutputBytes": 1048576,
+    "environmentKeys": [
+      "NO_COLOR",
+      "PATH"
+    ]
+  },
+  "result": {
+    "exitCode": 0,
+    "signal": null,
+    "timedOut": false,
+    "stdoutDigest": "sha256:522d976d288d5cbf56625cd1648d0e456bca1a48b4c78c7f82c532b251ede222",
+    "stderrDigest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "stdoutTail": "ype: 'test'\n  ...\n# Subtest: documents only BB Community and direct Git installation for Taskboard\nok 65 - documents only BB Community and direct Git installation for Taskboard\n  ---\n  duration_ms: 0.496757\n  type: 'test'\n  ...\n# Subtest: keeps Usage Tracker private and documents its Git release too\nok 66 - keeps Usage Tracker private and documents its Git release too\n  ---\n  duration_ms: 6.427946\n  type: 'test'\n  ...\n# Subtest: parses a tagged model response into a ticket draft\nok 67 - parses a tagged model response into a ticket draft\n  ---\n  duration_ms: 4.740428\n  type: 'test'\n  ...\n# Subtest: rejects malformed or incomplete model output\nok 68 - rejects malformed or incomplete model output\n  ---\n  duration_ms: 0.914659\n  type: 'test'\n  ...\n# Subtest: builds a read-only repository-aware worker prompt\nok 69 - builds a read-only repository-aware worker prompt\n  ---\n  duration_ms: 0.270494\n  type: 'test'\n  ...\n# Subtest: keeps the original prompt as an editable fallback\nok 70 - keeps the original prompt as an editable fallback\n  ---\n  duration_ms: 0.259083\n  type: 'test'\n  ...\n# Subtest: selects the active thread project only when it still exists\nok 71 - selects the active thread project only when it still exists\n  ---\n  duration_ms: 0.637944\n  type: 'test'\n  ...\n# Subtest: treats a different thread in the same project as new context\nok 72 - treats a different thread in the same project as new context\n  ---\n  duration_ms: 0.131069\n  type: 'test'\n  ...\n# Subtest: reads the project and thread from a BB project route\nok 73 - reads the project and thread from a BB project route\n  ---\n  duration_ms: 0.511534\n  type: 'test'\n  ...\n# Subtest: uses only the immediately previous navigation entry as source context\nok 74 - uses only the immediately previous navigation entry as source context\n  ---\n  duration_ms: 0.148692\n  type: 'test'\n  ...\n# Subtest: never replaces an explicit Taskboard project selection with route context\nok 75 - never replaces an explicit Taskboard project selection with route context\n  ---\n  duration_ms: 0.111073\n  type: 'test'\n  ...\n# Subtest: writes project credentials atomically with owner-only permissions\nok 76 - writes project credentials atomically with owner-only permissions\n  ---\n  duration_ms: 15.825661\n  type: 'test'\n  ...\n# Subtest: deleting a missing credential is harmless\nok 77 - deleting a missing credential is harmless\n  ---\n  duration_ms: 1.864611\n  type: 'test'\n  ...\n# Subtest: cached summaries never retain provider comments\nok 78 - cached summaries never retain provider comments\n  ---\n  duration_ms: 1.357076\n  type: 'test'\n  ...\n# Subtest: provider creation results carry strict native assignee confirmation\nok 79 - provider creation results carry strict native assignee confirmation\n  ---\n  duration_ms: 0.20279\n  type: 'test'\n  ...\n# Subtest: metadata failures expose only a fixed server-safe message\nok 80 - metadata failures expose only a fixed server-safe message\n  ---\n  duration_ms: 0.342244\n  type: 'test'\n  ...\n# Subtest: finds Jira project keys from common configured JQL scopes\nok 81 - finds Jira project keys from common configured JQL scopes\n  ---\n  duration_ms: 0.725143\n  type: 'test'\n  ...\n# Subtest: binds issue creation to the tracker reviewed in the modal\nok 82 - binds issue creation to the tracker reviewed in the modal\n  ---\n  duration_ms: 0.456253\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after successful issue creation\nok 83 - refreshes authoritative provider data after successful issue creation\n  ---\n  duration_ms: 0.256749\n  type: 'test'\n  ...\n# Subtest: refreshes authoritative provider data after ambiguous issue creation failure\nok 84 - refreshes authoritative provider data after ambiguous issue creation failure\n  ---\n  duration_ms: 0.266586\n  type: 'test'\n  ...\n# Subtest: keeps structural headers on neutral host theme surfaces\nok 85 - keeps structural headers on neutral host theme surfaces\n  ---\n  duration_ms: 0.962075\n  type: 'test'\n  ...\n# Subtest: uses restrained state glyph, focus, and conversation treatments\nok 86 - uses restrained state glyph, focus, and conversation treatments\n  ---\n  duration_ms: 0.280622\n  type: 'test'\n  ...\n# Subtest: keeps constrained filter values inside the vertical menu measure\nok 87 - keeps constrained filter values inside the vertical menu measure\n  ---\n  duration_ms: 0.244005\n  type: 'test'\n  ...\n# Subtest: keeps assignee avatars compact with six theme-safe identity tones\nok 88 - keeps assignee avatars compact with six theme-safe identity tones\n  ---\n  duration_ms: 0.359506\n  type: 'test'\n  ...\n1..88\n# tests 88\n# suites 0\n# pass 88\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 384.705907\n\n> bb-plugin-taskboard@0.3.1 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n\n> bb-plugin-taskboard@0.3.1 verify:build\n> node scripts/verify-build.mjs\n\nTaskboard build metadata is valid.\n\n> bb-plugin-usage-tracker@0.1.2 check\n> npm run types:check && npm run typecheck && npm test && npm run build\n\n\n> bb-plugin-usage-tracker@0.1.2 types:check\n> env -u BB_CLI bb plugin types --check .\n\nThis plugin uses the npm package @get-bb/plugin-sdk; pin is 0.4.6, host is 0.4.6.\nThe declarations are in node_modules/@get-bb/plugin-sdk/bundled-types/ — read them for exact signatures.\n\n> bb-plugin-usage-tracker@0.1.2 typecheck\n> tsc --noEmit\n\n\n> bb-plugin-usage-tracker@0.1.2 test\n> node --test --experimental-strip-types test/*.test.ts\n\nTAP version 13\n# Subtest: enables sidebar providers independently in display order\nok 1 - enables sidebar providers independently in display order\n  ---\n  duration_ms: 1.201592\n  type: 'test'\n  ...\n# Subtest: normalizes providers in stable order with every usage window\nok 2 - normalizes providers in stable order with every usage window\n  ---\n  duration_ms: 0.589876\n  type: 'test'\n  ...\n# Subtest: normalizes not-installed and provider-error states\nok 3 - normalizes not-installed and provider-error states\n  ---\n  duration_ms: 0.253072\n  type: 'test'\n  ...\n# Subtest: clamps progress geometry and rejects non-finite values\nok 4 - clamps progress geometry and rejects non-finite values\n  ---\n  duration_ms: 0.462022\n  type: 'test'\n  ...\n# Subtest: formats reset, update, percentage, and cost copy safely\nok 5 - formats reset, update, percentage, and cost copy safely\n  ---\n  duration_ms: 15.059053\n  type: 'test'\n  ...\n# Subtest: projects five-hour and weekly windows into the compact sidebar copy\nok 6 - projects five-hour and weekly windows into the compact sidebar copy\n  ---\n  duration_ms: 0.352554\n  type: 'test'\n  ...\n# Subtest: keeps last-known sidebar windows through partial and failed refreshes\nok 7 - keeps last-known sidebar windows through partial and failed refreshes\n  ---\n  duration_ms: 1.142254\n  type: 'test'\n  ...\n# Subtest: resolves the thread environment host\nok 8 - resolves the thread environment host\n  ---\n  duration_ms: 0.249445\n  type: 'test'\n  ...\n# Subtest: falls back when a thread has no environment or lookup fails\nok 9 - falls back when a thread has no environment or lookup fails\n  ---\n  duration_ms: 0.314794\n  type: 'test'\n  ...\n# Subtest: loads usage for the resolved host and tolerates missing host metadata\nok 10 - loads usage for the resolved host and tolerates missing host metadata\n  ---\n  duration_ms: 0.485817\n  type: 'test'\n  ...\n# Subtest: omits host override for primary-machine fallback\nok 11 - omits host override for primary-machine fallback\n  ---\n  duration_ms: 0.217276\n  type: 'test'\n  ...\n# Subtest: loads the primary machine directly for the sidebar strip\nok 12 - loads the primary machine directly for the sidebar strip\n  ---\n  duration_ms: 0.123916\n  type: 'test'\n  ...\n# Subtest: propagates thread and request-level usage failures\nok 13 - propagates thread and request-level usage failures\n  ---\n  duration_ms: 0.229739\n  type: 'test'\n  ...\n1..13\n# tests 13\n# suites 0\n# pass 13\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 103.172017\n\n> bb-plugin-usage-tracker@0.1.2 build\n> env -u BB_CLI bb plugin build .\n\ndist/server.js\ndist/server.js.map\ndist/server.meta.json\ndist/app.js\ndist/app.css\ndist/app.meta.json\n",
+    "stderrTail": "",
+    "stdoutTruncated": false,
+    "stderrTruncated": false
+  }
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/evidence/review-receipt-input.json b/.empirical/specs/taskboard-git-only-distribution/evidence/review-receipt-input.json
new file mode 100644
index 0000000..ec9f3f0
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/evidence/review-receipt-input.json
@@ -0,0 +1,16 @@
+{
+  "criteria": ["AC-1", "AC-2", "AC-3", "AC-4", "AC-5", "AC-6"],
+  "evidenceKinds": ["review"],
+  "summary": "Independent review passes every current two-plugin Git-only distribution requirement, confirms the accepted D-004 through D-006 supersessions, finds no implementation or supply-chain defects, and preserves integration, immutable tag, GitHub Release, and marketplace liveness as explicit post-approval gates.",
+  "collector": "codex",
+  "artifacts": [
+    {
+      "path": ".empirical/specs/taskboard-git-only-distribution/consults/code-review.md",
+      "mediaType": "text/markdown"
+    },
+    {
+      "path": ".empirical/specs/taskboard-git-only-distribution/consults/security.md",
+      "mediaType": "text/markdown"
+    }
+  ]
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/evidence/test-receipt-input.json b/.empirical/specs/taskboard-git-only-distribution/evidence/test-receipt-input.json
new file mode 100644
index 0000000..a4e9e4e
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/evidence/test-receipt-input.json
@@ -0,0 +1,6 @@
+{
+  "commandId": "workspace-check",
+  "criteria": ["AC-1", "AC-2", "AC-3", "AC-4", "AC-5", "AC-6"],
+  "evidenceKinds": ["test"],
+  "summary": "Run the repository-authorized root check after both externally unpublished plugins become Git-only: Taskboard 0.3.1 and Usage Tracker 0.1.2 private distribution guards, SDK contracts, TypeScript, 88 Taskboard tests, 13 Usage Tracker tests, and both production builds/metadata checks."
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/evidence/verification.md b/.empirical/specs/taskboard-git-only-distribution/evidence/verification.md
new file mode 100644
index 0000000..3471940
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/evidence/verification.md
@@ -0,0 +1,78 @@
+# Taskboard Git-only distribution verification
+
+## Source and build
+
+- Signed receipt `executed-f19eb7b3790a9c40e46b8d5e` records the final
+  `npm run check` passing against Taskboard `0.3.1` and Usage Tracker `0.1.2`.
+- Taskboard: SDK contracts, TypeScript, 88/88 tests, production build, and build
+  metadata verification pass.
+- Usage Tracker: TypeScript, 13/13 tests, and production build pass after the
+  user's superseding Git-only instruction.
+- Taskboard manifest is `private: true` and has no `publishConfig`, `files`, or
+  `prepack`; package name/version, BB source entries, dependencies, and build
+  scripts remain valid.
+- `npm publish --dry-run --ignore-scripts` reports
+  `Skipping workspace bb-plugin-taskboard, marked as private` and does not
+  publish.
+- Usage Tracker is likewise `private: true` with no `publishConfig`, `files`, or
+  `prepack`; its plugin identity/runtime/build scripts remain valid. Its dry run
+  reports `Skipping workspace bb-plugin-usage-tracker, marked as private`.
+- Root npm publish config and local publish credential are removed. The inert
+  `.npm-publish.env` deny-only ignore entry remains to protect legacy clones.
+  npm remains only the dependency/workspace/build tool.
+
+## Active documentation
+
+- Root and Taskboard READMEs contain no Taskboard npm badge, package URL, or
+  `npm:bb-plugin-taskboard` command.
+- Both lead with the exact direct Git range command using repository,
+  `plugins/taskboard`, `^0.3.0`, and `taskboard/` tag prefix.
+- BB Community shorthand is explicitly pending marketplace PR #126 rather than
+  presented as already live.
+- Usage Tracker npm badge/link/install copy is absent and its exact direct Git
+  command uses range `^0.1.2`, subdirectory `plugins/usage-tracker`, and tag
+  prefix `usage-tracker/`.
+
+## Git and marketplace provenance
+
+- Public annotated tag `taskboard/v0.3.0` peels to reviewed commit
+  `3cbd919bcce696131b1cc16480c54f3049401ea9`.
+- GitHub Release `taskboard/v0.3.0` is public and points users to that tag.
+- Managed Git installs record their resolved tag/commit and detect later tag
+  movement; hosting-administrator control remains an explicit trust assumption.
+- Marketplace entry source is Git repository
+  `https://github.com/MateoCerquetella/bb-plugins.git`, subdirectory
+  `plugins/taskboard`, range `^0.3.0`, tag prefix `taskboard/`.
+- Marketplace build produces 82 entries. PR #126 validation concluded SUCCESS
+  against commit `3e7fb10535b39a5a72fd8ef45e37237d03ad02db`.
+- Usage Tracker's marketplace source is prepared locally with the same
+  repository, subdirectory `plugins/usage-tracker`, range `^0.1.2`, and tag
+  prefix `usage-tracker/`; final liveness awaits that public tag.
+
+## Immutable evidence
+
+- Every historical Empirical specification/receipt path from pre-change HEAD is
+  byte-unchanged.
+- A receipt-artifact digest audit remains required again after capability
+  integration; no historical baseline is regenerated.
+
+## npm registry timeline
+
+- The approved CLI unpublish attempt for Taskboard was rejected with `EOTP`.
+- The user then completed npm deletion externally. Fresh registry responses now
+  report Taskboard unpublished at `2026-08-26T23:00:34.123Z` and Usage Tracker
+  unpublished at `2026-08-26T23:00:13.963Z`.
+- No repository operation stores or retries an unpublish command, OTP, or npm
+  credential. Active npm distribution surfaces for both plugins are removed.
+
+## Acceptance coverage
+
+- AC-1: private manifest, absent publish fields/hooks, preserved build identity.
+- AC-2: Taskboard npm copy absent; exact Git/community-pending copy guarded.
+- AC-3: superseded by the user's later explicit both-package removal; Usage
+  Tracker runtime/build identity remains while npm distribution is removed.
+- AC-4: Git-only capability delta, tag evidence, immutable receipt boundary.
+- AC-5: signed root check, public v0.3.0 provenance, and prepared v0.3.1 plus
+  Usage Tracker Git-release/marketplace sources pending exact remote approval.
+- AC-6: initial EOTP and later registry-confirmed external deletion recorded as
+  separate facts.
diff --git a/.empirical/specs/taskboard-git-only-distribution/impact.json b/.empirical/specs/taskboard-git-only-distribution/impact.json
new file mode 100644
index 0000000..628e3f7
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/impact.json
@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "classification": "behavioral",
+  "capabilities": [
+    "taskboard-distribution"
+  ],
+  "surfaces": [
+    "workflow"
+  ],
+  "regressionRationale": null,
+  "digest": "sha256:1fa6e66c5ce24725f2ade1a81eddec6859f67bd95e0816db2a8fca35c29fe005"
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/integration-receipt.json b/.empirical/specs/taskboard-git-only-distribution/integration-receipt.json
new file mode 100644
index 0000000..e1d7d7e
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/integration-receipt.json
@@ -0,0 +1,23 @@
+{
+  "schemaVersion": 1,
+  "feature": "taskboard-git-only-distribution",
+  "claimId": "taskboard-git-only-distribution-59becfd36252",
+  "repositoryId": "sha256:f8da5183fda8733511f6cba0809d0dd294fa59b7a90511fee567dc8aa4f04edc",
+  "baseCommit": "3cbd919bcce696131b1cc16480c54f3049401ea9",
+  "baseTree": "0a4368c1b8349090f0d154aae6f43a1b6187143f",
+  "featureTree": "sha256:deac688b840095986c27daa51b40e8aa823627780822aa174a9fe1450894ecab",
+  "targetCommit": "3cbd919bcce696131b1cc16480c54f3049401ea9",
+  "targetTree": "0a4368c1b8349090f0d154aae6f43a1b6187143f",
+  "capabilityBaseDigests": {
+    "taskboard-distribution": "sha256:3ea2d1a004c6f5980bfaffdc86a206526f1ac3b0106e27b2823f58239552a2c7"
+  },
+  "deltaDigest": "sha256:9c674dc12063f8f339ac25b3c8981b206f718f4bf3fda13cb62fd296b977cf85",
+  "resultDigests": {
+    "taskboard-distribution": "sha256:b318f7452a3513ae1d75d630c775103562159894c81b9c2e3a6ffeaa195fe4a6"
+  },
+  "verificationReceiptDigests": [
+    "sha256:b58123b16f3ac0808885e6b38cb674dd4b28e4b08593bc102a38611a5fb0c85c"
+  ],
+  "integratedAt": "2026-08-26T23:36:55.499Z",
+  "digest": "sha256:749ab3ac16f0e117d450e17004236c65f43ee2959e35ca6e3af9e14ecbcc2612"
+}
diff --git a/.empirical/specs/taskboard-git-only-distribution/plan.md b/.empirical/specs/taskboard-git-only-distribution/plan.md
new file mode 100644
index 0000000..732ad87
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/plan.md
@@ -0,0 +1,33 @@
+# Plan: Taskboard Git-only Distribution
+
+## 1. Disable npm publication for both plugins
+
+- Mark Taskboard and Usage Tracker private; remove publishConfig, files, and
+  prepack from both.
+- Preserve both plugin identities, dependencies, BB manifests, versions, and
+  build scripts.
+- Add focused distribution assertions.
+
+## 2. Replace active npm-facing documentation
+
+- Remove both plugins' npm badges, links, and installation language from the
+  root and plugin READMEs.
+- Document BB Community and direct Git semver/subdirectory/tag-prefix installs
+  for both plugins.
+- Preserve shared npm dependency/build tooling only.
+
+## 3. Verify and integrate
+
+- Run focused tests, root checks, both private-publish refusals, Git tag
+  resolution, marketplace Git-source build/liveness, and immutable receipt
+  audit.
+- Independently review the manifest/docs boundary and integrate the distribution
+  capability delta.
+- Commit/push through a normal source PR only after exact remote approval.
+
+## 4. Keep external deletion honest
+
+- Recheck both registry package names.
+- Preserve the ordered timeline: Taskboard CLI unpublish first failed with
+  `EOTP`, then the user removed both packages in npm's website and registry
+  queries confirmed `E404 Unpublished` for each.
diff --git a/.empirical/specs/taskboard-git-only-distribution/spec.md b/.empirical/specs/taskboard-git-only-distribution/spec.md
new file mode 100644
index 0000000..94a4248
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/spec.md
@@ -0,0 +1,61 @@
+# Taskboard Git Only Distribution
+
+## Request
+
+> Remove Taskboard's npm distribution path now and make Taskboard Git-only without touching Usage Tracker: mark the Taskboard workspace private/non-publishable while retaining its package name, dependencies, and npm-as-build-tool scripts required by BB Git installs; remove Taskboard publishConfig, prepack/files packaging contract where safe, tracked npm publish config, local publish credential/ignore entry, npm badges/links/install/update instructions, and root claims that every plugin ships through npm; document BB Community and direct Git semver install commands using plugins/taskboard and taskboard/ tags; update the living Taskboard distribution capability to Git-only; preserve immutable historical Empirical receipts. Verify builds/tests and marketplace Git source. The external npm unpublish of bb-plugin-taskboard versions 0.1.0 through 0.2.0 was explicitly authorized but npm rejected it with EOTP, so record the registry deletion as externally blocked rather than pretending it succeeded. Do not modify or unpublish Usage Tracker.
+
+## Goal
+
+Make Taskboard explicitly Git-only and impossible to publish accidentally to
+npm, while retaining npm as the repository's package manager/build tool and
+leaving Usage Tracker's separate npm distribution untouched.
+
+## Acceptance Criteria
+
+- [ ] [AC-1] `plugins/taskboard/package.json` is private and has no
+  `publishConfig`, `files`, or `prepack` npm-distribution contract, while its
+  package name, version, dependencies, BB manifest, build/dev/typecheck/test/
+  check scripts, and plugin identity remain valid for workspace and Git builds.
+- [ ] [AC-2] Root and Taskboard documentation remove Taskboard npm badges,
+  package links, npm install/update wording, and claims that Taskboard releases
+  through npm; they document BB Community installation and an exact direct Git
+  semver command using `plugins/taskboard` plus tag prefix `taskboard/`.
+- [ ] [AC-3] Usage Tracker's npm badge, install instructions, publish metadata,
+  root npm workspace/package-manager commands, lockfile registry dependencies,
+  and shared npm credential-ignore/config support remain unchanged.
+- [ ] [AC-4] The living Taskboard distribution contract and active docs define
+  immutable Git tags/GitHub Releases plus the BB Community Git range as the sole
+  Taskboard distribution path; immutable historical Empirical receipts remain
+  byte-valid.
+- [ ] [AC-5] Root checks, Taskboard build metadata, direct Git release-source
+  validation, and the existing marketplace Git entry checks pass.
+- [ ] [AC-6] The public `bb-plugin-taskboard` registry package is reported
+  accurately: full unpublish was explicitly attempted and rejected by npm with
+  `EOTP`; no code or evidence claims that registry deletion succeeded.
+
+## Scope
+
+- Taskboard manifest distribution flags and Taskboard/root documentation.
+- Living `taskboard-distribution` capability and focused distribution guards.
+- Verification of the public tag and existing Git-source marketplace PR.
+
+## Non-goals
+
+- Removing npm/node/package.json/package-lock dependencies used to build Git
+  installs.
+- Changing or unpublishing Usage Tracker.
+- Rewriting immutable historical specifications, receipts, release artifacts,
+  or the already-published GitHub Release/tag.
+- Claiming success for npm unpublish without registry confirmation.
+
+## Verification
+
+- Focused manifest/documentation assertions and `npm run check`.
+- `bb plugin build`/metadata validation through the existing Taskboard check.
+- Public `taskboard/v0.3.0` tag resolution and marketplace `npm run build` /
+  `npm run check` against the Git source.
+- Receipt-artifact digest audit and npm registry presence check.
+
+## Capability Deltas
+
+- `deltas/taskboard-distribution.md`
diff --git a/.empirical/specs/taskboard-git-only-distribution/state.json b/.empirical/specs/taskboard-git-only-distribution/state.json
new file mode 100644
index 0000000..380e7ef
--- /dev/null
+++ b/.empirical/specs/taskboard-git-only-distribution/state.json
@@ -0,0 +1,41 @@
+{
+  "schemaVersion": 5,
+  "revision": 9,
+  "activeFeature": "taskboard-git-only-distribution",
+  "request": "Remove Taskboard's npm distribution path now and make Taskboard Git-only without touching Usage Tracker: mark the Taskboard workspace private/non-publishable while retaining its package name, dependencies, and npm-as-build-tool scripts required by BB Git installs; remove Taskboard publishConfig, prepack/files packaging contract where safe, tracked npm publish config, local publish credential/ignore entry, npm badges/links/install/update instructions, and root claims that every plugin ships through npm; document BB Community and direct Git semver install commands using plugins/taskboard and taskboard/ tags; update the living Taskboard distribution capability to Git-only; preserve immutable historical Empirical receipts. Verify builds/tests and marketplace Git source. The external npm unpublish of bb-plugin-taskboard versions 0.1.0 through 0.2.0 was explicitly authorized but npm rejected it with EOTP, so record the registry deletion as externally blocked rather than pretending it succeeded. Do not modify or unpublish Usage Tracker.",
+  "profile": "complex",
+  "workflow": "complex",
+  "mode": "normal",
+  "phase": "done",
+  "status": "done",
+  "repairAttempts": 0,
+  "message": "Integrated capability changes: taskboard-distribution",
+  "implementationActor": "agent",
+  "specDigest": "sha256:54ed39d23680f882fe1fb9e0dcbbd671e48a40bdf759e86f4bd842c9d54e44a0",
+  "approvedSpecRevision": 2,
+  "capabilityArchiveRequired": true,
+  "capabilityDeltaDigest": "sha256:3d8cbd211af3ded962d5a578b1ad200d6c8d3a31c0e13897301d17b636f35ce6",
+  "impactDigest": "sha256:1fa6e66c5ce24725f2ade1a81eddec6859f67bd95e0816db2a8fca35c29fe005",
+  "capabilityClaimId": "taskboard-git-only-distribution-59becfd36252",
+  "authorizationDigest": null,
+  "evidence": [],
+  "evidenceReceiptIds": [
+    "executed-f19eb7b3790a9c40e46b8d5e",
+    "collected-1106d5804579d9b3edad6f44",
+    "collected-15d9242299950347a8c1b852"
+  ],
+  "legacyEvidenceCount": 0,
+  "completion": {
+    "implemented": true,
+    "verified": true,
+    "integrated": true,
+    "delivered": false,
+    "published": false,
+    "highest": "integrated",
+    "reasons": {
+      "delivered": "delivered has not been proven by a durable receipt.",
+      "published": "published has not been proven by a durable receipt."
+    }
+  },
+  "updatedAt": "2026-08-26T23:36:55.519Z"
+}
diff --git a/.npmrc.publish b/.npmrc.publish
deleted file mode 100644
index ae64359..0000000
--- a/.npmrc.publish
+++ /dev/null
@@ -1 +0,0 @@
-//registry.npmjs.org/:_authToken=${NPM_TOKEN}
diff --git a/README.md b/README.md
index da4db5e..2eeb00b 100644
--- a/README.md
+++ b/README.md
@@ -10,8 +10,6 @@
 
 <p align="center">
   <a href="https://github.com/MateoCerquetella/bb-plugins/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/MateoCerquetella/bb-plugins/ci.yml?branch=main&style=flat-square&label=CI" alt="CI status" /></a>
-  <a href="https://www.npmjs.com/package/bb-plugin-taskboard"><img src="https://img.shields.io/npm/v/bb-plugin-taskboard?style=flat-square&label=Taskboard" alt="Taskboard npm version" /></a>
-  <a href="https://www.npmjs.com/package/bb-plugin-usage-tracker"><img src="https://img.shields.io/npm/v/bb-plugin-usage-tracker?style=flat-square&label=Usage%20Tracker" alt="Usage Tracker npm version" /></a>
   <img src="https://img.shields.io/badge/BB-%E2%89%A5%200.38-7c3aed?style=flat-square" alt="BB 0.38 or newer" />
   <a href="./LICENSE"><img src="https://img.shields.io/badge/license-MIT-16a34a?style=flat-square" alt="MIT license" /></a>
 </p>
@@ -22,15 +20,22 @@
 
 | | Plugin | Install | What it does |
 | --- | --- | --- | --- |
-| <img src="./plugins/taskboard/assets/icon.svg" width="28" height="28" alt="" /> | [Taskboard](./plugins/taskboard) | `bb plugin install npm:bb-plugin-taskboard` | Brings each BB project's GitHub, Linear, or Jira tasks into one focused List or Kanban board. |
-| <img src="./plugins/usage-tracker/assets/icon.svg" width="28" height="28" alt="" /> | [Usage Tracker](./plugins/usage-tracker) | `bb plugin install npm:bb-plugin-usage-tracker` | Keeps Codex and Claude Code 5-hour and weekly limits beside BB's sidebar utility icons. |
+| <img src="./plugins/taskboard/assets/icon.svg" width="28" height="28" alt="" /> | [Taskboard](./plugins/taskboard) | [Git release](#taskboard-quick-start) | Brings each BB project's GitHub, Linear, or Jira tasks into one focused List or Kanban board. |
+| <img src="./plugins/usage-tracker/assets/icon.svg" width="28" height="28" alt="" /> | [Usage Tracker](./plugins/usage-tracker) | [Git release](#usage-tracker-quick-start) | Keeps Codex and Claude Code 5-hour and weekly limits beside BB's sidebar utility icons. |
 
 ## Taskboard quick start
 
-Install the public package:
+Install the tracking Git release directly from this monorepo:
 
 ```sh
-bb plugin install npm:bb-plugin-taskboard
+bb plugin install git:https://github.com/MateoCerquetella/bb-plugins.git@^0.3.0 --subdirectory plugins/taskboard --tag-prefix taskboard/
+```
+
+After [the BB Community entry](https://github.com/get-bb/marketplace/pull/126)
+is merged and live, the equivalent shorthand is:
+
+```sh
+bb plugin install taskboard
 ```
 
 Then open **Taskboard → Manage**, choose a BB project, and select exactly one
@@ -51,10 +56,17 @@ bb plugin remove taskboard
 
 ## Usage Tracker quick start
 
-Install the public package:
+Install the tracking Git release directly from this monorepo:
+
+```sh
+bb plugin install git:https://github.com/MateoCerquetella/bb-plugins.git@^0.1.2 --subdirectory plugins/usage-tracker --tag-prefix usage-tracker/
+```
+
+After [the BB Community entry](https://github.com/get-bb/marketplace/pull/126)
+is updated and live, the equivalent shorthand is:
 
 ```sh
-bb plugin install npm:bb-plugin-usage-tracker
+bb plugin install usage-tracker
 ```
 
 Usage Tracker mounts in BB's native sidebar footer beside the existing utility
@@ -111,8 +123,8 @@ bb plugin install git:https://github.com/MateoCerquetella/bb-plugins.git@main --
 bb plugin install git:https://github.com/MateoCerquetella/bb-plugins.git@main --plugin usage-tracker
 ```
 
-Each released plugin still gets its own npm package for one-command installs
-and marketplace updates.
+Taskboard and Usage Tracker release through immutable plugin-specific Git tags
+and the BB Community marketplace.
 
 ## Develop
 
@@ -125,8 +137,7 @@ npm run check
 
 New plugins belong in `plugins/<id>` with their own `package.json`, source,
 tests, pinned `@get-bb/plugin-sdk` development dependency, and README. Add each
-directory to `.bb/plugins.json`; the root npm workspace picks it up
-automatically.
+directory to `.bb/plugins.json`; the root workspace picks it up automatically.
 
 ## License
 
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index db586fc..6f6abb4 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -4,7 +4,7 @@ Taskboard vendors UI component source generated from the
 [BB component registry](https://github.com/get-bb/bb). BB and that component
 source are distributed under the MIT License.
 
-Taskboard also uses the npm dependencies declared in
+Taskboard also uses the third-party dependencies declared in
 `plugins/taskboard/package.json`. Their copyright and license notices remain
 available in their respective packages and repositories.
 
diff --git a/package-lock.json b/package-lock.json
index d73f2bb..1ceb9d4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5657,7 +5657,7 @@
     },
     "plugins/taskboard": {
       "name": "bb-plugin-taskboard",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "license": "MIT",
       "dependencies": {
         "@hugeicons/core-free-icons": "^4.1.3",
diff --git a/plugins/taskboard/README.md b/plugins/taskboard/README.md
index 1d94ea8..cc5de03 100644
--- a/plugins/taskboard/README.md
+++ b/plugins/taskboard/README.md
@@ -10,7 +10,6 @@
 
 <p align="center">
   <a href="https://github.com/MateoCerquetella/bb-plugins/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/MateoCerquetella/bb-plugins/ci.yml?branch=main&style=flat-square&label=CI" alt="CI status" /></a>
-  <a href="https://www.npmjs.com/package/bb-plugin-taskboard"><img src="https://img.shields.io/npm/v/bb-plugin-taskboard?style=flat-square" alt="npm version" /></a>
   <img src="https://img.shields.io/badge/BB-%E2%89%A5%200.38-7c3aed?style=flat-square" alt="BB 0.38 or newer" />
   <img src="https://img.shields.io/badge/GitHub%20%C2%B7%20Linear%20%C2%B7%20Jira-supported-2563eb?style=flat-square" alt="GitHub, Linear, and Jira supported" />
   <a href="./LICENSE"><img src="https://img.shields.io/badge/license-MIT-16a34a?style=flat-square" alt="MIT license" /></a>
@@ -60,11 +59,18 @@ task to an agent without rebuilding context by hand.
 
 ## Install
 
-Taskboard is a full-trust BB plugin. Review the source, then install the public
-[npm package](https://www.npmjs.com/package/bb-plugin-taskboard):
+Taskboard is a full-trust BB plugin. Review the source, then install its tracking
+Git release directly from this monorepo:
 
 ```sh
-bb plugin install npm:bb-plugin-taskboard
+bb plugin install git:https://github.com/MateoCerquetella/bb-plugins.git@^0.3.0 --subdirectory plugins/taskboard --tag-prefix taskboard/
+```
+
+After [the BB Community entry](https://github.com/get-bb/marketplace/pull/126)
+is merged and live, the equivalent shorthand is:
+
+```sh
+bb plugin install taskboard
 ```
 
 Open **Taskboard → Manage**, choose a BB project, select its tracker, and save
@@ -72,7 +78,7 @@ the connection. The same page configures that project's filters, default
 layout, and workflow ordering. Each project selects exactly one tracker; other
 projects can choose a different provider and board setup.
 
-Update, reload, or remove the npm installation later:
+Update, reload, or remove the managed Git installation later:
 
 ```sh
 bb plugin outdated
diff --git a/plugins/taskboard/THIRD_PARTY_NOTICES.md b/plugins/taskboard/THIRD_PARTY_NOTICES.md
index 8f65c03..55e6164 100644
--- a/plugins/taskboard/THIRD_PARTY_NOTICES.md
+++ b/plugins/taskboard/THIRD_PARTY_NOTICES.md
@@ -4,6 +4,6 @@ Taskboard vendors UI component source generated from the
 [BB component registry](https://github.com/get-bb/bb). BB and that component
 source are distributed under the MIT License.
 
-Taskboard also uses the npm dependencies declared in `package.json`. Their
+Taskboard also uses the third-party dependencies declared in `package.json`. Their
 copyright and license notices remain available in their respective packages
 and repositories.
diff --git a/plugins/taskboard/package.json b/plugins/taskboard/package.json
index 8ad11db..0e9251c 100644
--- a/plugins/taskboard/package.json
+++ b/plugins/taskboard/package.json
@@ -1,11 +1,9 @@
 {
   "name": "bb-plugin-taskboard",
-  "version": "0.3.0",
+  "version": "0.3.1",
+  "private": true,
   "description": "Bring each BB project's GitHub, Linear, or Jira tasks into one focused taskboard.",
   "type": "module",
-  "publishConfig": {
-    "access": "public"
-  },
   "license": "MIT",
   "author": "Mateo Cerquetella",
   "homepage": "https://github.com/MateoCerquetella/bb-plugins/tree/main/plugins/taskboard#readme",
@@ -41,36 +39,6 @@
     "app": "./app.tsx",
     "skills": []
   },
-  "files": [
-    "dist/server.js",
-    "dist/server.meta.json",
-    "dist/app.js",
-    "dist/app.meta.json",
-    "dist/app.css",
-    "assets/",
-    "components/",
-    "hooks/",
-    "lib/",
-    "sources/",
-    "README.md",
-    "LICENSE",
-    "THIRD_PARTY_NOTICES.md",
-    "app.css",
-    "app.tsx",
-    "board-settings.ts",
-    "browse-preferences.ts",
-    "browse.ts",
-    "components.json",
-    "contract.ts",
-    "create-issue.ts",
-    "credential-contract.ts",
-    "credentials.ts",
-    "issue-draft.ts",
-    "project-selection.ts",
-    "server.ts",
-    "store.ts",
-    "tsconfig.json"
-  ],
   "dependencies": {
     "@hugeicons/core-free-icons": "^4.1.3",
     "@hugeicons/react": "^1.1.6",
@@ -104,7 +72,6 @@
     "types:refresh": "env -u BB_CLI bb plugin types .",
     "test": "node --test --experimental-strip-types test/*.test.ts",
     "verify:build": "node scripts/verify-build.mjs",
-    "check": "npm run types:check && npm run typecheck && npm test && npm run build && npm run verify:build",
-    "prepack": "npm run check"
+    "check": "npm run types:check && npm run typecheck && npm test && npm run build && npm run verify:build"
   }
 }
diff --git a/plugins/taskboard/test/distribution.test.ts b/plugins/taskboard/test/distribution.test.ts
new file mode 100644
index 0000000..a716f58
--- /dev/null
+++ b/plugins/taskboard/test/distribution.test.ts
@@ -0,0 +1,166 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { test } from 'node:test';
+
+const taskboardManifest = JSON.parse(
+  await readFile(new URL('../package.json', import.meta.url), 'utf8')
+);
+const usageManifest = JSON.parse(
+  await readFile(
+    new URL('../../usage-tracker/package.json', import.meta.url),
+    'utf8'
+  )
+);
+const rootManifest = JSON.parse(
+  await readFile(new URL('../../../package.json', import.meta.url), 'utf8')
+);
+const taskboardReadme = await readFile(
+  new URL('../README.md', import.meta.url),
+  'utf8'
+);
+const usageReadme = await readFile(
+  new URL('../../usage-tracker/README.md', import.meta.url),
+  'utf8'
+);
+const usageChangelog = await readFile(
+  new URL('../../usage-tracker/CHANGELOG.md', import.meta.url),
+  'utf8'
+);
+const rootReadme = await readFile(
+  new URL('../../../README.md', import.meta.url),
+  'utf8'
+);
+const rootGitignore = await readFile(
+  new URL('../../../.gitignore', import.meta.url),
+  'utf8'
+);
+const ciWorkflow = await readFile(
+  new URL('../../../.github/workflows/ci.yml', import.meta.url),
+  'utf8'
+);
+const activeNotices = await Promise.all([
+  readFile(new URL('../../../THIRD_PARTY_NOTICES.md', import.meta.url), 'utf8'),
+  readFile(new URL('../THIRD_PARTY_NOTICES.md', import.meta.url), 'utf8'),
+]);
+const activeContext = await Promise.all([
+  readFile(
+    new URL('../../../.empirical/context/overview.md', import.meta.url),
+    'utf8'
+  ),
+  readFile(
+    new URL('../../../.empirical/context/architecture.md', import.meta.url),
+    'utf8'
+  ),
+  readFile(
+    new URL('../../../.empirical/context/commands.md', import.meta.url),
+    'utf8'
+  ),
+]);
+
+const directGitInstall =
+  'bb plugin install git:https://github.com/MateoCerquetella/bb-plugins.git@^0.3.0 --subdirectory plugins/taskboard --tag-prefix taskboard/';
+const usageGitInstall =
+  'bb plugin install git:https://github.com/MateoCerquetella/bb-plugins.git@^0.1.2 --subdirectory plugins/usage-tracker --tag-prefix usage-tracker/';
+
+test('keeps Taskboard private and Git-buildable without npm publication hooks', () => {
+  assert.equal(rootManifest.private, true);
+  for (const script of ['build', 'check', 'test', 'typecheck']) {
+    assert.equal(typeof rootManifest.scripts[script], 'string');
+  }
+  assert.equal(taskboardManifest.name, 'bb-plugin-taskboard');
+  assert.equal(taskboardManifest.version, '0.3.1');
+  assert.equal(taskboardManifest.private, true);
+  assert.equal('publishConfig' in taskboardManifest, false);
+  assert.equal('files' in taskboardManifest, false);
+  assert.equal('prepack' in taskboardManifest.scripts, false);
+  assert.equal(taskboardManifest.bb.server, './server.ts');
+  assert.equal(taskboardManifest.bb.app, './app.tsx');
+  for (const script of ['build', 'dev', 'typecheck', 'test', 'check']) {
+    assert.equal(typeof taskboardManifest.scripts[script], 'string');
+  }
+  assert.ok(Object.keys(taskboardManifest.dependencies).length > 0);
+});
+
+test('documents only BB Community and direct Git installation for Taskboard', () => {
+  for (const document of [
+    rootReadme,
+    taskboardReadme,
+    usageReadme,
+    usageChangelog,
+    ...activeContext,
+    ...activeNotices,
+  ]) {
+    assert.doesNotMatch(document, /npm:bb-plugin-taskboard/u);
+    assert.doesNotMatch(
+      document,
+      /(?:npmjs\.com\/package|shields\.io\/npm\/v)\/bb-plugin-taskboard/u
+    );
+    assert.doesNotMatch(document, /npm remains.*distribution/iu);
+  }
+  for (const readme of [rootReadme, taskboardReadme]) {
+    assert.match(readme, /bb plugin install taskboard/u);
+    assert.ok(readme.includes(directGitInstall));
+    assert.match(readme, /After \[the BB Community entry\]/u);
+  }
+  assert.match(rootReadme, /npm install/u);
+  assert.match(rootReadme, /npm run check/u);
+});
+
+test('keeps Usage Tracker private and documents its Git release too', async () => {
+  assert.equal(usageManifest.private, true);
+  assert.equal(usageManifest.name, 'bb-plugin-usage-tracker');
+  assert.equal(usageManifest.version, '0.1.2');
+  assert.equal('publishConfig' in usageManifest, false);
+  assert.equal('files' in usageManifest, false);
+  assert.equal('prepack' in usageManifest.scripts, false);
+  for (const document of [
+    rootReadme,
+    taskboardReadme,
+    usageReadme,
+    usageChangelog,
+    ...activeContext,
+    ...activeNotices,
+  ]) {
+    assert.doesNotMatch(document, /npm:bb-plugin-usage-tracker/u);
+    assert.doesNotMatch(
+      document,
+      /(?:npmjs\.com\/package|shields\.io\/npm\/v)\/bb-plugin-usage-tracker/u
+    );
+  }
+  for (const readme of [rootReadme, usageReadme]) {
+    assert.match(readme, /bb plugin install usage-tracker/u);
+    assert.ok(readme.includes(usageGitInstall));
+  }
+  await assert.rejects(
+    readFile(new URL('../../../.npmrc.publish', import.meta.url), 'utf8'),
+    /ENOENT/u
+  );
+  assert.match(rootGitignore, /^\.npm-publish\.env$/mu);
+});
+
+test('has no active registry publication automation or credential path', () => {
+  assert.doesNotMatch(
+    ciWorkflow,
+    /(?:npm\s+(?:publish|unpublish)|NPM_TOKEN|NODE_AUTH_TOKEN|registry\.npmjs\.org)/iu
+  );
+  assert.match(ciWorkflow, /permissions:\s*\n\s*contents:\s*read/u);
+  for (const manifest of [rootManifest, taskboardManifest, usageManifest]) {
+    assert.equal(manifest.private, true);
+    for (const field of ['publishConfig', 'files']) {
+      assert.equal(field in manifest, false);
+    }
+    for (const hook of [
+      'prepublish',
+      'prepublishOnly',
+      'publish',
+      'postpublish',
+      'prepack',
+      'postpack',
+    ]) {
+      assert.equal(hook in manifest.scripts, false);
+    }
+    for (const script of Object.values(manifest.scripts)) {
+      assert.doesNotMatch(String(script), /npm\s+(?:publish|unpublish)/iu);
+    }
+  }
+});
diff --git a/plugins/usage-tracker/CHANGELOG.md b/plugins/usage-tracker/CHANGELOG.md
index 066cf62..50ec43b 100644
--- a/plugins/usage-tracker/CHANGELOG.md
+++ b/plugins/usage-tracker/CHANGELOG.md
@@ -6,8 +6,8 @@ All notable changes to Usage Tracker are documented here.
 
 ### Changed
 
-- Migrated development types to the published `@get-bb/plugin-sdk` package
-  and raised the minimum BB version to 0.38.
+- Migrated development types to the pinned `@get-bb/plugin-sdk` development
+  dependency and raised the minimum BB version to 0.38.
 
 ## 0.1.1 - 2026-08-12
 
diff --git a/plugins/usage-tracker/README.md b/plugins/usage-tracker/README.md
index 626b3ee..48c6c52 100644
--- a/plugins/usage-tracker/README.md
+++ b/plugins/usage-tracker/README.md
@@ -9,7 +9,6 @@
 </p>
 
 <p align="center">
-  <a href="https://www.npmjs.com/package/bb-plugin-usage-tracker"><img src="https://img.shields.io/npm/v/bb-plugin-usage-tracker?style=flat-square" alt="npm version" /></a>
   <img src="https://img.shields.io/badge/BB-%E2%89%A5%200.38-7c3aed?style=flat-square" alt="BB 0.38 or newer" />
   <a href="./LICENSE"><img src="https://img.shields.io/badge/license-MIT-16a34a?style=flat-square" alt="MIT license" /></a>
 </p>
@@ -37,10 +36,17 @@ usage reading, without adding a navigation item or a separate plugin page.
 
 ## Install
 
-Usage Tracker requires BB 0.38 or newer. Install the public npm package:
+Usage Tracker requires BB 0.38 or newer. Install its tracking Git release:
 
 ```sh
-bb plugin install npm:bb-plugin-usage-tracker
+bb plugin install git:https://github.com/MateoCerquetella/bb-plugins.git@^0.1.2 --subdirectory plugins/usage-tracker --tag-prefix usage-tracker/
+```
+
+After [the BB Community entry](https://github.com/get-bb/marketplace/pull/126)
+is updated and live, the equivalent shorthand is:
+
+```sh
+bb plugin install usage-tracker
 ```
 
 The strip appears in the bottom of the sidebar as soon as the plugin loads.
@@ -124,7 +130,6 @@ npm run build --workspace bb-plugin-usage-tracker
 
 ## Links
 
-- [npm package](https://www.npmjs.com/package/bb-plugin-usage-tracker)
 - [Source repository](https://github.com/MateoCerquetella/bb-plugins)
 - [Issue tracker](https://github.com/MateoCerquetella/bb-plugins/issues)
 - [MIT license](./LICENSE)
diff --git a/plugins/usage-tracker/package.json b/plugins/usage-tracker/package.json
index a740604..ccd2dcc 100644
--- a/plugins/usage-tracker/package.json
+++ b/plugins/usage-tracker/package.json
@@ -1,6 +1,7 @@
 {
   "name": "bb-plugin-usage-tracker",
   "version": "0.1.2",
+  "private": true,
   "description": "Compact Codex and Claude usage limits in bb's sidebar footer.",
   "license": "MIT",
   "author": "Mateo Cerquetella",
@@ -23,9 +24,6 @@
     "claude-code",
     "cursor"
   ],
-  "publishConfig": {
-    "access": "public"
-  },
   "type": "module",
   "engines": {
     "bb": ">=0.38",
@@ -45,24 +43,6 @@
     "app": "./app.tsx",
     "skills": []
   },
-  "files": [
-    "dist/server.js",
-    "dist/server.meta.json",
-    "dist/app.js",
-    "dist/app.meta.json",
-    "dist/app.css",
-    "assets/",
-    "CHANGELOG.md",
-    "README.md",
-    "LICENSE",
-    "THIRD_PARTY_NOTICES.md",
-    "server.ts",
-    "app.tsx",
-    "app.css",
-    "lib/",
-    "types/",
-    "tsconfig.json"
-  ],
   "dependencies": {
     "zod": "^4.3.6"
   },
@@ -80,7 +60,6 @@
     "types:check": "env -u BB_CLI bb plugin types --check .",
     "types:refresh": "env -u BB_CLI bb plugin types .",
     "test": "node --test --experimental-strip-types test/*.test.ts",
-    "check": "npm run types:check && npm run typecheck && npm test && npm run build",
-    "prepack": "npm run check"
+    "check": "npm run types:check && npm run typecheck && npm test && npm run build"
   }
 }