just-vibe 0.7.0 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## Unreleased
+
+## 0.8.1
+
+- Clarify review/teaching variants and local implementation versus live execution; add effective infer/default/ask policies to every command.
+- Consolidate runtime-backed prompt procedures, make proof reports conditional, and preserve selected findings, exclusions and corrections across turns.
+- Add 22 conditional worked examples with misleading cases and concrete contributions for all 112 profiles, including a same-feature comparison.
+- Add a multi-turn review/repair harness with seven defect categories, working/disabled controls, immutable turn captures and independent scope checks; include linked guides in isolated evaluation payloads.
+
+- Bind lab/practice cleanup to complete reviewed snapshots, reject staged changes, and preflight every workspace before removing any.
+- Redact structured credentials and common sensitive command arguments before recording evidence; preserve output structure and command outcomes for key/value logs.
+- Preserve POSIX file permissions during memory edits, workspace selection, task undo and recovery, with conservative restoration for legacy records.
+- Treat symlink targets as incomplete snapshot coverage so old checks cannot certify changed linked inputs.
+- Retry browser text, URL, title and focus assertions within a bounded deadline for asynchronous UI changes.
+- Allow retired memory rules to move while retaining provenance, current revision checks and destination-file protection.
+- Add regression coverage and delayed-state Chromium smoke checks for the reviewed defects; document cleanup input migration and permission compatibility.
+
+## 0.8.0
+
+- Expand all 213 canonical workflows with authored technical evidence, methods, misdiagnosis controls and discriminating checks; aliases inherit them.
+- Route review/security into concrete vulnerability, framework, language and available-scanner guides, with primary references and scoped safe examples.
+- Add complete technical coverage documentation, transitive shipped-reference validation and five executable security fixture controls; preserve earlier model results as historical evidence.
+
+- Add explicit rule provenance, managed instruction edits, loading/conflict inspection, and control-validated text/import guards.
+- Add working-alternative labs with Git worktrees, shared checks, leased previews, comparison reports, journaled selection and reviewed cleanup.
+- Add requirement-linked verification records, freshness checks, browser screenshots and local HTML reports; human acceptance remains attributed.
+- Add repository exercises with solution/starter controls, protected test identities, hints, optional progress and real submissions.
+- Add bounded JSON/MLflow/W&B imports and binary/regression comparison with slice, parity, temporal and identity diagnostics.
+- Add selective local task undo and journal recovery, plus the new undo skill.
+- Add decision histories with watched assumptions, numeric reconsideration triggers and timestamped reviews.
+- Expand relevant command contracts and publish focused workflow guides; no new runtime dependencies or automatic remote actions.
+
+
 ## 0.7.0
 
 - Extend remember to merge explicit rules or current conversation decisions into CLAUDE.md/AGENTS.md, with shared instructions for both hosts, preview mode and optional named checkpoints in one invocation. Preserve existing guidance, user corrections and scope; distinguish saved files from verified host loading.

package/README.md

@@ -2,12 +2,31 @@
 
 Tools, skills, and commands for coding agents.
 
-**v0.7 ships 112 engineering profiles and 215 skill names backed by 212 canonical workflows** for Codex and Claude Code: focused skills for development, architecture, decisions, Git/GitHub, Vercel, Vite, React, UI, backend, APIs, databases, data, ML, LLMs, testing, security, and operations. Each canonical workflow has selection guidance, scope, concrete decision branches, evidence requirements, outputs, verification, recovery conditions and three example requests. Applied methods live in 22 pack guides.
+**v0.8.1 contains 112 engineering profiles and 216 skill names backed by 213 canonical workflows** for Codex and Claude Code: focused skills for development, architecture, decisions, Git/GitHub, Vercel, Vite, React, UI, backend, APIs, databases, data, ML, LLMs, testing, security, and operations. Each canonical workflow has selection guidance, scope, concrete decision branches, evidence requirements, outputs, verification, recovery conditions and at least three example requests. Each entry point also contains an authored technical method: evidence to inspect, a procedure, a likely misdiagnosis and a discriminating check. Applied methods live in 22 pack guides. The v0.8.1 prompt update adds explicit infer/default/ask policies, a conditional worked example for each pack, and guidance for preserving corrections across turns; see [prompt improvements](docs/prompt-improvements.md).
+
+The [technical audit](docs/technical-audit.md) and [complete coverage inventory](docs/technical-coverage.md) document the latest expansion across every canonical workflow. Review/security commands now route to concrete vulnerability, framework, language and scanner guides. [Security fixture controls](evals/security/README.md) distinguish seeded defects from legitimate behavior; they do not claim model-review accuracy.
 
 The active coding agent executes the workflows with its available tools. The dependency-free Node.js utilities provide catalog search, project inspection, capability discovery, and bounded run-state validation. Installing just-vibe does not connect services, grant permissions, provision compute, or make every workflow's prerequisites available.
 
 v0.7 adds a quick path for simple work, a small starter catalog, contextual routing with reasons, project preferences and checkpoints, explicit evidence collectors, and optional project hooks. Detailed auth, component, training and delivery scenarios load only when relevant. See [daily workflows](plugins/just-vibe/references/daily-workflows.md) for configuration and examples, and the [v0.7 validation record](evals/releases/0.7.0.md) for tested scope and limits.
 
+
+## Intent, evidence and reversible work
+
+v0.8.0 adds working runtime helpers behind natural-language skill requests:
+
+- Remember an explicit correction, inspect instruction provenance/loading, and test a rule with compliant/violating controls.
+- Build two or three alternatives in owned worktrees, run equal checks, preview them, and apply the selected result with an undo record.
+- Tie requirements to actual checks, screenshots and attributed human review in a local HTML report with freshness checks.
+- Learn from isolated exercises in the actual project, with validated controls, progressive hints and real submissions.
+- Import MLflow, W&B or JSON exports; compare binary/regression metrics, slices, identity, feature parity and temporal coverage.
+- Reverse a recorded local task while preserving nonoverlapping later edits; retain decision history with observable reconsideration triggers.
+
+See the [workflow guide](plugins/just-vibe/references/intent-workflows.md) for examples, boundaries and recovery. Users provide ordinary briefs; the agent prepares the helper inputs. These features support judgment rather than claiming an objective quality score.
+
+**Release status:** This checkout prepares v0.8.1. The previous [v0.8.0 publication](evals/releases/0.8.0-publication.json) was verified on npm. For this release, the maintainer again waived unavailable GitHub Actions because of the account minutes limit; local checks and exact-archive verification remain required. See the [v0.8.1 validation record](evals/releases/0.8.1.md).
+
+
 ## Use the workflows
 
 In Claude Code, use a command followed by as much context as needed:
@@ -49,11 +68,11 @@ Save decisions and corrections from the current conversation in one invocation:
 
 In Codex, select **remember** from just-vibe and append the same brief. The skill updates the established `CLAUDE.md` or `AGENTS.md`, merges existing guidance and saves only explicit instructions and accepted decisions. `both` keeps common rules in `AGENTS.md` with a relative import in `CLAUDE.md`. A checkpoint keeps temporary progress separate. You can also append one specific rule or ask for a preview without writing.
 
-This is an agent workflow using the host's file tools; terminal `project remember` only stores JSON notes. Saved instructions improve continuity but do not guarantee adherence or recover unavailable chat history. See [merging, host loading and examples](plugins/just-vibe/references/instruction-memory.md). Update older installations to receive this extension.
+The host interprets the conversation; the `memory` helper can persist individual rules with provenance and file-hash checks, while the agent merges established context sections and shared imports. Terminal `project remember` only stores JSON notes. See [rule checks and memory inspection](plugins/just-vibe/references/memory-checks.md) for the new helper. Saved instructions improve continuity but do not guarantee adherence or recover unavailable chat history. See [merging, host loading and examples](plugins/just-vibe/references/instruction-memory.md). Update older installations to receive this extension.
 
 ## Engineering profiles
 
-Profiles shape the agent's priorities and verification throughout a task. They are separate from commands: a machine learning engineer emphasizes prediction-time data, evaluation and serving parity; a frontend engineer emphasizes state, interactions and rendered behavior. Each of the **112 profiles** has concrete priorities, a decision rule, checks, a scope boundary and candidate workflows.
+Profiles shape the agent's priorities and verification throughout a task. They are separate from commands: a machine learning engineer emphasizes prediction-time data, evaluation and serving parity; a frontend engineer emphasizes state, interactions and rendered behavior. Each of the **112 profiles** has concrete priorities, a decision rule, checks, a scope boundary, a concrete task contribution and candidate workflows.
 
 ```text
 /just-vibe:profiles architecture
@@ -195,7 +214,7 @@ Use the equivalent `--local` flag when switching from a development checkout. Gi
 
 ## Native install without Node.js
 
-The included skills and plugin manifests can be installed directly. Node.js 22+ is still required for the bundled installer, discovery, run-state, and quiz utilities.
+The included skills and plugin manifests can be installed directly. Node.js 22+ is still required for all bundled CLI helpers, including installation, discovery, sessions, quizzes and the intent workflows.
 
 ```sh
 # Codex
@@ -238,22 +257,26 @@ The default checks validate catalogs, generated skills, references, manifests an
 
 The default host test copies and installs the bundled payload. `--local` tests direct checkout registration. `--github` installs the published private repository and requires Git access; use it after pushing a release. Both variants execute the cached plugin runtime and check every skill is present, independently of the source checkout.
 
-Edit `plugins/just-vibe/catalog/commands.json` for command contracts and runtime procedures, `catalog/packs.json` for pack requirements, and `references/packs/` for operational guidance. Run `npm run build:skills` to regenerate skills, the command reference, and evaluation scenarios. `npm run validate` rejects drift. Neither generation nor the installed runtime depends on the ignored local plan.
+Edit `plugins/just-vibe/catalog/commands.json` for command contracts and the single canonical procedure, `catalog/packs.json` for pack requirements/input policies, and `references/packs/` plus `references/examples/` for operational guidance. Profile contributions live in `catalog/profiles.json`. Run `npm run build:skills` to regenerate skills, the command reference, technical coverage inventory, and evaluation scenarios. `npm run validate` rejects drift. Neither generation nor the installed runtime depends on the ignored local plan.
 
 Every workflow has normal, edge and missing-evidence cases in [evals/scenarios.json](evals/scenarios.json). The [independent behavioral harness](evals/README.md) additionally prepares and grades 21 raw-artifact tasks, including code repairs and report judgments. Catalog structure, runtime utility coverage and observed agent behavior have separate validation fields. These are not claims that all commands have been run against live services or evaluated across models. See the [v0.4 observed results](evals/releases/0.4.0.md) and [evaluation guidance](evals/README.md) for the tested scope.
 
+The [conversation harness](evals/conversation/README.md) records review, selected repairs and later corrections with separate scope and behavior checks. Its [development record](evals/releases/prompt-improvements.md) describes observed results and limitations.
+
 The [v0.6 results](evals/releases/0.6.0.md) record 32 controlled implementation trials and eight revised-command development trials. All passed their bounded checks; this does not rank overall output quality or convenience. The tasks supplied detailed contracts and did not measure user effort or preference. The [command-depth review](docs/command-quality.md#focused-depth-review) explains 27 focused revisions, and the [contextual review guide](docs/command-quality.md#output-quality-and-convenience) covers judgment, clarity, discovery and correction burden. [Benchmark protocol and supporting metrics](evals/benchmark/README.md) remain available for reproduction. External integration, browser and deployment checks require the relevant task environment.
 
+The [technical-guidance validation record](evals/releases/0.8.0-technical-guidance.md) covers the latest command expansion and security controls. The earlier [v0.8 validation record](evals/releases/0.8.0.md) covers the new intent helpers, real browser reports, installation checks and the pending Windows confirmation. GitHub CI remains blocked by account billing. The maintainer waived that gate for the [verified npm publication](evals/releases/0.8.0-publication.json); Windows validation remains pending.
+
 ### Repository layout
 
 | Path | Purpose |
 |---|---|
 | `bin/just-vibe.mjs` | npm-executable entry point |
 | `plugins/just-vibe/scripts/installer.mjs` | Self-contained installer, also shipped inside the plugin |
-| `plugins/just-vibe/scripts/toolkit.mjs` | Search, inspection, discovery, routing candidates, run records, and quiz CLI |
-| `plugins/just-vibe/scripts/lib/` | Catalog, capability, project, run-state, and native quiz adapter modules |
+| `plugins/just-vibe/scripts/toolkit.mjs` | Discovery, routing, sessions, quizzes and persistent intent workflow CLI |
+| `plugins/just-vibe/scripts/lib/` | Catalog, capability, session, quiz, memory, guard, task, lab, proof, practice, experiment and decision modules |
 | `plugins/just-vibe/catalog/` | Canonical command contracts, 112 role profiles, examples, prerequisites and pack metadata |
-| `plugins/just-vibe/skills/` | 215 installed names, including three canonical aliases and setup |
+| `plugins/just-vibe/skills/` | 216 installed names, including three canonical aliases and setup |
 | `plugins/just-vibe/references/` | Shared execution rules, runtime interface, domain guidance and command index |
 | `.agents/plugins/marketplace.json` | Codex marketplace |
 | `.claude-plugin/marketplace.json` | Claude Code marketplace |

package/docs/command-quality.md

@@ -1,12 +1,16 @@
 # Command contracts and quality
 
+The [2026-09-20 technical audit](technical-audit.md) extends every canonical workflow with an authored technical method; the [coverage inventory](technical-coverage.md) shows the addressed failure distinctions and conditional routes.
+
 The catalog owns each canonical command's scope, mode, required inputs, selection boundary, procedure, decision branches, outputs, observable verification, recovery conditions and examples. Pack references add reusable methods and worked scenarios. Generated SKILL.md files expose all examples and link the applicable guide; they are not independently edited.
 
-215 names resolve to 212 canonical workflows. `do` inherits `auto`, `responsive` inherits `ui-responsive`, and `a11y` inherits `ui-accessibility`. Alias source records contain identity/search metadata only. Loading materializes the canonical behavior; validation rejects scope, mode, method, evidence or other behavioral drift. Routing collapses matching aliases to one canonical recommendation while preserving matched names.
+216 names resolve to 213 canonical workflows. `do` inherits `auto`, `responsive` inherits `ui-responsive`, and `a11y` inherits `ui-accessibility`. Alias source records contain identity/search metadata only. Loading materializes the canonical behavior; validation rejects scope, mode, method, evidence or other behavioral drift. Routing collapses matching aliases to one canonical recommendation while preserving matched names.
+
+The [prompt improvements](prompt-improvements.md) add explicit input policies, request variants, conditional worked examples, concrete role contributions and multi-turn validation. Every generated skill uses one canonical procedure; do not reintroduce parallel runtime instructions.
 
 ## Writing useful guidance
 
-Selection should distinguish a nearby workflow: explain versus teach, debug versus fix, local pr drafting versus remote github-pr identity/actions. A task-specific procedure should name the evidence to inspect and the decision it informs. A branch should cover a situation that changes the method, such as a partial external operation, incompatible old consumer, stale request completion or missing evaluation labels.
+Selection should distinguish a nearby workflow: explain versus teach, debug versus fix, local pr drafting versus remote github-pr identity/actions. A task-specific procedure should name the evidence to inspect and the decision it informs. Canonical commands must also supply technical.evidence, technical.method, technical.pitfall and technical.check. These fields appear directly in the skill, CLI contract and evaluation specification; references add conditional depth. A branch should cover a situation that changes the method, such as a partial external operation, incompatible old consumer, stale request completion or missing evaluation labels.
 
 Outputs need enough structure to assess correctness: a comparison needs assumptions and decisive evidence; a migration needs ordered phases, compatibility and recovery boundaries; an audit needs observed/conditional/unknown findings. Normal, edge and missing-evidence requests demonstrate scope and input handling. They do not count as successful evaluations by existing in the catalog.
 
@@ -67,8 +71,12 @@ The schema verifies the presence and shape of this contract, not the quality of
 
 ## Profiles and ownership
 
-`catalog/profiles.json` owns role guidance independently of action contracts. Maintain a distinct purpose, priorities, a decision rule, relevant verification, a boundary and valid canonical workflow links for each role. Generate the profile index and individual references with the same build command. A title alone is not a useful profile; nearby roles must change emphasis in an explainable way.
+`catalog/profiles.json` owns role guidance independently of action contracts. Maintain a distinct purpose, priorities, a decision rule, relevant verification, a boundary, a concrete task contribution and valid canonical workflow links for each role. Generate the profile index and individual references with the same build command. A title alone is not a useful profile; nearby roles must change emphasis in an explainable way.
 
 Test profile state transitions for pin protection, scope and budget preservation. Keep role discovery separate from activation. Do not claim that structural validation proves role expertise or that previous workflow trials evaluate newly added role guidance.
 
 All generated work belongs to the user. Shared execution and Git/GitHub guidance prohibit agent self-attribution in commits, PRs and messages while preserving human credits and required third-party notices.
+
+## v0.8 intent workflows
+
+The [intent helpers](../plugins/just-vibe/references/intent-workflows.md) implement stateful memory/guard, lab, proof, practice, experiment, task and decision operations. The related commands load focused contracts for those modes; ordinary explanation/comparison remains read-only. Runtime fixture coverage is separate from end-to-end model behavior: new branches are not claimed as independently agent-evaluated.

package/docs/compatibility.md

@@ -27,3 +27,9 @@ Project state and contextual routing use the bundled Node utilities on all suppo
 Optional hooks use PostToolUse and Stop and ship at the native plugin hook location. They remain inactive until project configuration and separate local trust are present. Codex also requires native hook trust. Native installation on macOS is verified separately from actual hook-event delivery on every host/OS. A direct hook runner test establishes handler behavior, not host parity. Command arrays support native executables and standard npm Windows wrappers through the shared process helper.
 
 GitHub evidence needs authenticated gh; Vercel evidence needs authenticated vercel and an explicit deployment identity. Browser evidence needs project-installed Playwright and Chromium, with authorized interactions. SQL migration evidence inspects local SQL and an optional supplied applied-history export; it does not connect to a live database. The package installs no optional provider or browser dependencies automatically. See the [daily workflow reference](../plugins/just-vibe/references/daily-workflows.md).
+
+## v0.8 intent workflows
+
+The new memory/guard, task, lab, proof, practice, experiment and decision helpers use the existing Node runtime without added runtime dependencies. Labs/practice/local undo require Git and a committed project root. Preview commands must run foreground loopback servers; the worker owns their process lifetime. These worktrees are not security sandboxes. Selected file and snapshot bounds can require a narrower task; incomplete coverage never grants selection/cleanup authority.
+
+The 216-skill payload passed isolated native Codex/Claude lifecycle checks on macOS. ML imports use supplied local exports, and browser proof screenshots use already-installed Playwright/Chromium. Native teaching questions still depend on the active host mode; exercise assessment does not fabricate question-tool availability. See the [v0.8 validation record](../evals/releases/0.8.0.md) and [workflow guides](../plugins/just-vibe/references/intent-workflows.md).

package/docs/prompt-improvements.md

@@ -0,0 +1,19 @@
+# Prompt improvements
+
+These changes improve existing workflows rather than adding more command names. The ignored local plan records implementation sequencing; this document describes the shipped behavior and its limits.
+
+| Area | Result | Source of truth |
+| --- | --- | --- |
+| Modes and scope | Separate source inspection, local implementation and actual execution. ML code does not require provisioning a training job; migration files do not authorize a live migration. | Command mode/scope/branches and shared execution |
+| Request variants | Review a diff, repository or named files; teach a topic, explain workflow implementation, or prepare explicitly requested practice. | `review` and `teach` contracts |
+| Missing context | Infer from project evidence, state reversible defaults, ask only about consequential unresolved choices. Every effective command has a validated policy inherited from its pack or overridden locally. | `inputPolicy` in catalogs |
+| Worked examples | All 22 packs have an evidence → decision → artifact → verification example and a misleading case. Read these only when relevant. | `references/examples/` |
+| Prompt duplication | One canonical execution procedure, with conditional guides for detailed operations. Ordinary verification does not require a durable proof report. | `procedure` and skill generator |
+| Profiles | All 112 roles name a concrete contribution; a same-feature comparison explains differences without expanding permission or scope. | Profile `contribution` and comparison guide |
+| Follow-ups | Keep stable finding identities, selected paths, exclusions, corrections and completed work across “fix these” and “continue.” | Shared execution and conversation evaluation |
+
+The `requiredInputs` fields identify evidence for the selected outcome; they are not mandatory questionnaires for every variant. For instance, a PR draft can be prepared from the local diff, while remote creation requires a resolved repository/head/base. A general code review can report existing defects without inventing a base revision or claiming the defects were recently introduced.
+
+The catalog resolves pack input policies before alias materialization. CLI contracts, generated skills and evaluation specifications therefore see the same policy. Validation rejects missing policies, profile contributions, independent alias behavior and a second runtime procedure. Structural checks cannot establish that the prose is useful; the [conversation evaluation](../evals/conversation/README.md) records actual responses, selected edits and independent checks.
+
+Examples are authored guidance, not measured results. Role contributions are expected artifacts, not credentials. The [observed development record](../evals/releases/prompt-improvements.md) distinguishes executable controls, real agent outcomes and untested environments. These changes are included in the v0.8.1 release candidate; see its [validation and publication status](../evals/releases/0.8.1.md).

package/docs/releases.md

@@ -49,3 +49,9 @@ Push the release commit and matching `vVERSION` tag. Run **Publish npm package**
 If publication fails, check whether that exact version already exists before retrying. A successful upload followed by a failed verification still consumes the version. If a bad release is already live, publish a corrected new version and deprecate the affected one with a clear explanation.
 
 Official references: [npm publishing](https://docs.npmjs.com/creating-and-publishing-unscoped-public-packages/), [trusted publishing](https://docs.npmjs.com/trusted-publishers/), [semantic versioning](https://docs.npmjs.com/about-semantic-versioning/).
+
+## Maintainer exception for unavailable CI
+
+The default publisher still requires successful CI. An explicit maintainer instruction can waive unavailable CI for a specific release without recording a fictitious pass or disabling Actions globally. Keep the local checks and exact-archive verification: match the clean source commit, package/manifests, SHA-256 release record and tested tarball; check whether that version already exists before publication. Publish only those verified bytes, complete npm account verification, then compare registry integrity and execute the exact version from a fresh temporary directory/cache outside the source checkout. `npm exec` inside the package checkout can select the local package and fail to resolve its bin.
+
+Record the reason, maintainer authorization, source commit, artifact hashes, local checks and outstanding platform coverage. Tag the actual published source revision. Never overwrite a published version or weaken the normal CI check for future releases. The [0.8.0 publication record](../evals/releases/0.8.0-publication.json) documents this release-specific exception.

package/docs/technical-audit.md

@@ -0,0 +1,40 @@
+# Technical guidance audit
+
+Audit scope: all 213 canonical workflows, their three aliases, 22 pack references, conditional scenario routes, 112 profile-to-workflow links, generator, CLI exposure and packaged references. This is a bounded inventory of the shipped catalog, not a claim to cover every possible technology or vulnerability. The audit was performed on 2026-09-20 against the existing 0.8.0 source.
+
+## Findings and implemented corrections
+
+| Area | Gap | Correction |
+|---|---|---|
+| Every canonical command | Procedures often named a task without enough evidence, diagnostic distinctions or acceptance checks | An authored technical method now specifies evidence, application, a likely misdiagnosis and a discriminating check in the catalog and generated skill |
+| General review and security | General security linked only general methods; specialist depth could remain unloaded | Direct security guide plus a review selector routes by actual changed boundary and stack |
+| Security vulnerabilities | Limited explicit mechanisms, unsafe/corrected examples and false-positive controls | Injection, identity, files, supply chain and framework guides with bounded regression/control cases and primary references |
+| Scanners | No concrete shared selection, execution and incomplete-result procedure | Available-tool recipes for dependency, source and secret analysis, explicit version/config/revision identity and partial/failure handling |
+| Language-specific reviews | Shared review depended heavily on model recall | Conditional JavaScript/TypeScript, Python, Go, JVM, Rust/native and SQL review branches |
+| Architecture and decisions | Shared methods did not enumerate each command's decisive checks | Ownership/contract/crash-window/scale/transition checks; sensitivity, feasibility, reversal and evidence rules for each decision workflow |
+| Git and GitHub | Existing staging and delivery depth was uneven across adjacent workflows | Per-command three-tree, recovery, bisect, PR identity, CI trust and artifact provenance checks; existing user-ownership rules retained |
+| Vercel and Vite | Generic build/performance guidance left configuration and measurement ambiguity | Build/runtime scope, deployment identity, asset MIME/base paths, public env exposure, HMR layer, chunk lifetime and compatible upgrade checks |
+| React and UI | Existing async/component scenarios did not give every workflow its own diagnostic contract | State ownership, two-instance behavior, form errors, hydration, profiling, reduced motion, keyboard and visual-baseline controls |
+| Backend/API/database/data | Detailed shared examples could be missed or applied too generally | Specific transaction/retry/claim/cursor/webhook/RLS/join-grain/watermark/backfill and reconciliation checks in every entry point |
+| ML and LLM | Broad coverage lacked consistent per-command failure distinctions | Prediction/fit-time boundaries, label maturity, leakage controls, calibration/threshold denominators, parity, rollout, retrieval permission and tool-execution checks |
+| Testing and operations | Some commands lacked concrete counterexamples and recovery observations | Broken/good controls, independent oracles, load bounds, failure cleanup, telemetry gaps, image layers, restore evidence and causal incident checks |
+| Profiles | A role could appear to supply specialist knowledge by itself | Profile selection now explicitly routes to the selected workflow's technical method; roles remain priorities, not credentials or permission |
+| Generation and packaging | Structural presence alone could allow missing technical fields or dangling deep references | Technical contract validation, reproducible generation, coverage inventory and transitive local-reference checks |
+
+The full [coverage inventory](technical-coverage.md) lists the specific ambiguity addressed by each command and its conditional references. Existing strong authentication, Git index, ML temporal and training scenarios were retained. All changes are owned by the user; no agent authorship is introduced.
+
+## Maintenance contract
+
+Edit canonical `catalog/commands.json`, not generated SKILL.md files. Every canonical command supplies `technical.evidence`, `technical.method`, `technical.pitfall` and `technical.check`; aliases inherit them. These are authored behavioral instructions, not generic pack-name substitution. Keep substantial conditional examples in references and attach a route explaining when to read them. Rebuild with `npm run build:skills`.
+
+Use installed versions and current primary documentation for unstable API/default behavior. Sources are linked in the relevant guide. The audit consulted OWASP, framework maintainers, language/runtime documentation and scanner maintainers; it did not copy ECC's instruction text or treat checklist length as evidence of better reviews. Existing Git, auth, ML and domain methods remain the basis for deeper scenario work.
+
+## Validation and limits
+
+The [validation record](../evals/releases/0.8.0-technical-guidance.md) records the completed local checks and their limits.
+
+`npm run check` verifies the catalog, generated artifacts, reference graph, runtime tests and executable security fixture controls. `npm run eval:security` runs the isolated controls directly. The fixture assertions distinguish seeded defects from legitimate behavior; they do not run a model or establish a comparative ECC score. The evaluation guide explains how to perform a separate blinded model review without leaking expected findings.
+
+Scanner recipes are host-agent procedures for tools already available and authorized. No scanner is silently installed, no registry/advisory database is bundled, and no hook or remote scan is automatically enabled. Structural validation cannot prove an agent loads every relevant guide or reasons correctly. Broad behavioral quality and current-version ecosystem coverage require ongoing real-task evaluation.
+
+This change does not by itself publish an npm version or establish new Windows/remote-CI evidence. Release records remain authoritative for actual published artifacts and platform validation.