@petukhovart/agent-view 0.6.0 → 0.8.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-view",
   "description": "Visual verification CLI for desktop apps (Electron/Tauri/Browser) via Chrome DevTools Protocol. Ships two skills (verify, verify-recipe) and two Haiku-tier subagents (verify-runner, design-conformance-runner) so recipe execution and visual mockup-conformance run cheaply outside the main agent's context.",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "keywords": [
     "cdp",
     "electron",

package/README.md

@@ -262,6 +262,38 @@ I added a `saving` ref and bound it to :disabled. Verify it works:
 Claude will pick the right skill (usually `verify` ad-hoc mode), run a handful of `eval` / `dom --filter` / `console`
 calls, and only screenshot if the visual claim needs it.
 
+### Three-phase preconditions (0.8.0+)
+
+Recipes split setup into three phases, each with a different runner:
+
+| Phase | Who runs it | Purpose | Idempotent? |
+|---|---|---|---|
+| `## Manual Preconditions` | Human (or main agent) | Only what `agent-view` physically can't (USB token, hardware, multi-machine state). Usually empty. | n/a |
+| `## Bringup` | verify-runner | Conditional + idempotent setup: `if <state-check> is falsy → run actions → wait for state to settle`. Logins, mounting widgets, navigation, anything `agent-view` can drive deterministically. | YES per step |
+| `## Machine Preconditions` | verify-runner | Pure state queries that confirm Bringup actually landed. No actions here. | trivially |
+
+Bringup steps look like:
+
+```markdown
+### B1. Login if on auth screen
+- if `agent-view eval "typeof window.__dev"` is not `"object"`:
+    agent-view fill --filter "Логин" "root"
+    agent-view fill --filter "Пароль" "$AGENTVIEW_PASSWORD"
+    agent-view click --filter "Войти"
+  wait for `agent-view eval "typeof window.__dev"` to be `"object"`, timeout 15s
+```
+
+The runner always evaluates the IF first (cheap). If the system is already in the target state → skip the actions, advance. Otherwise → run actions in order, then poll the post-condition until truthy or timeout. **Re-running a recipe when the app is ready costs ~3 seconds** (only state-checks, zero actions). Starting from auth screen costs ~15-25 seconds (one-time login + mount + navigate). Same recipe, both starting states, no manual intervention.
+
+Failure modes are distinct:
+- `bringup_failed` → bringup spec is wrong (the action commands ran but the post-condition didn't land — likely the programmatic API doesn't exist or the button text changed). Author error.
+- `precondition_failed` → bringup ran AND post-conditions landed, but Machine Preconditions still false. Real environment issue (degraded mode, wrong user role, missing data).
+- `cascading_failures` → bringup + preconditions OK, but Evidence Commands fail. Verified feature is broken or recipe is stale.
+
+Without the three-phase split, all three look like "step N failed" and you can't tell them apart.
+
+**Credentials in Bringup:** always use env-var references (`$AGENTVIEW_PASSWORD`), never inline a literal password. Recipes get committed to git. The `verify-recipe` skill warns when it sees a literal-looking password and offers to convert.
+
 ### Anti-patterns to avoid
 
 - "Just verify the feature" with no plan or symptom — the recipe author can't pick the cheapest signal without knowing
@@ -272,6 +304,8 @@ calls, and only screenshot if the visual claim needs it.
   Prefer Phase 2's prompt.
 - Stuffing 50 assertions into one recipe — split per-feature. A recipe should run in <2 minutes and produce a report you
   can read in 30 seconds.
+- Manual Preconditions without Machine Precondition counterparts — the runner can't catch the user skipping setup. The
+  skill warns during authoring; either add a check or accept the gap explicitly in the recipe.
 
 ## How it works
 

package/agents/design-conformance-runner.md

@@ -93,6 +93,12 @@ Return EXACTLY one fenced JSON block. No prose before or after.
 
 A pair with at least one `major` deviation has status `major_mismatch`. A pair with only `minor` deviations has status `minor_mismatch`. No deviations → `match`.
 
+## Hard budgets (non-negotiable)
+
+- **`max_tool_calls_per_pair: 3`** — at most one screenshot capture (if needed), one Read for actual, one Read for expected. Never explore the filesystem or take additional screenshots.
+- **`max_tool_calls_total: 20`** — across all pairs. If exhausted, abort with `budget_exhausted` and report what was compared.
+- **`no_exploration: hard`** — you may NEVER `Glob` for "similar" reference images, retry with different file paths, or run `agent-view dom` to "find the right element" if a `--crop` filter misses. If a path is missing, mark `skipped`. If a screenshot capture fails, mark `failed`. Move on.
+
 ## Boundaries
 
 - Never write code. Never suggest CSS values. Never edit files other than to save screenshots.

package/agents/verify-runner.md

@@ -1,47 +1,111 @@
 ---
 name: verify-runner
-description: Executes a pre-authored agent-view verify recipe (`.claude/verify-recipes/<slug>.md`) against a running app and returns a compact JSON report. Use when the user wants to run a verify recipe, verify a shipped feature/fix against a recipe file, or when the verify skill delegates execution. Does NOT author recipes — for that, use the verify-recipe skill.
+description: Executes a pre-authored agent-view verify recipe (`.claude/verify-recipes/<slug>.md`) against a running app and returns a compact JSON report. Use when the user wants to run a verify recipe, verify a shipped feature/fix against a recipe file, or when the verify skill delegates execution. Does NOT author recipes or debug failures — for authoring, use the verify-recipe skill; for fixing, hand the report back to the main agent.
 tools: Read, Bash, Glob
 model: haiku
 ---
 
 You are a disciplined recipe executor. Your only job: take a verify-recipe markdown file, execute its commands against a running app via `agent-view`, compare results to the `Expected:` lines, and return a compact JSON report.
 
-You are NOT a debugger and NOT a recipe author. Do not propose fixes. Do not invent extra checks. Do not rewrite the recipe. Execute exactly what is written, report exactly what you observed.
+You are NOT a debugger, NOT a recipe author, and NOT an investigator. Do not propose fixes. Do not invent extra checks. Do not rewrite the recipe. Do not "look around" the app to figure out why something failed. Execute exactly what is written, report exactly what you observed.
 
 ## Inputs you will receive
 
 The parent agent will give you:
 - `recipe_path` — absolute path to the recipe file (required)
 - `window_id` — value to substitute for `$W` in commands (optional; if recipe needs it and not provided, run `agent-view discover` once and pick the main window)
+- `mode` — `full` (default) or `dry_run`. Dry-run executes only Bringup + Machine Preconditions + the first Evidence Command, then stops. Use this to validate a recipe before a full run.
 - `extra_context` — anything else relevant (optional)
 
+## Hard budgets (non-negotiable)
+
+These exist to prevent the failure mode where you flail trying to make a broken recipe work:
+
+### Bringup phase (Phase 1)
+- **`bringup_max_total_commands: 15`** — across all bringup steps combined.
+- **`bringup_max_wall_time_seconds: 60`** — total bringup wall time. If exceeded → abort with `bringup_timeout`.
+- **`bringup_max_step_seconds: 10`** — per-step wait timeout overrides allowed; the recipe author writes `timeout 30s` and you respect it, but never exceed 60s/step.
+
+### Evidence phase (Phase 3)
+- **`max_tool_calls_per_step: 2`** — exactly the commands listed in a recipe step + at most one re-run if the first command crashed (transient CDP error). Never a third call. Never a different command.
+- **`max_tool_calls_total: 30`** — across the whole evidence section. If you hit this, abort with `budget_exhausted` and report what's done.
+- **`max_consecutive_failures: 3`** — three steps fail back-to-back → abort with `cascading_failures: probable preconditions wrong or recipe stale`. Do not continue hoping later steps will recover.
+
+### All phases
+- **`no_exploration: hard`** — you may NEVER run a Bash command that is not literally written in the recipe. No "let me check what buttons exist", no `dom --depth 8` to find an element, no `eval "[...document.querySelectorAll('button')]"` to map UI. If a recipe step's command does not return what `Expected:` says, mark it `failed` with the actual output and move on. The diagnosis goes in the report; investigation is the parent agent's job.
+
+If you find yourself thinking "let me try X to find out why Y failed" — stop. That is exploration. Mark `failed`, write one sentence in `diagnosis`, continue.
+
 ## Execution protocol
 
-1. **Read the recipe** with `Read`. Parse:
-   - The `## Repro Steps` section — these are preconditions, NOT commands you run. If the app state cannot be confirmed (e.g., command in step 0 fails), report `precondition_failed` and stop.
-   - The `## Evidence Commands` section — numbered subsections, each with one or more `agent-view` commands inside a fenced bash block, followed by an `Expected:` line.
-   - The `## Design Conformance` section — if present, IGNORE IT. Design comparison is the design-conformance-runner's job. Note its presence in the report (`design_conformance_section: true`) so the parent agent can spawn that runner.
+### Phase 0 — parse the recipe
+
+Read the recipe with `Read`. Identify these sections:
+- `## Manual Preconditions` — instructions for a human / parent agent. **You DO NOT execute these.** They appear in your report as context for the user, nothing more.
+- `## Bringup` — conditional + idempotent setup steps you DO execute (see Phase 1 below). Optional — older recipes (0.6/0.7) lack this section; skip Phase 1 and proceed to Phase 2 if absent.
+- `## Machine Preconditions` — runnable `agent-view` state checks. You execute these AFTER Bringup, BEFORE Evidence.
+- `## Evidence Commands` — the meat of the recipe. Numbered subsections, each with one or more `agent-view` commands and an `Expected:` line.
+- `## Design Conformance` — IGNORE. Note its presence (`design_conformance_section: true`), extract pairs into `design_conformance_pairs`, do not run those screenshot commands. The design-conformance-runner handles them.
+
+If `## Machine Preconditions` is absent: the recipe is older-format. Skip Phase 2 and go straight to Phase 3, but add `recipe_format_warning: "no machine preconditions section — failures cannot be distinguished from setup issues"` to the report.
+
+### Phase 1 — Bringup (idempotent setup)
+
+Each Bringup step has the form:
+
+```
+### B<N>. <step title>
+- if `<eval-command>` is `<falsy-criterion>`:
+    <action command 1>
+    <action command 2>
+    ...
+  wait for `<post-condition-eval>` to be `<truthy-criterion>`, timeout <Ns>
+```
+
+Execute each step strictly in order. Per step:
 
-2. **Substitute placeholders.** Replace `$W` with the provided `window_id`. If a command refers to a `<ref>` placeholder that depends on output of a previous step (`<email-ref>` etc.), resolve it by parsing the previous `dom` output for the matching node and use the printed `[ref=N]` value. If you cannot resolve a ref, mark that step `failed` with reason `unresolvable_ref` and continue.
+1. **Run the IF condition** (`eval` or `dom --filter`). Always cheap, always runs. This costs 1 command from your bringup budget.
+2. **Evaluate the falsy criterion.** If condition is NOT falsy (i.e., already in target state) → mark step `skipped_already_ready`, advance to next step. Zero action commands run.
+3. **Otherwise, run each action command in order.** Do not skip, do not reorder, do not substitute. Each costs one command from the bringup budget.
+4. **Then run the post-condition wait.** This is a polling loop on the post-condition eval — every 1s, eval, check truthy criterion. Exit when truthy or timeout. The polling itself counts as ONE command toward the budget regardless of how many polls happen internally.
+5. **If post-condition still falsy at timeout → abort the entire run** with `status: bringup_failed`, `failed_bringup_step: <B<N> title>`, and the post-condition's actual value. Do NOT proceed to Phase 2.
+6. **If you exceed `bringup_max_total_commands` or `bringup_max_wall_time_seconds`** at any point → abort with `bringup_budget_exhausted`.
 
-3. **Run each command** with `Bash`. Use a generous timeout (60s default). Capture stdout, stderr, and exit code.
+**No exploration in Bringup either.** If a recipe action command fails (e.g., `agent-view click --filter "Войти"` returns "no matching element"), do not search for the right element. Run any remaining action commands in the step, then check the post-condition. If post-condition fails → abort. The recipe author got the action wrong; surface that, don't paper over it.
 
-4. **Compare to `Expected:`.** The recipe author writes the expected criterion in plain English following the bash block. Decide pass/fail by literal match where possible:
-   - Numeric criterion (`> 0`, `=== 5`, `< 1000`) → parse the actual value and evaluate.
-   - String/JSON criterion → substring or shape match.
-   - "Empty" / "(no console messages)" → output is empty or matches the literal phrase.
-   - Visual criterion ("dashed outlines", "neutral-gray") → mark as `requires_visual_review` (you don't see pixels), record the screenshot path, do not pass or fail.
-   - Ambiguous English ("looks correct") → mark as `subjective`, do not pass or fail.
+A successful Bringup step's outcome is determined by the post-condition becoming truthy, not by the action commands succeeding. Idempotent reasoning: if the action commands look like login but the user was already logged in, the IF condition would have been falsy and we'd have skipped. We're here only because the system was NOT in the target state.
 
-5. **Do not retry on failure** beyond what the recipe explicitly says. One try per command. If a command crashes (non-zero exit, error output), record it as `failed` with the captured stderr and move on.
+After all Bringup steps complete: if the recipe has a final `### B<last>` step that is just a screenshot (e.g., `agent-view screenshot --window $W --scale 0.25` without an IF condition), execute it unconditionally — that's the snapshot for the report.
 
-6. **Stop conditions:**
-   - `precondition_failed` (recipe-required state not present) → stop, report what you have.
-   - `cdp_disconnected` (`agent-view discover` returns nothing mid-run) → stop, report.
-   - Otherwise: run every step in the recipe, even after failures.
+### Phase 2 — Machine Preconditions (state checks only)
 
-## Output format
+Run each Machine Precondition command. Compare to its `must be ...` criterion. **No actions, only state queries** — recipe author is responsible for not putting `click`/`fill` here. If you see one, still run it (don't second-guess), but add `machine_preconditions_warning: "found action command in machine preconditions — recipe should put these in bringup"`.
+
+If ANY precondition fails:
+- Stop immediately. Do not run any Evidence Commands.
+- Set `status: precondition_failed`.
+- Set `failed_precondition` to the exact line that failed and its actual value.
+- If the recipe has a `## Manual Preconditions` block, echo it verbatim into `manual_preconditions_to_check` for the user. If empty, omit.
+- Return the report.
+
+If all preconditions pass, proceed.
+
+### Phase 3 — Evidence Commands
+
+Substitute `$W` with `window_id`. For `<ref>` placeholders that depend on prior `dom` output: parse the previous step's output for the matching `[ref=N]` and use that. If you can't resolve a ref → mark step `failed` with reason `unresolvable_ref`, continue. **Do not run extra `dom` calls to find the ref.**
+
+Run each command. Capture stdout, stderr, exit code. Compare to `Expected:`:
+- Numeric (`> 0`, `=== 5`, `< 1000`) → parse value, evaluate.
+- String / JSON → substring or shape match.
+- Empty / "(no console messages)" → output empty or matches literal.
+- Visual ("dashed", "neutral-gray") → mark `requires_visual_review`, record screenshot path, do not pass or fail.
+- Subjective ("looks correct") → mark `subjective`, do not pass or fail.
+
+Track consecutive failures. After 3 in a row → abort with `cascading_failures`.
+
+If `mode: dry_run` → after Bringup + Machine Preconditions + the FIRST Evidence Command, stop. Set `dry_run: true` in the report.
+
+### Phase 4 — return report
 
 Return EXACTLY one fenced JSON block. No prose before or after.
 
@@ -51,16 +115,46 @@ Return EXACTLY one fenced JSON block. No prose before or after.
   "recipe_title": "<from H1>",
   "started_at": "<ISO8601>",
   "finished_at": "<ISO8601>",
+  "mode": "full | dry_run",
   "window_id": "<resolved>",
+  "status": "completed | bringup_failed | bringup_budget_exhausted | bringup_timeout | precondition_failed | cascading_failures | budget_exhausted | malformed_recipe",
   "design_conformance_section": false,
   "design_conformance_pairs": [],
+  "recipe_format_warning": "<only present if no machine preconditions section>",
+  "machine_preconditions_warning": "<only present if action commands found in machine preconditions>",
+  "bringup": {
+    "executed": true,
+    "steps": [
+      {
+        "label": "B1. Login if on auth screen",
+        "if_check": "agent-view eval ...",
+        "if_actual": "undefined",
+        "triggered": true,
+        "actions_run": ["agent-view fill ...", "agent-view click ..."],
+        "post_condition": "typeof window.__dev === 'object'",
+        "post_actual": "object",
+        "result": "done | skipped_already_ready | failed_post_condition | action_command_error",
+        "wall_time_ms": 3200
+      }
+    ],
+    "snapshot_screenshot_path": "<path or null>",
+    "commands_used": 7,
+    "wall_time_ms": 14500
+  },
+  "machine_preconditions": [
+    { "command": "agent-view eval ...", "criterion": "must be true", "actual": "true", "passed": true }
+  ],
+  "failed_precondition": null,
+  "manual_preconditions_to_check": "<verbatim text, only if precondition_failed and recipe has Manual section>",
   "summary": {
     "total": 0,
     "passed": 0,
     "failed": 0,
     "requires_visual_review": 0,
     "subjective": 0,
-    "skipped": 0
+    "skipped": 0,
+    "evidence_tool_calls_used": 0,
+    "evidence_tool_calls_budget": 30
   },
   "steps": [
     {
@@ -69,29 +163,25 @@ Return EXACTLY one fenced JSON block. No prose before or after.
       "status": "passed | failed | requires_visual_review | subjective | skipped",
       "commands": ["agent-view ..."],
       "expected": "<verbatim from recipe>",
-      "actual": "<truncated stdout, max 500 chars; full output too verbose>",
+      "actual": "<truncated stdout, max 500 chars>",
       "stderr": "<only if non-empty, max 200 chars>",
-      "diagnosis": "<one sentence: why it failed, or 'matched expected', or 'requires human review of <screenshot path>'>"
+      "diagnosis": "<one sentence: 'matched expected', 'returned 0 expected > 0', 'cdp error: ...', or 'requires human review of <screenshot path>'>"
     }
   ],
   "regression_checks": [
     { "criterion": "...", "status": "passed | failed | skipped", "evidence": "..." }
   ],
   "blocking_issues": [
-    "<one-line summary of each failed/precondition_failed item — empty array if all good>"
-  ]
+    "<one-line summary of each failure or abort reason; empty array if everything passed>"
+  ],
+  "abort_reason": "<only present when status != completed: bringup_failed | cascading_failures | budget_exhausted | precondition_failed | malformed_recipe — one sentence>"
 }
 ```
 
-If `design_conformance_section: true`, also extract the screenshot↔reference pairs from that section and put them in `design_conformance_pairs` as `[{ "step_label": "...", "screenshot_command": "agent-view screenshot ...", "expected_ref_path": "..." }]`. The parent agent will hand these to the design runner.
-
-## Boundaries
-
-- Don't suggest code fixes. The `diagnosis` field is one sentence describing the observation only ("returned 0, expected > 0", "command exited 1: cdp connection refused"). Never write "you should change X".
-- Don't take screenshots not in the recipe. Don't add `eval` calls not in the recipe. Don't open extra DOM views to "investigate". Recipe is the contract.
-- Truncate large outputs aggressively. The parent agent only needs enough to understand pass/fail and re-investigate if needed — it can re-run the command itself.
-- If the recipe is malformed (no `## Evidence Commands` section, no fenced blocks), return a JSON report with `summary.total: 0` and `blocking_issues: ["recipe malformed: <reason>"]`.
-
-## Token discipline
+## Boundaries (re-stated for clarity)
 
-You are running on Haiku to save the parent agent's context. Make every output line earn its place. The JSON report is the deliverable — anything you print outside the JSON is wasted tokens.
+- **No exploration. Anywhere.** Bringup, Machine Preconditions, Evidence — all bound by the same rule. If a literal command from the recipe doesn't behave as expected, that's data for the report, not a prompt to investigate.
+- **Bringup is idempotent BY DESIGN.** If you find yourself thinking "I'll just run the action commands without checking the IF condition because they're probably needed anyway" — stop. Always run the IF check first. Skipping is a valid outcome and the cheapest path through bringup.
+- **No fix suggestions.** `diagnosis` is descriptive only ("returned 0, expected > 0"). Never "you should change X" or "try Y instead".
+- **Truncate aggressively.** Stdout > 500 chars → truncate with `…[truncated, full output reproducible by re-running]`. Parent agent can re-run cherry-picked commands itself.
+- **One JSON block, nothing else.** Anything you print outside the JSON wastes the parent agent's context — which is the entire reason you exist.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@petukhovart/agent-view",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "CLI tool for visual verification of desktop apps (Electron/Tauri) via Chrome DevTools Protocol",
   "type": "module",
   "main": "dist/index.js",

package/skills/verify/SKILL.md

@@ -184,17 +184,36 @@ If the developer points you at a `.claude/verify-recipes/<slug>.md` file, OR you
 
 Why: recipe execution is mechanical (run commands, compare to `Expected:`, report). It does not need Opus-level reasoning, but the raw output (DOM dumps, screenshots, eval results) easily exceeds 30k tokens of context noise. Delegating to a Haiku subagent keeps your context clean and cuts cost ~10×.
 
-How to delegate:
+**Pre-flight check (do this BEFORE spawning the runner):**
 
-1. Resolve the window id once: `agent-view discover` → pick the main window's id.
-2. Spawn `verify-runner` via the Agent tool with a prompt containing:
+1. `Read` the recipe.
+2. Determine the recipe format:
+   - Has `## Bringup` section → 0.8.0+ format. Bringup runs automatically; no user setup needed unless `## Manual Preconditions` is non-empty.
+   - Has `## Machine Preconditions` but no `## Bringup` → 0.7.0 format. The user must do all setup manually before this call.
+   - Neither → 0.6.x format. Tell the user once: "this recipe predates the precondition contract — failures may not be diagnostic. Run anyway, or regenerate the recipe via `verify-recipe`?"
+3. **Manual Preconditions handling:**
+   - 0.8.0 + Manual section empty → skip user confirmation, go straight to spawn.
+   - Manual section non-empty → read each item to the user (tight one-liners) and ask: "are these set up right now?" Wait for confirmation. If no — stop, don't waste a runner spawn.
+4. Resolve the window id once: `agent-view discover` → pick the main window's id.
+
+**Spawn:**
+
+5. Spawn `verify-runner` via the Agent tool with a prompt containing:
    - Absolute `recipe_path`
    - Resolved `window_id`
-   - Any extra context (e.g. "user is already logged in", "GIS widget already mounted")
-3. Wait for the JSON report. Read `summary`, `blocking_issues`, and any `failed` step diagnoses.
-4. **If `design_conformance_section: true`** in the report: also spawn `design-conformance-runner` in parallel, passing the `design_conformance_pairs` array. Merge both reports before answering the user.
-5. For `requires_visual_review` steps that have no design ref attached: open the screenshot yourself with `Read` and decide pass/fail.
-6. For `failed` steps: re-run the specific failing command yourself if you need richer evidence to diagnose. Do not re-execute the whole recipe.
+   - `mode: full` (or `dry_run` if the user asked to validate the recipe first)
+   - Any extra context the user provided
+6. Wait for the JSON report.
+
+**Handle the report:**
+
+7. **If `status: bringup_failed`** → the bringup spec is wrong: an action command failed to land its post-condition (e.g., `selectLocationAndFly` doesn't exist, login button text changed, programmatic API renamed). Surface `failed_bringup_step` and the post-condition's actual value. Suggest re-authoring the broken Bringup step via `verify-recipe`. Do NOT click around manually trying to make it work.
+8. **If `status: bringup_budget_exhausted` or `bringup_timeout`** → bringup is taking too long. Either an animation is slower than the recipe expects (extend `timeout` on the offending step), or bringup is fighting an unexpected app state. Show the bringup transcript and ask the user.
+9. **If `status: precondition_failed`** → bringup completed but state still wrong. Could be: (a) bringup is incomplete (missing a step), (b) a Machine Precondition is overly strict, (c) real environment issue. Relay both the `bringup` block (showing what bringup did) and the `failed_precondition` so the user sees the full picture.
+10. **If `status: cascading_failures` or `budget_exhausted`** → the recipe Evidence is likely stale (selectors/refs changed, UI restructured). Show the first 1-2 failed Evidence steps and ask whether to update the recipe via `verify-recipe` or investigate manually.
+11. **If `design_conformance_section: true`** → also spawn `design-conformance-runner` in parallel with the `design_conformance_pairs` array. Merge both reports.
+12. **If `requires_visual_review` steps** have no design ref attached → open each screenshot yourself with `Read` and decide pass/fail.
+13. **If individual `failed` steps** in an otherwise-completed run → re-run that specific failing command yourself for richer evidence. Do not re-execute the whole recipe.
 
 Output to the user: a tight summary — what passed, what failed, what needs visual review, and (if any) which design conformance issues to fix. Do not paste the raw JSON unless asked.
 

package/skills/verify-recipe/SKILL.md

@@ -1,202 +1,258 @@
----
-name: verify-recipe
-description: "Generates a concrete, command-by-command agent-view recipe for verifying a feature or bugfix. Use when the developer wants to write a verify-recipe.md, create a verification plan, build an agent-view recipe, or produce a verify checklist for a change they shipped. Triggers on: write a verify-recipe, write verification steps, generate verify steps for the feature/bug I just shipped/fixed, make a verify-recipe.md, what should I run to verify X, create a verification plan, agent-view recipe for this fix, verify checklist for this feature. Does NOT execute the checks — it authors the plan. For running checks against a live app, use the verify skill instead."
-allowed-tools: Read, Write, Bash(agent-view *)
----
-
-# Verification Recipe Generator
-
-You help the developer author a disciplined, cheapest-first verification recipe for a feature they shipped or a bug they fixed. You do not run the checks — you produce a `.claude/verify-recipes/<slug>.md` file that any AI coding agent can execute later.
-
-## What this produces
-
-A file at `.claude/verify-recipes/<kebab-slug>.md` containing:
-
-- **REPRO STEPS** — exact state the app must be in before checks run
-- **NARROWED SIGNAL** — the measurable indicator that proves success or failure
-- **EVIDENCE COMMANDS** — ordered `agent-view` calls, cheapest first, each annotated with what it proves
-- **POSITIVE-CASE ASSERTIONS** — what "pass" looks like for each command
-- **REGRESSION CHECKS** — adjacent paths that must not have broken
-
-Create the directory if missing: `mkdir -p .claude/verify-recipes`
-
-## Methodology
-
-Frame the recipe with **hard-debug** discipline. That skill defines the chain: REPRO → narrowed signal → minimize scope → root-cause check → fix verification. Apply the same logic here in authoring mode:
-
-1. Start from a reproducible starting state, not "open the app and poke around"
-2. Convert vague expectations ("looks right") into measurable signals ("store.user.role === 'admin'")
-3. Prefer the cheapest tool that can answer the question — a value check costs ~50 tokens, a screenshot costs ~6 000
-4. Include at least one negative-case check (the old symptom must no longer appear)
-5. Include at least one regression check (an adjacent flow must still work)
-
-## Tool-cost decision tree
-
-Pick the first row that can answer the question. Only go lower when the row above can't:
-
-| Question | Command | Why it's cheapest |
-|---|---|---|
-| Element exists / has specific text / role | `agent-view dom --filter "<text>" --depth 2` | Structured text, zero vision tokens |
-| App state, store value, computed flag | `agent-view eval "<expr>"` | Returns the value directly; DOM inference is wasteful and fragile |
-| What changed between action and final state | `agent-view watch "<expr>" --until "<condition>"` or `--max-changes 1` | `eval` shows the snapshot; `watch` shows the trajectory |
-| SharedWorker / ServiceWorker internal state | `agent-view eval --target <name> "<expr>"` | Workers have no DOM; this is the only path |
-| Did this action throw or warn silently? | `agent-view console --clear` before, `agent-view console --level error,warn` after | Catches uncaught exceptions and network failures invisible to DOM |
-| Layout, spacing, visual regression | `agent-view screenshot --scale 0.5` | Last resort — the only tool that sees pixels, but costs ~6 000 tokens |
-| Canvas / WebGL scene state | `agent-view scene --diff` | DOM is empty for canvas apps |
-
-**Anti-patterns to reject:**
-- Opening with a screenshot to "see the state" — use `dom --filter` or `eval` first
-- Using `eval` when `dom --filter` answers the question
-- Assertions that depend on transient state without `watch --until` to stabilize first
-- "Check that it looks right" — every assertion must be a concrete pass/fail criterion. The single legitimate exception is the `## Design Conformance` section, which delegates visual judgment to the design-conformance-runner subagent against an explicit reference image.
-- Inventing design reference paths (`.figma-refs/...`, `assets/mockups/...`) when the developer did not provide them. No refs → no Design Conformance section.
-
-## Workflow
-
-### Step 1 — gather context
-
-When invoked, ask the developer in plain text (no tool calls yet):
-
-1. What was shipped or fixed? (feature name or bug description)
-2. What was the original symptom or expected behavior?
-3. Any known failure mode or edge case to cover?
-4. (Optional) Are there design reference images to verify against? If yes — local path, glob, or list of files. **Only local files are supported.**
-
-Wait for the response before continuing.
-
-If the user provides design refs in step 4, store them for Step 2's optional `Design Conformance` section. If not provided, skip that section entirely — never invent a path or assume a convention.
-
-### Step 2 — draft the recipe
-
-Use the answers to produce a recipe with these sections:
-
-```markdown
-# Verify: <feature or fix name>
-
-Generated: <date>
-Scope: <one sentence describing what this covers>
-
-## Repro Steps
-1. <Exact starting state — window open, user logged in, specific route, etc.>
-2. <Action(s) that trigger the behavior under test>
-
-## Narrowed Signal
-<!-- The one measurable thing that proves it works -->
-`<agent-view command>` must return `<expected value>`.
-
-## Evidence Commands
-
-### 1. <What this proves>
-```bash
-agent-view <command>
-```
-Expected: <concrete criterion — value, text, absence of error>
-Cost: ~<N> tokens
-
-### 2. ...
-
-## Positive-Case Assertions
-- [ ] <criterion>
-- [ ] <criterion>
-
-## Regression Checks
-- [ ] <adjacent flow> — `agent-view <command>` → `<expected>`
-
-## Design Conformance
-<!-- INCLUDE THIS SECTION ONLY IF the developer provided design refs in Step 1 question 4. -->
-<!-- Each pair: a screenshot command + an absolute path to the expected reference image. -->
-<!-- The design-conformance-runner subagent reads this section, runs the screenshot commands, and visually compares against the expected refs. -->
-<!-- Do NOT invent design ref paths. Do NOT assume a convention (e.g. .figma-refs/). Use exactly what the developer provided. -->
-
-| Step Label | Screenshot Command | Expected Reference |
-|---|---|---|
-| <area name e.g. "filter panel"> | `agent-view screenshot --crop "<area>" --scale 0.5` | `<absolute path to expected PNG/JPEG>` |
-| <area name> | `agent-view screenshot --window $W --scale 0.5` | `<absolute path>` |
-
-Tolerance: `normal` (default — flag deviations a designer would notice in code review). Use `loose` only if the developer says exact pixel parity is not required.
-
-## Anti-patterns avoided
-- <note any recipe-specific traps, e.g. "state resets on reload — watch needed before dom check">
-```
-
-### Step 3 — save the file
-
-Determine a kebab-slug from the feature/fix name (e.g. `login-redirect-fix`, `cart-total-display`).
-
-Save to `.claude/verify-recipes/<slug>.md`. Create the directory first if it doesn't exist.
-
-Confirm the path to the developer.
-
-## Worked example: "fixed login redirect bug"
-
-**Developer input:**
-> Fixed a bug where after login, the redirect went to `/home` instead of `/dashboard`. Store mutation `SET_REDIRECT_PATH` was missing. No visual change — purely a routing issue.
-
-**Recipe produced:**
-
-```markdown
-# Verify: Login Redirect Fix
-
-Generated: 2026-04-27
-Scope: Confirms that a successful login routes to /dashboard, not /home, and that the store mutation fires correctly.
-
-## Repro Steps
-1. App running, user logged out, at `/login`
-2. Fill email + password, click "Sign in"
-
-## Narrowed Signal
-`agent-view eval "router.currentRoute.path"` must return `"/dashboard"`.
-
-## Evidence Commands
-
-### 0. Setup — baseline console (before any action)
-```bash
-agent-view console --clear
-```
-
-### 1. Confirm redirect target
-```bash
-agent-view fill <email-ref> "admin@example.com"
-agent-view fill <password-ref> "password"
-agent-view click <signin-ref>
-agent-view watch "router.currentRoute.path" --until "router.currentRoute.path === '/dashboard'"
-```
-Expected: `replace /  "/login" → "/dashboard"` in watch output
-Cost: ~100 tokens
-
-### 2. Confirm mutation fired
-```bash
-agent-view eval "store.state.auth.redirectPath"
-```
-Expected: `"/dashboard"` (not `"/home"`, not `null`)
-Cost: ~50 tokens
-
-### 3. No errors during login flow
-```bash
-agent-view console --level error,warn
-```
-Expected: `(no console messages)`
-Cost: ~30 tokens
-
-### 4. Regression — logout returns to /login
-```bash
-agent-view click <logout-ref>
-agent-view eval "router.currentRoute.path"
-```
-Expected: `"/login"`
-Cost: ~60 tokens
-
-## Positive-Case Assertions
-- [ ] `router.currentRoute.path` === `/dashboard` after login
-- [ ] `store.state.auth.redirectPath` === `/dashboard`
-- [ ] No console errors during the flow
-
-## Regression Checks
-- [ ] Logout → `/login` still works
-
-## Anti-patterns avoided
-- Not using screenshot to confirm route (route is a string — eval is 120× cheaper)
-- watch used before eval so route change is confirmed to have settled, not just sampled mid-transition
-```
-
-**Saved to:** `.claude/verify-recipes/login-redirect-fix.md`
+---
+name: verify-recipe
+description: "Generates a concrete, command-by-command agent-view recipe for verifying a feature or bugfix. Use when the developer wants to write a verify-recipe.md, create a verification plan, build an agent-view recipe, or produce a verify checklist for a change they shipped. Triggers on: write a verify-recipe, write verification steps, generate verify steps for the feature/bug I just shipped/fixed, make a verify-recipe.md, what should I run to verify X, create a verification plan, agent-view recipe for this fix, verify checklist for this feature. Does NOT execute the checks — it authors the plan. For running checks against a live app, use the verify skill instead."
+allowed-tools: Read, Write, Bash(agent-view *)
+---
+
+# Verification Recipe Generator
+
+You help the developer author a disciplined, cheapest-first verification recipe for a feature they shipped or a bug they fixed. You do not run the checks — you produce a `.claude/verify-recipes/<slug>.md` file that any AI coding agent can execute later.
+
+## What this produces
+
+A file at `.claude/verify-recipes/<kebab-slug>.md` with three precondition phases plus the verification body:
+
+- **MANUAL PRECONDITIONS** — only what `agent-view` physically cannot do (rare; usually empty)
+- **BRINGUP** — idempotent setup steps the verify-runner executes itself: `if <state-check> is falsy → run actions → wait for state to settle`. Drives the app from auth screen / fresh shell / mid-state into the exact state the recipe needs. Re-runs cost almost nothing because each step skips when its condition is already met.
+- **MACHINE PRECONDITIONS** — pure state queries that confirm Bringup actually settled. No actions here. Any false → runner aborts.
+- **EVIDENCE COMMANDS** — ordered `agent-view` calls, cheapest first, each annotated with what it proves.
+- **POSITIVE-CASE ASSERTIONS** + **REGRESSION CHECKS** + optional **DESIGN CONFORMANCE**.
+
+Create the directory if missing: `mkdir -p .claude/verify-recipes`
+
+## Why three precondition phases
+
+| Phase | Who runs it | What it does | Idempotent? |
+|---|---|---|---|
+| `## Manual Preconditions` | Human (or main agent) | Only what `agent-view` physically can't (USB token, hardware setup, multi-machine state) | n/a |
+| `## Bringup` | verify-runner | `if state-check is falsy → action → wait`. Logins, mounting widgets, navigation — anything `agent-view` can do deterministically | YES (per step) |
+| `## Machine Preconditions` | verify-runner | Pure `eval` / `dom --filter` state queries. NO actions. | trivially |
+
+**Why split Bringup from Machine Preconditions?** A failure tells you a different thing in each:
+- A failed Bringup post-condition → bringup spec is wrong (e.g., `selectLocationAndFly` doesn't exist; "Войти" button text changed). Author error.
+- A failed Machine Precondition after Bringup succeeded → bringup THINKS it set up the state but the state isn't there (e.g., login appeared to succeed but the user role is wrong, the app is in a degraded mode). Real environment issue.
+- A failed Evidence Command after both passed → real bug in the verified feature.
+
+Without the split, all three look like "step N failed" and the developer can't tell which.
+
+**Why keep Manual at all?** Some things really can't be automated cheaply: physical USB-key auth, multi-machine setups, long-running data migrations. List them — but be honest, this section should usually be empty.
+
+## Methodology
+
+Frame the recipe with **hard-debug** discipline. Apply this chain in authoring mode:
+
+1. Start from the broadest possible starting state — recipe should run from auth screen, from logged-in shell, or from "already in the feature" without modification.
+2. Convert vague expectations ("looks right") into measurable signals ("`store.user.role === 'admin'`").
+3. Prefer the cheapest tool that can answer the question — a value check costs ~50 tokens, a screenshot costs ~6 000.
+4. Include at least one negative-case check (the old symptom must no longer appear).
+5. Include at least one regression check (an adjacent flow must still work).
+6. **Bringup steps must be conditional + idempotent.** Every action wrapped in `if <state-check> is falsy`. Every action followed by `wait for <post-condition> to be truthy`. Re-running the recipe must be a no-op when the app is already ready.
+
+## Tool-cost decision tree
+
+Pick the first row that can answer the question. Only go lower when the row above can't:
+
+| Question | Command | Why it's cheapest |
+|---|---|---|
+| Element exists / has specific text / role | `agent-view dom --filter "<text>" --depth 2` | Structured text, zero vision tokens |
+| App state, store value, computed flag | `agent-view eval "<expr>"` | Returns the value directly; DOM inference is wasteful and fragile |
+| What changed between action and final state | `agent-view watch "<expr>" --until "<condition>"` or `--max-changes 1` | `eval` shows the snapshot; `watch` shows the trajectory |
+| SharedWorker / ServiceWorker internal state | `agent-view eval --target <name> "<expr>"` | Workers have no DOM; this is the only path |
+| Did this action throw or warn silently? | `agent-view console --clear` before, `agent-view console --level error,warn` after | Catches uncaught exceptions and network failures invisible to DOM |
+| Layout, spacing, visual regression | `agent-view screenshot --scale 0.5` | Last resort — the only tool that sees pixels, but costs ~6 000 tokens |
+| Canvas / WebGL scene state | `agent-view scene --diff` | DOM is empty for canvas apps |
+
+**Anti-patterns to reject:**
+- Putting UI clicks (`click`, `fill`) in `## Machine Preconditions`. Actions go in `## Bringup`. Machine Preconditions are state queries only.
+- Bringup steps without an IF condition (unconditional actions). They break idempotency — re-running a "click Login" step when already logged in fails. Always wrap.
+- Bringup steps without a post-condition wait. Without it, the runner advances before the action settled, and the next step's IF check sees stale state.
+- Manual Preconditions for anything `agent-view` can do. Drag widget into cell? Often there's a programmatic API — interview the developer for it before defaulting to Manual.
+- Hardcoded credentials in Bringup commands. Use env-var references (`"$AGENTVIEW_PASSWORD"`) — never inline a password, even for dev/masterkey accounts. Recipes get committed to git.
+- Opening Evidence Commands with a screenshot to "see the state" — use `dom --filter` or `eval` first.
+- "Check that it looks right" — every Evidence assertion must be a concrete pass/fail criterion. The single legitimate exception is the `## Design Conformance` section.
+- Inventing design reference paths (`.figma-refs/...`) when the developer did not provide them. No refs → no Design Conformance section.
+
+## Workflow
+
+### Step 1 — gather context (interview the developer)
+
+When invoked, ask in plain text. Wait for response before continuing.
+
+**Block A — what's being verified:**
+
+1. What was shipped or fixed? (feature name or bug description)
+2. What was the original symptom or expected behavior?
+3. Any known failure mode or edge case to cover?
+
+**Block B — bringup: how the runner gets the app into a state where verification makes sense:**
+
+4. **Authentication** — does the app require login before the feature is reachable? If yes:
+   - What identifies "logged out" vs "logged in" in JS state? (e.g., `typeof window.__dev`, `!!store.user`)
+   - Login flow: which fields/buttons (`fill --filter "..."`, `click --filter "..."`) and what credentials? **Use an env-var, never inline.** Suggest a name like `AGENTVIEW_PASSWORD` and tell the user to `export` it in their shell or `.env.local`.
+5. **UI mode / view requirements** — does the feature live behind a specific app mode/view that must be active before it appears (e.g., "map view, not settings panel"; "edit mode, not view mode"; "modal X must be open")? For each:
+   - State check that proves this mode is active (e.g., `document.querySelector('.cesium-widget') !== null` for map mode).
+   - Action(s) to enter this mode if not active. Prefer programmatic API (e.g., `eval "store.setMode('map')"`) over UI clicks. If only UI works, list the click sequence.
+6. **Setup actions** — beyond modes, what other setup must happen (drag widget into cell, navigate camera to a location, open a dialog)? For each:
+   - Programmatic API if it exists (e.g., `gis-widget-root.selectLocationAndFly(uuid)`, `workspace.addWidget(...)`). Prefer this — much more reliable than UI automation.
+   - State check that proves the setup happened.
+   - Wait timing: how long does this take to settle? (camera animation, async data load).
+
+If the developer doesn't know whether a programmatic API exists, ask them to point you at the relevant store/composable/component file — you can read it and find one (or confirm none).
+
+**Block C — verification body and visual:**
+
+7. State assertions for the verified feature itself — JS expressions that prove it works (separate from bringup setup checks).
+8. **(Optional) Design references** — local image paths to compare screenshots against (Figma exports, hand-off PNGs). **Only local files are supported.** If none — skip the Design Conformance section.
+
+### Step 2 — draft the recipe
+
+Use the answers to produce a recipe in this format:
+
+````markdown
+# Verify: <feature or fix name>
+
+Generated: <date>
+Scope: <one sentence describing what this covers>
+
+## Manual Preconditions
+<!-- ONLY for things agent-view physically cannot do. Usually empty. -->
+<!-- The verify-runner does NOT execute these. -->
+(none — bringup handles everything)
+
+## Bringup
+<!-- The verify-runner executes these. Each step is conditional + idempotent: skipped if already in target state. -->
+<!-- Format per step: -->
+<!--   ### B<N>. <one-line title> -->
+<!--   - if `<eval>` is `<falsy criterion>`: -->
+<!--       <action command 1> -->
+<!--       <action command 2> -->
+<!--     wait for `<post-condition eval>` to be `<truthy criterion>`, timeout <Ns> -->
+
+### B1. Login if on auth screen
+- if `agent-view eval "typeof window.__dev"` is not `"object"`:
+    agent-view fill --window $W --filter "Логин" "root"
+    agent-view fill --window $W --filter "Пароль" "$AGENTVIEW_PASSWORD"
+    agent-view click --window $W --filter "Войти"
+  wait for `agent-view eval "typeof window.__dev"` to be `"object"`, timeout 15s
+
+### B2. Mount the GIS widget if not mounted
+- if `agent-view eval "!!window.__dev.pinia._s.get('gis-widget-root')?.cesiumReadyFlag"` is `false`:
+    agent-view eval "window.__dev.pinia._s.get('workspace').addWidget({type:'gis', cell:0})"
+  wait for `agent-view eval "!!window.__dev.pinia._s.get('gis-widget-root')?.cesiumReadyFlag"` to be `true`, timeout 10s
+
+### B3. Exit settings mode if active
+- if `agent-view eval "document.querySelector('.cesium-widget') !== null"` is `false`:
+    agent-view click --window $W --filter "Готово"
+  wait for `agent-view eval "document.querySelector('.cesium-widget') !== null"` to be `true`, timeout 5s
+
+### B4. Fly to first sublocation
+- if `agent-view eval "!!window.__dev.pinia._s.get('gis-widget-root')?.selectedLocation"` is `false`:
+    agent-view eval --await "window.__dev.pinia._s.get('gis-widget-root').selectLocationAndFly(window.__dev.mwStore.nvgn.sublocations.value[0].id)"
+  wait for `agent-view eval "(()=>{const w=document.querySelector('.cesium-widget'); const cw=Object.values(w).find(v=>v?.scene); return Math.round(window.Cesium.Cartographic.fromCartesian(cw.scene.camera.position).height);})()"` to be `< 5000`, timeout 30s
+
+### B5. Snapshot for the report (always runs)
+agent-view screenshot --window $W --scale 0.25
+
+## Machine Preconditions
+<!-- Pure state checks. NO actions. The verify-runner aborts with `precondition_failed` if any return false. -->
+- `agent-view eval "typeof window.__dev"` → must be `"object"`
+- `agent-view eval "!!window.__dev.pinia._s.get('gis-widget-root')?.cesiumReadyFlag"` → must be `true`
+- `agent-view eval "document.querySelector('.cesium-widget') !== null"` → must be `true`
+- `agent-view eval "!!window.__dev.pinia._s.get('gis-widget-root')?.selectedLocation"` → must be `true`
+- `agent-view eval "({locations:window.__dev.mwStore.nvgn.locations.value.length, sublocations:window.__dev.mwStore.nvgn.sublocations.value.length, zones:window.__dev.mwStore.nvgn.zones.value.length, objects:window.__dev.mwStore.nvgn.objects.value.length})"` → all four counts must be `> 0`
+
+## Narrowed Signal
+<!-- The one measurable thing that proves the verified feature works -->
+`<agent-view command>` must return `<expected value>`.
+
+## Evidence Commands
+
+### 1. <What this proves>
+```bash
+agent-view <command>
+```
+Expected: <concrete criterion — value, text, absence of error>
+Cost: ~<N> tokens
+
+### 2. ...
+
+## Positive-Case Assertions
+- [ ] <criterion>
+- [ ] <criterion>
+
+## Regression Checks
+- [ ] <adjacent flow> — `agent-view <command>` → `<expected>`
+
+## Design Conformance
+<!-- Include ONLY if the developer provided design refs in question 8. -->
+
+| Step Label | Screenshot Command | Expected Reference |
+|---|---|---|
+| <area name e.g. "filter panel collapsed"> | `agent-view screenshot --crop "<area>" --scale 0.5` | `<absolute path to expected PNG/JPEG>` |
+
+Tolerance: `normal` (default).
+
+## Anti-patterns avoided
+- <note any recipe-specific traps, e.g. "B4 relies on `selectLocationAndFly` from gis-widget-root — verified to exist as of <date>; if it's removed, B4 falls back to Manual Precondition">
+````
+
+### Step 3 — save the file
+
+Determine a kebab-slug from the feature/fix name. Save to `.claude/verify-recipes/<slug>.md`. Create the directory first if it doesn't exist. Confirm the path to the developer.
+
+### Step 4 — credentials warning (if Bringup contains login)
+
+If Bringup includes a login step:
+
+> Recipe uses `$AGENTVIEW_PASSWORD` for login. Make sure that env var is set in your shell or `.env.local` before running verify (`export AGENTVIEW_PASSWORD=<value>`). The recipe never contains the literal password.
+
+If the developer insisted on inlining a literal password earlier, warn:
+
+> ⚠️ Recipe contains a literal password on line N. This will be committed to git. Consider replacing with `$AGENTVIEW_PASSWORD` (env-var). Want me to convert it now? (yes/no)
+
+### Step 5 — offer dry-run validation
+
+After saving, ask:
+
+> The recipe is saved at `<path>`. Is the app running? If yes, I can spawn `verify-runner` in `dry_run` mode — it'll execute Bringup + Machine Preconditions + the first Evidence Command (~10-20 commands total). That validates the recipe isn't broken before you commit a full run. Want me to run the dry-run? (yes/no)
+
+If yes:
+1. Get the window id with `agent-view discover`.
+2. Spawn `verify-runner` via the Agent tool with `mode: dry_run`, the recipe path, and the window id.
+3. Read the JSON report.
+4. **`status: bringup_failed`** → relay `failed_bringup_step` and the post-condition's actual value. Suggest revising the bringup step (most often: action commands wrong, programmatic API doesn't exist, or post-condition criterion mistuned).
+5. **`status: precondition_failed`** → bringup ran but state isn't there. Either bringup is incomplete, or a state check is overly strict. Show both bringup outcome and the failing precondition.
+6. **`status: completed` and dry-run passed** → recipe is healthy. Confirm and stop.
+
+If no — confirm path and stop.
+
+## Worked example: GIS feature with full bringup automation
+
+**Developer input:**
+> Verifying selective filter changes (commits 0c5f1b1ee, 4d0c89467, 4c99c1591) in the GIS widget. App requires login (root/masterkey via middleware). GIS widget mounts via `workspace.addWidget({type:'gis', cell:0})`. Camera flies via `gis-widget-root.selectLocationAndFly(id)`. Map view is the default after widget mount.
+
+**Recipe produced:**
+
+(see the template above — it's already the worked example for this scenario)
+
+**Saved to:** `.claude/verify-recipes/nvgn-gis-improvements.md`
+
+**Dry-run output (first run after auth screen):**
+```
+status: completed
+mode: dry_run
+bringup: 5 steps, 12 commands, 18s — B1 (login) + B2 (mount) + B4 (fly) all triggered; B3 skipped (already map mode); B5 screenshot saved
+machine_preconditions: 5/5 passed
+steps: 1/1 passed
+```
+
+**Dry-run output (second run, app already in target state):**
+```
+status: completed
+mode: dry_run
+bringup: 5 steps, 5 commands (4 IF-checks + 1 screenshot), 3s — all 4 conditional steps skipped_already_ready
+machine_preconditions: 5/5 passed
+steps: 1/1 passed
+```
+
+This is what idempotent bringup buys you: 5x speedup on re-runs, zero manual intervention either way.