docs(cto): CONTRACT.md catch-up to v1.0 MVP — drop scaffold-era language

Audit cross-check flagged CONTRACT.md still claimed "v0.1 scaffold" + "v1.0
not yet implemented" throughout while README + skill frontmatter + manifest
all already said v1.0 MVP. This commit aligns CONTRACT to the actual ship state:

- frontmatter: status draft → active; description drops "v0.1 = scaffold;
  orchestrator unimplemented" → "v1.0 MVP shipped"
- §"Status:" line: v0.1 scaffold → v1.0 MVP shipped 2026-05-24
- §4 V1 scope: restructure into v1.0 SHIPPED / v1.1+ NEXT / v2+ DEFERRED.
  v1.0 SHIPPED now lists cto-agent executable + cto-python-toolkit +
  cto-angular-toolkit + lib/cto-worker.sh + kanban worker contract +
  approval gate enforcement.
- §5 invocation pattern: "(v1.0 plan)" → "(v1.0 — shipped via lib/cto-worker.sh)"
- §8 routing table: "(v1.0 — not yet implemented)" → "(v1.0 — shipped)"
- §10 build state: drop v0.1 scaffold-only language; "v1.0 MVP (current)"
  lists shipped deliverables; v1.1 next lists iteration loop / multi-stack
  / memory / observability.

Source-of-truth alignment: README v1.0 MVP, manifest v1.0.0, distribution
v1.0.0, skill SKILL.md v1.0.0, install.sh dropped scaffold notes — all
now consistent.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CONTRACT.md

@@ -1,12 +1,12 @@
 ---
 name: cto-planb-contract
 tier: T1
-status: draft
+status: active
 owner: jp
 source: hand
 last_reviewed: 2026-05-24
 review_by: 2026-08-22
-description: cto-planb profile behavior contract — what CTO does, doesn't do, edge cases. Tier T1 — this file wins for the cto-planb profile. v0.1 = scaffold; orchestrator unimplemented.
+description: cto-planb profile behavior contract — what CTO does, doesn't do, edge cases. Tier T1 — this file wins for the cto-planb profile. v1.0 MVP shipped (executable cto-agent + cto-worker.sh helper + 2 toolkit skills).
 depends_on:
   - profile-distribution-protocol
 ---
@@ -16,7 +16,7 @@ depends_on:
 **Role:** Chief Technology Officer, Plan B
 **Date:** 2026-05-24
 **Owner:** JP
-**Status:** v0.1 — scaffold (orchestrator skill not yet implemented)
+**Status:** v1.0 MVP shipped 2026-05-24 — executable cto-agent orchestrator + cto-worker.sh sandcastle helper + 2 toolkit skills (Python + Angular)
 
 ---
 
@@ -72,22 +72,29 @@ Max 3 re-sandcastle cycles before escalating to JP. Never hand-fix the diff —
 
 ## §4 V1 scope
 
-### What v0.1 includes (scaffold only)
+### What v1.0 MVP ships (current — 2026-05-24)
 
-- `AGENT.md` + `CONTRACT.md` + `manifest.yaml` + `distribution.yaml` + `install.sh` + `credbridge.sh` skeleton
+- `AGENT.md` + `CONTRACT.md` + `manifest.yaml` + `distribution.yaml` + `install.sh` + `credbridge.sh`
 - `schema.sql` (cto.db tables: work_queue, agent_runtime, invocations)
-- `skills/cto-agent/SKILL.md` (orchestrator stub — not executable until v1.0)
+- `skills/cto-agent/SKILL.md` — executable orchestrator (decompose → sandcastle.run → review → PR → report)
+- `skills/cto-python-toolkit/SKILL.md` — Python stack patterns (anchored to bte-mcp, svrnty-hermes-webui-plugin, curator/sweep.py, scripts/sot-precommit.py)
+- `skills/cto-angular-toolkit/SKILL.md` — Angular stack patterns (anchored to adwright/adwright-console)
+- `lib/cto-worker.sh` — sandcastle invocation helper + open-pr + emit-5w commands
+- Routing rules per task type + per stack
+- 5W founder/CEO update format
+- Approval gate enforcement (merge to main requires JP `approve`; CTO never `gh pr merge` autonomously)
+- Kanban worker contract (kanban_complete | kanban_block required at task end — no protocol violations)
 - Workspace map + .gitignore entries
 
-### What v1.0 will add (next milestone, not yet built)
+### What v1.1+ defers (next)
 
-- Executable `cto-agent` orchestrator (decompose, sandcastle invoke, review, PR open, report)
-- Routing rules per task type
-- 5W founder/CEO update format
-- Approval gate enforcement (merge to main requires JP `approve` row)
-- Memory protocol (episodic via `memory_tool`)
+- Iteration loop: auto-rerun sandcastle on test-failure detect (max 3 iterations, then escalate)
+- Multi-stack tasks: orchestrate sandcastle invocations sequentially for tasks spanning .NET backend + Angular frontend
+- Memory: capture per-repo learnings + surface in next invocation
+- Observability: emit sandcastle commit + PR + judgment to a metrics endpoint
+- Extract Python + Angular toolkit skills into `cortex/L6-svrnty.lib-{python,angular}-framework` when usage justifies
 
-### What v1.0 explicitly defers (v2+)
+### What v2+ explicitly defers
 
 - Production deploy gates (CI/CD integration)
 - Observability MCPs (Grafana, Prometheus, logs)
@@ -103,7 +110,7 @@ Max 3 re-sandcastle cycles before escalating to JP. Never hand-fix the diff —
 
 CTO's primary execution mechanism = `workspaces/hermes/sandcastle` (Matt Pocock, MIT, pinned v0.5.11).
 
-### Invocation pattern (v1.0 plan)
+### Invocation pattern (v1.0 — shipped via lib/cto-worker.sh)
 
 Programmatic TypeScript invocation via `tsx`:
 
@@ -181,7 +188,7 @@ npx --yes @google/design.md@latest lint BRAND-DESIGN.md
 
 If the task is pure backend or non-UI, DESIGN.md is irrelevant — skip this section.
 
-## §8 Routing table (v1.0 — not yet implemented)
+## §8 Routing table (v1.0 — shipped)
 
 | Task type | Action |
 |---|---|
@@ -216,11 +223,11 @@ If the task is pure backend or non-UI, DESIGN.md is irrelevant — skip this sec
 
 ## §10 Build state
 
-**v0.1 (current):** scaffold only — identity, contract, manifest, distribution, install.sh skeleton, schema, skill stub. Nothing executable yet.
+**v1.0 MVP (current — shipped 2026-05-24):** executable cto-agent orchestrator + cto-worker.sh helper + 2 toolkit skills (Python anchored to workspace projects; Angular anchored to adwright-console). Approval gate enforced (kanban_block on deploy-adjacent; CTO never `gh pr merge`). Kanban worker contract complete (kanban_complete | kanban_block required at task end).
 
-**v1.0 next:** implement `cto-agent` orchestrator skill (decompose → sandcastle.run → review → PR → report), wire approval gate enforcement, ship founder/CEO update format.
+**v1.1 next:** iteration loop (auto-rerun on test-failure), multi-stack orchestration, memory of per-repo learnings, observability emit.
 
-**v2 deferred:** sub-agent profiles, deploy gates, observability, IaC, cost monitoring, security automation.
+**v2 deferred:** sub-agent profiles, deploy gates, IaC, cost monitoring, security automation.
 
 ---