diff --git a/.cursorrules b/.cursorrules
index e625490..ff1eff3 100644
--- a/.cursorrules
+++ b/.cursorrules
@@ -3,7 +3,7 @@ You are working on Developer Tools Directory, a meta-repository that catalogs, s
 ## Repo structure
 
 - `registry.json` -- single source of truth for all 9 tool repos (name, type, counts, links, status)
-- `standards/` -- 9 Markdown docs defining conventions (folder structure, CI/CD, manifests, pages, commits, README, AGENTS.md, versioning)
+- `standards/` -- 18 Markdown docs defining conventions (folder structure, CI/CD, manifests, pages, commits, README, AGENTS.md, versioning, and more)
 - `scaffold/create-tool.py` -- Python repo generator using Jinja2 templates
 - `scaffold/templates/` -- Jinja2 templates producing a standards-compliant repo
 - `site-template/` -- shared GitHub Pages build system for tool repos (build_site.py + template.html.j2 + fonts)
@@ -33,7 +33,8 @@ Use conventional commits. Prefix determines changelog category:
 
 ## When editing registry.json
 
-- Every entry needs all required fields: name, repo, slug, description, type, homepage, skills, rules, mcpTools, extras, topics, status, version, language, license, pagesType, hasCI.
+- Every entry needs all required fields: name, repo, slug, description, type, homepage, skills, rules, mcpTools, extras, topics, status, language, license, pagesType, hasCI.
+- Do not add a per-tool `version` field. It was removed because tool repos auto-bump patch on every content merge, so a catalog-pinned version re-stales on each tool's next content PR. The catalog tracks tools by repo and homepage, not by patch version.
 - `type` must be `cursor-plugin` or `mcp-server`.
 - `skills`, `rules`, `mcpTools` must be integers.
 - After editing registry.json, also update:
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index c52d69c..b153b1c 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/dependency-review-action@v4
+      - uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high
           comment-summary-in-pr: always
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 44ca4cc..e87eb64 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -39,7 +39,6 @@ jobs:
             "extras": dict,
             "topics": list,
             "status": str,
-            "version": str,
             "language": str,
             "license": str,
             "pagesType": str,
@@ -92,7 +91,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -153,17 +152,27 @@ jobs:
 
       - name: Scaffold regression checks for DTD#41 patterns
         run: |
+          # Meta action pins are DERIVED from the meta VERSION at generation
+          # time, so assert against the derived train rather than a hardcoded
+          # literal (which would itself go stale on the next meta release).
+          VERSION=$(cat VERSION)
+          IFS='.' read -r META_MAJOR META_MINOR META_PATCH <<< "$VERSION"
+
           # validate-counts job present
           grep -q 'validate-counts' /tmp/scaffold-test/ci-test-plugin/.github/workflows/validate.yml \
             || { echo "::error::validate.yml missing validate-counts job"; exit 1; }
 
-          # drift-check pinned to @v1.9
-          grep -q 'drift-check@v1.9' /tmp/scaffold-test/ci-test-plugin/.github/workflows/drift-check.yml \
-            || { echo "::error::drift-check.yml not pinned to @v1.9"; exit 1; }
+          # drift-check pinned to @vMAJOR.MINOR (derived from meta VERSION)
+          grep -q "drift-check@v${META_MAJOR}.${META_MINOR}" /tmp/scaffold-test/ci-test-plugin/.github/workflows/drift-check.yml \
+            || { echo "::error::drift-check.yml not pinned to derived @v${META_MAJOR}.${META_MINOR}"; exit 1; }
+
+          # release.yml consumes release-doc-sync@vMAJOR (derived from meta VERSION)
+          grep -q "release-doc-sync@v${META_MAJOR}" /tmp/scaffold-test/ci-test-plugin/.github/workflows/release.yml \
+            || { echo "::error::release.yml does not consume derived release-doc-sync@v${META_MAJOR}"; exit 1; }
 
-          # release.yml consumes release-doc-sync@v1
-          grep -q 'release-doc-sync@v1' /tmp/scaffold-test/ci-test-plugin/.github/workflows/release.yml \
-            || { echo "::error::release.yml does not consume release-doc-sync@v1"; exit 1; }
+          # release.yml pins release-doc-sync meta-repo-ref to the full meta release tag
+          grep -q "meta-repo-ref: v${META_MAJOR}.${META_MINOR}.${META_PATCH}" /tmp/scaffold-test/ci-test-plugin/.github/workflows/release.yml \
+            || { echo "::error::release.yml meta-repo-ref not pinned to derived v${META_MAJOR}.${META_MINOR}.${META_PATCH}"; exit 1; }
 
           # release.yml has the initial-release version-handling branch
           grep -q 'Initial release' /tmp/scaffold-test/ci-test-plugin/.github/workflows/release.yml \
@@ -195,9 +204,12 @@ jobs:
           grep -q '<!-- standards-version:' /tmp/scaffold-test/ci-test-plugin/AGENTS.md \
             || { echo "::error::AGENTS.md missing standards-version marker"; exit 1; }
 
-          # LICENSE has correct CC-BY-NC-ND-4.0 copyright (TM Hospitality Strategies, not TMHSDigital)
-          grep -q 'Copyright (c) 2026 TM Hospitality Strategies' /tmp/scaffold-test/ci-test-plugin/LICENSE \
-            || { echo "::error::LICENSE missing canonical 'TM Hospitality Strategies' copyright line"; exit 1; }
+          # LICENSE has correct CC-BY-NC-ND-4.0 copyright (TM Hospitality Strategies, not TMHSDigital).
+          # The year is DERIVED from the current UTC year at generation time, so assert against
+          # that rather than a hardcoded literal (which would itself go stale every January 1).
+          YEAR=$(date -u +%Y)
+          grep -q "Copyright (c) ${YEAR} TM Hospitality Strategies" /tmp/scaffold-test/ci-test-plugin/LICENSE \
+            || { echo "::error::LICENSE missing canonical 'Copyright (c) ${YEAR} TM Hospitality Strategies' line"; exit 1; }
           grep -q 'SPDX-License-Identifier: CC-BY-NC-ND-4.0' /tmp/scaffold-test/ci-test-plugin/LICENSE \
             || { echo "::error::LICENSE missing SPDX-License-Identifier"; exit 1; }
 
@@ -222,7 +234,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -273,7 +285,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -331,3 +343,19 @@ jobs:
 
           echo "::error::feat: or fix: commits require a VERSION bump. Update VERSION and commit before merging. Use '[skip version]' in the commit subject or body to opt out for workflow-only changes."
           exit 1
+
+  test-drift-check:
+    name: Run drift_check tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install test dependencies
+        run: pip install -r requirements-test.txt
+
+      - name: Run drift_check tests
+        run: pytest tests/ -v
diff --git a/.gitignore b/.gitignore
index aebe235..6b900f2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -43,4 +43,8 @@ Thumbs.db
 
 # Scaffold test output
 output/
+_scaffold*/
 /tmp/
+
+# Windows NULL device - appears as untracked on Windows when shells redirect to nul
+nul
diff --git a/AGENTS.md b/AGENTS.md
index 6a3dcb6..86807c9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -9,7 +9,7 @@ This file tells AI coding agents how the Developer Tools Directory repo works an
 This is a **meta-repository** -- it does not contain a Cursor plugin or MCP server itself. It catalogs, standardizes, and scaffolds other TMHSDigital developer tool repos. It contains:
 
 - **`registry.json`** -- single source of truth for all tool repos. README, CLAUDE.md, and the catalog site's embedded registry are generated from it by `scripts/sync_from_registry.py`.
-- **`standards/`** -- 17 Markdown docs defining conventions for folder structure, CI/CD, plugin manifests, GitHub Pages, commits, README format, AGENTS.md format, versioning, testing, skills, rules, MCP servers, security, licensing, scope, lifecycle, and writing style.
+- **`standards/`** -- 18 Markdown docs defining conventions for folder structure, CI/CD, plugin manifests, GitHub Pages, commits, README format, AGENTS.md format, versioning, release-doc-sync, testing, skills, rules, MCP servers, security, licensing, scope, lifecycle, and writing style.
 - **`scaffold/`** -- Python repo generator (`create-tool.py`) with Jinja2 templates that produce a fully standards-compliant new tool repo.
 - **`scripts/`** -- automation utilities. `sync_from_registry.py` regenerates all derived artifacts from `registry.json`.
 - **`site-template/`** -- shared GitHub Pages build system for tool repos. `build_site.py` reads `.cursor-plugin/plugin.json`, `site.json`, `skills/`, `rules/`, and `mcp-tools.json` from a tool repo and renders `docs/index.html` via `template.html.j2`. Self-hosts Inter and JetBrains Mono fonts. Tool repos clone this directory in CI and run the build script at deploy time.
@@ -124,12 +124,13 @@ Array of tool objects. Required fields per entry:
 | `npm` | string | npm package name (empty string or omit if none) |
 | `topics` | string[] | Discovery tags |
 | `status` | string | `experimental`, `beta`, `active`, `maintenance`, `deprecated`, or `archived` (see [`standards/lifecycle.md`](standards/lifecycle.md)) |
-| `version` | string | Current semver version |
 | `language` | string | Primary language |
 | `license` | string | SPDX identifier |
 | `pagesType` | string | `static`, `mkdocs`, or `none` |
 | `hasCI` | bool | Whether the repo has CI workflows |
 
+There is intentionally no per-tool `version` field. Tool repos auto-bump patch on every content merge, so a catalog-pinned patch version re-stales on each tool's next content PR (and is never rendered anywhere - the sync generator and docs site ignore it). The catalog tracks tools by repo and homepage. Do not reintroduce it.
+
 ### `docs/index.html`
 
 The catalog site. It embeds a copy of the registry data in a `<script type="application/json">` tag as a fallback, and also fetches `registry.json` at runtime. The embedded copy is regenerated from `registry.json` by `scripts/sync_from_registry.py`. Do not edit the embedded block by hand.
diff --git a/CLAUDE.md b/CLAUDE.md
index 3e6a165..105cc9c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -16,7 +16,7 @@ Developer Tools Directory is a **meta-repository** that catalogs, standardizes,
 ```
 Developer-Tools-Directory/
   registry.json              # Source of truth for all tool repos
-  standards/                 # 17 convention docs (structure, CI/CD, testing, MCP, security, licensing, etc.)
+  standards/                 # 18 convention docs (structure, CI/CD, testing, MCP, security, licensing, etc.)
   scaffold/
     create-tool.py           # Python repo generator (Jinja2)
     templates/               # Jinja2 templates for new repos
@@ -47,7 +47,9 @@ Developer-Tools-Directory/
 
 ### registry.json
 
-Array of tool objects. Each entry has: `name`, `repo`, `slug`, `description`, `type` (cursor-plugin | mcp-server), `homepage`, `skills`, `rules`, `mcpTools`, `extras`, `topics`, `status`, `version`, `language`, `license`, `pagesType`, `hasCI`. `status` is one of `experimental`, `beta`, `active`, `maintenance`, `deprecated`, or `archived` (see [`standards/lifecycle.md`](standards/lifecycle.md)).
+Array of tool objects. Each entry has: `name`, `repo`, `slug`, `description`, `type` (cursor-plugin | mcp-server), `homepage`, `skills`, `rules`, `mcpTools`, `extras`, `topics`, `status`, `language`, `license`, `pagesType`, `hasCI`. `status` is one of `experimental`, `beta`, `active`, `maintenance`, `deprecated`, or `archived` (see [`standards/lifecycle.md`](standards/lifecycle.md)).
+
+There is intentionally no per-tool `version` field. Tool repos auto-bump patch on every content merge, so a catalog-pinned patch version re-stales on each tool's next content PR; the catalog tracks tools by repo and homepage instead. Do not reintroduce it.
 
 When updating, run `python scripts/sync_from_registry.py` to regenerate every derived artifact. The `sync-check` CI job blocks PRs that drift.
 
@@ -83,10 +85,13 @@ Static HTML/CSS/JS. No build step. No external CDN. The `pages.yml` workflow cop
 | Monday Cursor Plugin | Plugin | 21 | 8 | 45 |
 | Steam Cursor Plugin | Plugin | 30 | 9 | 25 |
 | Steam MCP Server | MCP Server | 0 | 0 | 25 |
+| Developer Tools MCP | MCP Server | 0 | 0 | 7 |
+| CFX MCP | MCP Server | 0 | 0 | 0 |
+| Blender Developer Tools | Plugin | 12 | 6 | 0 |
 <!-- registry:tools:end -->
 
 <!-- registry:stats:start -->
-**Totals:** 177 skills, 71 rules, 371 MCP tools across 9 repos
+**Totals:** 189 skills, 77 rules, 378 MCP tools across 11 repos
 <!-- registry:stats:end -->
 
 ## Development Workflow
@@ -164,3 +169,66 @@ Open `docs/index.html` in a browser. The script falls back to embedded registry
 | Jinja2 >=3.1,<4.0 | Scaffold template rendering | `requirements.txt` |
 
 The docs site has zero runtime dependencies. The sync script is pure stdlib.
+
+# context-mode — MANDATORY routing rules
+
+You have context-mode MCP tools available. These rules are NOT optional — they protect your context window from flooding. A single unrouted command can dump 56 KB into context and waste the entire session.
+
+## BLOCKED commands — do NOT attempt these
+
+### curl / wget — BLOCKED
+Any Bash command containing `curl` or `wget` is intercepted and replaced with an error message. Do NOT retry.
+Instead use:
+- `ctx_fetch_and_index(url, source)` to fetch and index web pages
+- `ctx_execute(language: "javascript", code: "const r = await fetch(...)")` to run HTTP calls in sandbox
+
+### Inline HTTP — BLOCKED
+Any Bash command containing `fetch('http`, `requests.get(`, `requests.post(`, `http.get(`, or `http.request(` is intercepted and replaced with an error message. Do NOT retry with Bash.
+Instead use:
+- `ctx_execute(language, code)` to run HTTP calls in sandbox — only stdout enters context
+
+### WebFetch — BLOCKED
+WebFetch calls are denied entirely. The URL is extracted and you are told to use `ctx_fetch_and_index` instead.
+Instead use:
+- `ctx_fetch_and_index(url, source)` then `ctx_search(queries)` to query the indexed content
+
+## REDIRECTED tools — use sandbox equivalents
+
+### Bash (>20 lines output)
+Bash is ONLY for: `git`, `mkdir`, `rm`, `mv`, `cd`, `ls`, `npm install`, `pip install`, and other short-output commands.
+For everything else, use:
+- `ctx_batch_execute(commands, queries)` — run multiple commands + search in ONE call
+- `ctx_execute(language: "shell", code: "...")` — run in sandbox, only stdout enters context
+
+### Read (for analysis)
+If you are reading a file to **Edit** it → Read is correct (Edit needs content in context).
+If you are reading to **analyze, explore, or summarize** → use `ctx_execute_file(path, language, code)` instead. Only your printed summary enters context. The raw file content stays in the sandbox.
+
+### Grep (large results)
+Grep results can flood context. Use `ctx_execute(language: "shell", code: "grep ...")` to run searches in sandbox. Only your printed summary enters context.
+
+## Tool selection hierarchy
+
+1. **GATHER**: `ctx_batch_execute(commands, queries)` — Primary tool. Runs all commands, auto-indexes output, returns search results. ONE call replaces 30+ individual calls.
+2. **FOLLOW-UP**: `ctx_search(queries: ["q1", "q2", ...])` — Query indexed content. Pass ALL questions as array in ONE call.
+3. **PROCESSING**: `ctx_execute(language, code)` | `ctx_execute_file(path, language, code)` — Sandbox execution. Only stdout enters context.
+4. **WEB**: `ctx_fetch_and_index(url, source)` then `ctx_search(queries)` — Fetch, chunk, index, query. Raw HTML never enters context.
+5. **INDEX**: `ctx_index(content, source)` — Store content in FTS5 knowledge base for later search.
+
+## Subagent routing
+
+When spawning subagents (Agent/Task tool), the routing block is automatically injected into their prompt. Bash-type subagents are upgraded to general-purpose so they have access to MCP tools. You do NOT need to manually instruct subagents about context-mode.
+
+## Output constraints
+
+- Keep responses under 500 words.
+- Write artifacts (code, configs, PRDs) to FILES — never return them as inline text. Return only: file path + 1-line description.
+- When indexing content, use descriptive source labels so others can `ctx_search(source: "label")` later.
+
+## ctx commands
+
+| Command | Action |
+|---------|--------|
+| `ctx stats` | Call the `ctx_stats` MCP tool and display the full output verbatim |
+| `ctx doctor` | Call the `ctx_doctor` MCP tool, run the returned shell command, display as checklist |
+| `ctx upgrade` | Call the `ctx_upgrade` MCP tool, run the returned shell command, display as checklist |
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f66a118..855564f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -24,7 +24,7 @@ Thank you for your interest in contributing. This guide covers everything you ne
 ```
 Developer-Tools-Directory/
   registry.json              # Tool catalog (source of truth)
-  standards/                 # Convention documentation (9 docs)
+  standards/                 # Convention documentation (18 docs)
   scaffold/
     create-tool.py           # Repo generator script
     templates/               # Jinja2 templates for new repos
diff --git a/README.md b/README.md
index 93c56ba..60f370d 100644
--- a/README.md
+++ b/README.md
@@ -31,7 +31,7 @@
 
 <!-- registry:stats:start -->
 <p align="center">
- 9 repos &nbsp;&bull;&nbsp; 177 skills &nbsp;&bull;&nbsp; 71 rules &nbsp;&bull;&nbsp; 371 MCP tools
+ 11 repos &nbsp;&bull;&nbsp; 189 skills &nbsp;&bull;&nbsp; 77 rules &nbsp;&bull;&nbsp; 378 MCP tools
 </p>
 <!-- registry:stats:end -->
 
@@ -62,6 +62,9 @@ flowchart LR
 | **Monday Cursor Plugin** | Plugin | 21 | 8 | 45 | [![Repo](https://img.shields.io/badge/repo-blue?logo=github)](https://github.com/TMHSDigital/Monday-Cursor-Plugin) [![Docs](https://img.shields.io/badge/docs-7c3aed)](https://tmhsdigital.github.io/Monday-Cursor-Plugin/) |
 | **Steam Cursor Plugin** | Plugin | 30 | 9 | 25 | [![Repo](https://img.shields.io/badge/repo-blue?logo=github)](https://github.com/TMHSDigital/Steam-Cursor-Plugin) [![Docs](https://img.shields.io/badge/docs-7c3aed)](https://tmhsdigital.github.io/Steam-Cursor-Plugin/) |
 | **Steam MCP Server** | MCP Server | - | - | 25 | [![Repo](https://img.shields.io/badge/repo-blue?logo=github)](https://github.com/TMHSDigital/steam-mcp) [![npm](https://img.shields.io/badge/npm-cb3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@tmhs/steam-mcp) |
+| **Developer Tools MCP** | MCP Server | - | - | 7 | [![Repo](https://img.shields.io/badge/repo-blue?logo=github)](https://github.com/TMHSDigital/Developer-Tools-MCP) [![Docs](https://img.shields.io/badge/docs-7c3aed)](https://tmhsdigital.github.io/Developer-Tools-MCP/) |
+| **CFX MCP** | MCP Server | - | - | 0 | [![Repo](https://img.shields.io/badge/repo-blue?logo=github)](https://github.com/TMHSDigital/cfx-mcp) |
+| **Blender Developer Tools** | Plugin | 12 | 6 | 0 | [![Repo](https://img.shields.io/badge/repo-blue?logo=github)](https://github.com/TMHSDigital/Blender-Developer-Tools) |
 <!-- registry:tools:end -->
 
 <details>
@@ -81,6 +84,9 @@ flowchart LR
 | **Monday Cursor Plugin** | Cursor IDE plugin for Monday.com with boards, items, sprints, docs, dashboards, and GraphQL |
 | **Steam Cursor Plugin** | Steam and Steamworks integration for Cursor IDE for game developers, modders, and power users |
 | **Steam MCP Server** | MCP server for Steam and Steamworks APIs with store data, player stats, reviews, achievements, and workshop tools |
+| **Developer Tools MCP** | MCP server providing agent-callable read and write access to the TMHSDigital developer-tools ecosystem: registry, fleet status, drift checking, and standards management |
+| **CFX MCP** | MCP server providing agent-callable tools for CFX/FiveM resource development, server management, and community platform integration. |
+| **Blender Developer Tools** | Cursor and Claude Code skills, rules, snippets, and templates for Blender Python add-on and scripting development |
 <!-- registry:descriptions:end -->
 
 </details>
diff --git a/ROADMAP.md b/ROADMAP.md
index b1094a5..cd19503 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -4,10 +4,18 @@
 
 ## Current Status
 
-**v1.6.3** - Patch release. Resolves drafter-body detection and branch-protection residuals from the version-scheme migration. `release.yml` now treats a drafter body of `## What's Changed / * No changes` as empty and falls through to the commit-log fallback. `main` is now protected by a GitHub ruleset (`main protection`) with 7 required status checks including `feat/fix commits require VERSION bump`, squash-merge only, no force pushes, no deletion, empty bypass list. Documentation across AGENTS.md, CLAUDE.md, CONTRIBUTING.md, `.github/workflows/README.md`, and `standards/ci-cd.md` updated to reflect the PR-based workflow.
+**v1.9.5** - Patch release. Removes `paths-ignore` from the meta-repo `release.yml` so content-only changes still gate releases on commit prefix. Companion fix removes `paths-ignore` from the scaffold `release.yml.j2` template so generated repos get the same behavior.
 
 Prior milestones in this line:
 
+- **v1.9.4** - docs: update release-doc-sync header comment to reflect the @v1 / @v1.X floating-tag convention.
+- **v1.9.3** - fix: align scaffold output with current ecosystem patterns (ref #45).
+- **v1.9.2** - fix: release-doc-sync default meta-repo-ref changed to `v1` (floating major tag).
+- **v1.9.1** - fix: stale-counts policy correction; example sections and dialogue lines added to aggregate-scan skip list (DTD#37).
+- **v1.9.0** - CI maintenance. Node 24-compatible GitHub Actions versions, dependabot coverage extended to github-actions ecosystem, Sponsor button and FUNDING.yml, stale-counts DTD#12 skip for AGENTS.md and CLAUDE.md.
+- **v1.8.x** - release-doc-sync composite action (v1.8.0) plus fixes for checkout pollution, workspace cleanup, label-sync self-healing, floating-tag automation in `release.yml`, and version-bump-check parser.
+- **v1.7.x** - drift checker in two phases: Phase 1 (agents-template standard, scaffold updates, workflow docs); Phase 2 (core library, additional checks, CI integration, token separation, exit-code propagation).
+- **v1.6.3** - Drafter-body fix and branch-protection ruleset. `release.yml` treats a drafter body of `## What's Changed / * No changes` as empty. `main protection` ruleset established with 7 required checks.
 - **v1.6.2** - Release-drafter decoupling. Release-drafter no longer computes its own version; change-note aggregation only. Versioning is fully driven by the `VERSION` file and `release.yml`.
 - **v1.6.1** - `VERSION`-file-driven releases. Replaces conventional-commit auto-bump with an authoritative `VERSION` file; `feat:`/`fix:` commits require a VERSION bump enforced by CI.
 - **v1.6.0** - Standards and Governance. Nine new standards docs, registry-to-artifact sync automation, DCO + inbound license grant, scope and lifecycle principles, public-repo safety hardening.
@@ -26,9 +34,12 @@ Prior milestones in this line:
 | v1.6.1 | VERSION-file-driven releases | Released |
 | v1.6.2 | Release-drafter decoupling | Released |
 | v1.6.3 | Drafter-body fix and branch-protection ruleset | Released |
-| v1.7.0 | Sync Everywhere and Agent-File Drift | Planned |
-| v1.8.0 | Observability and Feedback | Planned |
-| v1.9.0 | Standards Versioning | Planned |
+| v1.7.0 | Drift Checker Foundation | Released |
+| v1.7.1 - v1.7.5 | Drift Checker Complete | Released |
+| v1.8.0 | Release Doc Sync | Released |
+| v1.8.1 - v1.8.5 | Release Doc Sync Fixes | Released |
+| v1.9.0 | CI Maintenance | Released |
+| v1.9.1 - v1.9.5 | Scaffold and Pipeline Fixes | Released |
 
 ---
 
@@ -181,38 +192,68 @@ Close the content, automation, and governance gaps identified in the v1.5 audit.
 
 ---
 
-## v1.7.0 - Sync Everywhere and Agent-File Drift
+## v1.7.0 - Drift Checker Foundation
 
-Extend the single-source-of-truth pattern beyond the directory repo.
+Phase 1 of the drift checker project. Established the agents-template standard, updated scaffold templates, and aligned workflow documentation with the branch-protection ruleset.
 
-- Generate `AGENTS.md` and `CLAUDE.md` sections in every tool repo from `registry.json` where they duplicate registry data
-- Add a `standards-version` frontmatter to every tool repo's `AGENTS.md` so the directory can audit compliance
-- Aggregate changelog workflow pulling each tool repo's `CHANGELOG.md` into a weekly digest on the catalog site
-- Cross-tool integration guidance: when to share code, when to duplicate, how to version shared modules
+- `standards/agents-template.md` added, documenting the required structure for AI agent guidance files in tool repos
+- Scaffold updated to generate compliant `AGENTS.md` from the new template
+- Workflow documentation across `AGENTS.md`, `CLAUDE.md`, and `.github/workflows/README.md` updated to reflect the active `main protection` ruleset
 
 ---
 
-## v1.8.0 - Observability and Feedback
+## v1.7.1 - v1.7.5 - Drift Checker Complete
 
-Empirical signals to drive standards revision.
+Phase 2: the drift checker itself. Automated detection of tool-repo policy drift surfaced as GitHub issues.
 
-- Opt-in telemetry spec for MCP tool invocation counts
-- npm download aggregator on the catalog site (public data)
-- `docs/INSIGHTS.md` generated weekly showing top tools/skills by signal
-- CI check flagging skills not invoked in the last 90 days as dormant
-- Feedback loop: standards changes must cite an empirical observation or user report
+- `scripts/drift_check/` core library: checks for standards-version signals in `AGENTS.md`, `CLAUDE.md`, skills, and rules files against the meta-repo `VERSION`
+- Additional policy checks: broken standards links, required references, stale aggregate counts in markdown
+- CI integration: runs on push to `main` (when checker code or standards change), weekly on schedule, and on demand via `workflow_dispatch`
+- Token split: `DRIFT_CHECK_TOKEN` for cross-repo sparse-checkout reads, `GITHUB_TOKEN` for issue writes
+- Exit-code propagation fix for the composite action caller
 
 ---
 
-## v1.9.0 - Standards Versioning
+## v1.8.0 - Release Doc Sync
 
-Version the ecosystem itself.
+Composite action for keeping `CHANGELOG.md`, `CLAUDE.md`, and `ROADMAP.md` in sync after an automated release.
 
-- Each standards doc gets a `standards-version` header
-- A per-standard changelog
-- Tool repos pin the standards version they claim to meet
-- Directory emits a compliance matrix per tool by standards version
-- Principles doc maintains its own version and changelog
+- `.github/actions/release-doc-sync/action.yml` composite action checks out the tool repo, runs the sync script, commits and pushes any drift
+- Designed for use in tool-repo `release.yml` workflows: `uses: TMHSDigital/Developer-Tools-Directory/.github/actions/release-doc-sync@v1`
+- `standards/release-doc-sync.md` documents the contract between the action and calling repos
+
+---
+
+## v1.8.1 - v1.8.5 - Release Doc Sync Fixes
+
+Correctness fixes for the composite action and related CI machinery.
+
+- Checkout pollution: action no longer contaminates the caller's working tree
+- Defensive workspace cleanup added on failure paths
+- Label-sync self-healing: ports the self-healing pattern to the meta-repo `label-sync.yml`
+- Floating-tag automation: `release.yml` now creates and updates `v1` and `v1.X` floating tags on every release
+- Version-bump-check parser: fixed silent pass-all bug affecting PRs with multi-line commit subjects
+
+---
+
+## v1.9.0 - CI Maintenance
+
+Routine maintenance to keep the CI stack current and discoverable.
+
+- GitHub Actions bumped to Node 24-compatible versions across all workflows
+- Dependabot coverage extended to the `github-actions` ecosystem
+- Sponsor button added via `.github/FUNDING.yml`
+- Stale-counts check: `AGENTS.md` and `CLAUDE.md` skipped wholesale by filename regardless of config (DTD#12); aggregate-truth for those files belongs in a per-repo validate-counts job
+
+---
+
+## v1.9.1 - v1.9.5 - Scaffold and Pipeline Fixes
+
+- Stale-counts policy correction: example sections and roleplay dialogue lines excluded from aggregate scanning (DTD#37)
+- release-doc-sync `action.yml` default `meta-repo-ref` corrected to `v1` (floating major tag)
+- Scaffold `release.yml.j2` template: `paths-ignore` removed so content-only changes still gate releases on commit prefix
+- Scaffold output aligned with current ecosystem patterns (ref #45)
+- Meta-repo `release.yml`: `paths-ignore` removed for the same reason as the scaffold fix
 
 ---
 
diff --git a/STANDARDS_VERSION b/STANDARDS_VERSION
new file mode 100644
index 0000000..81c871d
--- /dev/null
+++ b/STANDARDS_VERSION
@@ -0,0 +1 @@
+1.10.0
diff --git a/VERSION b/VERSION
index 6ecac68..c807441 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.9.5
\ No newline at end of file
+1.16.3
diff --git a/docs/index.html b/docs/index.html
index 6929f95..1aaa6f1 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -257,7 +257,7 @@ <h1>Developer Tools Directory</h1>
   <section id="standards" class="section">
     <div class="section-header">
       <h2>Standards</h2>
-      <span class="count">8</span>
+      <span class="count">18</span>
       <div class="section-actions">
         <button class="btn-sm toggle-section" data-target="standards-body">Expand</button>
       </div>
@@ -271,9 +271,19 @@ <h2>Standards</h2>
           <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/ci-cd.md" class="standard-card" target="_blank" rel="noopener"><h3>CI/CD</h3><p>GitHub Actions workflows every repo must have</p></a>
           <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/github-pages.md" class="standard-card" target="_blank" rel="noopener"><h3>GitHub Pages</h3><p>Documentation site setup and deployment</p></a>
           <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/commit-conventions.md" class="standard-card" target="_blank" rel="noopener"><h3>Commit Conventions</h3><p>Conventional commits and version bumping rules</p></a>
-          <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/versioning.md" class="standard-card" target="_blank" rel="noopener"><h3>Versioning</h3><p>Semver management and automated release flow</p></a>
           <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/readme-template.md" class="standard-card" target="_blank" rel="noopener"><h3>README Template</h3><p>Standard README structure and required sections</p></a>
           <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/agents-template.md" class="standard-card" target="_blank" rel="noopener"><h3>AGENTS.md Template</h3><p>AI agent guidance file structure</p></a>
+          <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/versioning.md" class="standard-card" target="_blank" rel="noopener"><h3>Versioning</h3><p>Semver management and automated release flow</p></a>
+          <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/release-doc-sync.md" class="standard-card" target="_blank" rel="noopener"><h3>Release Doc Sync</h3><p>Composite action contract for keeping CHANGELOG, CLAUDE, and ROADMAP in sync after a release</p></a>
+          <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/testing.md" class="standard-card" target="_blank" rel="noopener"><h3>Testing</h3><p>Test frameworks, minimum coverage bar, and CI wiring</p></a>
+          <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/skills.md" class="standard-card" target="_blank" rel="noopener"><h3>Skills</h3><p>SKILL.md structure and frontmatter conventions</p></a>
+          <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/rules.md" class="standard-card" target="_blank" rel="noopener"><h3>Rules</h3><p>.mdc structure, globs, and the secrets rule pattern</p></a>
+          <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/mcp-server.md" class="standard-card" target="_blank" rel="noopener"><h3>MCP Server</h3><p>Tool naming, runtime, transport, and destructive operation handling</p></a>
+          <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/security.md" class="standard-card" target="_blank" rel="noopener"><h3>Security</h3><p>Vulnerability disclosure, secrets handling, and workflow supply chain</p></a>
+          <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/licensing.md" class="standard-card" target="_blank" rel="noopener"><h3>Licensing</h3><p>DCO + inbound license grant model</p></a>
+          <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/scope.md" class="standard-card" target="_blank" rel="noopener"><h3>Scope</h3><p>What belongs in the directory and what does not</p></a>
+          <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/lifecycle.md" class="standard-card" target="_blank" rel="noopener"><h3>Lifecycle</h3><p>Tool status transitions from experimental to archived</p></a>
+          <a href="https://github.com/TMHSDigital/Developer-Tools-Directory/blob/main/standards/writing-style.md" class="standard-card" target="_blank" rel="noopener"><h3>Writing Style</h3><p>Prose conventions across all repos</p></a>
         </div>
       </div>
     </details>
@@ -308,7 +318,7 @@ <h3>Scaffold Generator</h3>
       </div>
       <div class="footer-divider"></div>
       <div class="footer-meta">
-        <span>v1.5.0</span>
+        <span>v1.9.5</span>
         <span>&middot;</span>
         <span>CC-BY-NC-ND-4.0</span>
         <span>&middot;</span>
@@ -327,7 +337,7 @@ <h3>Scaffold Generator</h3>
   </button>
 
   <script id="registry-data" type="application/json">
-[{"name":"CFX Developer Tools","repo":"TMHSDigital/CFX-Developer-Tools","slug":"cfx-developer-tools","description":"AI-powered Cursor IDE plugin for FiveM and RedM resource development","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/CFX-Developer-Tools/","skills":9,"rules":6,"mcpTools":6,"extras":{"snippets":24,"templates":11,"natives":12000,"events":101},"topics":["fivem","redm","cfx","lua","game-development"],"status":"active","version":"0.7.2","language":"Python","license":"CC-BY-NC-ND-4.0","pagesType":"mkdocs","hasCI":true},{"name":"Unity Developer Tools","repo":"TMHSDigital/Unity-Developer-Tools","slug":"unity-developer-tools","description":"Cursor IDE plugin for Unity game development with URP, HDRP, and Built-in render pipeline support","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Unity-Developer-Tools/","skills":18,"rules":8,"mcpTools":4,"extras":{"snippets":20,"templates":5},"topics":["unity","game-development","csharp","urp","hdrp"],"status":"active","version":"1.2.1","language":"Python","license":"CC-BY-NC-ND-4.0","pagesType":"mkdocs","hasCI":true},{"name":"Docker Developer Tools","repo":"TMHSDigital/Docker-Developer-Tools","slug":"docker-developer-tools","description":"Cursor IDE plugin for Docker workflows with container management, Compose, and Dockerfile support","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Docker-Developer-Tools/","skills":17,"rules":10,"mcpTools":150,"extras":{},"npm":"@tmhs/docker-mcp","topics":["docker","containers","devops","docker-compose","dockerfile"],"status":"active","version":"1.0.0","language":"Python","license":"CC-BY-NC-ND-4.0","pagesType":"static","hasCI":true},{"name":"Home Lab Developer Tools","repo":"TMHSDigital/Home-Lab-Developer-Tools","slug":"home-lab-developer-tools","description":"Home lab and Raspberry Pi workflows for Cursor with Docker Compose, monitoring, DNS, networking, and security","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Home-Lab-Developer-Tools/","skills":22,"rules":11,"mcpTools":50,"extras":{},"npm":"@tmhs/homelab-mcp","topics":["homelab","raspberry-pi","infrastructure","docker-compose","monitoring"],"status":"active","version":"1.0.0","language":"Python","license":"CC-BY-NC-ND-4.0","pagesType":"static","hasCI":true},{"name":"Mobile App Developer Tools","repo":"TMHSDigital/Mobile-App-Developer-Tools","slug":"mobile-app-developer-tools","description":"Cursor plugin for mobile app development with React Native, Expo, and Flutter support","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Mobile-App-Developer-Tools/","skills":43,"rules":12,"mcpTools":36,"extras":{},"npm":"@tmhs/mobile-mcp","topics":["react-native","expo","flutter","mobile-development","typescript"],"status":"active","version":"1.0.0","language":"TypeScript","license":"CC-BY-NC-ND-4.0","pagesType":"static","hasCI":true},{"name":"Plaid Developer Tools","repo":"TMHSDigital/Plaid-Developer-Tools","slug":"plaid-developer-tools","description":"Cursor plugin and MCP companion for building on the Plaid API","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Plaid-Developer-Tools/","skills":17,"rules":7,"mcpTools":30,"extras":{},"topics":["plaid","fintech","banking","open-banking","plaid-api"],"status":"active","version":"1.0.0","language":"Python","license":"CC-BY-NC-ND-4.0","pagesType":"static","hasCI":true},{"name":"Monday Cursor Plugin","repo":"TMHSDigital/Monday-Cursor-Plugin","slug":"monday-cursor-plugin","description":"Cursor IDE plugin for Monday.com with boards, items, sprints, docs, dashboards, and GraphQL","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Monday-Cursor-Plugin/","skills":21,"rules":8,"mcpTools":45,"extras":{},"topics":["monday","project-management","graphql","productivity","work-management"],"status":"active","version":"1.0.0","language":"TypeScript","license":"CC-BY-NC-ND-4.0","pagesType":"static","hasCI":true},{"name":"Steam Cursor Plugin","repo":"TMHSDigital/Steam-Cursor-Plugin","slug":"steam-cursor-plugin","description":"Steam and Steamworks integration for Cursor IDE for game developers, modders, and power users","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Steam-Cursor-Plugin/","skills":30,"rules":9,"mcpTools":25,"extras":{},"topics":["steam","steamworks","game-development","modding","steam-workshop"],"status":"active","version":"1.0.0","language":"TypeScript","license":"CC-BY-NC-ND-4.0","pagesType":"static","hasCI":true},{"name":"Steam MCP Server","repo":"TMHSDigital/steam-mcp","slug":"steam-mcp","description":"MCP server for Steam and Steamworks APIs with store data, player stats, reviews, achievements, and workshop tools","type":"mcp-server","homepage":"https://www.npmjs.com/package/@tmhs/steam-mcp","skills":0,"rules":0,"mcpTools":25,"extras":{},"npm":"@tmhs/steam-mcp","topics":["steam","mcp-server","steamworks","game-development","npm"],"status":"active","version":"1.0.0","language":"TypeScript","license":"CC-BY-NC-ND-4.0","pagesType":"none","hasCI":true}]
+[{"name":"CFX Developer Tools","repo":"TMHSDigital/CFX-Developer-Tools","slug":"cfx-developer-tools","description":"AI-powered Cursor IDE plugin for FiveM and RedM resource development","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/CFX-Developer-Tools/","skills":9,"rules":6,"mcpTools":6,"extras":{"snippets":24,"templates":11,"natives":12000,"events":101},"topics":["fivem","redm","cfx","lua","game-development"],"status":"active","language":"Python","license":"CC-BY-NC-ND-4.0","pagesType":"mkdocs","hasCI":true},{"name":"Unity Developer Tools","repo":"TMHSDigital/Unity-Developer-Tools","slug":"unity-developer-tools","description":"Cursor IDE plugin for Unity game development with URP, HDRP, and Built-in render pipeline support","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Unity-Developer-Tools/","skills":18,"rules":8,"mcpTools":4,"extras":{"snippets":20,"templates":5},"topics":["unity","game-development","csharp","urp","hdrp"],"status":"active","language":"Python","license":"CC-BY-NC-ND-4.0","pagesType":"mkdocs","hasCI":true},{"name":"Docker Developer Tools","repo":"TMHSDigital/Docker-Developer-Tools","slug":"docker-developer-tools","description":"Cursor IDE plugin for Docker workflows with container management, Compose, and Dockerfile support","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Docker-Developer-Tools/","skills":17,"rules":10,"mcpTools":150,"extras":{},"npm":"@tmhs/docker-mcp","topics":["docker","containers","devops","docker-compose","dockerfile"],"status":"active","language":"Python","license":"CC-BY-NC-ND-4.0","pagesType":"static","hasCI":true},{"name":"Home Lab Developer Tools","repo":"TMHSDigital/Home-Lab-Developer-Tools","slug":"home-lab-developer-tools","description":"Home lab and Raspberry Pi workflows for Cursor with Docker Compose, monitoring, DNS, networking, and security","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Home-Lab-Developer-Tools/","skills":22,"rules":11,"mcpTools":50,"extras":{},"npm":"@tmhs/homelab-mcp","topics":["homelab","raspberry-pi","infrastructure","docker-compose","monitoring"],"status":"active","language":"Python","license":"CC-BY-NC-ND-4.0","pagesType":"static","hasCI":true},{"name":"Mobile App Developer Tools","repo":"TMHSDigital/Mobile-App-Developer-Tools","slug":"mobile-app-developer-tools","description":"Cursor plugin for mobile app development with React Native, Expo, and Flutter support","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Mobile-App-Developer-Tools/","skills":43,"rules":12,"mcpTools":36,"extras":{},"npm":"@tmhs/mobile-mcp","topics":["react-native","expo","flutter","mobile-development","typescript"],"status":"active","language":"TypeScript","license":"CC-BY-NC-ND-4.0","pagesType":"static","hasCI":true},{"name":"Plaid Developer Tools","repo":"TMHSDigital/Plaid-Developer-Tools","slug":"plaid-developer-tools","description":"Cursor plugin and MCP companion for building on the Plaid API","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Plaid-Developer-Tools/","skills":17,"rules":7,"mcpTools":30,"extras":{},"topics":["plaid","fintech","banking","open-banking","plaid-api"],"status":"active","language":"Python","license":"CC-BY-NC-ND-4.0","pagesType":"static","hasCI":true},{"name":"Monday Cursor Plugin","repo":"TMHSDigital/Monday-Cursor-Plugin","slug":"monday-cursor-plugin","description":"Cursor IDE plugin for Monday.com with boards, items, sprints, docs, dashboards, and GraphQL","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Monday-Cursor-Plugin/","skills":21,"rules":8,"mcpTools":45,"extras":{},"topics":["monday","project-management","graphql","productivity","work-management"],"status":"active","language":"TypeScript","license":"CC-BY-NC-ND-4.0","pagesType":"static","hasCI":true},{"name":"Steam Cursor Plugin","repo":"TMHSDigital/Steam-Cursor-Plugin","slug":"steam-cursor-plugin","description":"Steam and Steamworks integration for Cursor IDE for game developers, modders, and power users","type":"cursor-plugin","homepage":"https://tmhsdigital.github.io/Steam-Cursor-Plugin/","skills":30,"rules":9,"mcpTools":25,"extras":{},"topics":["steam","steamworks","game-development","modding","steam-workshop"],"status":"active","language":"TypeScript","license":"CC-BY-NC-ND-4.0","pagesType":"static","hasCI":true},{"name":"Steam MCP Server","repo":"TMHSDigital/steam-mcp","slug":"steam-mcp","description":"MCP server for Steam and Steamworks APIs with store data, player stats, reviews, achievements, and workshop tools","type":"mcp-server","homepage":"https://www.npmjs.com/package/@tmhs/steam-mcp","skills":0,"rules":0,"mcpTools":25,"extras":{},"npm":"@tmhs/steam-mcp","topics":["steam","mcp-server","steamworks","game-development","npm"],"status":"active","language":"TypeScript","license":"CC-BY-NC-ND-4.0","pagesType":"none","hasCI":true},{"name":"Developer Tools MCP","repo":"TMHSDigital/Developer-Tools-MCP","slug":"developer-tools-mcp","description":"MCP server providing agent-callable read and write access to the TMHSDigital developer-tools ecosystem: registry, fleet status, drift checking, and standards management","type":"mcp-server","homepage":"https://tmhsdigital.github.io/Developer-Tools-MCP/","skills":0,"rules":0,"mcpTools":7,"extras":{},"topics":["mcp-server","developer-tools","ecosystem","registry","typescript"],"status":"active","language":"TypeScript","license":"CC-BY-NC-ND-4.0","pagesType":"static","hasCI":true},{"name":"CFX MCP","repo":"TMHSDigital/cfx-mcp","slug":"cfx-mcp","description":"MCP server providing agent-callable tools for CFX/FiveM resource development, server management, and community platform integration.","type":"mcp-server","homepage":"","skills":0,"rules":0,"mcpTools":0,"extras":{},"topics":[],"status":"experimental","language":"TypeScript","license":"CC-BY-NC-ND-4.0","pagesType":"none","hasCI":true},{"name":"Blender Developer Tools","repo":"TMHSDigital/Blender-Developer-Tools","slug":"blender-developer-tools","description":"Cursor and Claude Code skills, rules, snippets, and templates for Blender Python add-on and scripting development","type":"cursor-plugin","homepage":"","skills":12,"rules":6,"mcpTools":0,"extras":{"snippets":17,"templates":2},"topics":["blender","python","bpy","3d","addon-development"],"status":"active","language":"Python","license":"CC-BY-NC-ND-4.0","pagesType":"none","hasCI":true}]
 </script>
 
   <script id="search-index" type="application/json">
diff --git a/registry.json b/registry.json
index 768735d..c2b6062 100644
--- a/registry.json
+++ b/registry.json
@@ -15,9 +15,14 @@
       "natives": 12000,
       "events": 101
     },
-    "topics": ["fivem", "redm", "cfx", "lua", "game-development"],
+    "topics": [
+      "fivem",
+      "redm",
+      "cfx",
+      "lua",
+      "game-development"
+    ],
     "status": "active",
-    "version": "0.7.2",
     "language": "Python",
     "license": "CC-BY-NC-ND-4.0",
     "pagesType": "mkdocs",
@@ -37,9 +42,14 @@
       "snippets": 20,
       "templates": 5
     },
-    "topics": ["unity", "game-development", "csharp", "urp", "hdrp"],
+    "topics": [
+      "unity",
+      "game-development",
+      "csharp",
+      "urp",
+      "hdrp"
+    ],
     "status": "active",
-    "version": "1.2.1",
     "language": "Python",
     "license": "CC-BY-NC-ND-4.0",
     "pagesType": "mkdocs",
@@ -57,9 +67,14 @@
     "mcpTools": 150,
     "extras": {},
     "npm": "@tmhs/docker-mcp",
-    "topics": ["docker", "containers", "devops", "docker-compose", "dockerfile"],
+    "topics": [
+      "docker",
+      "containers",
+      "devops",
+      "docker-compose",
+      "dockerfile"
+    ],
     "status": "active",
-    "version": "1.0.0",
     "language": "Python",
     "license": "CC-BY-NC-ND-4.0",
     "pagesType": "static",
@@ -77,9 +92,14 @@
     "mcpTools": 50,
     "extras": {},
     "npm": "@tmhs/homelab-mcp",
-    "topics": ["homelab", "raspberry-pi", "infrastructure", "docker-compose", "monitoring"],
+    "topics": [
+      "homelab",
+      "raspberry-pi",
+      "infrastructure",
+      "docker-compose",
+      "monitoring"
+    ],
     "status": "active",
-    "version": "1.0.0",
     "language": "Python",
     "license": "CC-BY-NC-ND-4.0",
     "pagesType": "static",
@@ -97,9 +117,14 @@
     "mcpTools": 36,
     "extras": {},
     "npm": "@tmhs/mobile-mcp",
-    "topics": ["react-native", "expo", "flutter", "mobile-development", "typescript"],
+    "topics": [
+      "react-native",
+      "expo",
+      "flutter",
+      "mobile-development",
+      "typescript"
+    ],
     "status": "active",
-    "version": "1.0.0",
     "language": "TypeScript",
     "license": "CC-BY-NC-ND-4.0",
     "pagesType": "static",
@@ -116,9 +141,14 @@
     "rules": 7,
     "mcpTools": 30,
     "extras": {},
-    "topics": ["plaid", "fintech", "banking", "open-banking", "plaid-api"],
+    "topics": [
+      "plaid",
+      "fintech",
+      "banking",
+      "open-banking",
+      "plaid-api"
+    ],
     "status": "active",
-    "version": "1.0.0",
     "language": "Python",
     "license": "CC-BY-NC-ND-4.0",
     "pagesType": "static",
@@ -135,9 +165,14 @@
     "rules": 8,
     "mcpTools": 45,
     "extras": {},
-    "topics": ["monday", "project-management", "graphql", "productivity", "work-management"],
+    "topics": [
+      "monday",
+      "project-management",
+      "graphql",
+      "productivity",
+      "work-management"
+    ],
     "status": "active",
-    "version": "1.0.0",
     "language": "TypeScript",
     "license": "CC-BY-NC-ND-4.0",
     "pagesType": "static",
@@ -154,9 +189,14 @@
     "rules": 9,
     "mcpTools": 25,
     "extras": {},
-    "topics": ["steam", "steamworks", "game-development", "modding", "steam-workshop"],
+    "topics": [
+      "steam",
+      "steamworks",
+      "game-development",
+      "modding",
+      "steam-workshop"
+    ],
     "status": "active",
-    "version": "1.0.0",
     "language": "TypeScript",
     "license": "CC-BY-NC-ND-4.0",
     "pagesType": "static",
@@ -174,12 +214,86 @@
     "mcpTools": 25,
     "extras": {},
     "npm": "@tmhs/steam-mcp",
-    "topics": ["steam", "mcp-server", "steamworks", "game-development", "npm"],
+    "topics": [
+      "steam",
+      "mcp-server",
+      "steamworks",
+      "game-development",
+      "npm"
+    ],
     "status": "active",
-    "version": "1.0.0",
     "language": "TypeScript",
     "license": "CC-BY-NC-ND-4.0",
     "pagesType": "none",
     "hasCI": true
+  },
+  {
+    "name": "Developer Tools MCP",
+    "repo": "TMHSDigital/Developer-Tools-MCP",
+    "slug": "developer-tools-mcp",
+    "description": "MCP server providing agent-callable read and write access to the TMHSDigital developer-tools ecosystem: registry, fleet status, drift checking, and standards management",
+    "type": "mcp-server",
+    "homepage": "https://tmhsdigital.github.io/Developer-Tools-MCP/",
+    "skills": 0,
+    "rules": 0,
+    "mcpTools": 7,
+    "extras": {},
+    "topics": [
+      "mcp-server",
+      "developer-tools",
+      "ecosystem",
+      "registry",
+      "typescript"
+    ],
+    "status": "active",
+    "language": "TypeScript",
+    "license": "CC-BY-NC-ND-4.0",
+    "pagesType": "static",
+    "hasCI": true
+  },
+  {
+    "name": "CFX MCP",
+    "repo": "TMHSDigital/cfx-mcp",
+    "slug": "cfx-mcp",
+    "description": "MCP server providing agent-callable tools for CFX/FiveM resource development, server management, and community platform integration.",
+    "type": "mcp-server",
+    "homepage": "",
+    "skills": 0,
+    "rules": 0,
+    "mcpTools": 0,
+    "extras": {},
+    "topics": [],
+    "status": "experimental",
+    "language": "TypeScript",
+    "license": "CC-BY-NC-ND-4.0",
+    "pagesType": "none",
+    "hasCI": true
+  },
+  {
+    "name": "Blender Developer Tools",
+    "repo": "TMHSDigital/Blender-Developer-Tools",
+    "slug": "blender-developer-tools",
+    "description": "Cursor and Claude Code skills, rules, snippets, and templates for Blender Python add-on and scripting development",
+    "type": "cursor-plugin",
+    "homepage": "",
+    "skills": 12,
+    "rules": 6,
+    "mcpTools": 0,
+    "extras": {
+      "snippets": 17,
+      "templates": 2
+    },
+    "topics": [
+      "blender",
+      "python",
+      "bpy",
+      "3d",
+      "addon-development"
+    ],
+    "status": "active",
+    "language": "Python",
+    "license": "CC-BY-NC-ND-4.0",
+    "pagesType": "none",
+    "hasCI": true
   }
 ]
diff --git a/requirements-test.txt b/requirements-test.txt
new file mode 100644
index 0000000..a40b0ed
--- /dev/null
+++ b/requirements-test.txt
@@ -0,0 +1,8 @@
+pytest>=8.0,<9.0
+# PyYAML is required by the YAML-validating tests (test_release_doc_sync.py,
+# test_composite_action_shape.py). Without it those tests pytest.importorskip
+# and silently skip in CI, hiding real coverage.
+PyYAML>=6.0,<7.0
+# Jinja2 is required by the born-green scaffold integration test, which renders
+# a repo of each type and runs the drift checker against the output.
+Jinja2>=3.1,<4.0
diff --git a/scaffold/create-tool.py b/scaffold/create-tool.py
index ae7cc36..24254b4 100644
--- a/scaffold/create-tool.py
+++ b/scaffold/create-tool.py
@@ -7,6 +7,7 @@
 """
 
 import argparse
+import datetime
 import os
 import re
 import sys
@@ -20,6 +21,7 @@
 
 
 TEMPLATES_DIR = Path(__file__).parent / "templates"
+STANDARDS_VERSION_FILE = Path(__file__).parent.parent / "STANDARDS_VERSION"
 VERSION_FILE = Path(__file__).parent.parent / "VERSION"
 
 LICENSE_FILES = {
@@ -42,23 +44,23 @@ def slugify(name: str) -> str:
 
 
 def read_standards_version() -> str:
-    """Read the meta-repo VERSION at generation time.
+    """Read the meta-repo STANDARDS_VERSION at generation time.
 
     New tool repos are pre-aligned with the current standards version, so the
-    value here is not a runtime decision. If VERSION is missing or unreadable,
-    fail loudly rather than silently substituting a default - a wrong version
-    would defeat the drift-checker invariant.
+    value here is not a runtime decision. If STANDARDS_VERSION is missing or
+    unreadable, fail loudly rather than silently substituting a default - a
+    wrong version would defeat the drift-checker invariant.
     """
     try:
-        raw = VERSION_FILE.read_text(encoding="utf-8").strip()
+        raw = STANDARDS_VERSION_FILE.read_text(encoding="utf-8").strip()
     except FileNotFoundError:
         print(
-            f"Error: VERSION file not found at {VERSION_FILE}. "
+            f"Error: STANDARDS_VERSION file not found at {STANDARDS_VERSION_FILE}. "
             "The scaffold must run from a working copy of Developer-Tools-Directory."
         )
         sys.exit(1)
     except OSError as e:
-        print(f"Error: could not read {VERSION_FILE}: {e}")
+        print(f"Error: could not read {STANDARDS_VERSION_FILE}: {e}")
         sys.exit(1)
     if not re.fullmatch(r"\d+\.\d+\.\d+", raw):
         print(
@@ -69,6 +71,36 @@ def read_standards_version() -> str:
     return raw
 
 
+def read_meta_version() -> tuple[int, int, int]:
+    """Read the meta-repo VERSION at generation time, split into (major, minor, patch).
+
+    Workflow action pins in generated repos are DERIVED from this so a repo
+    scaffolded after any future meta release is born current instead of stale.
+    Hardcoding today's number in the templates only moves staleness forward one
+    release; deriving from the live VERSION removes it. If VERSION is missing or
+    malformed, fail loudly rather than emit a wrong pin.
+    """
+    try:
+        raw = VERSION_FILE.read_text(encoding="utf-8").strip()
+    except FileNotFoundError:
+        print(
+            f"Error: VERSION file not found at {VERSION_FILE}. "
+            "The scaffold must run from a working copy of Developer-Tools-Directory."
+        )
+        sys.exit(1)
+    except OSError as e:
+        print(f"Error: could not read {VERSION_FILE}: {e}")
+        sys.exit(1)
+    m = re.fullmatch(r"(\d+)\.(\d+)\.(\d+)", raw)
+    if not m:
+        print(
+            f"Error: VERSION contents '{raw}' are not a valid X.Y.Z semver string. "
+            "Refusing to derive workflow action pins from a malformed value."
+        )
+        sys.exit(1)
+    return int(m.group(1)), int(m.group(2)), int(m.group(3))
+
+
 def parse_args():
     parser = argparse.ArgumentParser(
         description="Scaffold a new TMHSDigital developer tool repository",
@@ -152,6 +184,7 @@ def main():
     rule_names = [f"rule-{i + 1}" for i in range(args.rules)]
 
     standards_version = read_standards_version()
+    meta_major, meta_minor, meta_patch = read_meta_version()
 
     ctx = {
         "name": args.name,
@@ -170,6 +203,11 @@ def main():
         "repo_owner": "TMHSDigital",
         "repo_name": slug,
         "standards_version": standards_version,
+        "meta_major": meta_major,
+        "meta_minor": meta_minor,
+        "meta_patch": meta_patch,
+        "meta_version": f"{meta_major}.{meta_minor}.{meta_patch}",
+        "year": datetime.datetime.now(datetime.timezone.utc).year,
     }
 
     print(f"\nScaffolding '{args.name}' ({slug}) into {output_dir}\n")
@@ -178,10 +216,23 @@ def main():
     if args.type == "cursor-plugin":
         write_file(output_dir, ".cursor-plugin/plugin.json", render_template(env, "plugin.json.j2", ctx))
 
-    # GitHub workflows
-    write_file(output_dir, ".github/workflows/validate.yml", render_template(env, "validate.yml.j2", ctx))
-    write_file(output_dir, ".github/workflows/release.yml", render_template(env, "release.yml.j2", ctx))
-    write_file(output_dir, ".github/workflows/pages.yml", render_template(env, "pages.yml.j2", ctx))
+    # GitHub workflows - emitted set is type-specific and must match the
+    # per-type required_workflows in standards/drift-checker.config.json plus
+    # the two optional-for-both workflows (pages, label-sync). Do NOT emit
+    # cursor-plugin-specific workflows for mcp-server repos: validate.yml's
+    # checks all assume a plugin.json and publish.yml replaces release.yml
+    # (see standards/ci-cd.md "MCP-server Variations").
+    if args.type == "mcp-server":
+        # Required for mcp-server: drift-check, stale, publish.
+        write_file(output_dir, ".github/workflows/publish.yml", render_template(env, "publish.yml.j2", ctx))
+        # Optional-for-both: pages (mcp variant), label-sync.
+        write_file(output_dir, ".github/workflows/pages.yml", render_template(env, "pages.mcp.yml.j2", ctx))
+    else:
+        # Required for cursor-plugin: validate, release, stale, drift-check.
+        write_file(output_dir, ".github/workflows/validate.yml", render_template(env, "validate.yml.j2", ctx))
+        write_file(output_dir, ".github/workflows/release.yml", render_template(env, "release.yml.j2", ctx))
+        # Optional-for-both: pages, label-sync.
+        write_file(output_dir, ".github/workflows/pages.yml", render_template(env, "pages.yml.j2", ctx))
     write_file(output_dir, ".github/workflows/stale.yml", render_template(env, "stale.yml.j2", ctx))
     write_file(output_dir, ".github/workflows/drift-check.yml", render_template(env, "drift-check.yml.j2", ctx))
     write_file(output_dir, ".github/workflows/label-sync.yml", render_template(env, "label-sync.yml.j2", ctx))
@@ -213,6 +264,11 @@ def main():
     (output_dir / "assets" / ".gitkeep").touch()
     print("  created assets/.gitkeep")
 
+    # MCP server specific files
+    if args.type == "mcp-server":
+        write_file(output_dir, "package.json", render_template(env, "package.json.j2", ctx))
+        write_file(output_dir, "docs/index.html", render_template(env, "docs/index.mcp.html.j2", ctx))
+
     # Skills
     for skill in skill_names:
         skill_content = f"""---
diff --git a/scaffold/templates/LICENSE.j2 b/scaffold/templates/LICENSE.j2
index 74f1217..fb05c48 100644
--- a/scaffold/templates/LICENSE.j2
+++ b/scaffold/templates/LICENSE.j2
@@ -1,7 +1,7 @@
 {% if license_key == 'mit' %}
 MIT License
 
-Copyright (c) 2026 {{ author_name }}
+Copyright (c) {{ year }} {{ author_name }}
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -25,7 +25,7 @@ Apache License
 Version 2.0, January 2004
 http://www.apache.org/licenses/
 
-Copyright (c) 2026 {{ author_name }}
+Copyright (c) {{ year }} {{ author_name }}
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -41,7 +41,7 @@ limitations under the License.
 {% else %}
 Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International
 
-Copyright (c) 2026 TM Hospitality Strategies
+Copyright (c) {{ year }} TM Hospitality Strategies
 
 This work is licensed under the Creative Commons
 Attribution-NonCommercial-NoDerivatives 4.0 International License.
diff --git a/scaffold/templates/docs/index.mcp.html.j2 b/scaffold/templates/docs/index.mcp.html.j2
new file mode 100644
index 0000000..690b9f2
--- /dev/null
+++ b/scaffold/templates/docs/index.mcp.html.j2
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>{{ name }}</title>
+  <style>
+    body { font-family: system-ui, sans-serif; background: #0d1117; color: #e6edf3; margin: 0; padding: 2rem; }
+    h1 { color: #7c3aed; }
+    a { color: #a78bfa; }
+  </style>
+</head>
+<body>
+  <h1>{{ name }}</h1>
+  <p>{{ description }}</p>
+  <p>Full documentation will be available here once the server implementation is complete.</p>
+  <p><a href="https://github.com/{{ repo_owner }}/{{ slug }}">View on GitHub</a></p>
+</body>
+</html>
diff --git a/scaffold/templates/drift-check.yml.j2 b/scaffold/templates/drift-check.yml.j2
index 4e858fc..4d01c11 100644
--- a/scaffold/templates/drift-check.yml.j2
+++ b/scaffold/templates/drift-check.yml.j2
@@ -15,7 +15,7 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v6
-      - uses: TMHSDigital/Developer-Tools-Directory/.github/actions/drift-check@v1.9
+      - uses: TMHSDigital/Developer-Tools-Directory/.github/actions/drift-check@v{{ meta_major }}.{{ meta_minor }}
         with:
           mode: self
           format: gh-summary
diff --git a/scaffold/templates/package.json.j2 b/scaffold/templates/package.json.j2
new file mode 100644
index 0000000..c87c908
--- /dev/null
+++ b/scaffold/templates/package.json.j2
@@ -0,0 +1,21 @@
+{
+  "name": "@{{ repo_owner | lower }}/{{ slug }}",
+  "version": "0.1.0",
+  "description": "{{ description }}",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {"{{ slug }}": "dist/index.js"},
+  "files": ["dist", "README.md", "LICENSE"],
+  "scripts": {
+    "build": "echo 'No build target yet'",
+    "test": "echo 'No tests yet' && exit 0",
+    "prepublishOnly": "npm run build"
+  },
+  "author": "{{ author_name }}",
+  "license": "{{ license_spdx }}",
+  "repository": {"type": "git", "url": "git+https://github.com/{{ repo_owner }}/{{ slug }}.git"},
+  "homepage": "https://github.com/{{ repo_owner }}/{{ slug }}#readme",
+  "bugs": {"url": "https://github.com/{{ repo_owner }}/{{ slug }}/issues"},
+  "keywords": ["mcp", "model-context-protocol", "developer-tools"],
+  "engines": {"node": ">=20.0.0"}
+}
diff --git a/scaffold/templates/pages.mcp.yml.j2 b/scaffold/templates/pages.mcp.yml.j2
new file mode 100644
index 0000000..0b123e0
--- /dev/null
+++ b/scaffold/templates/pages.mcp.yml.j2
@@ -0,0 +1,37 @@
+name: Deploy GitHub Pages
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - "assets/**"
+  workflow_dispatch:
+
+permissions:
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+{% raw %}
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+{% endraw %}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/configure-pages@v6
+
+      - uses: actions/upload-pages-artifact@v5
+        with:
+          path: docs
+
+      - uses: actions/deploy-pages@v5
+        id: deployment
diff --git a/scaffold/templates/plugin.json.j2 b/scaffold/templates/plugin.json.j2
index 0aca9c0..dee4c1f 100644
--- a/scaffold/templates/plugin.json.j2
+++ b/scaffold/templates/plugin.json.j2
@@ -10,8 +10,8 @@
   "license": "{{ license_spdx }}",
   "keywords": [
     "cursor-plugin",
-    "developer-tools",
-    "mcp"
+    "developer-tools"{% if has_mcp %},
+    "mcp"{% endif +%}
   ],
   "skills": [
 {% for skill in skills %}
diff --git a/scaffold/templates/publish.yml.j2 b/scaffold/templates/publish.yml.j2
new file mode 100644
index 0000000..bbca65d
--- /dev/null
+++ b/scaffold/templates/publish.yml.j2
@@ -0,0 +1,29 @@
+name: Publish to npm
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+          cache: npm
+      - run: npm install -g npm@latest
+      - run: npm ci
+      - run: npm run build
+      - run: npm test
+{% raw %}
+      - run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+{% endraw %}
diff --git a/scaffold/templates/release.yml.j2 b/scaffold/templates/release.yml.j2
index 80d607a..793e366 100644
--- a/scaffold/templates/release.yml.j2
+++ b/scaffold/templates/release.yml.j2
@@ -133,13 +133,16 @@ jobs:
               with open(readme, 'w') as f:
                   f.write(content)
           "
-{% raw %}
       - name: Sync release docs
         if: steps.check.outputs.skip == 'false'
-        uses: TMHSDigital/Developer-Tools-Directory/.github/actions/release-doc-sync@v1
+        uses: TMHSDigital/Developer-Tools-Directory/.github/actions/release-doc-sync@v{{ meta_major }}
         with:
+{% raw %}
           plugin-version: ${{ steps.new.outputs.version }}
           previous-version: ${{ steps.current.outputs.version }}
+{% endraw %}
+          meta-repo-ref: v{{ meta_major }}.{{ meta_minor }}.{{ meta_patch }}
+{% raw %}
 
       - name: Commit version bump
         if: steps.check.outputs.skip == 'false'
diff --git a/scripts/add_comment_marker.py b/scripts/add_comment_marker.py
new file mode 100644
index 0000000..11ced8b
--- /dev/null
+++ b/scripts/add_comment_marker.py
@@ -0,0 +1,51 @@
+"""Update the standards-version HTML comment marker in an agent file.
+
+Usage: python add_comment_marker.py <file_path> <new_version>
+
+Finds a line matching ``<!-- standards-version: X.Y.Z -->`` (anywhere in the
+file, though convention is the first line) and replaces the version.  Exits 0
+on success, 1 if the marker is absent.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+
+_MARKER_RE = re.compile(r"<!--\s*standards-version\s*:\s*[^\s>]+\s*-->")
+
+
+def _update(text: str, new_version: str) -> str | None:
+    """Return updated text, or None if no marker is found."""
+    new_marker = f"<!-- standards-version: {new_version} -->"
+    updated, count = _MARKER_RE.subn(new_marker, text, count=1)
+    return updated if count else None
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) != 3:
+        print(f"usage: {argv[0]} <file_path> <new_version>", file=sys.stderr)
+        return 1
+
+    path = Path(argv[1])
+    new_version = argv[2]
+
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError as exc:
+        print(f"error: cannot read {path}: {exc}", file=sys.stderr)
+        return 1
+
+    updated = _update(text, new_version)
+    if updated is None:
+        print(f"error: standards-version marker not found in {path}", file=sys.stderr)
+        return 1
+
+    path.write_text(updated, encoding="utf-8")
+    print(f"updated {path}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))
diff --git a/scripts/add_frontmatter.py b/scripts/add_frontmatter.py
new file mode 100644
index 0000000..bb05a96
--- /dev/null
+++ b/scripts/add_frontmatter.py
@@ -0,0 +1,65 @@
+"""Update the standards-version field in a YAML-frontmatter file.
+
+Usage: python add_frontmatter.py <file_path> <new_version>
+
+Finds the ``standards-version:`` key inside the leading ``---`` block and
+replaces its value.  Exits 0 on success, 1 if the marker is absent or the
+file cannot be parsed.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+
+_FRONTMATTER_RE = re.compile(r"\Astandardsversion:", re.I)  # loose sentinel
+
+
+def _update(text: str, new_version: str) -> str | None:
+    """Return updated text, or None if the standards-version key is absent."""
+    lines = text.splitlines(keepends=True)
+    in_block = False
+    for i, line in enumerate(lines):
+        stripped = line.lstrip()
+        if i == 0 and stripped.rstrip() == "---":
+            in_block = True
+            continue
+        if in_block and stripped.rstrip() in ("---", "..."):
+            break
+        if in_block and re.match(r"^standards-version\s*:", stripped):
+            lines[i] = re.sub(
+                r"(standards-version\s*:\s*).*",
+                rf"\g<1>{new_version}",
+                line,
+            )
+            return "".join(lines)
+    return None
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) != 3:
+        print(f"usage: {argv[0]} <file_path> <new_version>", file=sys.stderr)
+        return 1
+
+    path = Path(argv[1])
+    new_version = argv[2]
+
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError as exc:
+        print(f"error: cannot read {path}: {exc}", file=sys.stderr)
+        return 1
+
+    updated = _update(text, new_version)
+    if updated is None:
+        print(f"error: standards-version not found in frontmatter of {path}", file=sys.stderr)
+        return 1
+
+    path.write_text(updated, encoding="utf-8")
+    print(f"updated {path}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))
diff --git a/scripts/drift_check/checks/__init__.py b/scripts/drift_check/checks/__init__.py
index 6cf791b..d364386 100644
--- a/scripts/drift_check/checks/__init__.py
+++ b/scripts/drift_check/checks/__init__.py
@@ -1,11 +1,12 @@
 """Registered checks live here.
 
 Session A shipped ``version_signal``. Session B adds ``broken_refs``,
-``required_refs``, and ``stale_counts``. Phase 3 will add more via the
-same ``Check`` Protocol from ``types.py``.
+``required_refs``, and ``stale_counts``. ``required_workflows`` was added
+in v1.10.0.
 """
 from .broken_refs import BrokenRefsCheck
 from .required_refs import RequiredRefsCheck
+from .required_workflows import RequiredWorkflowsCheck
 from .stale_counts import StaleCountsCheck
 from .version_signal import VersionSignalCheck
 
@@ -13,5 +14,6 @@
     "VersionSignalCheck",
     "BrokenRefsCheck",
     "RequiredRefsCheck",
+    "RequiredWorkflowsCheck",
     "StaleCountsCheck",
 ]
diff --git a/scripts/drift_check/checks/required_workflows.py b/scripts/drift_check/checks/required_workflows.py
new file mode 100644
index 0000000..851d84c
--- /dev/null
+++ b/scripts/drift_check/checks/required_workflows.py
@@ -0,0 +1,68 @@
+"""Required-workflows check.
+
+For each repo, compare the set of workflow filenames present under
+``.github/workflows/`` against the per-type ``required_workflows`` list
+resolved from ``standards/drift-checker.config.json``.
+
+A workflow that is required but absent -> ``error``.
+Extra or unexpected workflows are never flagged; this check is presence-
+only and never emits "this workflow should not be here" findings.
+
+Policy lives entirely in config (``types.<repo-type>.required_workflows``),
+merged via the additive-strictness tier logic in ``DriftConfig.resolve``.
+No workflow names are hardcoded here.
+
+Edge cases:
+* ``repo_type == "unknown"`` -> silent; we cannot know what is required.
+* ``required_workflows`` empty (absent from config) -> silent; permissive
+  by default, same posture as ``required-refs``.
+* ``skip_checks`` contains this check's name -> silent for that repo.
+* No per-file pragma support; suppression is via ``skip_checks`` in
+  config, because the check operates at repo level (no file to annotate
+  when the workflow is absent).
+"""
+from __future__ import annotations
+
+from typing import Iterable, List
+
+from ..types import Finding, RepoSnapshot
+
+
+NAME = "required-workflows"
+
+
+class RequiredWorkflowsCheck:
+    name: str = NAME
+
+    def run(self, snapshot: RepoSnapshot) -> Iterable[Finding]:
+        if NAME in snapshot.config.skip_checks:
+            return ()
+
+        # Cannot determine requirements for unknown repo types.
+        if snapshot.repo_type == "unknown":
+            return ()
+
+        required = snapshot.config.required_workflows
+        if not required:
+            return ()
+
+        out: List[Finding] = []
+        for workflow in sorted(required):
+            if workflow not in snapshot.present_workflows:
+                out.append(
+                    Finding(
+                        repo=snapshot.slug,
+                        file=None,
+                        check=NAME,
+                        severity="error",
+                        message=(
+                            f"required workflow '{workflow}' is absent"
+                            f" (required for {snapshot.repo_type} repos)"
+                        ),
+                        suggested_fix=(
+                            f"add .github/workflows/{workflow} following"
+                            f" the scaffold template or ci-cd.md"
+                        ),
+                    )
+                )
+        return out
diff --git a/scripts/drift_check/cli.py b/scripts/drift_check/cli.py
index 770d34c..237a74f 100644
--- a/scripts/drift_check/cli.py
+++ b/scripts/drift_check/cli.py
@@ -41,6 +41,7 @@
     from drift_check.checks import (  # type: ignore
         BrokenRefsCheck,
         RequiredRefsCheck,
+        RequiredWorkflowsCheck,
         StaleCountsCheck,
         VersionSignalCheck,
     )
@@ -63,6 +64,7 @@
     from .checks import (
         BrokenRefsCheck,
         RequiredRefsCheck,
+        RequiredWorkflowsCheck,
         StaleCountsCheck,
         VersionSignalCheck,
     )
@@ -84,19 +86,19 @@
 
 
 def _find_repo_root() -> Path:
-    """Walk up from this file to the repo that contains ``VERSION``."""
+    """Walk up from this file to the repo that contains ``STANDARDS_VERSION``."""
     here = Path(__file__).resolve()
     for candidate in (here.parent, *here.parents):
-        if (candidate / "VERSION").is_file():
+        if (candidate / "STANDARDS_VERSION").is_file():
             return candidate
     return here.parents[2]
 
 
 def _read_meta_version(repo_root: Path) -> Version:
-    raw = (repo_root / "VERSION").read_text(encoding="utf-8").strip()
+    raw = (repo_root / "STANDARDS_VERSION").read_text(encoding="utf-8").strip()
     v = parse_version(raw)
     if v is None:
-        raise SystemExit(f"meta-repo VERSION is not a valid semver: {raw!r}")
+        raise SystemExit(f"meta-repo STANDARDS_VERSION is not a valid semver: {raw!r}")
     return v
 
 
@@ -197,7 +199,7 @@ def build_parser() -> argparse.ArgumentParser:
         default=None,
         help=(
             "path to the meta-repo root for resolving standards/*.md references "
-            "(defaults to the repo that contains VERSION)"
+            "(defaults to the repo that contains STANDARDS_VERSION)"
         ),
     )
     p.add_argument(
@@ -315,6 +317,7 @@ def _run_checks(snapshots: Sequence[RepoSnapshot]) -> List[Finding]:
         VersionSignalCheck(),
         BrokenRefsCheck(),
         RequiredRefsCheck(),
+        RequiredWorkflowsCheck(),
         StaleCountsCheck(),
     )
     for snap in snapshots:
@@ -352,7 +355,7 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
     except SystemExit:
         raise
     except Exception as exc:  # pragma: no cover - defensive
-        print(f"error: cannot read VERSION: {exc}", file=sys.stderr)
+        print(f"error: cannot read STANDARDS_VERSION: {exc}", file=sys.stderr)
         return 2
 
     try:
diff --git a/scripts/drift_check/snapshot.py b/scripts/drift_check/snapshot.py
index 90941a0..bc04853 100644
--- a/scripts/drift_check/snapshot.py
+++ b/scripts/drift_check/snapshot.py
@@ -49,6 +49,7 @@
     "skills",
     "rules",
     ".cursor-plugin",
+    ".github/workflows",  # workflow presence for the required-workflows check
 )
 
 
@@ -91,6 +92,19 @@ def _detect_repo_type(repo_path: Path) -> RepoType:
     return "unknown"
 
 
+def _collect_workflow_names(repo_path: Path) -> frozenset[str]:
+    """Return the set of workflow filenames (not paths) present under
+    ``.github/workflows/``. Only ``.yml`` and ``.yaml`` files count.
+    Missing directory -> empty frozenset (not an error)."""
+    wf_dir = repo_path / ".github" / "workflows"
+    if not wf_dir.is_dir():
+        return frozenset()
+    return frozenset(
+        p.name for p in wf_dir.iterdir()
+        if p.is_file() and p.suffix.lower() in (".yml", ".yaml")
+    )
+
+
 def _collect_paths(repo_path: Path) -> list[Path]:
     out: list[Path] = []
     for name in ("AGENTS.md", "CLAUDE.md"):
@@ -159,6 +173,7 @@ def _build_snapshot_from_path(
         config=config.resolve(slug, repo_type),
         meta_standards=meta_standards,
         meta_required_refs=meta_required_refs,
+        present_workflows=_collect_workflow_names(repo_path),
     )
 
 
diff --git a/scripts/drift_check/types.py b/scripts/drift_check/types.py
index 4b53096..455314f 100644
--- a/scripts/drift_check/types.py
+++ b/scripts/drift_check/types.py
@@ -94,6 +94,11 @@ class RepoConfig:
     repo_type: RepoType
     skip_checks: frozenset[str] = frozenset()
     signal_policy: str = "same-major-minor"
+    # Additive-strictness: tiers ADD requirements, never relax them.
+    # This is the opposite safety direction from skip_checks (which accumulates
+    # permissiveness). Do not change to a last-tier-wins override - that would
+    # let a repo-tier entry silently zero out the type-tier requirements.
+    required_workflows: frozenset[str] = frozenset()
 
 
 @dataclass(frozen=True)
@@ -109,8 +114,16 @@ class DriftConfig:
 
     def resolve(self, slug: str, repo_type: RepoType) -> RepoConfig:
         """Merge globals -> type -> repo. Later layers override scalars and
-        extend ``skip_checks``."""
+        extend accumulating sets (``skip_checks``, ``required_workflows``).
+
+        Note on required_workflows: the merge is additive-strictness only.
+        Tiers can ADD required workflows but cannot remove them. This is the
+        opposite safety direction from skip_checks (which accumulates
+        permissiveness). A repo tier that lists extra workflows makes the repo
+        stricter, never more lenient.
+        """
         skip: set[str] = set()
+        required_wf: set[str] = set()
         signal_policy = str(self.globals.get("signal_policy", "same-major-minor"))
 
         for tier in (self.globals, self.types.get(repo_type, {}), self.repos.get(slug, {})):
@@ -121,12 +134,16 @@ def resolve(self, slug: str, repo_type: RepoType) -> RepoConfig:
                 skip.update(str(x) for x in tier_skips)
             if "signal_policy" in tier:
                 signal_policy = str(tier["signal_policy"])
+            wf_list = tier.get("required_workflows", [])
+            if isinstance(wf_list, list):
+                required_wf.update(str(x) for x in wf_list)
 
         return RepoConfig(
             slug=slug,
             repo_type=repo_type,
             skip_checks=frozenset(skip),
             signal_policy=signal_policy,
+            required_workflows=frozenset(required_wf),
         )
 
 
@@ -145,6 +162,10 @@ class RepoSnapshot:
     # this in remote mode via sparse-checkout.
     meta_standards: frozenset[str] = frozenset()
     meta_required_refs: Mapping[str, Mapping[str, Sequence[str]]] = field(default_factory=dict)
+    # Filenames (not paths) of workflow files present under .github/workflows/.
+    # Populated at snapshot time; the required-workflows check reads this.
+    # Default frozenset() so existing snapshot constructions remain valid.
+    present_workflows: frozenset[str] = frozenset()
 
 
 @dataclass(frozen=True)
diff --git a/standards/ci-cd.md b/standards/ci-cd.md
index a062455..e415a71 100644
--- a/standards/ci-cd.md
+++ b/standards/ci-cd.md
@@ -1,6 +1,6 @@
 # CI/CD Standards
 
-Every developer tool repository must have these four core GitHub Actions workflows. Optional workflows are documented at the end.
+Cursor-plugin repositories must have the four core GitHub Actions workflows listed below. MCP-server repositories require a different set of three; see MCP-server Variations. Optional workflows are documented at the end.
 
 ## Core Workflows
 
@@ -55,49 +55,24 @@ Automatic version bump, tagging, and GitHub Release creation.
 - `permissions: contents: write`
 - `fetch-depth: 0` on checkout for full git history
 
-### 3. `pages.yml`
+### 3. `drift-check.yml`
 
-**Triggers:** `push` to `main` (paths: `docs/**`, `assets/**`), `workflow_dispatch`
+**Triggers:** `push` to `main`, `pull_request` to `main`, `workflow_dispatch`
 
-Deploys the `docs/` directory to GitHub Pages.
+Runs the ecosystem drift checker against the repo's own agent files to detect version-signal drift and missing or broken required references.
 
-**Static HTML approach (default):**
+**Required configuration:**
 
 ```yaml
-steps:
-  - uses: actions/checkout@v4
-  - name: Copy assets into docs
-    run: cp -r assets docs/assets
-  - uses: actions/configure-pages@v5
-  - uses: actions/upload-pages-artifact@v4
-    with:
-      path: docs
-  - uses: actions/deploy-pages@v5
+- uses: TMHSDigital/Developer-Tools-Directory/.github/actions/drift-check@v<MAJOR>.<MINOR>
+  with:
+    mode: self
+    format: gh-summary
 ```
 
-**MkDocs approach (for repos with extensive docs):**
+Pin the action to the meta-repo's current `MAJOR.MINOR` floating tag, never `@main` and never an older hardcoded minor. The scaffold derives this pin from the meta-repo `VERSION` at generation time, so newly created repos are born current; bumping the pin in existing repos is the periodic standards re-stamp's job. The companion `release-doc-sync` action pins to the `MAJOR` train (`@v<MAJOR>`) by the same rule. See [`release-doc-sync.md`](release-doc-sync.md) for that action's pinning convention.
 
-```yaml
-steps:
-  - uses: actions/checkout@v4
-  - uses: actions/setup-python@v5
-    with:
-      python-version: "3.12"
-  - run: pip install mkdocs-material
-  - run: mkdocs build --strict
-  - uses: actions/upload-pages-artifact@v3
-    with:
-      path: site/
-  - uses: actions/deploy-pages@v4
-```
-
-**Required permissions:**
-
-```yaml
-permissions:
-  pages: write
-  id-token: write
-```
+`mode: self` checks only the calling repo's checkout; no cross-repo token is needed. Findings at `info` severity are advisory. Findings at `error` or `warn` severity indicate real drift that should be addressed.
 
 ### 4. `stale.yml`
 
@@ -109,12 +84,23 @@ Marks issues and PRs as stale after inactivity and closes them after further ina
 
 | Workflow | Purpose | When to include |
 | --- | --- | --- |
+| `pages.yml` | GitHub Pages deployment | Repos with a `docs/` site; generated by scaffold by default |
+| `label-sync.yml` | Auto-label PRs by changed file paths | Any repo; generated by scaffold but not required |
 | `codeql.yml` | Security scanning via GitHub CodeQL | Repos with substantial code (MCP servers, TypeScript packages) |
 | `dependency-review.yml` | PR dependency audit | Repos with external dependencies |
 | `release-drafter.yml` | Draft release notes automatically | Repos with frequent PRs |
 | `ci.yml` | Extended test/lint/build pipeline | Repos with complex test suites |
 | Domain-specific update | Auto-fetch external data (e.g., native DBs, API schemas) | Repos that consume external data |
 
+## MCP-server Variations
+
+MCP-server repos require three workflows: `drift-check.yml`, `stale.yml`, and `publish.yml`. This is a different set from cursor-plugin repos, not a superset or subset.
+
+- **`validate.yml` is not required**. Every check in `validate.yml` (`plugin.json` validity, manifest fields, skill and rule file existence) assumes a `plugin.json`. MCP-server repos have no `plugin.json`, so `validate.yml` does not apply. CI validation is still expected; use `ci.yml` or an equivalent workflow suited to the server's runtime.
+- **`publish.yml` replaces `release.yml`**. MCP servers release via npm publish (OIDC provenance recommended; see [versioning.md](versioning.md)). A conventional-commit `release.yml` that reads `plugin.json` does not apply.
+- **`pages.yml` is optional**. Include it if the repo has a `docs/` site; omit it otherwise.
+- **`drift-check.yml` and `stale.yml` are required**, same as cursor-plugin repos.
+
 ## Workflow Naming
 
 - Use lowercase with hyphens: `validate.yml`, `release.yml`, `pages.yml`
diff --git a/standards/drift-checker.config.json b/standards/drift-checker.config.json
index 5bf69bb..05a46ca 100644
--- a/standards/drift-checker.config.json
+++ b/standards/drift-checker.config.json
@@ -6,10 +6,21 @@
   },
   "types": {
     "cursor-plugin": {
-      "skip_checks": []
+      "skip_checks": [],
+      "required_workflows": [
+        "validate.yml",
+        "release.yml",
+        "stale.yml",
+        "drift-check.yml"
+      ]
     },
     "mcp-server": {
-      "skip_checks": ["required-refs"]
+      "skip_checks": ["required-refs"],
+      "required_workflows": [
+        "drift-check.yml",
+        "stale.yml",
+        "publish.yml"
+      ]
     }
   },
   "repos": {
diff --git a/standards/versioning.md b/standards/versioning.md
index 5743c5a..2a009b8 100644
--- a/standards/versioning.md
+++ b/standards/versioning.md
@@ -72,12 +72,24 @@ The release workflow auto-generates release notes grouped by commit type:
 
 `CHANGELOG.md` is maintained manually for curated, human-readable release history. It is not auto-generated.
 
-## What a MINOR bump means for ecosystem standards
+## Two version files in the meta-repo
 
-The meta-repo's `VERSION` file carries the ecosystem-wide standards version. It follows the same SemVer rules, but each component has a second, standards-specific meaning for tool repos that embed a `standards-version` signal in their agent files.
+The meta-repo root contains two separate version files that serve distinct purposes and move independently.
 
-- **MAJOR** (e.g., `1.x.y` → `2.0.0`) — an incompatible change to the standards themselves. New required elements, removed fields, or restructured file conventions that existing tool repos will fail to validate against without re-alignment.
-- **MINOR** (e.g., `1.6.x` → `1.7.0`) — ecosystem standards changed in a way that tool repos need to re-align with. Typical triggers: new required elements in agent files, changed frontmatter schemas, new required standards references, restructured validation rules, or new checks in the drift checker that introduce findings for existing tool-repo content. A mechanical rollout session across the tool repos is typically scheduled after a MINOR bump.
-- **PATCH** (e.g., `1.7.0` → `1.7.1`) — bug fixes, clarifications, or additions that do not change the standards surface. Tool repos with a PATCH-behind signal are reported as `info` by the drift checker — visible in verbose runs but not blocking CI.
+### `VERSION` - meta-repo release version
 
-The drift checker enforces this mapping via the `same-major-minor` signal policy (see `standards/drift-checker.config.json`). Tool repos whose `standards-version` differs from the meta-repo's `VERSION` in MAJOR or MINOR are reported as `error`; PATCH differences are `info`; tool values ahead of meta are `warn` (either an in-flight rollout or a missed meta-repo bump, both worth surfacing).
+Tracks the release history of the meta-repo itself (registry additions, scaffold changes, doc updates, new CI workflows). Bumped by `release.yml` on every qualifying push to `main` using the same conventional-commit rules as tool repos. Registry additions (`feat:`) force a MINOR bump here. This number appears in GitHub Releases and the release changelog but has no direct meaning to tool repos.
+
+### `STANDARDS_VERSION` - ecosystem standards surface version
+
+Tracks the version of the standards that tool repos are expected to comply with. Tool repos embed this value in their `<!-- standards-version: X.Y.Z -->` markers in CLAUDE.md, AGENTS.md, and ROADMAP.md. The drift checker compares each tool repo's embedded marker against this file, not against `VERSION`.
+
+`STANDARDS_VERSION` moves **only** when the standards surface actually changes in a way that requires tool repos to update:
+
+- **MAJOR** (e.g., `1.x.y` to `2.0.0`) - an incompatible change to the standards themselves. New required elements, removed fields, or restructured file conventions that existing tool repos will fail to validate against without re-alignment.
+- **MINOR** (e.g., `1.6.x` to `1.7.0`) - standards changed in a way that tool repos need to re-align with. Typical triggers: new required elements in agent files, changed frontmatter schemas, new required standards references, restructured validation rules, or new checks in the drift checker that introduce findings for existing tool-repo content. A fleet-wide re-stamp session is typically scheduled after a MINOR bump.
+- **PATCH** (e.g., `1.7.0` to `1.7.1`) - clarifications or additions that do not change the standards surface. Tool repos with a PATCH-behind marker are reported as `info` by the drift checker - visible in verbose runs but not blocking CI.
+
+Registry-only changes, scaffold improvements, docs additions, and other meta-repo work that does not change what tool repos are required to contain **do not** bump `STANDARDS_VERSION`, even if they bump `VERSION`.
+
+The drift checker enforces this mapping via the `same-major-minor` signal policy (see `standards/drift-checker.config.json`). Tool repos whose `standards-version` marker differs from `STANDARDS_VERSION` in MAJOR or MINOR are reported as `error`; PATCH differences are `info`; tool values ahead of meta are `warn`.
diff --git a/tests/test_cli.py b/tests/test_cli.py
index a8d58ad..2e61965 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -9,11 +9,11 @@
 
 @pytest.fixture
 def meta_repo(tmp_path: Path) -> Path:
-    """Isolated meta-repo for CLI tests. Pins meta VERSION to 1.6.3 so that
+    """Isolated meta-repo for CLI tests. Pins STANDARDS_VERSION to 1.6.3 so that
     the on-disk fixtures (which still carry 1.6.3 signals) read as clean."""
     root = tmp_path / "meta"
     root.mkdir()
-    (root / "VERSION").write_text("1.6.3", encoding="utf-8")
+    (root / "STANDARDS_VERSION").write_text("1.6.3", encoding="utf-8")
     (root / "standards").mkdir()
     (root / "standards" / "required-refs.json").write_text(
         '{"version": 1, "requirements": {"cursor-plugin": {}, "mcp-server": {}}}',
diff --git a/tests/test_cli_remote_flags.py b/tests/test_cli_remote_flags.py
index c1834a6..26325ad 100644
--- a/tests/test_cli_remote_flags.py
+++ b/tests/test_cli_remote_flags.py
@@ -16,7 +16,7 @@
 def meta_repo(tmp_path: Path) -> Path:
     root = tmp_path / "meta"
     root.mkdir()
-    (root / "VERSION").write_text("1.6.3", encoding="utf-8")
+    (root / "STANDARDS_VERSION").write_text("1.6.3", encoding="utf-8")
     (root / "standards").mkdir()
     (root / "standards" / "required-refs.json").write_text(
         '{"version": 1, "requirements": {"cursor-plugin": {}, "mcp-server": {}}}',
@@ -48,7 +48,7 @@ def test_remote_without_token_errors(capsys, meta_repo: Path, monkeypatch):
 def test_all_without_registry_errors(capsys, tmp_path: Path):
     bare = tmp_path / "bare-meta"
     bare.mkdir()
-    (bare / "VERSION").write_text("1.6.3", encoding="utf-8")
+    (bare / "STANDARDS_VERSION").write_text("1.6.3", encoding="utf-8")
     rc = cli.main([
         "--all",
         "--meta-repo", str(bare),
diff --git a/tests/test_release_doc_sync.py b/tests/test_release_doc_sync.py
index 583aafd..2be0f89 100644
--- a/tests/test_release_doc_sync.py
+++ b/tests/test_release_doc_sync.py
@@ -25,6 +25,7 @@
 
 import json
 import os
+import re
 import subprocess
 import sys
 from pathlib import Path
@@ -673,12 +674,17 @@ def test_outputs_present(self, action_doc):
         ):
             assert key in outputs, f"missing output: {key}"
 
-    def test_meta_repo_ref_default_is_v1_0(self, action_doc):
-        """The pinning convention from DTD#5 is that tool repos consume
-        @v1.0 (matching drift-check@v1.7's pattern of major-floating tags).
-        Defending the default keeps tool-repo PRs from accidentally
-        consuming @main."""
-        assert action_doc["inputs"]["meta-repo-ref"]["default"] == "v1.0"
+    def test_meta_repo_ref_default_is_floating_major(self, action_doc):
+        """DTD#14: the meta-repo-ref default must be a floating MAJOR tag
+        (v1, v2, ...), never a hardcoded MINOR (v1.0) or PATCH. The major
+        train is auto-maintained by release.yml on every release, so a
+        consumer that does not override the input tracks the latest patch
+        instead of pinning to whatever minor was current when the action
+        last shipped. Defending the default keeps tool-repo PRs from
+        accidentally consuming @main or a stale minor."""
+        assert re.fullmatch(
+            r"v\d+", action_doc["inputs"]["meta-repo-ref"]["default"]
+        ), "meta-repo-ref default must be a floating major tag (v1, v2, ...)"
 
     def test_steps_follow_drift_check_pattern(self, action_doc):
         """Composite must check out the meta-repo at the pinned ref into a
diff --git a/tests/test_required_workflows.py b/tests/test_required_workflows.py
new file mode 100644
index 0000000..595deea
--- /dev/null
+++ b/tests/test_required_workflows.py
@@ -0,0 +1,186 @@
+"""Standalone tests for the required-workflows drift check.
+
+No test harness existed before this file. Run directly or with pytest:
+
+    python tests/test_required_workflows.py
+    pytest tests/test_required_workflows.py -v
+
+Each test function asserts a single behaviour; failures print the finding
+list so the cause is immediately visible without a debugger.
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+# Allow running from repo root: python tests/test_required_workflows.py
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "scripts"))
+
+from drift_check.checks.required_workflows import RequiredWorkflowsCheck
+from drift_check.types import (
+    DriftConfig,
+    Finding,
+    RepoConfig,
+    RepoSnapshot,
+    Version,
+)
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+_META = Version(major=1, minor=10, patch=0, raw="1.10.0")
+
+
+def _snap(
+    *,
+    slug: str = "test-repo",
+    repo_type: str = "cursor-plugin",
+    present: frozenset[str] = frozenset(),
+    required: frozenset[str] = frozenset(),
+    skip_checks: frozenset[str] = frozenset(),
+) -> RepoSnapshot:
+    cfg = RepoConfig(
+        slug=slug,
+        repo_type=repo_type,
+        skip_checks=skip_checks,
+        required_workflows=required,
+    )
+    return RepoSnapshot(
+        slug=slug,
+        repo_type=repo_type,
+        files={},
+        meta_version=_META,
+        meta_commit="abc1234",
+        config=cfg,
+        present_workflows=present,
+    )
+
+
+def _run(snap: RepoSnapshot) -> list[Finding]:
+    return list(RequiredWorkflowsCheck().run(snap))
+
+
+# ---------------------------------------------------------------------------
+# Tests
+# ---------------------------------------------------------------------------
+
+
+def test_missing_required_workflow_is_error() -> None:
+    """A required workflow absent from present_workflows emits an error."""
+    findings = _run(_snap(
+        required=frozenset({"validate.yml", "stale.yml"}),
+        present=frozenset({"validate.yml"}),
+    ))
+    assert len(findings) == 1, findings
+    f = findings[0]
+    assert f.severity == "error"
+    assert f.check == "required-workflows"
+    assert "stale.yml" in f.message
+    assert f.file is None
+
+
+def test_compliant_repo_is_silent() -> None:
+    """A repo with all required workflows present emits nothing."""
+    required = frozenset({"validate.yml", "release.yml", "stale.yml", "drift-check.yml"})
+    findings = _run(_snap(required=required, present=required))
+    assert findings == [], findings
+
+
+def test_unknown_type_is_silent() -> None:
+    """repo_type 'unknown' never emits required-workflows findings."""
+    findings = _run(_snap(
+        repo_type="unknown",
+        required=frozenset({"validate.yml"}),
+        present=frozenset(),
+    ))
+    assert findings == [], findings
+
+
+def test_config_absent_is_silent() -> None:
+    """Empty required_workflows (absent from config) produces no findings."""
+    findings = _run(_snap(required=frozenset(), present=frozenset()))
+    assert findings == [], findings
+
+
+def test_skip_checks_suppresses() -> None:
+    """skip_checks containing 'required-workflows' silences the check."""
+    findings = _run(_snap(
+        required=frozenset({"validate.yml"}),
+        present=frozenset(),
+        skip_checks=frozenset({"required-workflows"}),
+    ))
+    assert findings == [], findings
+
+
+def test_extra_workflows_not_flagged() -> None:
+    """Workflows present but not required are never flagged."""
+    required = frozenset({"validate.yml"})
+    present = frozenset({"validate.yml", "publish.yml", "codeql.yml", "label-sync.yml"})
+    findings = _run(_snap(required=required, present=present))
+    assert findings == [], findings
+
+
+def test_multiple_missing_workflows_each_get_finding() -> None:
+    """Each missing required workflow produces its own error finding."""
+    required = frozenset({"validate.yml", "release.yml", "stale.yml", "drift-check.yml"})
+    findings = _run(_snap(required=required, present=frozenset()))
+    assert len(findings) == 4, findings
+    assert all(f.severity == "error" for f in findings)
+    missing = {f.message.split("'")[1] for f in findings}
+    assert missing == required
+
+
+def test_mcp_server_type_respected() -> None:
+    """mcp-server repos use their own required list (publish.yml not release.yml)."""
+    findings = _run(_snap(
+        repo_type="mcp-server",
+        required=frozenset({"drift-check.yml", "stale.yml", "publish.yml"}),
+        present=frozenset({"drift-check.yml", "publish.yml"}),
+    ))
+    # stale.yml missing -> one error
+    assert len(findings) == 1, findings
+    assert "stale.yml" in findings[0].message
+
+
+def test_config_tier_merge_adds_requirements() -> None:
+    """DriftConfig.resolve merges required_workflows additively across tiers."""
+    cfg_data = {
+        "globals": {"signal_policy": "same-major-minor", "required_workflows": ["validate.yml"]},
+        "types": {"cursor-plugin": {"required_workflows": ["release.yml"]}},
+        "repos": {"my-repo": {"required_workflows": ["drift-check.yml"]}},
+    }
+    import json, tempfile, os
+    with tempfile.NamedTemporaryFile(
+        mode="w", suffix=".json", delete=False, encoding="utf-8"
+    ) as fh:
+        json.dump(cfg_data, fh)
+        tmp = fh.name
+    try:
+        from drift_check.config import load_config
+        cfg = load_config(Path(tmp))
+        resolved = cfg.resolve("my-repo", "cursor-plugin")
+        assert resolved.required_workflows == frozenset(
+            {"validate.yml", "release.yml", "drift-check.yml"}
+        ), resolved.required_workflows
+    finally:
+        os.unlink(tmp)
+
+
+# ---------------------------------------------------------------------------
+# Runner
+# ---------------------------------------------------------------------------
+
+if __name__ == "__main__":
+    tests = [v for k, v in sorted(globals().items()) if k.startswith("test_")]
+    passed = failed = 0
+    for fn in tests:
+        try:
+            fn()
+            print(f"  ok  {fn.__name__}")
+            passed += 1
+        except Exception as exc:
+            print(f"FAIL  {fn.__name__}: {exc}")
+            failed += 1
+    print(f"\n{passed} passed, {failed} failed")
+    sys.exit(1 if failed else 0)
diff --git a/tests/test_scaffold_born_green.py b/tests/test_scaffold_born_green.py
new file mode 100644
index 0000000..b95fcc2
--- /dev/null
+++ b/tests/test_scaffold_born_green.py
@@ -0,0 +1,243 @@
+"""Born-green integration test for the scaffold generator.
+
+Renders a repo of each supported type with ``scaffold/create-tool.py`` and
+asserts the Phase-2-B properties against the generated tree:
+
+* ``_detect_repo_type`` returns the intended type (not ``unknown``);
+* the meta drift checker reports zero error/warn findings (born green);
+* every standards-version marker equals the meta ``STANDARDS_VERSION``;
+* workflow action pins equal the train derived from the meta ``VERSION``;
+* the README aggregate counts match the generated content, so the repo's
+  own ``validate-counts`` job would pass on day one;
+* the emitted workflow set EXACTLY equals the per-type required set from
+  ``standards/drift-checker.config.json`` plus the two optional-for-both
+  workflows (``label-sync.yml``, ``pages.yml``) - no more, no less.
+
+The last assertion is the regression guard for the
+"mcp-server-got-plugin-workflows" bug class: it fails CI the moment the
+renderer emits a workflow that does not belong to a type, instead of the
+drift surfacing three reconciles later.
+
+Run directly or with pytest::
+
+    pytest tests/test_scaffold_born_green.py -v
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+if str(REPO_ROOT) not in sys.path:
+    sys.path.insert(0, str(REPO_ROOT))
+
+from scripts.drift_check.checks import (  # noqa: E402
+    BrokenRefsCheck,
+    RequiredRefsCheck,
+    RequiredWorkflowsCheck,
+    StaleCountsCheck,
+    VersionSignalCheck,
+)
+from scripts.drift_check.checks.required_refs import load_required_refs  # noqa: E402
+from scripts.drift_check.config import load_config  # noqa: E402
+from scripts.drift_check.semver import parse_version  # noqa: E402
+from scripts.drift_check.snapshot import (  # noqa: E402
+    _detect_repo_type,
+    build_local_snapshot,
+    list_meta_standards,
+)
+
+CREATE_TOOL = REPO_ROOT / "scaffold" / "create-tool.py"
+CONFIG_PATH = REPO_ROOT / "standards" / "drift-checker.config.json"
+REQUIRED_REFS_PATH = REPO_ROOT / "standards" / "required-refs.json"
+
+OPTIONAL_FOR_BOTH = frozenset({"label-sync.yml", "pages.yml"})
+
+# Render parameters per type. mcp-server is rendered with zero skills/rules so
+# the no-plugin-manifest detection shape (no skills/, no rules/, CLAUDE.md
+# present) holds; rendering it with skills would create skills/ and make
+# _detect_repo_type return "unknown".
+_CASES = {
+    "cursor-plugin": ["--skills", "2", "--rules", "1"],
+    "mcp-server": [],
+}
+
+
+def _standards_version() -> str:
+    return (REPO_ROOT / "STANDARDS_VERSION").read_text(encoding="utf-8").strip()
+
+
+def _meta_version_parts() -> tuple[int, int, int]:
+    raw = (REPO_ROOT / "VERSION").read_text(encoding="utf-8").strip()
+    m = re.fullmatch(r"(\d+)\.(\d+)\.(\d+)", raw)
+    assert m, f"VERSION is not X.Y.Z: {raw!r}"
+    return int(m.group(1)), int(m.group(2)), int(m.group(3))
+
+
+def _required_workflows(repo_type: str) -> frozenset[str]:
+    cfg = json.loads(CONFIG_PATH.read_text(encoding="utf-8"))
+    return frozenset(cfg["types"][repo_type]["required_workflows"])
+
+
+def _render(repo_type: str, dest: Path) -> Path:
+    slug = f"born-green-{repo_type}"
+    cmd = [
+        sys.executable,
+        str(CREATE_TOOL),
+        "--name",
+        f"Born Green {repo_type}",
+        "--description",
+        "born green probe",
+        "--type",
+        repo_type,
+        "--slug",
+        slug,
+        "--output",
+        str(dest),
+        *_CASES[repo_type],
+    ]
+    proc = subprocess.run(cmd, capture_output=True, text=True)
+    assert proc.returncode == 0, f"scaffold failed:\n{proc.stdout}\n{proc.stderr}"
+    repo = dest / slug
+    assert repo.is_dir(), f"expected generated repo at {repo}"
+    return repo
+
+
+@pytest.fixture(scope="module")
+def rendered(tmp_path_factory) -> dict[str, Path]:
+    out: dict[str, Path] = {}
+    for repo_type in _CASES:
+        dest = tmp_path_factory.mktemp(repo_type)
+        out[repo_type] = _render(repo_type, dest)
+    return out
+
+
+def _run_drift_checks(repo: Path, slug: str):
+    meta_version = parse_version(_standards_version())
+    cfg = load_config(CONFIG_PATH)
+    required_refs = load_required_refs(REQUIRED_REFS_PATH)
+    meta_standards = list_meta_standards(REPO_ROOT)
+    snap = build_local_snapshot(
+        repo_path=repo,
+        meta_version=meta_version,
+        meta_commit="born-green-test",
+        config=cfg,
+        slug=slug,
+        meta_standards=meta_standards,
+        meta_required_refs=dict(required_refs),
+    )
+    checks = (
+        VersionSignalCheck(),
+        BrokenRefsCheck(),
+        RequiredRefsCheck(),
+        RequiredWorkflowsCheck(),
+        StaleCountsCheck(),
+    )
+    findings = []
+    for check in checks:
+        findings.extend(check.run(snap))
+    return snap, findings
+
+
+@pytest.mark.parametrize("repo_type", list(_CASES))
+def test_detected_type_matches(rendered, repo_type):
+    repo = rendered[repo_type]
+    assert _detect_repo_type(repo) == repo_type, (
+        f"{repo_type} scaffold detected as {_detect_repo_type(repo)!r}"
+    )
+
+
+@pytest.mark.parametrize("repo_type", list(_CASES))
+def test_born_green_no_drift(rendered, repo_type):
+    repo = rendered[repo_type]
+    snap, findings = _run_drift_checks(repo, f"born-green-{repo_type}")
+    assert snap.repo_type == repo_type
+    actionable = [f for f in findings if f.severity in ("error", "warn")]
+    assert actionable == [], (
+        "freshly scaffolded repo is not born green: "
+        + "; ".join(f"{f.check}/{f.severity}: {f.message}" for f in actionable)
+    )
+
+
+@pytest.mark.parametrize("repo_type", list(_CASES))
+def test_standards_markers_current(rendered, repo_type):
+    repo = rendered[repo_type]
+    expected = _standards_version()
+    marker_files = [repo / "AGENTS.md", repo / "CLAUDE.md"]
+    for skill_md in (repo / "skills").glob("*/SKILL.md"):
+        marker_files.append(skill_md)
+    for rule_mdc in (repo / "rules").glob("*.mdc"):
+        marker_files.append(rule_mdc)
+    for f in marker_files:
+        text = f.read_text(encoding="utf-8")
+        assert f"standards-version: {expected}" in text, (
+            f"{f.relative_to(repo)} missing current standards-version {expected}"
+        )
+
+
+@pytest.mark.parametrize("repo_type", list(_CASES))
+def test_action_pins_derived(rendered, repo_type):
+    repo = rendered[repo_type]
+    major, minor, patch = _meta_version_parts()
+    drift = (repo / ".github" / "workflows" / "drift-check.yml").read_text(encoding="utf-8")
+    assert f"drift-check@v{major}.{minor}" in drift, (
+        f"drift-check.yml not pinned to derived @v{major}.{minor}"
+    )
+    if repo_type == "cursor-plugin":
+        release = (repo / ".github" / "workflows" / "release.yml").read_text(encoding="utf-8")
+        assert f"release-doc-sync@v{major}" in release, (
+            f"release.yml does not consume derived release-doc-sync@v{major}"
+        )
+        assert f"meta-repo-ref: v{major}.{minor}.{patch}" in release, (
+            "release.yml meta-repo-ref not pinned to derived full meta tag"
+        )
+
+
+@pytest.mark.parametrize("repo_type", list(_CASES))
+def test_readme_counts_consistent(rendered, repo_type):
+    repo = rendered[repo_type]
+    skills_dir = repo / "skills"
+    rules_dir = repo / "rules"
+    skill_count = (
+        len([d for d in skills_dir.iterdir() if (d / "SKILL.md").is_file()])
+        if skills_dir.is_dir()
+        else 0
+    )
+    rule_count = (
+        len([f for f in rules_dir.iterdir() if f.suffix == ".mdc"])
+        if rules_dir.is_dir()
+        else 0
+    )
+    readme = (repo / "README.md").read_text(encoding="utf-8")
+    if repo_type == "cursor-plugin":
+        assert f"{skill_count} skills" in readme, (
+            f"README missing '{skill_count} skills' (validate-counts would fail)"
+        )
+        assert f"{rule_count} rules" in readme, (
+            f"README missing '{rule_count} rules' (validate-counts would fail)"
+        )
+
+
+@pytest.mark.parametrize("repo_type", list(_CASES))
+def test_emitted_workflow_set_exact(rendered, repo_type):
+    repo = rendered[repo_type]
+    present = frozenset(
+        p.name
+        for p in (repo / ".github" / "workflows").iterdir()
+        if p.suffix in (".yml", ".yaml")
+    )
+    expected = _required_workflows(repo_type) | OPTIONAL_FOR_BOTH
+    assert present == expected, (
+        f"{repo_type} emitted workflows {sorted(present)} != expected "
+        f"{sorted(expected)} (required ∪ optional-for-both)"
+    )
+
+
+if __name__ == "__main__":
+    raise SystemExit(pytest.main([__file__, "-v"]))