just-vibe 0.11.0 → 0.14.0

package/.claude-plugin/marketplace.json

@@ -1,12 +1,12 @@
 {
   "name": "just-vibe",
-  "metadata": { "description": "Tools, skills, and commands for coding agents." },
+  "metadata": { "description": "Engineering workflows and role profiles for coding agents." },
   "owner": { "name": "Zachary Martin" },
   "plugins": [
     {
       "name": "just-vibe",
       "source": "./plugins/just-vibe",
-      "description": "Tools, skills, and commands for coding agents."
+      "description": "Engineering workflows and role profiles for coding agents."
     }
   ]
 }

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## 0.14.0
+
+0.13.0 was prepared but not published to npm. This release also contains its changes, listed under 0.13.0.
+
+- Send the automatic-assistance protocol once per session (first routed prompt, resume and compaction) instead of with every prompt. A routed prompt now adds about 600 characters of context instead of about 3,000.
+- Treat background-task notifications, messages from other agent sessions, desktop CI monitor events and local-command echoes delivered through the prompt hook as part of the current task: they no longer create a task, suggest workflows or make Stop ask for a selection. A prompt that adds the user's own words to them is still routed.
+- Cut hook cost per tool call: the project root is found without a Git subprocess, the catalog loads only for prompts and Stop, feature modules load per event and tool observations skip the router. On the macOS development machine, the time above node startup fell from about 28 to 14 ms for PreToolUse and from about 62 to 16 ms for PostToolUse (medians of 57 to 42-48 ms and 91 to 44-50 ms across three runs, with node startup alone at 29-34 ms); `scripts/hook-latency.mjs` reports the numbers on any machine.
+- List 17 entry workflows on a first installation (`--profile entry`, 3,991 description characters instead of 40,826), so hosts keep their descriptions within the shared skill-listing budget. Existing installations keep their selection. Every other workflow stays installed as a reference reached by routing, `workflows_search` and `workflow_load`, and Claude `/jv` shortcuts load those references. `doctor` reports the listing size.
+- Route questions about misbehaving code ("why does this function return null?", "why is this endpoint 500ing") to `debug`, and stop the word "function" alone from suggesting `vercel-runtime`. Routing weights stay hand-set: `scripts/tune-routing.mjs` searches them with five-fold cross-validation and adopts a change only when held-out first choice and absence both improve, and neither of two runs did.
+- Navigate and check code with the project's own language servers: `atlas definition`, `references` and `diagnostics` start a trusted TypeScript, Pyright, gopls or rust-analyzer server for one bounded session (pull diagnostics when offered, otherwise the published set). A server runs only after it is configured and trusted as the runner `lsp-<id>`; `atlas servers` reports what is detected and trusted.
+- Report type errors in files edited during a turn: the automation setting `diagnostics: true` runs one language-server session per language at Stop, and `structural: [packs]` scans the same files with ast-grep rules. Findings come back in the Stop message and `.just-vibe/automation/review.json`.
+- Ship seven ast-grep rules for the checkable parts of the TypeScript, Python, Go, Kotlin and C# rule packs (`structural rules|status|scan`). Each names the prose rule it checks; a finding is a review prompt, not proof of a defect.
+- Add mutation testing as proof: `mutation start` runs a trusted Stryker, cargo-mutants or mutmut runner as a detached job (15-minute default, 60-minute limit, cancellable), and `mutation report` or the `mutation` proof collector narrows its report to the lines this change touched. Surviving or unreached mutants on changed lines fail the criterion.
+- Claude Code: `setup --target claude --code-intelligence on` registers language servers found on PATH through the plugin's `.lsp.json`, so Claude starts them itself and receives diagnostics after edits. Updates keep the setting, and doctor reports a changed server binary.
+- Add worker sandbox levels. `host` passes each CLI's own sandbox and network settings; `os` also confines the worker with bubblewrap (Linux) or `sandbox-exec` (macOS, where it replaces the CLI's own sandbox because macOS cannot nest them) to its worktree, temp and CLI state, and hides credential files. `env: minimal` passes only runtime variables and the CLI's own auth. Status and results record the sandbox applied.
+- Add a ready queue of tracked work items with priorities, labels, blocks/parent links, cycle checks, token-based claims with leases, and `ready` ordering. Project queues stay local; team queues are one sorted JSON file per item for Git review. `queue dispatch` claims ready items into an orchestration run with dependencies from their links, and `queue sync` closes accepted items and releases failed ones.
+- Let the MCP server handle requests concurrently and ask the client questions. With form elicitation, `canvas_manage ask` and `learning_review approve` take the user's answer from a host dialog. With MCP Apps, plan review and preferences open as in-host views.
+- Stop failing with ENOENT when another process removes a lock or state file while its managed path is being checked. A service stop could fail this way on Windows.
+- Share one cycle check across orchestration, GitHub epics and the queue, and create the personal state directory before the first orchestration lock.
+
+## 0.13.0
+
+- Route ordinary requests to the right workflow. On 1,183 realistic requests from the September 2026 review, the right workflow now ranks first for 63% (was 35%) and in the top three for 82% (was 53%); a ratchet on that corpus guards the rates.
+- Engage automatic assistance on everyday engineering requests, answer "which workflow should I use" questions without starting the task, and keep a chosen role across prompts, compaction and resume.
+- Classify quick versus tracked work from each request's verbs and objects, so external, destructive and consequential effects are tracked and local edits stay quick.
+- Make every workflow's mode policy, write scope, examples and defaults agree, and validate that agreement, including examples that ask for a change.
+- State each workflow's procedure once and in order, with one output, and name neighboring workflows where their scopes meet. Generated skills punctuate descriptions, label pack prerequisites and keep headings separate.
+- Link profiles to the workflows and specialist methods their work needs, differentiate overlapping roles, move domain architects into their domains and add an open-source maintainer profile. Profile search finds roles by name and by task.
+- Correct technical guidance, including React 19 APIs, WCAG 2.2 thresholds, RFC 9457 errors, webhook signature rotation, provider-neutral token accounting and unreachable Git objects.
+- Make tracked runs safe to retry and add a validated continuation link. CLI operations name missing fields, missing records point to the command that lists them, and doctor reports every failing layer at once.
+- Evaluate large tool events in hooks instead of letting them through, and show the last hook failure in diagnose status.
+- Stop shipping development and audit records in the npm archive, and use one product description across the package, marketplaces and plugin manifests.
+- Remove the default sixty-minute limit from tracked `auto` and workflow runs. `budget.maxMinutes` is `null` (no wall-clock limit) unless the user sets 1–1440 minutes; stage and attempt budgets are unchanged, and capped runs still expire and cannot be reset by resume.
+
+## 0.12.0
+
+- Fix QA redirect enforcement, clipped-ancestor detection, human-only checks and assertion failure classification; isolate task-specific diagnosis and surface host startup errors.
+- Add the local `dashboard` launcher with isolated demo mode, durable preference creation, draft preservation, scoped setting conflicts, task exclusions and actual delivery history.
+- Add reviewed request coverage, explicit test-session/additional-origin authorization, screenshot masking and standalone QA regression export.
+- Add previewed project-context backup/import with stale-preview protection. Keep all publishing manual.
+- Fix dashboard loading races, duplicate preference submission, delivery ordering, import-state changes and forgotten exclusions. Preserve structured values when evolving preferences, QA timeouts in exported tests, nonzero acceptance-failure exits and network restriction reporting after log truncation.
+- Keep backup downloads consistent with their current preview, refresh learned completion checks after preference changes, and select recent tasks by time. Reject unsupported QA actions, defer custom clipping/rotation to human review, and close truncated proxy responses promptly.
+- Preserve task-exclusion drafts through view changes and concurrent saves, avoid replaying completed preference activations during recovery, and close both sides of idle QA proxy tunnels.
+- Reject mixed-case private-directory paths, detect clipping through shadow hosts and slots, and wait for fully transparent QA targets to become visible. Goal constraint changes now reset completion evidence while preserving the previous scope in history.
+- Close local dashboard and review servers even with unfinished uploads, keep downloaded backups within the import byte limit, and preserve new canvas feedback entered while an earlier submission is pending.
+- Preserve coding-task context for repeat requests, detach skipped prompts from earlier task evidence, and retain interrupted approval journals until recovery finishes. Enforce lesson capacity across concurrent creation, feedback and approval processes.
+- Keep preference mutations exclusive across dashboard refreshes, ignore obsolete canvas polls, and reject QA text matches supplied only by invisible or zero-size descendants, including slotted text.
+
+- Add request-derived Agent QA with bounded browser assertions, screenshots, stale-evidence checks and retained failure/retest history.
+- Add local preference editing, preview, disable and restoration controls with provenance and revision checks.
+- Add observed-delivery diagnosis and opt-in live journeys through correction and a fresh host session.
+- Generate release metadata from the canonical catalog for website and portfolio consumers.
+- Repair Windows path/shim handling and cross-platform test fixtures. CI and manual publication evidence are recorded separately; GitHub Actions does not publish releases.
+
 ## 0.11.0
 
 - Add owned Claude command shortcuts for every selected workflow: `/jv <command>`, `/just-vibe <command>` and `/jv:<command>`. Preserve the canonical `/just-vibe:<command>` form, appended context and workflow authority; validate conflicts before install and preserve user-edited files on uninstall.
@@ -11,10 +65,10 @@
 - Correct strict file-read tracking, Cursor/Kiro event handling, quiz answer identity, session alias collisions, and supported configuration discovery/auditing.
 - Preserve installed Git hooks across package-cache cleanup and make installed hook identity usable for removal after upgrades.
 - Preserve Unicode across HTTP, native-hook, and subprocess boundaries; reject stale browser installation previews and support operator-page reloads.
-- Bind release preparation to unchanged checked source and verify published execution outside the checkout. See the [full review and verification record](docs/full-code-review-2026-09-21.md).
+- Bind release preparation to unchanged checked source and verify published execution outside the checkout. See the [full review and verification record](https://github.com/Zachshotamartin/just-vibe/blob/main/docs/full-code-review-2026-09-21.md).
 - Complete owned-process cleanup before terminal results, preserve literal runner arguments, bind Node preload files to trust, and redact preview output independently of chunk boundaries.
 - Protect adaptive cleanup/recovery and unfinished learning activations; preserve repeated session messages; expose implemented recovery/window operations; correct benchmark Unicode and exception evidence.
-- Inspect Git's actual commit index, recover interrupted hook ownership updates, detect managed installation drift, isolate evaluation Git operations, and bind release verification to unchanged archive bytes. See the [second review](docs/second-code-review-2026-09-21.md).
+- Inspect Git's actual commit index, recover interrupted hook ownership updates, detect managed installation drift, isolate evaluation Git operations, and bind release verification to unchanged archive bytes. See the [second review](https://github.com/Zachshotamartin/just-vibe/blob/main/docs/second-code-review-2026-09-21.md).
 - Refine website navigation, full-width header/footer surfaces, selected sections, catalog padding, transparent branding, and page transitions without vertical text movement.
 
 ## 0.10.0

package/README.md

@@ -1,341 +1,105 @@
 # just-vibe
 
-**Command shortcuts (v0.11.0):** Claude setup adds `/jv <command>`, `/just-vibe <command>` and `/jv:<command>` alongside `/just-vibe:<command>`. Append the same request after any form. For example, `/jv reprompt Make this prompt clearer: Fix stale search results.` See the [shortcut guide](https://just-vibe-tools.vercel.app/docs/command-shortcuts/) for setup, context examples and Codex's skill-picker equivalent.
+Engineering workflows and role profiles for coding agents, with remembered preferences and verifiable outcomes.
 
-Tools, skills, and commands for coding agents.
+[Website](https://just-vibe-tools.vercel.app/) · [Docs](https://just-vibe-tools.vercel.app/docs/) · [Commands](https://just-vibe-tools.vercel.app/commands/) · [Profiles](https://just-vibe-tools.vercel.app/profiles/)
 
-[Website](https://just-vibe-tools.vercel.app/) · [Documentation](https://just-vibe-tools.vercel.app/docs/) · [Command library](https://just-vibe-tools.vercel.app/commands/) · [Engineering profiles](https://just-vibe-tools.vercel.app/profiles/)
+Describe what you want normally. With supported, trusted host hooks, just-vibe suggests relevant workflows and directs the agent to load their methods and discover the tools it needs. Explicit corrections can refine later instructions. Current requests always take precedence, and saved preferences grant no permissions.
 
-**v0.11.0 contains 112 engineering profiles and 220 skill names backed by 217 canonical workflows** for Codex and Claude Code: focused skills for development, architecture, decisions, Git/GitHub, Vercel, Vite, React, UI, backend, APIs, databases, data, ML, LLMs, testing, security, and operations. Each canonical workflow has selection guidance, scope, concrete decision branches, evidence requirements, outputs, verification, recovery conditions and at least three example requests. Each entry point also contains an authored technical method: evidence to inspect, a procedure, a likely misdiagnosis and a discriminating check. Applied methods live in 22 pack guides. The v0.8.1 prompt update adds explicit infer/default/ask policies, a conditional worked example for each pack, and guidance for preserving corrections across turns; see [prompt improvements](docs/prompt-improvements.md).
+**Source version: 0.14.0**, with language-server checks, structural rules, mutation evidence, sandboxed workers, a ready queue and in-host MCP review, and lower per-prompt and per-tool-call hook cost. It also contains the routing, workflow contract and profile revisions prepared for 0.13.0, which was not published separately. The catalog has 221 skill names, 218 canonical workflows, 113 engineering profiles and 22 packs. Check [npm](https://www.npmjs.com/package/just-vibe) for published versions and the [implementation and verification plan](https://github.com/Zachshotamartin/just-vibe/blob/main/docs/agent-qa-and-learning-plan.md) for acceptance evidence. A source build is not evidence of publication.
 
-The [technical audit](docs/technical-audit.md) and [complete coverage inventory](docs/technical-coverage.md) document the latest expansion across every canonical workflow. Review/security commands now route to concrete vulnerability, framework, language and scanner guides. [Security fixture controls](evals/security/README.md) distinguish seeded defects from legitimate behavior; they do not claim model-review accuracy.
+## Install
 
-The active coding agent executes the workflows with its available tools. The dependency-free Node.js utilities provide catalog search, project inspection, capability discovery, and bounded run-state validation. Installing just-vibe does not connect services, grant permissions, provision compute, or make every workflow's prerequisites available.
-
-v0.7 adds a quick path for simple work, a small starter catalog, contextual routing with reasons, project preferences and checkpoints, explicit evidence collectors, and optional project hooks. Detailed auth, component, training and delivery scenarios load only when relevant. See [daily workflows](plugins/just-vibe/references/daily-workflows.md) for configuration and examples, and the [v0.7 validation record](evals/releases/0.7.0.md) for tested scope and limits.
-
-
-## Runtime tools and goals
-
-The frozen ECC backlog now has a separate [implementation and evidence ledger](docs/ecc-implementation-plan.md). This expansion adds 43 focused methods, 22 connector recipes, native session imports, configuration cleanup, behavior rules, MCP health, bounded jobs and services, independent councils, evaluation receipts, CodeTour exports, a context graph, usage accounting and an offline operator/catalog interface. [Use these features](plugins/just-vibe/references/runtime-expansion.md). These capabilities are included starting in **v0.10.0**. Acceptance is tracked separately: local regression and installation checks do not establish every framework, live-provider or operating-system requirement. See the [release fixes and remaining validation](docs/release-fixes-2026-09-20.md).
-
-The toolkit includes **/goal**, scoped searchable memory, 48 native MCP tools, 24 independent specialists, optional worktree workers, before-action policy, a configuration scanner, reviewed pattern learning, preference sharing/evolution, an activity report, selective installations and 16 language/framework rule packs. Cursor, OpenCode, Copilot, Gemini, Kimi, Qwen, Windsurf and Antigravity IDE have project file adapters. The source catalog now contains **220 skill names and 217 canonical workflows**, including the `reprompt` workflow added in v0.11.0. Guided setup, portable context, reviewed dependent workers and a browser plan canvas are included.
-
-Read [the feature guide](docs/runtime-tools.md), [operation schemas and examples](plugins/just-vibe/references/runtime-platform.md), and [the implementation/validation plan](docs/runtime-expansion-plan.md). Existing installs retain their defaults; observation, blocking policy and worker launching are opt-in.
-
-The toolkit also includes context and repeated-call warnings, detected check presets, batched formatting, staged commit checks, Cursor/OpenCode event adapters, Zed/Hermes skill installation, GitHub epic coordination, and JSON/Markdown/SARIF security reports with an optional reviewed AgentShield runner. Focused Django, FastAPI, Spring Boot, Flutter and React Native guides extend existing workflows. See [configuration, examples and limits](plugins/just-vibe/references/runtime-depth.md) and [verification](docs/remaining-ecc-gaps-plan.md).
-
-The [complete ECC comparison](docs/ecc-complete-audit.md) inventories a pinned upstream snapshot and records remaining functionality, technical-depth gaps, optional products and implementation requirements. Earlier completed rounds covered their selected findings; they did not establish full ECC parity. The ledger distinguishes source presence from live verification and includes a maintainer check for upstream drift.
-
-## Improve a prompt
-
-Starting in v0.11.0, select **just-vibe → reprompt** in Codex, or use `/just-vibe:reprompt` in Claude Code, and append the prompt:
-
-```text
-/just-vibe:reprompt Fix our React search page when older requests finish last.
-Keep the current API and dependencies. Do not deploy.
-Use relevant installed skills in the rewritten prompt.
-```
-
-It returns a paste-ready prompt, preserves your constraints, and names only skills it can verify (with availability checks for another host). It does not execute the embedded task. Add “output only,” “no skills,” or identify an earlier prompt or file to refine. See [examples and boundaries](plugins/just-vibe/references/reprompt.md).
-
-## Automatic assistance
-
-Describe the outcome normally: “Fix the mobile menu,” “Why is training unstable?” or “Address this PR’s feedback.” Trusted native hooks now route each request to a focused shortlist, restore selected work after compaction, and direct the agent to discover and use its actual tools. Command names remain optional.
-
-The agent loads the relevant full workflow with versioned personal/project feedback. Explicit corrections and endorsements can change instructions, routing triggers, preferred tools and required checks. History, rollback, retirement and forgetting are supported. Silence and passing tests do not create preferences. Source and artifact changes invalidate old evidence; completion can request one bounded follow-up for missing evidence, then reports unresolved work honestly.
-
-Automatic assistance is included starting in **v0.9.0**. Native hook support and host trust are required; setup does not grant that trust. Personal state lives under `~/.just-vibe/adaptive`, outside repositories, with bounded task retention. No additional model service or runtime dependency is used. See [automatic assistance, schemas and limits](plugins/just-vibe/references/adaptive.md) and [validation](docs/adaptive-assistance.md).
-
-## Intent, evidence and reversible work
-
-v0.8.0 adds working runtime helpers behind natural-language skill requests:
-
-- Remember an explicit correction, inspect instruction provenance/loading, and test a rule with compliant/violating controls.
-- Build two or three alternatives in owned worktrees, run equal checks, preview them, and apply the selected result with an undo record.
-- Tie requirements to actual checks, screenshots and attributed human review in a local HTML report with freshness checks.
-- Learn from isolated exercises in the actual project, with validated controls, progressive hints and real submissions.
-- Import MLflow, W&B or JSON exports; compare binary/regression metrics, slices, identity, feature parity and temporal coverage.
-- Reverse a recorded local task while preserving nonoverlapping later edits; retain decision history with observable reconsideration triggers.
-
-See the [workflow guide](plugins/just-vibe/references/intent-workflows.md) for examples, boundaries and recovery. Users provide ordinary briefs; the agent prepares the helper inputs. These features support judgment rather than claiming an objective quality score.
-
-**Release:** v0.11.0 adds prompt rewriting and short command invocations, together with the runtime fixes from both recent code reviews. Check [npm](https://www.npmjs.com/package/just-vibe) for registry availability. Native syntax, installation checks and evaluation limits are documented in the [shortcut verification record](docs/audits/command-shortcuts-2026-09-21.md). GitHub Actions is unavailable because account billing prevents jobs from starting; local checks are recorded separately and no CI pass is claimed.
-
-
-## Use the workflows
-
-With trusted hooks, use an ordinary request. For explicit shortcuts, Claude Code supports a command followed by as much context as needed:
-
-```text
-/just-vibe:auto fix checkout, add regression coverage, and verify.
-Keep the existing API. No new dependencies. Do not push.
-
-/just-vibe:tools react
-/just-vibe:tools --available
-/just-vibe:help my model works offline but fails in production
-/just-vibe:teach linked lists, with a worked insertion example
-/just-vibe:teach the concepts I need to implement ml-split
-/just-vibe:teach-test linked lists; five questions, one at a time
-/just-vibe:git-split separate formatting from the checkout fix; show the grouping first
-/just-vibe:vercel-build-fix compare this preview's logs with the local build
-/just-vibe:ml-leakage prediction happens 30 days before cancellation; inspect only
-```
-
-In Codex, select the corresponding skill from the **just-vibe** plugin in the skill picker and append the same brief. `do` aliases `auto`, `responsive` aliases `ui-responsive`, and `a11y` aliases `ui-accessibility`; each inherits one canonical implementation. `tools` browses availability; `help` explains which workflow fits a scenario. Inspect, plan, and apply modes preserve the user's constraints and existing authorization. Read the [full command reference](plugins/just-vibe/references/command-reference.md).
-
-`teach` explains a standalone topic or the prerequisites behind a particular workflow. It adapts to your experience, uses worked examples, connects concepts to actual implementation where available, and offers optional practice. Teaching a tool does not execute it.
-
-`teach-test` uses the host's **native multiple-choice question dialog**, waits for your answer, explains mistakes, and adapts the next question. Request test mode to defer feedback until the end. It requires a question tool available and permitted in the current host/mode; when unavailable, it reports that limitation instead of printing inline quiz questions. [Interactive teaching behavior](plugins/just-vibe/references/teach-test.md) documents the adapters and quiz state.
-
-Release testing verified a real native quiz in Claude Code. The tested Codex CLI session restricted question tools to clarification/planning uses, so it correctly stopped without a quiz. Codex quiz adapters are included, but interactive assessment is not available in that tested mode. See the [v0.2 validation record](evals/releases/0.2.0.md) for the tested workflows and remaining environment limitations.
-
-Shared host packaging and context behavior follow the [OpenAI skill format](https://developers.openai.com/plugins/build/skills) and [Claude Code skill argument handling](https://code.claude.com/docs/en/skills#pass-arguments-to-skills). No dynamic shell interpolation is used in skill files.
-
-## Remember project instructions
-
-Save decisions and corrections from the current conversation in one invocation:
-
-```text
-/just-vibe:remember context
-/just-vibe:remember context both
-/just-vibe:remember context both, including a checkpoint named checkout for unfinished work
-```
-
-In Codex, select **remember** from just-vibe and append the same brief. The skill updates the established `CLAUDE.md` or `AGENTS.md`, merges existing guidance and saves only explicit instructions and accepted decisions. `both` keeps common rules in `AGENTS.md` with a relative import in `CLAUDE.md`. A checkpoint keeps temporary progress separate. You can also append one specific rule or ask for a preview without writing.
-
-The host interprets the conversation; the `memory` helper can persist individual rules with provenance and file-hash checks, while the agent merges established context sections and shared imports. Terminal `project remember` only stores JSON notes. See [rule checks and memory inspection](plugins/just-vibe/references/memory-checks.md) for the new helper. Saved instructions improve continuity but do not guarantee adherence or recover unavailable chat history. See [merging, host loading and examples](plugins/just-vibe/references/instruction-memory.md). Update older installations to receive this extension.
-
-## Engineering profiles
-
-Profiles shape the agent's priorities and verification throughout a task. They are separate from commands: a machine learning engineer emphasizes prediction-time data, evaluation and serving parity; a frontend engineer emphasizes state, interactions and rendered behavior. Each of the **112 profiles** has concrete priorities, a decision rule, checks, a scope boundary, a concrete task contribution and candidate workflows.
-
-```text
-/just-vibe:profiles architecture
-/just-vibe:profile machine-learning-engineer with mlops-engineer as secondary
-/just-vibe:profile frontend-engineer for this task
-/just-vibe:profile principal-engineer; review the design without expanding the project
-/just-vibe:profile auto — choose an appropriate role for this task
-/just-vibe:profile status
-/just-vibe:profile clear
-```
-
-In Codex, select the **profile** or **profiles** skill in the plugin picker and append the same request. Explicit choices are pinned for the current task. The agent may choose an unpinned role from task evidence, but cannot replace a user pin. Choose one primary role and up to two complementary roles. Profiles preserve the original brief, scope, mode, permissions and budgets; they do not create additional agents or persist global preferences.
-
-The catalog covers application engineering, interface and experience, platform/infrastructure, data/databases, ML/AI, security/privacy, quality/technical leadership, and systems/specialized computing. Examples include firmware, robotics, compilers, graphics, game networking, geospatial computing, scientific software, privacy, identity, AI evaluation, agent systems, inference, and data governance.
-
-Architecture and seniority profiles have different emphasis:
-
-| Profile | Focus |
-|---|---|
-| Senior software engineer | Complete a bounded implementation with maintainable choices |
-| Staff engineer | Cross-team interfaces, migration and adoption |
-| Principal engineer | Systemic constraints, technical direction and reversible strategy |
-| Software architect | System responsibilities, boundaries and contracts |
-| Solutions architect | Fit a specific use case to a workable system |
-| Enterprise architect | Shared capabilities and transitions across systems |
-| Domain architects | Frontend, data, cloud, security, ML, platform and integration architecture |
-
-Titles vary across companies; these are working approaches, not credentials or grants of authority. Browse the [complete profile catalog](plugins/just-vibe/references/profile-reference.md) and [selection/runtime guide](plugins/just-vibe/references/profiles.md).
-
-The [v0.5 profile validation record](evals/releases/0.5.0.md) distinguishes tested profile selection and packaging from profession-specific model judgment.
-
-All changes are owned by the user. Commit messages, PRs, comments and other messages must contain **no agent self-attribution**, agent co-author trailers, generated-by signatures or AI badges. Existing human attribution and required third-party notices are preserved. See the [ownership rule](plugins/just-vibe/references/execution.md#ownership-and-attribution).
-
-## Terminal utilities
-
-From this checkout:
-
-```sh
-node bin/just-vibe.mjs tools
-node bin/just-vibe.mjs tools --pack ml-evaluation --json
-node bin/just-vibe.mjs tools --available --root /path/to/project
-node bin/just-vibe.mjs show auto
-node bin/just-vibe.mjs profiles architecture
-node bin/just-vibe.mjs profile principal-engineer
-node bin/just-vibe.mjs inspect --root /path/to/project
-node bin/just-vibe.mjs discover --root /path/to/project
-node bin/just-vibe.mjs route --root /path/to/project -- "Investigate failing GitHub checks"
-node bin/just-vibe.mjs project show --root /path/to/project
-node bin/just-vibe.mjs project resume checkout --root /path/to/project
-node bin/just-vibe.mjs evidence github --repo owner/repo --pr 42
-node bin/just-vibe.mjs hooks status --root /path/to/project
-node bin/just-vibe.mjs workflow fix --root /path/to/project --mode plan -- "Fix checkout; preserve the API"
-node bin/just-vibe.mjs workflow auto --profile machine-learning-engineer --stdin
-```
-
-`route` suggests candidates for the host agent; it does not execute them or call a model. `workflow` creates a JSON context record on stdout. Use `--stdin` or `--brief-file` to preserve multiline context verbatim. The CLI inventories the shipped payload; native host enablement still applies. It never treats a CLI on PATH as proof of authenticated access.
-
-External capabilities stay unknown until the host observes relevant access or supplied evidence. Explicit capability reports expire after 15 minutes and are bound to a project. The [runtime interface](plugins/just-vibe/references/runtime.md) documents their format and `session create/start/amend/supersede/profile/record/finish/resume`. These utilities validate bookkeeping; they do not sandbox host tools or independently prove the agent's evidence.
-
-Plain `tools` shows a starter selection; `tools --all` lists everything. `route` explains a few candidates; use `--json` for structured context. Project writes require explicit operations and revision-aware JSON input. Evidence collectors have their own prerequisites and do not automatically grant capability status. See [examples and schemas](plugins/just-vibe/references/daily-workflows.md).
-
-## Quick install
-
-You need **Node.js 22+** and **Codex CLI** or **Claude Code** with native plugin support on your `PATH`. See [compatibility and known limits](docs/compatibility.md).
-
-Install the public `just-vibe` package from npm with your preferred package manager:
+Requires Node.js 22+ and Codex CLI or Claude Code with native plugin support on your PATH. All package managers use the same npm registry package:
 
 ```sh
-# Choose your package manager; all use the same npm package.
-pnpm dlx just-vibe@latest setup
 npx just-vibe@latest setup
-yarn dlx just-vibe@latest setup
+# Or: pnpm dlx just-vibe@latest setup
+# Or: yarn dlx just-vibe@latest setup
 
 # Claude Code
-pnpm dlx just-vibe@latest setup --target claude
+npx just-vibe@latest setup --target claude
 ```
 
-The installer copies the included plugin into a persistent directory under `~/.just-vibe`, then registers it through the host's native plugin manager. The installed files survive npm/pnpm/Yarn cache cleanup. No private GitHub access is required for the default bundled source. `JUST_VIBE_HOME` can select another persistent directory.
-
-**Start a new conversation after installation.** In Claude Code, run `/just-vibe:help what is available?`. In Codex, select the `help` skill from the just-vibe plugin and add your request.
-
-For development builds, users with repository access can fetch the package from GitHub and still use the bundled installer:
-
-```sh
-pnpm --package=git+https://github.com/Zachshotamartin/just-vibe.git dlx just-vibe setup
-```
-
-GitHub access is needed to download that package, but the installed marketplace is a persistent local copy.
-
-## Preview, diagnose, update, remove
-
-```sh
-pnpm dlx just-vibe@latest setup --dry-run
-pnpm dlx just-vibe@latest doctor
-pnpm dlx just-vibe@latest update
-pnpm dlx just-vibe@latest uninstall
-```
-
-Append `--target claude` for Claude Code. `--dry-run` performs no host commands or payload copying and does not inspect installed state; the package manager may still fetch/cache the CLI before it starts.
-
-Repeated `setup` preserves the existing managed version and registration. `update` replaces the managed source with the version in the package you execute and updates the host plugin. Use `@latest` to fetch new releases. `doctor` checks prerequisites, source identity, managed files and enabled installation without changing configuration.
+The installer keeps the bundled plugin under `~/.just-vibe`, then registers it through the host's plugin manager. A first installation lists 17 entry workflows as native skills so hosts keep their descriptions; every other workflow stays installed and reachable through ordinary requests, `/jv <name>` and `workflow_load`. Add `--profile full` to list all of them; updates keep the existing selection. It survives package-manager cache cleanup. Start a new conversation afterward; host hook trust remains a separate host choice. Installation does not connect services or grant tool access.
 
-Uninstall removes only this plugin and retains its marketplace, managed source and persistent plugin data. To remove registration too, use the host's native marketplace-removal command after uninstalling. A failed native operation reports partial completion; fix its cause and rerun. Unmanaged destinations, different marketplace sources, and conflicting Claude scopes are never silently overwritten.
+Prefer an installed CLI? Use `npm install -g just-vibe`, `pnpm add -g just-vibe`, or `yarn global add just-vibe` with Yarn Classic, then run `just-vibe setup`. A project dependency also works with your package manager's executable runner. [Installation and compatibility](https://just-vibe-tools.vercel.app/docs/installation/).
 
-## Claude scope
+## Use it
 
-Claude defaults to `user`. From a project's directory, use `--scope project` for shared plugin enablement or `--scope local` for unshared project enablement:
+With automatic assistance enabled, ask “Fix the mobile menu,” “Investigate unstable training,” or “Address this PR's feedback.” To choose a workflow explicitly, Claude setup supports all four forms with the same trailing context:
 
-```sh
-pnpm dlx just-vibe@latest setup --target claude --scope project
+```text
+/jv reprompt Make this React bug report actionable. Keep the existing API.
+/just-vibe reprompt Make this React bug report actionable. Keep the existing API.
+/jv:reprompt Make this React bug report actionable. Keep the existing API.
+/just-vibe:reprompt Make this React bug report actionable. Keep the existing API.
 ```
 
-Pass the same scope to subsequent commands. Each teammate installs their own local marketplace. Codex does not take Claude's `--scope` option.
+In Codex, choose the matching skill from the just-vibe plugin and append your request. Native invocation formats differ by host; [the shortcut guide](https://just-vibe-tools.vercel.app/docs/command-shortcuts/) explains the supported mappings.
 
-## Existing GitHub installs and source migration
+| Need | Workflow or capability |
+| --- | --- |
+| Find the right method | `auto`, `tools`, `help`, ordinary-request routing |
+| Improve a prompt without executing it | `reprompt` |
+| Keep corrections and decisions | `remember`, scoped memory, versioned learned preferences |
+| Check the requested visitor journey | `agent-qa`: assertions, screenshots, failures and bounded retests |
+| Inspect and undo learned instructions | Local operator **Preferences** view; `preferences` CLI |
+| Check whether integration actually ran | `diagnose status`; opt-in `diagnose trial` |
+| Learn a concept or practice | `teach`, `teach-test`, isolated exercises |
+| Guide a longer task | `goal`, engineering profiles, plans and checkpoints |
 
-v0.2 registered GitHub as the marketplace source. Manage that source explicitly with `--github`:
+The command catalog covers frontend, backend, databases, architecture, decisions, Git/GitHub, Vercel, Vite, React, data, ML, LLMs, testing, security and operations. Workflows define scope, technical methods, decision branches, evidence and recovery. They execute through the active host's available tools; missing capabilities remain missing.
 
-```sh
-node bin/just-vibe.mjs doctor --github
-node bin/just-vibe.mjs update --github
-```
+## Evidence and personalization
 
-To switch to bundled installation, uninstall using the old source flag, remove only the just-vibe marketplace through the host CLI, then run setup without a source flag:
-
-```sh
-# Codex; use the selected package runner instead of node when outside this checkout.
-node bin/just-vibe.mjs uninstall --github
-codex plugin marketplace remove just-vibe
-node bin/just-vibe.mjs setup
-
-# Claude (preserve any --scope option used for the old installation).
-node bin/just-vibe.mjs uninstall --github --target claude
-claude plugin marketplace remove just-vibe
-node bin/just-vibe.mjs setup --target claude
-```
+Agent QA translates the original request into observable acceptance criteria. Its optional Playwright runner checks uploads, completion text, advancing media playback, invalid input and selected mobile geometry. It preserves failed attempts after repairs and invalidates stale evidence. Without the runner, the workflow can use host-browser observations with their provenance clearly labeled. Subjective design or audio quality still needs judgment. [Agent QA schema and limits](plugins/just-vibe/references/agent-qa.md).
 
-Use the equivalent `--local` flag when switching from a development checkout. GitHub sources still require Git access; authenticate using your normal Git credentials, never tokens embedded in commands.
+Learned preferences retain their explicit user source, scope and versions. The local dashboard supports editing, disabling, restoring and read-only routing previews. Neither silence nor passing tests creates a preference. [Automatic assistance](plugins/just-vibe/references/adaptive.md).
 
-## Native install without Node.js
+`diagnose status` distinguishes observed hook delivery, workflow selection/loading and observed tools. `diagnose trial` requires explicit `useAccount:true` and runs an isolated install → request → correction → fresh session → follow-up journey using the existing signed-in host. This consumes model usage; ordinary setup and status checks do not. [Diagnosis and preferences](https://just-vibe-tools.vercel.app/docs/preferences/).
 
-The included skills and plugin manifests can be installed directly. Node.js 22+ is still required for all bundled CLI helpers, including installation, discovery, sessions, quizzes and the intent workflows.
+## Maintain the installation
 
 ```sh
-# Codex
-codex plugin marketplace add Zachshotamartin/just-vibe
-codex plugin add just-vibe@just-vibe
-
-# Claude Code
-claude plugin marketplace add Zachshotamartin/just-vibe
-claude plugin install just-vibe@just-vibe --scope user
+npx just-vibe@latest setup --dry-run
+npx just-vibe@latest doctor
+npx just-vibe@latest update
+npx just-vibe@latest uninstall
 ```
 
-Use one installation channel per host. The wrapper and native commands above manage the same plugin; do not additionally copy skills or merge global rules by hand.
-
-## Local development
+Append `--target claude` for Claude, and your installation `--scope` when it was `project` or `local`; the same scope is needed for doctor, update and uninstall. Repeated setup preserves the managed version; update uses the package version you execute. Uninstall removes the plugin registration and retains its marketplace, managed source and personal data. Conflicting or unmanaged installations are not silently overwritten. `doctor` inspects installation state, while `diagnose status` inspects recorded delivery. For a previewed, integrity-checked update use `updater check`, `updater preview` and `updater apply`. To remove the marketplace, adapters, hooks and personal data as well, follow "Remove everything" in [Troubleshooting](https://just-vibe-tools.vercel.app/docs/updates/).
 
-```sh
-git clone https://github.com/Zachshotamartin/just-vibe.git
-cd just-vibe
-npm ci
-npm run check
-node bin/just-vibe.mjs setup --local --dry-run
-node bin/just-vibe.mjs setup --local
-```
+For a development checkout, use `setup --local` consistently and keep the checkout in place. Switching bundled, local or GitHub sources is deliberate: uninstall the old plugin and remove its marketplace through the host before registering the new source. [Troubleshooting](https://just-vibe-tools.vercel.app/docs/updates/).
 
-`--local` registers the persistent checkout directly. Keep the checkout in place. Use `--local` consistently for its `doctor`, `update`, and `uninstall` operations. For changes to the plugin payload, bump the version in both plugin manifests and `package.json`, then run `update --local` and start a fresh conversation.
-
-Switching between bundled, local and GitHub sources is deliberate: uninstall from the old source, remove its marketplace with the host CLI, then run setup for the new source. The installer will not silently replace one with the other.
-
-### Tests and generation
+## Development and verification
 
 ```sh
-npm run check
-npm run test:hosts
-npm run test:hosts -- --github
-npm run eval:runtime
+npm ci --ignore-scripts
 npm run build:skills
+npm run check
+npm run website:build
+npm run website:test
 ```
 
-The default checks validate catalogs, generated skills, references, manifests and packaging; test installer/discovery/run behavior; and exercise context preservation across all command names and both host mappings. They do not access your host configuration or make model calls. `test:hosts` is an opt-in native lifecycle test requiring both host CLIs. It runs install, repeat install, doctor, update, uninstall, and reinstall inside temporary `CODEX_HOME` and `CLAUDE_CONFIG_DIR` directories.
-
-The default host test copies and installs the bundled payload. `--local` tests direct checkout registration. `--github` installs the published private repository and requires Git access; use it after pushing a release. Both variants execute the cached plugin runtime and check every skill is present, independently of the source checkout.
-
-Edit `plugins/just-vibe/catalog/commands.json` for command contracts and the single canonical procedure, `catalog/packs.json` for pack requirements/input policies, and `references/packs/` plus `references/examples/` for operational guidance. Profile contributions live in `catalog/profiles.json`. Run `npm run build:skills` to regenerate skills, the command reference, technical coverage inventory, and evaluation scenarios. `npm run validate` rejects drift. Neither generation nor the installed runtime depends on the ignored local plan.
-
-Every workflow has normal, edge and missing-evidence cases in [evals/scenarios.json](evals/scenarios.json). The [independent behavioral harness](evals/README.md) additionally prepares and grades 21 raw-artifact tasks, including code repairs and report judgments. Catalog structure, runtime utility coverage and observed agent behavior have separate validation fields. These are not claims that all commands have been run against live services or evaluated across models. See the [v0.4 observed results](evals/releases/0.4.0.md) and [evaluation guidance](evals/README.md) for the tested scope.
-
-The [conversation harness](evals/conversation/README.md) records review, selected repairs and later corrections with separate scope and behavior checks. Its [development record](evals/releases/prompt-improvements.md) describes observed results and limitations.
-
-The [v0.6 results](evals/releases/0.6.0.md) record 32 controlled implementation trials and eight revised-command development trials. All passed their bounded checks; this does not rank overall output quality or convenience. The tasks supplied detailed contracts and did not measure user effort or preference. The [command-depth review](docs/command-quality.md#focused-depth-review) explains 27 focused revisions, and the [contextual review guide](docs/command-quality.md#output-quality-and-convenience) covers judgment, clarity, discovery and correction burden. [Benchmark protocol and supporting metrics](evals/benchmark/README.md) remain available for reproduction. External integration, browser and deployment checks require the relevant task environment.
-
-The [technical-guidance validation record](evals/releases/0.8.0-technical-guidance.md) covers the v0.8.0 command expansion and security controls. The earlier [v0.8 validation record](evals/releases/0.8.0.md) covers the new intent helpers, real browser reports, installation checks and the pending Windows confirmation. GitHub CI remains blocked by account billing. The [v0.10.0 release record](evals/releases/0.10.0.md) records the local checks and release-specific waiver; Windows validation remains pending.
-
-### Repository layout
-
-| Path | Purpose |
-|---|---|
-| `bin/just-vibe.mjs` | npm-executable entry point |
-| `plugins/just-vibe/scripts/installer.mjs` | Self-contained installer, also shipped inside the plugin |
-| `plugins/just-vibe/scripts/toolkit.mjs` | Discovery, routing, sessions, quizzes and persistent intent workflow CLI |
-| `plugins/just-vibe/scripts/lib/` | Catalog, capability, session, quiz, memory, guard, task, lab, proof, practice, experiment and decision modules |
-| `plugins/just-vibe/catalog/` | Canonical command contracts, 112 role profiles, examples, prerequisites and pack metadata |
-| `plugins/just-vibe/skills/` | 220 source skill names, including three aliases, goal, orchestration, plan review and setup |
-| `plugins/just-vibe/references/` | Shared execution rules, runtime interface, domain guidance and command index |
-| `.agents/plugins/marketplace.json` | Codex marketplace |
-| `.claude-plugin/marketplace.json` | Claude Code marketplace |
-| `scripts/` and `tests/` | Validation and lifecycle tests |
-| `evals/` | Behavior scenarios and isolated project/data fixtures |
+Edit command contracts in `plugins/just-vibe/catalog/commands.json`, pack policies in `catalog/packs.json`, profiles in `catalog/profiles.json`, and supporting methods in `references/`. Generation produces host skills, the command reference, coverage inventory and scenarios; validation rejects drift. Root `PLAN.md` and `NAMING.md` are ignored and excluded from the package.
 
-The installer has no runtime npm dependencies or lifecycle install scripts. Automatic routing hooks use native host trust and keep personal task records. Optional project check/formatter hooks still do no work until separately configured and trusted. The source plugin adds a local MCP server with scoped access controls. Language rule packs are optional; no host permissions are granted. Provider/check commands use argument arrays rather than interpolating user input into a shell. Host CLIs own installation state and caches. Local planning and naming documents are excluded from both Git and the npm archive.
+Optional checks: `test:hosts` tests isolated native install lifecycles; `test:qa-browser` exercises broken and repaired browser flows; `eval:hosts -- --run` uses real model accounts. The default suite does not call models or alter your normal host configuration.
 
-## Troubleshooting
+The website generates `/release.json` from the package and canonical catalogs. Its version, counts, catalog hash and pinned installation examples can be consumed with a validated fallback. Manifest metadata alone does not prove npm publication or host compatibility.
 
-- **Host executable not found:** install the selected CLI and reopen your terminal.
-- **Plugin subcommands unavailable:** update that host CLI; just-vibe checks command support before changing state.
-- **Repository not found / authentication failed:** verify `git ls-remote https://github.com/Zachshotamartin/just-vibe.git` succeeds with your account.
-- **Different marketplace source:** use the matching bundled, `--local`, or `--github` setting or explicitly switch sources as described above.
-- **Claude scope conflict:** inspect `claude plugin list --json`; manage the scope already in use rather than layering installations.
-- **Skills not visible:** verify with `doctor`, then start a new conversation.
+Runtime and catalog checks, real host observations, subjective review and publication evidence are separate. There is no claim that every command works with every live service, or that a fixture score measures overall quality or convenience.
 
-Host formats evolve. When a JSON inventory format is unrecognized, the installer stops rather than guessing how to change configuration.
+- [Runtime operations and schemas](plugins/just-vibe/references/runtime-platform.md), [expanded workbench](plugins/just-vibe/references/runtime-expansion.md).
+- [Command quality contract](https://github.com/Zachshotamartin/just-vibe/blob/main/docs/command-quality.md), [technical coverage](https://github.com/Zachshotamartin/just-vibe/blob/main/docs/technical-coverage.md), [compatibility](docs/compatibility.md).
+- [Behavioral evaluation](https://github.com/Zachshotamartin/just-vibe/blob/main/evals/README.md), [conversation evaluation](https://github.com/Zachshotamartin/just-vibe/blob/main/evals/conversation/README.md), [security controls](https://github.com/Zachshotamartin/just-vibe/blob/main/evals/security/README.md).
+- [Pinned ECC comparison](https://github.com/Zachshotamartin/just-vibe/blob/main/docs/ecc-complete-audit.md), [implementation versus acceptance ledger](https://github.com/Zachshotamartin/just-vibe/blob/main/docs/ecc-implementation-plan.md).
+- [0.11.0 publication evidence](https://github.com/Zachshotamartin/just-vibe/blob/main/evals/releases/0.11.0-publication.json), [changelog](CHANGELOG.md), [release procedure](docs/releases.md).
 
-## Release and license
+## License
 
-Licensed under [MIT](LICENSE), copyright 2026 Zachary Martin. Commercial use, modification and redistribution are allowed under the license terms. The license ships with the npm archive and installed plugin.
+[MIT](LICENSE), copyright 2026 Zachary Martin. Commercial use, modification and redistribution are permitted under its terms. The license ships with the npm archive and installed plugin.
 
-[Release instructions](docs/releases.md) describe validation, the first npm publication, trusted publishing, versioning and recovery. [Changelog](CHANGELOG.md) records user-visible changes.
+### Local preference dashboard
 
-Command authoring and alias maintenance follow the [command quality contract](docs/command-quality.md).
+Run `just-vibe dashboard --root .` to manage local preferences, inspect which versions reached tasks, set task-only exclusions, and review project-context backups. `--no-open` prints the private URL; `--demo` runs an isolated disposable example. There is no website login or cloud sync. See the [dashboard guide](https://just-vibe-tools.vercel.app/docs/preferences/) and [QA coverage, test sessions and regression export](plugins/just-vibe/references/agent-qa.md). Publication remains a reviewed manual CLI step.