just-vibe 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.11.0
+
+- Add owned Claude command shortcuts for every selected workflow: `/jv <command>`, `/just-vibe <command>` and `/jv:<command>`. Preserve the canonical `/just-vibe:<command>` form, appended context and workflow authority; validate conflicts before install and preserve user-edited files on uninstall.
+- Recognize all four invocation forms in catalog lookup and explicit routing, with exact selection and unknown-command errors. Add a website guide and links from every command page, distinguishing Claude shortcuts from other hosts' native skill interfaces.
+
+- Add `reprompt` for rewriting prompts with preserved constraints, verified optional skill references, portable fallbacks, and no execution of the embedded task.
+
+- Repair worker startup and orchestration cancellation, runner input identity, workbench lock ownership, and Git repository isolation.
+- Correct strict file-read tracking, Cursor/Kiro event handling, quiz answer identity, session alias collisions, and supported configuration discovery/auditing.
+- Preserve installed Git hooks across package-cache cleanup and make installed hook identity usable for removal after upgrades.
+- Preserve Unicode across HTTP, native-hook, and subprocess boundaries; reject stale browser installation previews and support operator-page reloads.
+- Bind release preparation to unchanged checked source and verify published execution outside the checkout. See the [full review and verification record](docs/full-code-review-2026-09-21.md).
+- Complete owned-process cleanup before terminal results, preserve literal runner arguments, bind Node preload files to trust, and redact preview output independently of chunk boundaries.
+- Protect adaptive cleanup/recovery and unfinished learning activations; preserve repeated session messages; expose implemented recovery/window operations; correct benchmark Unicode and exception evidence.
+- Inspect Git's actual commit index, recover interrupted hook ownership updates, detect managed installation drift, isolate evaluation Git operations, and bind release verification to unchanged archive bytes. See the [second review](docs/second-code-review-2026-09-21.md).
+- Refine website navigation, full-width header/footer surfaces, selected sections, catalog padding, transparent branding, and page transitions without vertical text movement.
+
 ## 0.10.0
 
 - Deliver source and focused methods for the 49-group frozen ECC backlog; track partial acceptance separately from implementation and retain the original comparison as a historical snapshot.

package/README.md

@@ -1,10 +1,12 @@
 # just-vibe
 
+**Command shortcuts (v0.11.0):** Claude setup adds `/jv <command>`, `/just-vibe <command>` and `/jv:<command>` alongside `/just-vibe:<command>`. Append the same request after any form. For example, `/jv reprompt Make this prompt clearer: Fix stale search results.` See the [shortcut guide](https://just-vibe-tools.vercel.app/docs/command-shortcuts/) for setup, context examples and Codex's skill-picker equivalent.
+
 Tools, skills, and commands for coding agents.
 
 [Website](https://just-vibe-tools.vercel.app/) · [Documentation](https://just-vibe-tools.vercel.app/docs/) · [Command library](https://just-vibe-tools.vercel.app/commands/) · [Engineering profiles](https://just-vibe-tools.vercel.app/profiles/)
 
-**v0.10.0 contains 112 engineering profiles and 219 skill names backed by 216 canonical workflows** for Codex and Claude Code: focused skills for development, architecture, decisions, Git/GitHub, Vercel, Vite, React, UI, backend, APIs, databases, data, ML, LLMs, testing, security, and operations. Each canonical workflow has selection guidance, scope, concrete decision branches, evidence requirements, outputs, verification, recovery conditions and at least three example requests. Each entry point also contains an authored technical method: evidence to inspect, a procedure, a likely misdiagnosis and a discriminating check. Applied methods live in 22 pack guides. The v0.8.1 prompt update adds explicit infer/default/ask policies, a conditional worked example for each pack, and guidance for preserving corrections across turns; see [prompt improvements](docs/prompt-improvements.md).
+**v0.11.0 contains 112 engineering profiles and 220 skill names backed by 217 canonical workflows** for Codex and Claude Code: focused skills for development, architecture, decisions, Git/GitHub, Vercel, Vite, React, UI, backend, APIs, databases, data, ML, LLMs, testing, security, and operations. Each canonical workflow has selection guidance, scope, concrete decision branches, evidence requirements, outputs, verification, recovery conditions and at least three example requests. Each entry point also contains an authored technical method: evidence to inspect, a procedure, a likely misdiagnosis and a discriminating check. Applied methods live in 22 pack guides. The v0.8.1 prompt update adds explicit infer/default/ask policies, a conditional worked example for each pack, and guidance for preserving corrections across turns; see [prompt improvements](docs/prompt-improvements.md).
 
 The [technical audit](docs/technical-audit.md) and [complete coverage inventory](docs/technical-coverage.md) document the latest expansion across every canonical workflow. Review/security commands now route to concrete vulnerability, framework, language and scanner guides. [Security fixture controls](evals/security/README.md) distinguish seeded defects from legitimate behavior; they do not claim model-review accuracy.
 
@@ -13,18 +15,30 @@ The active coding agent executes the workflows with its available tools. The dep
 v0.7 adds a quick path for simple work, a small starter catalog, contextual routing with reasons, project preferences and checkpoints, explicit evidence collectors, and optional project hooks. Detailed auth, component, training and delivery scenarios load only when relevant. See [daily workflows](plugins/just-vibe/references/daily-workflows.md) for configuration and examples, and the [v0.7 validation record](evals/releases/0.7.0.md) for tested scope and limits.
 
 
-## Next release: runtime tools and goals
+## Runtime tools and goals
 
 The frozen ECC backlog now has a separate [implementation and evidence ledger](docs/ecc-implementation-plan.md). This expansion adds 43 focused methods, 22 connector recipes, native session imports, configuration cleanup, behavior rules, MCP health, bounded jobs and services, independent councils, evaluation receipts, CodeTour exports, a context graph, usage accounting and an offline operator/catalog interface. [Use these features](plugins/just-vibe/references/runtime-expansion.md). These capabilities are included starting in **v0.10.0**. Acceptance is tracked separately: local regression and installation checks do not establish every framework, live-provider or operating-system requirement. See the [release fixes and remaining validation](docs/release-fixes-2026-09-20.md).
 
-The source checkout adds **/goal**, scoped searchable memory, 48 native MCP tools, 24 independent specialists, optional worktree workers, before-action policy, a configuration scanner, reviewed pattern learning, preference sharing/evolution, an activity report, selective installations and 16 language/framework rule packs. Cursor, OpenCode, Copilot, Gemini, Kimi, Qwen, Windsurf and Antigravity IDE have project file adapters. The source catalog now contains **219 skill names and 216 canonical workflows**. Guided setup, portable context, reviewed dependent workers and a browser plan canvas are included. These additions have not yet been published to npm.
+The toolkit includes **/goal**, scoped searchable memory, 48 native MCP tools, 24 independent specialists, optional worktree workers, before-action policy, a configuration scanner, reviewed pattern learning, preference sharing/evolution, an activity report, selective installations and 16 language/framework rule packs. Cursor, OpenCode, Copilot, Gemini, Kimi, Qwen, Windsurf and Antigravity IDE have project file adapters. The source catalog now contains **220 skill names and 217 canonical workflows**, including the `reprompt` workflow added in v0.11.0. Guided setup, portable context, reviewed dependent workers and a browser plan canvas are included.
 
 Read [the feature guide](docs/runtime-tools.md), [operation schemas and examples](plugins/just-vibe/references/runtime-platform.md), and [the implementation/validation plan](docs/runtime-expansion-plan.md). Existing installs retain their defaults; observation, blocking policy and worker launching are opt-in.
 
-The next release also includes context and repeated-call warnings, detected check presets, batched formatting, staged commit checks, Cursor/OpenCode event adapters, Zed/Hermes skill installation, GitHub epic coordination, and JSON/Markdown/SARIF security reports with an optional reviewed AgentShield runner. Focused Django, FastAPI, Spring Boot, Flutter and React Native guides extend existing workflows. See [configuration, examples and limits](plugins/just-vibe/references/runtime-depth.md) and [verification](docs/remaining-ecc-gaps-plan.md).
+The toolkit also includes context and repeated-call warnings, detected check presets, batched formatting, staged commit checks, Cursor/OpenCode event adapters, Zed/Hermes skill installation, GitHub epic coordination, and JSON/Markdown/SARIF security reports with an optional reviewed AgentShield runner. Focused Django, FastAPI, Spring Boot, Flutter and React Native guides extend existing workflows. See [configuration, examples and limits](plugins/just-vibe/references/runtime-depth.md) and [verification](docs/remaining-ecc-gaps-plan.md).
 
 The [complete ECC comparison](docs/ecc-complete-audit.md) inventories a pinned upstream snapshot and records remaining functionality, technical-depth gaps, optional products and implementation requirements. Earlier completed rounds covered their selected findings; they did not establish full ECC parity. The ledger distinguishes source presence from live verification and includes a maintainer check for upstream drift.
 
+## Improve a prompt
+
+Starting in v0.11.0, select **just-vibe → reprompt** in Codex, or use `/just-vibe:reprompt` in Claude Code, and append the prompt:
+
+```text
+/just-vibe:reprompt Fix our React search page when older requests finish last.
+Keep the current API and dependencies. Do not deploy.
+Use relevant installed skills in the rewritten prompt.
+```
+
+It returns a paste-ready prompt, preserves your constraints, and names only skills it can verify (with availability checks for another host). It does not execute the embedded task. Add “output only,” “no skills,” or identify an earlier prompt or file to refine. See [examples and boundaries](plugins/just-vibe/references/reprompt.md).
+
 ## Automatic assistance
 
 Describe the outcome normally: “Fix the mobile menu,” “Why is training unstable?” or “Address this PR’s feedback.” Trusted native hooks now route each request to a focused shortlist, restore selected work after compaction, and direct the agent to discover and use its actual tools. Command names remain optional.
@@ -46,7 +60,7 @@ v0.8.0 adds working runtime helpers behind natural-language skill requests:
 
 See the [workflow guide](plugins/just-vibe/references/intent-workflows.md) for examples, boundaries and recovery. Users provide ordinary briefs; the agent prepares the helper inputs. These features support judgment rather than claiming an objective quality score.
 
-**Release version: 0.10.0.** Check [npm](https://www.npmjs.com/package/just-vibe) for the current `latest` tag. The [0.10.0 release validation record](evals/releases/0.10.0.md) describes the tested capabilities, platform limits and release-specific GitHub Actions waiver. No CI pass is claimed.
+**Release:** v0.11.0 adds prompt rewriting and short command invocations, together with the runtime fixes from both recent code reviews. Check [npm](https://www.npmjs.com/package/just-vibe) for registry availability. Native syntax, installation checks and evaluation limits are documented in the [shortcut verification record](docs/audits/command-shortcuts-2026-09-21.md). GitHub Actions is unavailable because account billing prevents jobs from starting; local checks are recorded separately and no CI pass is claimed.
 
 
 ## Use the workflows
@@ -298,7 +312,7 @@ The [technical-guidance validation record](evals/releases/0.8.0-technical-guidan
 | `plugins/just-vibe/scripts/toolkit.mjs` | Discovery, routing, sessions, quizzes and persistent intent workflow CLI |
 | `plugins/just-vibe/scripts/lib/` | Catalog, capability, session, quiz, memory, guard, task, lab, proof, practice, experiment and decision modules |
 | `plugins/just-vibe/catalog/` | Canonical command contracts, 112 role profiles, examples, prerequisites and pack metadata |
-| `plugins/just-vibe/skills/` | 219 source skill names, including three aliases, goal, orchestration, plan review and setup |
+| `plugins/just-vibe/skills/` | 220 source skill names, including three aliases, goal, orchestration, plan review and setup |
 | `plugins/just-vibe/references/` | Shared execution rules, runtime interface, domain guidance and command index |
 | `.agents/plugins/marketplace.json` | Codex marketplace |
 | `.claude-plugin/marketplace.json` | Claude Code marketplace |

package/docs/audits/command-shortcuts-2026-09-21.md

@@ -0,0 +1,14 @@
+# Command shortcut verification — 2026-09-21
+
+This records prepublication checks for the v0.11.0 changes. It is not a general model-quality evaluation or proof of registry publication.
+
+- Node 24: full validation and test suite, 400 tests total, 399 passed, one Windows-only skip.
+- Native bundled installation lifecycles passed in isolated Codex 0.152.0 and Claude Code 2.1.258 configuration directories: setup, repeated setup, doctor, update, uninstall, repeated uninstall and reinstall.
+- Claude Code 2.1.258 live startup listed all 220 canonical namespaced commands and all 220 jv aliases, plus the jv and just-vibe dispatchers.
+- Four separate live Claude requests using /jv reprompt, /just-vibe reprompt, /jv:reprompt and /just-vibe:reprompt successfully returned rewritten prompts. The three forwarding forms called the canonical just-vibe:reprompt skill with the complete argument string. The canonical form loaded directly. The embedded explanatory task was not executed.
+- Four live Codex 0.152.0 CLI requests passed through the installed plugin and trusted prompt hooks, one for each form. All four selected reprompt, loaded its instructions and returned a rewritten prompt. These were ordinary prompt-text invocations, not custom slash-menu registrations. One run also emitted tracking commentary despite output-only wording; this is not a claim of perfect model adherence.
+- The native lifecycle suite was repeated successfully with v0.11.0 package and plugin metadata.
+- Fixtures cover every catalog ID through all four parsers, multiline context preservation, unknown IDs, explicit routing over incidental task keywords, selected installations, ownership conflicts, selection expansion, edited files and uninstall preservation.
+- Website production build generated 355 pages; four static catalog/link/metadata checks passed. The guide was inspected in the browser at desktop and 390px widths, with no document overflow. Its link is available from docs navigation and every command page.
+
+Limits: live checks exercised a simple rewrite, not every command's behavior or every host/version. Prompt quality, implied assumptions and skill selection still require case-specific judgment. Codex uses its native skill picker; parser recognition does not add custom slash entries to another host's input box. New catalog behavior remains marked not-evaluated in the formal behavioral evaluation system.

package/docs/audits/ecc-implementation.json

@@ -25,7 +25,7 @@
         },
         {
           "path": "scripts/smoke-operator-browser.mjs",
-          "sha256": "de0c58a8ba3b372add8a32866412627c04e0cb9a5221416bc9980bf447fbf84f"
+          "sha256": "9a71f2306b40e89245500d00c144370a6a070940318cff4fb13fe578e192d5e8"
         },
         {
           "path": "tests/expansion-contracts.test.mjs",
@@ -306,11 +306,11 @@
       "evidence": [
         {
           "path": "plugins/just-vibe/scripts/lib/orchestration.mjs",
-          "sha256": "32c5b3691d0d6087663aa8c2f0492fb85994b3c9b1040e8365817dd16e7766be"
+          "sha256": "a9c0a3423087c585700fde08429a53d52739d95f1943a15db1896c484ef4d010"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/workers.mjs",
-          "sha256": "b865b0981c5c61ce7bdca8d1dfcf5007015bc95e70c58c5127f7742cbb91a06d"
+          "sha256": "5e962e7d84b85304fe355cd27b563628fd55fc7fbc389bfff5b767c1ccf01579"
         },
         {
           "path": "tests/gap-closure.test.mjs",
@@ -359,11 +359,11 @@
       "evidence": [
         {
           "path": "plugins/just-vibe/scripts/lib/git-hooks.mjs",
-          "sha256": "4fd3e3366a58943e74e87c1e7e4d9d31f486bef3f9ba34355d16bc5e4f261bc1"
+          "sha256": "5ce212ccf18103214956bdd0345590b41f8b9284fa07c1ababc2eec181d6a57d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/quality.mjs",
-          "sha256": "3b12a019dc6c73628eec6ebe472a9e7f3bd4062242e75fddc577207c528a82e4"
+          "sha256": "17a697ade6140ce5dfab62fd79e45d4162b9e943abcf584eba7164c90673a094"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/behavior-rules.mjs",
@@ -383,7 +383,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -428,11 +428,11 @@
       "evidence": [
         {
           "path": "plugins/just-vibe/scripts/lib/config-inventory.mjs",
-          "sha256": "2ec5e61aef17de05f0f80167abd5cca5ca01e64cd7af0a4e776e3a0ae2c1d8cb"
+          "sha256": "7d157a012b8b7465b65f6ffcdeba65ffafc5ace818dc6c3344b4f6e832820b36"
         },
         {
           "path": "tests/capability-runtime.test.mjs",
-          "sha256": "a02eafeec1278661907981743377e99d7c17308f0d9cfed313391d972709cb44"
+          "sha256": "a62b3c245c2526bae7ff30727f0c8d4c85a46b4f102c80dfc0ad80bc30a1f0d7"
         }
       ],
       "verification": [
@@ -473,7 +473,7 @@
         },
         {
           "path": "tests/capability-runtime.test.mjs",
-          "sha256": "a02eafeec1278661907981743377e99d7c17308f0d9cfed313391d972709cb44"
+          "sha256": "a62b3c245c2526bae7ff30727f0c8d4c85a46b4f102c80dfc0ad80bc30a1f0d7"
         },
         {
           "path": "tests/expansion-contracts.test.mjs",
@@ -522,7 +522,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/investigation.mjs",
-          "sha256": "46afe11fe0ac0cd506776841ec0b39497f43572434b29fc750febdae8e411abd"
+          "sha256": "c9fab1548046a579200045bf96c15f5ad23e5655215b6cabf405d6d6df6c0fc9"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/lifecycle.mjs",
@@ -530,7 +530,7 @@
         },
         {
           "path": "tests/capability-runtime.test.mjs",
-          "sha256": "a02eafeec1278661907981743377e99d7c17308f0d9cfed313391d972709cb44"
+          "sha256": "a62b3c245c2526bae7ff30727f0c8d4c85a46b4f102c80dfc0ad80bc30a1f0d7"
         },
         {
           "path": "tests/expansion-contracts.test.mjs",
@@ -542,7 +542,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -591,7 +591,7 @@
         },
         {
           "path": "tests/capability-runtime.test.mjs",
-          "sha256": "a02eafeec1278661907981743377e99d7c17308f0d9cfed313391d972709cb44"
+          "sha256": "a62b3c245c2526bae7ff30727f0c8d4c85a46b4f102c80dfc0ad80bc30a1f0d7"
         },
         {
           "path": "tests/expansion-contracts.test.mjs",
@@ -603,7 +603,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -648,11 +648,11 @@
       "evidence": [
         {
           "path": "plugins/just-vibe/scripts/lib/native-sessions.mjs",
-          "sha256": "84b33c5243f75b8b0f247f41f10538cf5f46db69effa58ac484497ff7fd37d81"
+          "sha256": "2b310f50a77e59761e095984347350a7c7c9793b53e9a7336a8ad6600693e6b9"
         },
         {
           "path": "tests/capability-runtime.test.mjs",
-          "sha256": "a02eafeec1278661907981743377e99d7c17308f0d9cfed313391d972709cb44"
+          "sha256": "a62b3c245c2526bae7ff30727f0c8d4c85a46b4f102c80dfc0ad80bc30a1f0d7"
         },
         {
           "path": "tests/release-regressions.test.mjs",
@@ -660,7 +660,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -719,7 +719,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -817,7 +817,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -872,7 +872,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/orchestration.mjs",
-          "sha256": "32c5b3691d0d6087663aa8c2f0492fb85994b3c9b1040e8365817dd16e7766be"
+          "sha256": "a9c0a3423087c585700fde08429a53d52739d95f1943a15db1896c484ef4d010"
         },
         {
           "path": "tests/expansion-contracts.test.mjs",
@@ -917,7 +917,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/service-supervisor.mjs",
-          "sha256": "a87ed702360a129a0ddd68b7bae3178cb6e973868cfa60c7be38cc583b25e26c"
+          "sha256": "57a91ca341c8a4e7b8069ebc6c62c6f061fab7662defd36b17809e7936e865d9"
         },
         {
           "path": "tests/extended-workbench.test.mjs",
@@ -929,7 +929,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -988,7 +988,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -1573,7 +1573,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -1983,7 +1983,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/operator-http.mjs",
-          "sha256": "9087457482f80453701b330f2f544aaaeaf7d3ca21a5d3d48de802dbafcabf28"
+          "sha256": "0ed376d6d7d97ccdcc2bf017d0595706b06320c1d87a3edcb3f9ad5830501a15"
         },
         {
           "path": "tests/expansion-contracts.test.mjs",
@@ -1995,7 +1995,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -2107,7 +2107,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -2172,7 +2172,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -2217,7 +2217,7 @@
         },
         {
           "path": ".github/workflows/publish.yml",
-          "sha256": "28333657439b6d61306c2de89e10605f80e6b42b1480012775867b856761dd2d"
+          "sha256": "bbf290aea294981ddcb22bd9a9bb954623ca766a11b821f84a58dc3f30c5a88f"
         },
         {
           "path": "plugins/just-vibe/references/methods/release-maintenance.md",
@@ -2323,7 +2323,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/editor-events.mjs",
-          "sha256": "e2e6c2b1e41eb00f72e89ea8296672d92543f9adba83ccecf5ab833613389d29"
+          "sha256": "8a518b1e95c795ed89a7dc5a290f09be3d0b33742499489428f29db0042fae55"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/opencode-plugin.mjs",
@@ -2331,7 +2331,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/kiro-hooks.mjs",
-          "sha256": "916c78363577c307954e35d95043bab8747b91c8d3cac38509d50139e88f973d"
+          "sha256": "fbc993d9dbf21a5432767111caddafcb957ce90abf4b65777b71ed96fc39b934"
         },
         {
           "path": "tests/expansion-contracts.test.mjs",
@@ -2347,7 +2347,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -2404,11 +2404,11 @@
       "evidence": [
         {
           "path": "plugins/just-vibe/scripts/lib/operator-http.mjs",
-          "sha256": "9087457482f80453701b330f2f544aaaeaf7d3ca21a5d3d48de802dbafcabf28"
+          "sha256": "0ed376d6d7d97ccdcc2bf017d0595706b06320c1d87a3edcb3f9ad5830501a15"
         },
         {
           "path": "scripts/smoke-operator-browser.mjs",
-          "sha256": "de0c58a8ba3b372add8a32866412627c04e0cb9a5221416bc9980bf447fbf84f"
+          "sha256": "9a71f2306b40e89245500d00c144370a6a070940318cff4fb13fe578e192d5e8"
         },
         {
           "path": "tests/expansion-contracts.test.mjs",
@@ -2420,7 +2420,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",
@@ -2491,7 +2491,7 @@
         },
         {
           "path": "tests/bundle.test.mjs",
-          "sha256": "17ae10a054d92d8d9bac3ae202795e3f62506caa1dcf51179a3f705df04035c5"
+          "sha256": "8ea5d1fa28a85e04f560df4a399a6bb97e10d37b1535f5af67bfb7bd30492244"
         },
         {
           "path": "tests/release-regressions.test.mjs",
@@ -2499,7 +2499,7 @@
         },
         {
           "path": "plugins/just-vibe/scripts/lib/file-lock.mjs",
-          "sha256": "2195eecdcc87c85b6082cc21b5e077e6cc99556fd54930b81376ddd16d6ec7e0"
+          "sha256": "fd2e6bae64c58482549f68d7971f59cf67cdf37e37b934689a785e22c78e111d"
         },
         {
           "path": "plugins/just-vibe/scripts/lib/execution-control.mjs",

package/docs/command-quality.md

@@ -4,7 +4,7 @@ The [2026-09-20 technical audit](technical-audit.md) extends every canonical wor
 
 The catalog owns each canonical command's scope, mode, required inputs, selection boundary, procedure, decision branches, outputs, observable verification, recovery conditions and examples. Pack references add reusable methods and worked scenarios. Generated SKILL.md files expose all examples and link the applicable guide; they are not independently edited.
 
-216 names resolve to 213 canonical workflows. `do` inherits `auto`, `responsive` inherits `ui-responsive`, and `a11y` inherits `ui-accessibility`. Alias source records contain identity/search metadata only. Loading materializes the canonical behavior; validation rejects scope, mode, method, evidence or other behavioral drift. Routing collapses matching aliases to one canonical recommendation while preserving matched names.
+220 source names resolve to 217 canonical workflows. `do` inherits `auto`, `responsive` inherits `ui-responsive`, and `a11y` inherits `ui-accessibility`. Alias source records contain identity/search metadata only. Loading materializes the canonical behavior; validation rejects scope, mode, method, evidence or other behavioral drift. Routing collapses matching aliases to one canonical recommendation while preserving matched names.
 
 The [prompt improvements](prompt-improvements.md) add explicit input policies, request variants, conditional worked examples, concrete role contributions and multi-turn validation. Every generated skill uses one canonical procedure; do not reintroduce parallel runtime instructions.
 

package/docs/compatibility.md

@@ -57,3 +57,9 @@ The source adds 43 methods, 24 total specialists and 48 total MCP tools. Ninetee
 The operator/catalog browser was checked in Chromium at desktop/mobile widths, with keyboard interaction, reduced motion, accessibility scanning, local record actions and a reviewed fixture installation. Python provider tests use loopback HTTP and visible streaming/request fixtures; paid OpenAI/Anthropic and real Ollama requests were not run. CPU ranking/split examples do not establish CUDA/distributed behavior.
 
 Native Git pre-commit/pre-push hooks are opt-in and preserve foreign hook managers. Pre-push requires an explicitly trusted verifier and a clean checkout matching the pushed HEAD. Service supervisors own only their child processes; stale PID recovery requires inspection. Cross-platform CI configuration is not a claim of a completed CI run, especially while GitHub Actions minutes are unavailable. Source/baseline comparisons and current evidence are tracked separately in the [frozen-backlog implementation](ecc-implementation-plan.md).
+
+## v0.11 command shortcuts
+
+Claude Code setup installs two dispatcher commands and an owned skills-directory plugin named `jv`. Every selected command supports `/jv <command>`, `/just-vibe <command>`, `/jv:<command>` and `/just-vibe:<command>`. This syntax is checked on Claude Code 2.1.258 on macOS. Setup does not overwrite foreign or edited shortcut files, and uninstall retains persistent data.
+
+Codex uses its native skill picker. The just-vibe router also accepts all four forms when supplied as ordinary prompt text through supported, trusted hooks; parser support does not register new custom commands in the Codex slash menu. Other editors retain their native skill interfaces. See [verification and limits](audits/command-shortcuts-2026-09-21.md).

package/docs/full-code-review-2026-09-21.md

@@ -0,0 +1,60 @@
+# Full code review — 2026-09-21
+
+Baseline: `0fba56d` (the repository after verified publication of 0.10.0). These repairs are unreleased working-tree changes, not part of the existing npm archive.
+
+Three reviewers covered execution, integrations, and workflows. The primary reviewer covered the CLI, browser interfaces, website, and release tooling, independently reproduced each reported defect, and reviewed the repairs. Four agents total were used. Reproductions used isolated files, repositories, processes, and loopback servers; no paid model execution or production mutation was needed.
+
+## Confirmed findings and repairs
+
+| ID | Priority | Reproduced failure | Repair and regression evidence |
+| --- | --- | --- | --- |
+| R01 | P1 | Agent and preview supervisors launched a child even when its matching stop token existed before startup. | Check owned cancellation before spawning. Foreign tokens still permit execution. `tests/worker-startup.test.mjs`. |
+| R02 | P1 | Cancelling an orchestration during its first worker's setup acknowledged success, but dispatch launched a second worker afterward and failed its final state save. | Serialize orchestration writes with worker reservations, recheck authoritative state for each launch, reconcile pending attempts on cancellation, and refuse retirement of an unresolved reservation. `tests/orchestration-cancellation.test.mjs`. |
+| R03 | P1 | A script symlink was omitted from trusted runner inputs; editing its target left the runner current and executable. | Reject unsupported symlink inputs and recheck actual argv input coverage, including legacy records. Keep ordinary inline code and package-manager arguments valid. `tests/trusted-runner-identity.test.mjs`. |
+| R04 | P1 | Workbench recovery could unlink a replacement live lock after reading an older dead owner; async cleanup also unconditionally removed its lock path. | Track host/token/filesystem identity, serialize acquisition and recovery, and release only the same owned lock. A real-child contention regression also prevents successful operations from stranding a lock during cleanup. `tests/workbench-memory.test.mjs`. |
+| R05 | P1 | Inherited `GIT_DIR` and `GIT_WORK_TREE` made the selected project's identity report another repository's HEAD; alternate index/configuration variables could redirect operations. | Remove inherited Git overrides and disable replacement objects for project-bound workbench commands. Tests preserve the foreign repository and exercise binary stdin/stdout. `tests/workbench-memory.test.mjs`. |
+| R06 | P2 | An explicitly failed nested file-read result satisfied strict investigation's successful-read prerequisite. | Reject nested error markers and nonzero result codes before recording inspection. `tests/capability-runtime.test.mjs`. |
+| R07 | P2 | Cursor discarded the native result envelope, so an error returned by a Read tool still satisfied strict investigation. | Normalize native `tool_output` and compatibility result envelopes, keeping malformed or failed reads unverified. `tests/integration-review.test.mjs`. |
+| R08 | P2 | A quiz label matching another option's ID produced different grades depending on shuffle order. | Reject cross-option answer aliases and refuse ambiguous legacy answers without consuming the question. `tests/teaching.test.mjs`. |
+| R09 | P2 | Kiro's native lowercase tools and aliases bypassed file/command-specific behavior rules. | Normalize exact built-in names and write fields while preserving namespaced remote tool identities. `tests/integration-review.test.mjs`. |
+| R10 | P2 | Default inventory missed the root `opencode.json` written by the connector installer and could not resolve its server for health checks. | Include root JSON/JSONC configurations in shared project discovery paths. `tests/integration-review.test.mjs`. |
+| R11 | P2 | Default static auditing skipped Kiro and other supported editor roots, missing indicators found by an explicit path scan. | Share host paths between discovery and auditing; check coverage against every project skill adapter and retain scan bounds. `tests/integration-review.test.mjs`. |
+| R12 | P2 | Branching a session into an existing alias succeeded, but subsequent lookup resolved the other session. | Reject alias collisions before creating a branch and preserve both original sessions. `tests/integration-review.test.mjs`. |
+| R13 | P2 | Installed Git hooks referenced a disposable npm/dlx cache and failed after cache removal. | On explicit install, stage source-bound runtime bytes in durable managed storage; preview remains read-only. Execute both installed entrypoints after deleting the temporary package in `tests/integration-review.test.mjs`. |
+| R14 | P2 | Git hook status recomputed the invoking package's proposed hash, making documented uninstall fail after changing package locations. | Status returns installed identity; preview distinguishes proposed and installed hashes. Cover legacy uninstall and edited-hook preservation in `tests/integration-review.test.mjs`. |
+| R15 | P2 | A valid UTF-8 character split across HTTP chunks was silently replaced in canvas feedback; the same reader could corrupt operator owner identity. | Accumulate bounded bytes before decoding JSON. Test both APIs and oversize rejection in `tests/http-review.test.mjs`. |
+| R16 | P2 | A split UTF-8 character in native Cursor/Kiro stdin stopped a configured rule from matching; the same whole input was blocked. | Decode bounded complete input, preserving rule behavior across pipe boundaries. Installed-entrypoint regressions in `tests/hook-input.test.mjs`. |
+| R17 | P2 | Command evidence and agent, preview, and service logs corrupted split characters independently on stdout/stderr. | Use a decoder per stream while preserving output bounds and cancellation behavior. `tests/utf8-output.test.mjs`. |
+| R18 | P2 | An older install-preview response re-enabled Apply after the selected editor changed, offering a plan for the wrong editor. | Invalidate pending preview generations on every selection/request; lock installation controls while applying. Delayed-response browser regression in `scripts/smoke-operator-browser.mjs`. |
+| R19 | P2 | Reloading the operator page lost its removed fragment token and displayed a JSON parsing error. | Retain the token in tab-scoped session storage; preserve the fragment if storage is unavailable and give a clear missing-token message. Browser reload regression in `scripts/smoke-operator-browser.mjs`. |
+| R20 | P2 | The publication workflow's final `npm exec` could run a local checkout binary instead of the registry package and did not assert its version. | Use the existing registry verifier with an unrelated working directory, fresh cache, explicit registry, and exact version assertion. Verified local-shadow behavior with an unpublished offline fixture; helper coverage in `tests/publication.test.mjs`. |
+| R21 | P2 | Release preparation could check one commit and later bind its archive receipt to an untested concurrent commit. | Capture the starting commit, require clean unchanged source after checks and before recording the archive, and bind the receipt to that captured commit. Dirty and committed changes at multiple phases are tested in `tests/release-preparation.test.mjs`. |
+
+The repair review caught and corrected two intermediate regressions: cleanup contention in the first lock fix, and long inline Node arguments in the first runner-input fix. Neither is left in the final implementation.
+
+## Coverage
+
+- All runtime library modules, supervisors, CLI entrypoints, installer, native adapters, MCP definitions, hook paths, Python provider, and plugin manifests were assigned and reviewed. This includes storage, cancellation, execution authorization, import/export boundaries, recovery, evidence freshness, and result handling.
+- The command, role, method, connector, rule, and specialist catalogs received contract/schema and targeted semantic review. Generated copies are checked against their canonical sources; the 402 generated artifacts were not separately hand-edited or claimed as independent behavioral evaluations.
+- Reviewed skill generation, validation, archive and release tooling, CI workflows, host smoke helpers, behavior/conversation/security/benchmark harnesses, language oracles, and fixture contracts.
+- Reviewed website components, navigation lifecycle, installation and command controls, catalog pages, documentation routes, CSS layout/motion behavior, and static hosting configuration. Browser checks cover every command/profile/guide page at 320 and 768 pixels, template breakpoints, expanded text spacing, navigation, clipboard, keyboard controls, reduced motion, and automated accessibility checks.
+- Reviewed both local web applications, including token/origin checks, HTML preview isolation, state freshness, installation previews, and browser interaction tests.
+
+## Verification
+
+- Complete test suite on Node 22 and Node 24: **365 passed, zero failed, one Windows-only test skipped** on each version (366 tests total). Tests used the available Python runtime explicitly for provider coverage.
+- Node 24 `release:check`: canonical catalog and generated-artifact validation, the full suite above, release metadata, MIT notices, internal links, credential-pattern checks, and all **789 packaged files** passed.
+- A separate review archive passed execution, all 219 skills and 112 profiles, and both bundled setup previews through npm, pnpm 10, pnpm 12, and Yarn. The installed payload also ran after deleting its temporary package cache. The previously published archive was not overwritten.
+- Website production build: **353 pages**. All four static tests passed. Browser checks passed for installation variants, navigation/history, clipboard, search, keyboard controls, dropdown/menu states, reduced motion, automated accessibility, and no-JavaScript catalog use. Layout checks covered 15 template widths and all 347 command/profile/guide pages at both 320 and 768 pixels, plus expanded text spacing.
+- Operator and canvas browser suites passed on desktop and mobile with zero reported automated accessibility violations. These include the new stale-install-preview and private-page-reload regressions, plus annotation, stale-approval, and HTML-isolation checks.
+- Current implementation evidence validation and `git diff --check` passed. The implementation ledger still records all 49 groups as acceptance-partial; passing these checks does not promote their status.
+
+Local logs and reproduction fixtures are retained under `.tmp/full-review/` (ignored by Git). These results describe the reviewed working tree on macOS, not a newly published release.
+
+## Limits and rejected concerns
+
+An install-widget history/restoration mismatch was investigated in Chromium and not reproduced; controls and displayed command remained consistent, so no speculative website change was made. An archive-invocation shadowing concern in updater tests was also disproved; it is separate from the publication workflow's verified local-resolution issue.
+
+This review does not establish universal correctness, complete ECC parity, or successful model behavior for every prompt. Catalog prose received targeted semantic review, not a claim that every reference sentence was independently fact-checked. Generated artifacts received parity checks. Live model/account integrations, Windows/Linux execution, and every possible process-crash ordering remain outside the observed local results. The historical ECC snapshot and prior release receipts remain unchanged; current implementation evidence is refreshed without upgrading partial acceptance to verified.
+
+Host schema references checked during this review: [Kiro built-in tools](https://kiro.dev/docs/reference/built-in-tools/) and [Cursor hook result envelopes](https://cursor.com/docs/hooks).

package/docs/releases.md

@@ -54,4 +54,4 @@ Official references: [npm publishing](https://docs.npmjs.com/creating-and-publis
 
 The default publisher still requires successful CI. An explicit maintainer instruction can waive unavailable CI for a specific release without recording a fictitious pass or disabling Actions globally. Keep the local checks and exact-archive verification: match the clean source commit, package/manifests, SHA-256 release record and tested tarball; check whether that version already exists before publication. Publish only those verified bytes, complete npm account verification, then compare registry integrity and execute the exact version from a fresh temporary directory/cache outside the source checkout. `npm exec` inside the package checkout can select the local package and fail to resolve its bin.
 
-Record the reason, maintainer authorization, source commit, artifact hashes, local checks and outstanding platform coverage. Tag the actual published source revision. Never overwrite a published version or weaken the normal CI check for future releases. The [0.8.0 publication record](../evals/releases/0.8.0-publication.json), [0.8.1 publication record](../evals/releases/0.8.1-publication.json) and [0.9.0 publication record](../evals/releases/0.9.0-publication.json) document separately authorized release-specific exceptions.
+Record the reason, maintainer authorization, source commit, artifact hashes, local checks and outstanding platform coverage. Tag the actual published source revision. Never overwrite a published version or weaken the normal CI check for future releases. The [0.8.0 publication record](../evals/releases/0.8.0-publication.json), [0.8.1 publication record](../evals/releases/0.8.1-publication.json) [0.9.0 publication record](../evals/releases/0.9.0-publication.json) and [0.10.0 publication record](../evals/releases/0.10.0-publication.json) document separately authorized release-specific exceptions.

package/docs/second-code-review-2026-09-21.md

@@ -0,0 +1,47 @@
+# Second code review — 2026-09-21
+
+This pass reviews the working tree after the [first review](full-code-review-2026-09-21.md). Three reviewers rotated areas; the primary reviewer independently reproduced every reported failure before authorizing repairs and then inspected the resulting changes. Four reviewers total were used. Reproductions used isolated repositories, inert subprocesses, fixture credentials, and loopback servers. No model inference or production mutation was needed to reproduce the defects.
+
+## Confirmed findings
+
+| ID | Priority | Failure and repair |
+| --- | --- | --- |
+| S01 | P1 | Agent, preview, and command supervisors considered execution finished while ordinary descendants in their owned process group could still change files. Completion now includes group cleanup, including children holding inherited output pipes. |
+| S02 | P2 | A service published terminal status before its termination grace period ended, allowing overlapping restart/reconfiguration. It now retains nonterminal state until cleanup finishes. |
+| S03 | P1 | Trusted Node runners omitted directly named preload modules such as `--import=./loader.mjs`; replacing the file left trust current. Startup-file inputs now participate in the existing content identity checks, including supported attached/separate forms and legacy records. |
+| S04 | P2 | Runner configuration trimmed literal argument whitespace. Argument validation now preserves the exact argument values. |
+| S05 | P2 | Preview logging repeatedly redacted an already-redacted buffer, exposing credential suffixes split across chunks. It now retains bounded raw output internally and redacts persisted snapshots. |
+| S06 | P1 | Explicit adaptive lock recovery could remove a replacement live writer's lock. It now shares the acquisition/recovery gate and host/owner identity checks. |
+| S07 | P2 | Pruning deleted a task or session updated after its initial read. Deletion now holds the record lock and rechecks its revision and eligibility. |
+| S08 | P2 | Learning cleanup removed an approved but unfinished activation journal, permanently losing the recoverable preference. It now retains approval data until the lesson exists. |
+| S09 | P2 | Session import collapsed repeated user requests across distinct records or interrupted turns. It now pairs adjacent response/event mirrors once and preserves separate identities and turn boundaries. |
+| S10 | P2 | Implemented session windows, MCP health recovery, and dispatch retirement were missing from the public operation registry. The operations are now reachable with the existing access restrictions. |
+| S11 | P2 | Benchmark output corrupted UTF-8 characters split across process chunks. Each output stream now uses incremental decoding. |
+| S12 | P2 | Benchmark sensitivity rejected real implementation exceptions detected by regression tests. It now recognizes completed TAP behavior failures with test/source stack evidence while excluding setup, syntax, loader, filesystem, and unsupported failure evidence. |
+| S13 | P2 | Native pre-commit checks scanned the normal index instead of Git's temporary `--only`/`--all` index, allowing an actual commit containing conflict markers. The hook validates and explicitly passes the repository-owned index; standalone checks still discard foreign Git overrides. |
+| S14 | P2 | A failed hook ownership write left an executable hook installed but permanently classified as foreign. Installation/removal now serialize ownership and retain an exact recoverable pending record before changing the hook. Foreign or edited hooks remain protected. |
+| S15 | P2 | Native doctor reported healthy after a required runtime module was deleted. It now compares managed files against the recorded manifest without modifying them, and reports unknown integrity for legacy manifests. |
+| S16 | P2 | Inherited Git overrides redirected live-evaluation fixture initialization and configuration into a foreign repository. The evaluator now sanitizes Git and child environments and disables fixture hooks/signing. Offline tests invoke the actual helper; live models were not run. |
+| S17 | P1 | Inherited Git overrides made release preparation bind dirty source to another repository's clean HEAD. Preparation and publication now use sanitized repository-bound Git operations and child environments. |
+| S18 | P2 | A release archive replaced during smoke or dry-run validation could receive a trusted receipt for different bytes. Preparation now binds the initial archive digest and checks it after each verification phase. |
+
+## Coverage and scope
+
+The rotated review covered runtime storage and recovery, execution and cancellation, worker/service ownership, runner trust, CLI/MCP routing, native and editor installation, hooks, learning/session retention, evaluation harnesses, release preparation/publication, and their regression tests. Canonical catalog contracts and generated-artifact parity remain part of validation; prompt quality is not claimed to be objectively proven for every scenario.
+
+Website work in this round adds full-width lime header/footer surfaces, clearer current-section navigation, scroll-aware header visibility, consistent catalog card insets, and a transparent logo. Navigation keeps text at its final position, avoids full-page blank fades, and does not replay entrances on already-visible content. The motion regression samples heading position over 60 frames after each of three bottom-of-document navigations. One Voice's separate repository receives full-width charcoal chrome, stable header opacity, shared page introduction spacing, and aligned hero columns.
+
+## Verification
+
+- Complete suites on Node 22 and Node 24: **392 passed, zero failed, one Windows-only test skipped** on each version (393 total), using the available Python runtime for provider tests.
+- Node 24 release check: canonical/generated artifact validation, complete tests, MIT notices, metadata, internal links, credential-pattern checks, and **790 package files** passed.
+- A separate review archive passed npm, pnpm 10, pnpm 12, and Yarn execution, all 219 skills and 112 profiles, both host setup previews, and execution after deleting the temporary package cache. Current implementation integrity validation retains all 49 groups as acceptance-partial.
+- Website: **353-page production build**, all four static tests, formatting, header/footer/card checks, navigation/motion checks, and browser accessibility/control checks passed. Layout checks covered 15 template widths, all 347 detail pages at 320px and 768px, and expanded text spacing.
+- The original execution reproductions now report no post-completion side effects for command, agent, preview, and service execution; literal whitespace remains exact and split/whole preview output receives identical redaction. The new regressions also cover inherited pipes, cancellation, and service stop requests during cleanup.
+- Final review of preload handling caught a directory resolution exception to the explicit-file rule. The primary reviewer reproduced it with a symlinked `index.js`; directory preloads are now rejected while explicit files and supported extension resolution remain covered.
+
+Focused repair suites and reproduction logs are retained under `.tmp/second-review/` in the local checkout. The prior published 0.10.0 archive is preserved; website deployment does not publish a new npm version.
+
+## Limits
+
+These repairs address reproduced failures, not a claim of universal correctness or complete ECC parity. POSIX process ownership is not a hostile-process sandbox: deliberately detached/reparented processes remain outside that guarantee. Windows/Linux process behavior and real paid model sessions were not executed during this pass. Current implementation hashes are refreshed without changing the historical ECC snapshot or promoting partial acceptance to verified.

package/docs/technical-coverage.md

@@ -8,6 +8,7 @@ Generated from the canonical catalog. This is an inventory of authored guidance
 |---|---|---|
 | [orient](../plugins/just-vibe/skills/orient/SKILL.md) | A package script's name does not prove it works, and importing configuration can execute code during inspection. | Technical method and pack guide in entry point |
 | [explain](../plugins/just-vibe/skills/explain/SKILL.md) | Plausible business intent cannot be inferred solely from a function name; configuration-dependent behavior remains conditional. | Technical method and pack guide in entry point |
+| [reprompt](../plugins/just-vibe/skills/reprompt/SKILL.md) | More detail can change the task: skill names, assumed access, generic roles and automatic execution can turn a rewrite into an unauthorized implementation. | [Prompt rewriting examples](../plugins/just-vibe/references/reprompt.md) |
 | [teach](../plugins/just-vibe/skills/teach/SKILL.md) | Teaching a command does not authorize running it; overwhelming prerequisite lists can obscure the actual concept. | [Project exercises](../plugins/just-vibe/references/practice.md) |
 | [teach-test](../plugins/just-vibe/skills/teach-test/SKILL.md) | Inline questions or an early answer key defeat native assessment; if the host forbids quiz dialogs, explain the limit and stop the quiz without disguising it as clarification. | Technical method and pack guide in entry point |
 | [trace](../plugins/just-vibe/skills/trace/SKILL.md) | A static call graph does not prove which branch executed; queue handoffs can change identity and ordering. | Technical method and pack guide in entry point |