What's Inside the Engine Package You Download

In short

When you pay for an engine, you download a zip package built for your tool — not "a file with a prompt", but an assembled file structure that the compiler generates deterministically. Inside you always get: a README with the engine's spec sheet and contents, INSTALL-PROMPT.md (a ready installer prompt — the model installs the engine itself), INSTALL.md with a readiness checklist, a QUICKSTART for beginners, .engine.json with a SHA-256 hash of the contents and the license, plus a portable safety net: a git pre-commit hook and a CI check. For Claude Code you also get role subagents, commands, rules and .mcp.json; Cursor and AGENTS.md have their own formats on the same skeleton. No secrets are ever stored as values — only placeholders. The package is your files on your disk: open them, read them, edit them.

What it is

Once you've paid for an engine and opened the install link, you download a zip package built for one specific target. It isn't "a text file with a prompt" — it's your vibe-coding engine in assembled form: a file structure emitted deterministically by the exporters.ts compiler. Let's go through it file by file, using Claude Code as the example (Cursor and AGENTS.md differ in format, but the skeleton is the same).

Why it matters

You're paying for a build, so you have every right to see exactly what you get. The package is your files on your disk: open them, read them, adapt them.

What's actually in the package (verified in the code)

Common to every target:

• README.md — the engine's title and description; a spec-sheet line (slug@version · target · engine type · autonomy); contents counters ("Inside: 8 agents, 5 skills, 6 MCP servers"); an Installation section with the steps for your target; a Secrets section (names only, in the form ${GITHUB_MCP_PAT} — no values anywhere; all secrets are optional, the engine works without them, and the decision log and notes are kept locally in .engine/); a Team section (roles + model); an Engine phases section (6 phases).
• INSTALL-PROMPT.md — a ready installer prompt: copy it whole, paste it into your AI model together with the archive, and the model installs the engine into the project itself (unpack the archive → run the install steps → create the folders → request any missing access with an explanation of why → run the readiness checklist → say "done").
• INSTALL.md — extended instructions and a readiness checklist (emitted if the engine defines a setup layer).
• QUICKSTART.md — a beginner's quick start: 3 ready prompts to copy-paste, a jargon-free glossary, and what counts as "done".
• .engine.json — the emit's passport: the SHA-256 of the content (contentHash) plus {slug, version, target}. Already emitted — use it to verify the package hasn't been tampered with. In the purchased zip a license block is added here (your license key and seat count), and LICENSE.md sits next to it — the terms of use always at hand, right inside the package (the dev export from the build page does not include these files).
• .engine/hooks/pre-commit + .github/workflows/engine-guard.yml — a portable safety floor: the guard works not only inside Claude but also as a git hook and a CI check on any target. Already emitted.

Claude Code specifics:

• .claude/agents/<role>.md — one file per each of the 8 agents (role + system text).
• .claude/agents/prism-<key>.md — 13 prisms as separate reviewer subagents.
• .claude/commands/<kind>.md — the engine command (quest) with the FULL workflow body verbatim.
• .claude/rules/<rule>.md — rules (always / auto-by-glob).
• .claude/skills/<name>/SKILL.md — 6 directories: 5 skills (including prompt-composer — help with framing a task in EARS) plus an agent rule shipped as a skill.
• .claude/hooks/*.sh — two hooks: guard-dangerous (PreToolUse, an ENFORCED block on dangerous commands) and route-engine (UserPromptSubmit: a request without an explicit /command gets a reminder line, "run this through the engine", injected straight into the turn's context).
• .claude/settings.json — registration of both hooks (${CLAUDE_PROJECT_DIR}) plus pre-approval of the MCP servers from .mcp.json.
• .mcp.json — wiring for 6 MCP servers (secrets as ${NAME} placeholders).
• AGENTS.md — the full portable contract (for Cursor/Codex); CLAUDE.md — a thin always-on contract: team, charter, invariants, plus the "Language" section (which language the engine speaks and documents in — chosen when the engine is built) and the "Default router" section, pointing at /quest.

Cursor specifics: .cursor/rules/*.mdc (rules with front matter) plus .cursor/mcp.json.

AGENTS.md specifics: a single AGENTS.md in the project root — the MCP wiring lives inside it as a JSON block in the "MCP" section (this target does not emit a separate .mcp.json; that file is read specifically by Claude Code).

What already exists and what is marked roadmap (honestly)

Already in the package:

• .engine.json (content-hash identity) — a file with the SHA-256 of the emit, {slug, version, contentHash, target}. Emitted — the hash lets you verify the integrity of what you downloaded.
• Portable Safety Floor — .engine/hooks/pre-commit plus .github/workflows/engine-guard.yml, so the guard works not only inside Claude but also as a git hook and a CI check on any target. Emitted.

Roadmap (honestly, not there yet):

• An even clearer pre-purchase preview — prism cards in the storefront will get short human-readable descriptions of "what exactly this angle checks" — roadmap.

The package is self-contained: the engine keeps its decision log, lessons and backlog locally in .engine/ (DEVLOG, decisions.md, backlog.md) — no cloud service is required for any of it. The version you bought is yours forever; a new core version ships as a separate product. Modules from the catalog extend the engine: a module you've bought attaches to your build, and the export drops its layers into the same package.

A worked example

Input: you bought Quest, chose the Claude Code target, and downloaded forge-core-claude-code.zip.

What the compiler does: exportMod(spec, 'claude-code') lays out the files deterministically. .mcp.json gets 6 wirings (filesystem, memory, context7, sequential-thinking, playwright, github), with secrets as placeholders: "Authorization": "Bearer ${GITHUB_MCP_PAT}" — the value is NOT in the file (this is covered by a test asserting that "the secret does NOT end up as a value in .mcp.json").

The result — unpack it and you see:

forge-core-claude-code/
├─ README.md              (spec sheet + installation + secrets + team + phases)
├─ INSTALL.md             (readiness checklist)
├─ INSTALL-PROMPT.md      (installer prompt — paste it to the model)
├─ AGENTS.md              (full portable contract — for Cursor/Codex)
├─ CLAUDE.md              (thin always-on contract: team · charter · language · router · → /quest)
├─ QUICKSTART.md          (3 ready prompts + beginner's glossary)
├─ .engine.json           (SHA-256 of the content + slug/version/target)
├─ .engine/hooks/pre-commit          (portable floor — git hook)
├─ .github/workflows/engine-guard.yml (portable floor — CI)
├─ .claude/agents/{product-owner,analyst,architect,designer,engineer,reviewer,security,quest-verifier}.md  (8 agents)
├─ .claude/agents/prism-{security,tenancy,gating,regression,data-integrity,...}.md   (13 prisms)
├─ .claude/commands/quest.md      (full workflow: Analysis→Spec→Plan→Implementation→Handover→Learning,
│                                  + the quest task list .quests/<date>-<slug>/{spec,plan,tasks}.md)
├─ .claude/rules/{tenancy,i18n-sync,migrations,secrets-hygiene,...}.md
├─ .claude/skills/{prompt-composer,frontend-design,webapp-testing,skill-creator,mcp-builder,rule-spec-first}/SKILL.md  (5 skills + rule-as-skill)
├─ .claude/hooks/guard-dangerous.sh + route-engine.sh   (guard — ENFORCED block; router — reminder injection)
├─ .claude/settings.json  (hook registration + enabledMcpjsonServers)
└─ .mcp.json              (6 MCP servers, secrets = ${NAME})

All of this consists of real files the compiler already emits. The only manual step after unpacking is to click Trust in Claude Code, and /quest works.