Add a safe Xquik research template and strict manifest identities

[kriptoburak]

Summary

• Add an installable Ranch template for evidence-backed public X research through Xquik MCP.
• Keep writes, private reads, paid calls, persistent resources, extractions, and bulk jobs behind explicit approval.
• Declare transport, network host, secret reference, runtime requirements, and permission surface.
• Add Paddock scenarios for provenance, catalog-first discovery, and exact write approval.

Independent Repository Fix

The registry specification requires safe template IDs and strict semantic versions, but the schema accepted arbitrary non-empty strings. This PR enforces lowercase kebab-case IDs and Semantic Versioning 2.0.0. The repaired pattern also rejects numeric prerelease identifiers with leading zeros, such as 1.2.3-01 and 1.2.3-alpha.01.

Regression tests cover valid slugs, path traversal, whitespace, valid releases, prereleases, build metadata, incomplete versions, and invalid numeric prereleases.

Validation

• Passed both identity-schema regression tests.
• Validated the schema itself as JSON Schema Draft 2020-12.
• Validated both default and Xquik manifests with URI format checks.
• Parsed every JSON, YAML, and Paddock scenario file.
• Verified every scenario weight totals 1.
• Passed README, specification, and template external-link checks.
• Verified the live MCP endpoint returns the expected OAuth authentication challenge and advertises X-API-Key support.
• Passed exact disclosure, prohibited-dash, and git diff --check gates.

Disclosure

I maintain Xquik.

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

[kriptoburak]

Repair pushed in a45fa50 after a complete PR audit.

The Xquik template now gates paid, private, persistent, recurring, extraction, bulk, monitor, webhook, and account actions in addition to writes. Its evidence scenario requires catalog-first discovery before live calls.

The independent registry fix is also stricter: semantic versions with numeric prerelease identifiers containing leading zeros are rejected and covered by regression tests. Both manifests pass Draft 2020-12 validation, all JSON/YAML files parse, scenario weights are valid, documentation links pass, and the live MCP authentication boundary was verified.

All current comments, replies, reviews, review threads, checks, commits, events, and the full diff were reviewed. No unresolved feedback exists.

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

[kriptoburak]

Repair consolidated in signed commit 5d6425b.

• Removed unrelated punctuation churn from existing documentation.
• Kept the Xquik MCP research template with secret isolation and exact approval gates.
• Kept the independent manifest hardening for safe kebab-case IDs and strict semantic versions.
• Added regression coverage for unsafe IDs, incomplete versions, and invalid numeric prerelease identifiers.
• Validated every manifest against Draft 2020-12, parsed every JSON and YAML file, and verified scenario weights.
• Verified both documentation links return HTTP 200 and the unauthenticated MCP boundary returns HTTP 401 as expected.

The PR now contains one GitHub-verified signed commit. No review threads or unresolved maintainer feedback exist.

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.