feat(studio): daily Today-Hero proposal pipeline (v0.31.0)

Cross-store research (Apple, Play, Steam, Docker, VS Code,
Chrome Web Store, Flathub) consistently rewards editorial
curation over algorithmic recommendations — but manual
copywriting per release does not survive a solo-dev cadence.
This commit lands a daily-build pipeline so the Today-Hero
card stays fresh without operator hand-edits per release.

Pipeline shape (full design in docs/today-pipeline.md):

1. tools/today/collect.sh aggregates "what happened in the
   last 24 hours" across the F∆I monorepos: git log per repo,
   store-index seed.yaml diffs, architecture/system-gaps doc
   changes, Studio release tags, and (opt-in) audit-log
   highlights. Outputs plain text.

2. tools/today/propose.sh feeds the signal summary plus
   prompt.template.md to the operator's already-configured
   System-AI (Ollama default; OpenAI-compatible endpoints
   work via env-var override). Drafts N candidate stories as
   YAML files under ~/.fai/today/proposals/<date>/.

3. tools/today/accept.sh validates a chosen candidate against
   the today/v1 schema and the no-marketing-speak banned-word
   list, then atomic-renames it into ~/.fai/today/active.yaml.

4. Studio reads active.yaml at store-page init via the new
   TodayStoryLoader (lib/data/today_story_loader.dart). On any
   failure (file missing, schema mismatch, banned-words hit,
   parse error) it falls back to the compiled-in
   _kFallbackTodayStory so KRITIS deployments and fresh
   installs always render something sensible.

Trust + audit:
- All proposed and accepted stories live as plain YAML on disk.
- The pipeline calls only the operator's already-configured
  System-AI; it never reaches a CMS, never phones home, works
  air-gapped if the System-AI does.
- The bash accept gate AND the Dart loader both enforce the
  banned-word list — a hand-edited active.yaml that bypassed
  the shell still won't reach the UI.
- Removing the cron entry disables the pipeline; Studio falls
  back to the const story and continues to work.

Cron / launchd / systemd recipes documented in
tools/today/README.md.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

docs/today-pipeline.md

@@ -0,0 +1,113 @@
+# Today-Hero Editorial Pipeline
+
+## Why this exists
+
+The Studio store ships an editorial Today-Hero card (`_StoreTodayHero` in
+`lib/pages/store.dart`) that plays the role Apple's Today tab plays in the App
+Store: a single curated story per release that sets context for what the
+operator should care about right now.
+
+Editorial curation beats algorithmic recommendations on the discovery surfaces
+operators love — but it only works if the curation actually happens. Manual
+copywriting per release does not survive a solo-dev cadence. This pipeline
+produces draft stories every day, has the operator accept or reject them, and
+feeds the accepted story straight into Studio without a code release.
+
+## Loop overview
+
+```
+┌────────────────────────────────────────────────────────────────────┐
+│  1. SIGNAL COLLECTOR        tools/today/collect.sh                 │
+│     git log + store-index diff + audit-log highlights →            │
+│     plain-text "what happened in the last N hours" summary         │
+│                                                                    │
+│  2. PROPOSER                tools/today/propose.sh                 │
+│     local System-AI (Ollama by default) drafts 3 story candidates  │
+│     using tools/today/prompt.template.md + the signal summary →    │
+│     ~/.fai/today/proposals/<ISO-DATE>-<n>.yaml                     │
+│                                                                    │
+│  3. REVIEW + ACCEPT         tools/today/accept.sh <proposal-id>    │
+│     operator skims the proposal files, picks one (or none) →       │
+│     ~/.fai/today/active.yaml                                       │
+│                                                                    │
+│  4. STUDIO                  lib/pages/store.dart                   │
+│     Studio reads active.yaml at startup; falls back to the         │
+│     compiled-in `_kCurrentTodayStory` when the file is absent      │
+│     or invalid (KRITIS / fresh install path)                       │
+└────────────────────────────────────────────────────────────────────┘
+```
+
+The accept step is the only human gate. Everything else can run from a launchd
+agent (macOS), systemd timer (Linux), or `cron` — see
+`tools/today/README.md` for the on-disk recipes.
+
+## Schema
+
+`~/.fai/today/active.yaml` (and every proposal file) follows this shape:
+
+```yaml
+schema: today/v1
+badge_en: CAPABILITY FEDERATION
+badge_de: CAPABILITY-FEDERATION
+title_en: Two MCP servers away from a richer hub
+title_de: Zwei MCP-Server bis zu einem reicheren Hub
+body_en: |
+  Click a recommended public source below — DeepWiki for repository docs,
+  Semgrep for security scans — and synthetic `mcp.<server>.<tool>`
+  capabilities appear here within seconds. No Node, no API key, no
+  subprocess.
+body_de: |
+  Klicke unten auf eine öffentliche Quelle — DeepWiki für Repo-Doku,
+  Semgrep für Security-Scans — und synthetische
+  `mcp.<server>.<tool>`-Capabilities erscheinen binnen Sekunden hier.
+  Kein Node, kein API-Key, kein Subprozess.
+icon: hub_outlined        # Material icon name; loader maps to IconData
+cta: openSettings | none  # enum from _TodayCta
+cta_label_en: Open MCP settings
+cta_label_de: MCP-Einstellungen öffnen
+```
+
+`schema: today/v1` is mandatory and gates loader compatibility. Future schema
+revisions bump the version and Studio renders the const fallback rather than
+attempt a dirty migration.
+
+## Design rules for the prompt
+
+The prompt template (`tools/today/prompt.template.md`) hard-encodes:
+
+1. **One story, not three feature bullets.** Apple-Today-style storytelling
+   — narrative arc, single takeaway, calls the operator forward.
+2. **Bilingual peers, not machine translation.** EN and DE are written in
+   parallel by the same prompt pass; tone matches between languages.
+3. **No marketing speak.** The "no buzzwords" rule from
+   `feedback_no_marketing_speak.md` is included in the prompt: ban
+   "viral", "killer", "powerful", "just works", "revolutionary",
+   "game-changing".
+4. **No private references.** Generic terms only; no
+   ITDZ / Kammergericht / HTW / J∆I per
+   `feedback_confidentiality.md`.
+5. **Concrete CTA.** Every story names exactly one action the operator
+   can take in Studio (which page, which button).
+6. **Body fits in ~3 sentences.** Hero card height is fixed; longer
+   stories truncate.
+
+## Audit + air-gap
+
+- All proposed and accepted stories live as plain YAML on disk;
+  reviewable by `git log` if checked in.
+- The pipeline calls only the operator's **already-configured** System-AI
+  (Ollama / OpenAI / vLLM). It never reaches out to a CMS, never phones
+  home, and works air-gapped if the System-AI does.
+- KRITIS deployments can disable the pipeline entirely by removing the
+  cron entry; Studio falls back to `_kCurrentTodayStory` and continues
+  to work.
+
+## Out of scope (Phase 0.5)
+
+- Multi-story rotation (one active story at a time).
+- A/B-testing or click-through tracking — F∆I has no surveillance budget
+  and no telemetry pipeline to feed it into.
+- Auto-publication to git (operator-curated boundary stays manual).
+- Hub-served stories. Studio reads `~/.fai/today/active.yaml` directly
+  for now; promoting this to a HubAdmin RPC is a Phase 1 question once
+  multi-tenant Studio appears.

lib/data/today_story_loader.dart

@@ -0,0 +1,187 @@
+// Today-Hero story loader.
+//
+// Reads ~/.fai/today/active.yaml when present, validates the
+// schema, and hands the parsed bilingual story back to the
+// store page. On any failure (file missing, schema mismatch,
+// banned-words hit, parse error) the caller falls back to the
+// compiled-in const story so KRITIS / fresh installs always
+// have something to render.
+//
+// See docs/today-pipeline.md for the full design rationale and
+// tools/today/ for the operator-facing CLI.
+
+import 'dart:io';
+
+import 'package:flutter/material.dart';
+import 'package:path/path.dart' as p;
+import 'package:yaml/yaml.dart';
+
+/// Editorial action attached to a Today story. The set is kept
+/// closed and ABI-stable — adding a new variant without bumping
+/// the schema would let an old Studio render an unknown action
+/// as a no-op button.
+enum TodayCta { none, openSettings }
+
+/// Bilingual story rendered by the Today-Hero card. Either
+/// loaded from disk or supplied as a const fallback.
+@immutable
+class TodayStoryData {
+  final String badgeEn;
+  final String badgeDe;
+  final String titleEn;
+  final String titleDe;
+  final String bodyEn;
+  final String bodyDe;
+  final String ctaLabelEn;
+  final String ctaLabelDe;
+  final IconData icon;
+  final TodayCta cta;
+
+  const TodayStoryData({
+    required this.badgeEn,
+    required this.badgeDe,
+    required this.titleEn,
+    required this.titleDe,
+    required this.bodyEn,
+    required this.bodyDe,
+    required this.ctaLabelEn,
+    required this.ctaLabelDe,
+    required this.icon,
+    required this.cta,
+  });
+}
+
+/// Static loader. Pure I/O + parsing, no widget concerns. The
+/// store page calls `loadOrFallback` once per fetch and feeds
+/// the result into `_StoreTodayHero`.
+class TodayStoryLoader {
+  /// Resolves to `~/.fai/today/active.yaml` on every supported
+  /// host. The pipeline writes here from [tools/today/accept.sh].
+  static String activePath() {
+    final home = Platform.environment['HOME'] ??
+        Platform.environment['USERPROFILE'] ??
+        '';
+    return p.join(home, '.fai', 'today', 'active.yaml');
+  }
+
+  /// Reads and validates the active story. Returns `fallback`
+  /// when the file is missing, malformed, or fails schema /
+  /// banned-words checks. Loud failures stay on disk in the
+  /// pipeline tooling — Studio quietly falls back so the UI
+  /// never crashes on bad operator input.
+  static TodayStoryData loadOrFallback(TodayStoryData fallback) {
+    try {
+      final f = File(activePath());
+      if (!f.existsSync()) return fallback;
+      final raw = f.readAsStringSync();
+      final story = _parse(raw);
+      return story ?? fallback;
+    } catch (_) {
+      return fallback;
+    }
+  }
+
+  static TodayStoryData? _parse(String raw) {
+    final dynamic doc = loadYaml(raw);
+    if (doc is! YamlMap) return null;
+
+    if (doc['schema']?.toString() != 'today/v1') return null;
+
+    String s(String key) => (doc[key] ?? '').toString().trim();
+    if (_bannedWords.hasMatch(
+          '${s('title_en')} ${s('title_de')} ${s('body_en')} ${s('body_de')}',
+        )) {
+      return null;
+    }
+
+    final required = [
+      'badge_en',
+      'badge_de',
+      'title_en',
+      'title_de',
+      'body_en',
+      'body_de',
+      'icon',
+      'cta',
+    ];
+    for (final k in required) {
+      if (s(k).isEmpty) return null;
+    }
+
+    final cta = _ctaFor(s('cta'));
+    if (cta == null) return null;
+    if (cta != TodayCta.none) {
+      if (s('cta_label_en').isEmpty || s('cta_label_de').isEmpty) {
+        return null;
+      }
+    }
+    final icon = _iconFor(s('icon'));
+    if (icon == null) return null;
+
+    return TodayStoryData(
+      badgeEn: s('badge_en'),
+      badgeDe: s('badge_de'),
+      titleEn: s('title_en'),
+      titleDe: s('title_de'),
+      bodyEn: s('body_en'),
+      bodyDe: s('body_de'),
+      ctaLabelEn: s('cta_label_en'),
+      ctaLabelDe: s('cta_label_de'),
+      icon: icon,
+      cta: cta,
+    );
+  }
+
+  /// Same banned-word list as `tools/today/accept.sh`. Kept in
+  /// sync by hand — a candidate that bypassed the shell gate
+  /// (e.g. a hand-edited active.yaml) still won't reach the UI.
+  static final RegExp _bannedWords = RegExp(
+    r'\b('
+    r'viral|killer|powerful|just\s+works|revolutionary|game[- ]changing|'
+    r'seamless|next[- ]generation|cutting[- ]edge|world[- ]class|unprecedented'
+    r')\b',
+    caseSensitive: false,
+  );
+
+  static TodayCta? _ctaFor(String s) {
+    switch (s) {
+      case 'none':
+        return TodayCta.none;
+      case 'openSettings':
+        return TodayCta.openSettings;
+      default:
+        return null;
+    }
+  }
+
+  /// Whitelist of icons the prompt template is allowed to
+  /// produce. Keeping the set explicit means an LLM hallucinated
+  /// icon name fails the load (and we fall back) rather than
+  /// rendering a random glyph.
+  static IconData? _iconFor(String name) {
+    switch (name) {
+      case 'hub_outlined':
+        return Icons.hub_outlined;
+      case 'account_tree_outlined':
+        return Icons.account_tree_outlined;
+      case 'shield_outlined':
+        return Icons.shield_outlined;
+      case 'extension':
+        return Icons.extension;
+      case 'bolt':
+        return Icons.bolt;
+      case 'menu_book_outlined':
+        return Icons.menu_book_outlined;
+      case 'security':
+        return Icons.security;
+      case 'auto_awesome':
+        return Icons.auto_awesome;
+      case 'rocket_launch':
+        return Icons.rocket_launch;
+      case 'timeline_outlined':
+        return Icons.timeline_outlined;
+      default:
+        return null;
+    }
+  }
+}

lib/main.dart

@@ -26,7 +26,7 @@ import 'widgets/widgets.dart';
 /// Studio's own build version. Bump on every UI commit so the
 /// running app self-identifies — visible in the sidebar header
 /// and quick-glance proof that you're seeing the current build.
-const String kStudioVersion = '0.30.0';
+const String kStudioVersion = '0.31.0';
 
 Future<void> main() async {
   WidgetsFlutterBinding.ensureInitialized();

lib/pages/store.dart

@@ -10,6 +10,7 @@ import 'package:flutter_markdown/flutter_markdown.dart';
 
 import '../data/hub.dart';
 import '../data/system_actions.dart';
+import '../data/today_story_loader.dart';
 import '../l10n/app_localizations.dart';
 import '../theme/theme.dart';
 import '../theme/tokens.dart';
@@ -38,6 +39,11 @@ class _StorePageState extends State<StorePage> {
   /// session. Not persisted — the next Studio launch shows it
   /// again so a release-bumped story has a chance to be seen.
   bool _todayDismissed = false;
+  /// Loaded once at init from `~/.fai/today/active.yaml`; falls
+  /// back to the compiled-in story when the pipeline hasn't
+  /// produced an accepted candidate yet.
+  late final TodayStoryData _todayStory =
+      TodayStoryLoader.loadOrFallback(_kFallbackTodayStory);
   late Future<List<StoreItem>> _future;
 
   /// Active UI locale, read from the app-wide MaterialApp
@@ -265,11 +271,11 @@ class _StorePageState extends State<StorePage> {
                     children: [
                       if (showToday) ...[
                         _StoreTodayHero(
-                          story: _kCurrentTodayStory,
+                          story: _todayStory,
                           locale: _locale,
                           onDismiss: () =>
                               setState(() => _todayDismissed = true),
-                          onCta: _kCurrentTodayStory.cta == _TodayCta.openSettings
+                          onCta: _todayStory.cta == TodayCta.openSettings
                               ? () => FaiSettingsDialog.show(context)
                               : null,
                         ),
@@ -1934,47 +1940,11 @@ class _ScreenshotPlaceholder extends StatelessWidget {
   }
 }
 
-/// Editorial action attached to a `_TodayStory`. Kept as an
+/// Compiled-in fallback story shown when
-/// enum (not a closure) so the story list stays `const` and
+/// `~/.fai/today/active.yaml` is absent or fails schema
-/// thus shippable as a frozen, audit-friendly artefact.
+/// validation. The pipeline operator can override at any time
-enum _TodayCta { openSettings }
+/// without recompiling Studio — see docs/today-pipeline.md.
-
+const TodayStoryData _kFallbackTodayStory = TodayStoryData(
-/// Editorial story shown in the Today-hero strip. One story
-/// is curated per release in [_kCurrentTodayStory] — operators
-/// who launch Studio see the same narrative until the next
-/// version bump. Bilingual content is shipped inline so KRITIS
-/// deployments don't need to pull translations from a CMS.
-class _TodayStory {
-  final String badgeEn;
-  final String badgeDe;
-  final String titleEn;
-  final String titleDe;
-  final String bodyEn;
-  final String bodyDe;
-  final String ctaLabelEn;
-  final String ctaLabelDe;
-  final IconData icon;
-  final _TodayCta cta;
-
-  const _TodayStory({
-    required this.badgeEn,
-    required this.badgeDe,
-    required this.titleEn,
-    required this.titleDe,
-    required this.bodyEn,
-    required this.bodyDe,
-    required this.ctaLabelEn,
-    required this.ctaLabelDe,
-    required this.icon,
-    required this.cta,
-  });
-}
-
-/// The story shown by Studio v0.30.x. Update when the
-/// release-narrative changes — this is the editorial role of
-/// the App Store Today tab, kept lightweight: one story, one
-/// CTA, refreshed per release.
-const _TodayStory _kCurrentTodayStory = _TodayStory(
   badgeEn: 'CAPABILITY FEDERATION',
   badgeDe: 'CAPABILITY-FEDERATION',
   titleEn: 'Two MCP servers away from a richer hub',
@@ -1986,7 +1956,7 @@ const _TodayStory _kCurrentTodayStory = _TodayStory(
   ctaLabelEn: 'Open MCP settings',
   ctaLabelDe: 'MCP-Einstellungen öffnen',
   icon: Icons.hub_outlined,
-  cta: _TodayCta.openSettings,
+  cta: TodayCta.openSettings,
 );
 
 /// Editorial hero strip — the first surface a browsing operator
@@ -1995,7 +1965,7 @@ const _TodayStory _kCurrentTodayStory = _TodayStory(
 /// bullets. Auto-hides whenever a filter is active so a
 /// purposeful search isn't pushed below the fold.
 class _StoreTodayHero extends StatelessWidget {
-  final _TodayStory story;
+  final TodayStoryData story;
   final String locale;
   final VoidCallback onDismiss;
   /// CTA action — null hides the button. Wired by the parent

pubspec.lock

@@ -357,7 +357,7 @@ packages:
     source: hosted
     version: "2.2.0"
   path:
-    dependency: transitive
+    dependency: "direct main"
     description:
       name: path
       sha256: "75cca69d1490965be98c73ceaea117e8a04dd21217b37b292c9ddbec0d955bc5"
@@ -610,7 +610,7 @@ packages:
     source: hosted
     version: "1.1.0"
   yaml:
-    dependency: transitive
+    dependency: "direct main"
     description:
       name: yaml
       sha256: b9da305ac7c39faa3f030eccd175340f968459dae4af175130b3fc47e40d76ce

pubspec.yaml

@@ -1,7 +1,7 @@
 name: fai_studio
 description: "F∆I Studio — desktop GUI for the F∆I hub"
 publish_to: 'none'
-version: 0.30.0
+version: 0.31.0
 
 environment:
   sdk: ^3.11.0-200.1.beta
@@ -21,6 +21,10 @@ dependencies:
   shared_preferences: ^2.5.5
   # Inline README rendering inside the Store detail sheet.
   flutter_markdown: ^0.7.7
+  # Today-Hero pipeline reads accepted stories from
+  # ~/.fai/today/active.yaml — see docs/today-pipeline.md.
+  yaml: ^3.1.2
+  path: ^1.9.0
 
 dev_dependencies:
   flutter_test:

tools/today/README.md

@@ -0,0 +1,73 @@
+# Today-Hero proposal tooling
+
+Daily-build pipeline for the editorial Today-Hero card in Studio's store.
+See `../../docs/today-pipeline.md` for the full design rationale.
+
+## Quick start
+
+```bash
+# 1. Generate today's proposals (calls the local Ollama by default).
+./propose.sh
+
+# 2. Skim them — they sit under ~/.fai/today/proposals/<ISO-DATE>/
+ls ~/.fai/today/proposals/
+
+# 3. Accept one. The chosen file becomes ~/.fai/today/active.yaml,
+#    which Studio reads at startup.
+./accept.sh ~/.fai/today/proposals/2026-05-08/candidate-2.yaml
+
+# 4. Restart Studio (or let the next launch pick it up).
+```
+
+## Schedule it
+
+### macOS — launchd
+
+```bash
+# Drop a plist that runs propose.sh every morning at 07:30 local time.
+# `launchctl load ~/Library/LaunchAgents/ai.flemming.fai.today.plist` to
+# install. The plist must point at the absolute path of propose.sh.
+```
+
+A starter plist lives at `launchd/ai.flemming.fai.today.plist`.
+
+### Linux — systemd timer
+
+```bash
+# Copy systemd/fai-today.{service,timer} into ~/.config/systemd/user/,
+# then `systemctl --user enable --now fai-today.timer`.
+```
+
+### Anywhere — cron
+
+```cron
+30 7 * * * /Users/flemming/.../tools/today/propose.sh > /tmp/fai-today.log 2>&1
+```
+
+## Provider override
+
+`propose.sh` defaults to Ollama at `http://127.0.0.1:11434` with the model
+`gemma3:4b`. Override via env vars:
+
+| Variable          | Default                          | Example                                         |
+|-------------------|----------------------------------|-------------------------------------------------|
+| `FAI_TODAY_API`   | `http://127.0.0.1:11434/api/generate` | `https://api.openai.com/v1/chat/completions` |
+| `FAI_TODAY_MODEL` | `gemma3:4b`                      | `gpt-4o-mini`                                   |
+| `FAI_TODAY_KEY`   | (unset)                          | `$OPENAI_API_KEY`                               |
+| `FAI_TODAY_N`     | `3`                              | `1` (single shot)                               |
+
+OpenAI-compatible endpoints will work as long as they speak `chat/completions`
+or `generate`; the script auto-detects from the URL path.
+
+## Trust model
+
+- Reads only `git log`, `git diff`, and the bundled `seed.yaml` of
+  installed F∆I monorepos. Never your audit log without explicit op-in.
+- Calls only the System-AI you've already configured for Studio. The same
+  privacy mode you set there applies here.
+- Writes only into `~/.fai/today/`. Nothing in `~/.fai/data/` or
+  `~/.fai/config.yaml` is touched.
+- Studio loads `active.yaml` at startup; if the file is missing or fails
+  schema validation, the compiled-in fallback story renders. KRITIS
+  fresh installs see the fallback until and unless an operator accepts a
+  proposal.

tools/today/accept.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# tools/today/accept.sh <proposal-path>
+#
+# Validates the chosen candidate, then atomically swaps it in as
+# ~/.fai/today/active.yaml. Studio reads that file at startup.
+set -euo pipefail
+
+if [ "${1:-}" = "" ]; then
+  printf 'Usage: %s <path-to-candidate.yaml>\n' "$0" >&2
+  exit 1
+fi
+
+src="$1"
+[ -f "$src" ] || { printf 'No such file: %s\n' "$src" >&2; exit 1; }
+
+# Schema gate. Block accept if the candidate is missing required
+# top-level keys or carries the wrong schema version. Studio
+# would silently fall back, but we want a loud failure here so
+# the operator knows the proposal was malformed.
+require_key() {
+  local key="$1"
+  if ! grep -qE "^$key:" "$src"; then
+    printf 'Reject: candidate is missing key `%s`.\n' "$key" >&2
+    exit 2
+  fi
+}
+
+if ! grep -qE '^schema:[[:space:]]*today/v1[[:space:]]*$' "$src"; then
+  printf 'Reject: candidate must declare `schema: today/v1`.\n' >&2
+  exit 2
+fi
+
+for k in badge_en badge_de title_en title_de body_en body_de icon cta; do
+  require_key "$k"
+done
+
+# Banned-words check (matches both DE and EN bodies/titles).
+banned='viral|killer|powerful|just[[:space:]]+works|revolutionary|game-changing|seamless|next-generation|cutting-edge|world-class|unprecedented'
+if grep -qiE "$banned" "$src"; then
+  printf 'Reject: candidate contains banned marketing language.\n' >&2
+  printf 'Hits:\n' >&2
+  grep -niE "$banned" "$src" >&2 || true
+  exit 3
+fi
+
+# Atomic move via copy-then-rename so Studio never reads a torn
+# half-written file even if it polls during the swap.
+dst="$HOME/.fai/today/active.yaml"
+mkdir -p "$(dirname "$dst")"
+tmp="$(mktemp "${dst}.XXXXXX")"
+cp "$src" "$tmp"
+mv "$tmp" "$dst"
+
+printf 'Accepted: %s\n  → %s\n' "$src" "$dst"
+printf 'Restart Studio (or wait for the next launch) to see it.\n'

tools/today/collect.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# tools/today/collect.sh
+#
+# Aggregates "what happened in the last N hours" across the F∆I
+# monorepos into a single plain-text summary the proposer feeds
+# to the System-AI.
+#
+# Touches only git history and the bundled store-index seed file.
+# Does not read the audit log without --with-audit.
+set -euo pipefail
+
+SINCE="${FAI_TODAY_SINCE:-24 hours ago}"
+
+# Walk every fai-* directory next to fai_studio so the collector
+# works from any of the sibling checkouts. Adjust here if the
+# layout ever changes.
+ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+
+emit_section() {
+  printf '\n## %s\n\n' "$1"
+}
+
+emit_section "RECENT COMMITS (last: $SINCE)"
+for repo in "$ROOT"/fai_*/; do
+  [ -d "$repo/.git" ] || continue
+  name="$(basename "$repo")"
+  log=$(git -C "$repo" log --since="$SINCE" --pretty='%h %s' 2>/dev/null || true)
+  if [ -n "$log" ]; then
+    printf '### %s\n%s\n\n' "$name" "$log"
+  fi
+done
+
+emit_section "STORE INDEX SEED CHANGES"
+seed="$ROOT/fai_platform/crates/fai_hub/store-index/seed.yaml"
+if [ -f "$seed" ] && [ -d "$ROOT/fai_platform/.git" ]; then
+  diff=$(git -C "$ROOT/fai_platform" log --since="$SINCE" --oneline -- \
+    crates/fai_hub/store-index/seed.yaml 2>/dev/null || true)
+  if [ -n "$diff" ]; then
+    printf '%s\n' "$diff"
+  else
+    printf '(no changes in window)\n'
+  fi
+fi
+
+emit_section "ARCHITECTURE / SYSTEM-GAPS CHANGES"
+arch_dir="$ROOT/fai_platform/docs"
+if [ -d "$arch_dir" ] && [ -d "$ROOT/fai_platform/.git" ]; then
+  changes=$(git -C "$ROOT/fai_platform" log --since="$SINCE" --oneline -- \
+    docs/architecture docs/advanced 2>/dev/null || true)
+  if [ -n "$changes" ]; then
+    printf '%s\n' "$changes"
+  else
+    printf '(no changes in window)\n'
+  fi
+fi
+
+emit_section "STUDIO RECENT RELEASES"
+studio="$ROOT/fai_studio"
+if [ -d "$studio/.git" ]; then
+  tags=$(git -C "$studio" log --since="$SINCE" --pretty='%h %s' \
+    --grep='^feat(studio)\|^chore(studio): bump' 2>/dev/null || true)
+  if [ -n "$tags" ]; then
+    printf '%s\n' "$tags"
+  else
+    printf '(no Studio release activity)\n'
+  fi
+fi
+
+emit_section "AUDIT-LOG HIGHLIGHTS"
+if [ "${FAI_TODAY_WITH_AUDIT:-0}" = "1" ] && command -v fai >/dev/null 2>&1; then
+  fai audit recent --limit 20 2>/dev/null | head -40 || \
+    printf '(audit query failed; daemon may be stopped)\n'
+else
+  printf '(audit pull disabled — set FAI_TODAY_WITH_AUDIT=1 to opt in)\n'
+fi

tools/today/prompt.template.md

@@ -0,0 +1,78 @@
+You are the Today-tab editor for the F∆I Platform Studio store.
+Your job is to draft ONE editorial story per run that the platform's
+solo developer (Stefan Flemming) will review and either accept or
+discard.
+
+## Project identity (do not deviate)
+
+F∆I Platform is a deterministic workflow engine for AI-assisted
+document processing in regulated environments. It runs WASM modules
+inside YAML flows, with sandbox-secure capability discovery.
+
+The product mantra is "Hub. Module. Flow." — the platform is the
+product, not specific modules. Operators run Studio (Flutter Desktop
+GUI) against a local hub binary.
+
+## What you write
+
+A bilingual story for the Today-Hero card on the store page. The
+operator opens the store, sees one hero card with:
+
+- A short uppercase BADGE (3-4 words, e.g. "CAPABILITY FEDERATION")
+- A headline TITLE (one sentence, max 12 words)
+- A BODY of 2-3 short sentences telling a single story arc
+- A CTA action that calls the operator forward
+
+EN and DE are written in parallel by you, in the same pass. Match
+register and length between languages — German operators must not
+feel like they're reading a translation.
+
+## Bans (hard)
+
+- Banned words: "viral", "killer", "powerful", "just works",
+  "revolutionary", "game-changing", "seamless", "next-generation",
+  "cutting-edge", "world-class", "unprecedented".
+- No private organisation names: never "ITDZ", "Kammergericht",
+  "HTW", "J∆I", or any specific institution. Generic terms only —
+  "a regulated organisation", "a public administration".
+- No emoji.
+- No "Co-authored-by Claude" or other AI attribution.
+
+## Output format (strict)
+
+Reply with ONE YAML document, no surrounding prose, no markdown
+fences. Schema:
+
+```yaml
+schema: today/v1
+badge_en: <STRING, ALL CAPS, ≤4 words>
+badge_de: <STRING, ALL CAPS, ≤4 words>
+title_en: <ONE SENTENCE, ≤12 words>
+title_de: <ONE SENTENCE, ≤12 words>
+body_en: |
+  <2-3 sentences. ≤80 words total. Single story arc.>
+body_de: |
+  <2-3 sentences. ≤80 words total. Single story arc.>
+icon: <one of: hub_outlined | account_tree_outlined | shield_outlined |
+       extension | bolt | menu_book_outlined | security |
+       auto_awesome | rocket_launch | timeline_outlined>
+cta: <one of: openSettings | none>
+cta_label_en: <≤5 words. Required when cta != none.>
+cta_label_de: <≤5 words. Required when cta != none.>
+```
+
+## Signal input
+
+Below is the "what happened in F∆I in the last 24 hours" summary —
+git log entries, store-index changes, audit-log highlights. Pick the
+ONE most operator-relevant thread and tell its story. If nothing
+notable happened, surface a longer-arc theme (recent week's progress,
+a soon-to-ship capability, a stability message).
+
+---
+
+{{SIGNAL_INPUT}}
+
+---
+
+Now write the YAML. One story. No explanation.

tools/today/propose.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# tools/today/propose.sh
+#
+# Orchestrates: collect → System-AI → write candidate YAML files.
+# Defaults to a local Ollama at 127.0.0.1:11434 with gemma3:4b.
+# See README.md for env-var overrides.
+#
+# Output:  ~/.fai/today/proposals/<ISO-DATE>/candidate-<n>.yaml
+# Operator then runs accept.sh with the chosen file.
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+DATE="$(date -u +%Y-%m-%d)"
+OUT_DIR="${FAI_TODAY_OUT:-$HOME/.fai/today/proposals/$DATE}"
+N="${FAI_TODAY_N:-3}"
+API="${FAI_TODAY_API:-http://127.0.0.1:11434/api/generate}"
+MODEL="${FAI_TODAY_MODEL:-gemma3:4b}"
+KEY="${FAI_TODAY_KEY:-}"
+
+mkdir -p "$OUT_DIR"
+
+signals="$("$HERE/collect.sh")"
+template="$(cat "$HERE/prompt.template.md")"
+prompt="${template//\{\{SIGNAL_INPUT\}\}/$signals}"
+
+call_ollama() {
+  # Streaming off, single completion. The /api/generate endpoint
+  # returns one big JSON; we extract `.response`.
+  jq -n --arg model "$MODEL" --arg prompt "$prompt" \
+    '{model: $model, prompt: $prompt, stream: false}' \
+    | curl -fsS -X POST -H 'Content-Type: application/json' \
+        --data-binary @- "$API" \
+    | jq -r '.response'
+}
+
+call_openai_compatible() {
+  local body
+  body=$(jq -n --arg model "$MODEL" --arg prompt "$prompt" '{
+    model: $model,
+    messages: [{role: "user", content: $prompt}],
+    temperature: 0.6
+  }')
+  local hdr_args=()
+  if [ -n "$KEY" ]; then
+    hdr_args=(-H "Authorization: Bearer $KEY")
+  fi
+  printf '%s' "$body" \
+    | curl -fsS -X POST -H 'Content-Type: application/json' \
+        "${hdr_args[@]}" --data-binary @- "$API" \
+    | jq -r '.choices[0].message.content'
+}
+
+draft_one() {
+  case "$API" in
+    *"/generate"*)             call_ollama ;;
+    *"/chat/completions"*)     call_openai_compatible ;;
+    *)
+      printf 'unknown API path in %s — aborting\n' "$API" >&2
+      exit 2 ;;
+  esac
+}
+
+# Strip ```yaml fences if the model adds them despite the prompt.
+clean_yaml() {
+  sed -e '/^```yaml$/d' -e '/^```$/d' -e 's/^```$//'
+}
+
+for n in $(seq 1 "$N"); do
+  out="$OUT_DIR/candidate-$n.yaml"
+  printf 'Drafting candidate %d/%d via %s (%s)…\n' "$n" "$N" "$API" "$MODEL"
+  draft_one | clean_yaml > "$out"
+  printf '  → %s (%d bytes)\n' "$out" "$(wc -c < "$out")"
+done
+
+printf '\nDone. Skim with:\n  ls -la %s\n  for f in %s/*.yaml; do echo "=== $f ==="; cat "$f"; done\n' \
+  "$OUT_DIR" "$OUT_DIR"
+printf '\nAccept with:\n  %s/accept.sh <path-to-chosen.yaml>\n' "$HERE"