just-vibe 0.8.1 → 0.9.0

package/CHANGELOG.md

@@ -1,6 +1,19 @@
 # Changelog
 
-## Unreleased
+## 0.9.0
+
+- Add automatic request routing and compaction/resume context through native Codex/Claude plugin hooks, with focused workflow loading and guidance for discovering actual host capabilities.
+- Add personal/project feedback overlays that change effective command instructions and routing, retain source/version history, and support rollback, retirement and forgetting without rewriting package caches.
+- Add attributed evidence with source/artifact freshness, tool-activity records, and one bounded missing-evidence continuation; preserve current instructions and distinguish blockers from successful verification.
+- Add local activation settings, task retention, natural-language personalization controls, packaged runtime tests and native installation checks.
+- Preserve task identity across host continuation turns, enforce task-only feedback restrictions against the complete user message, and isolate optional project-hook failures while checking evidence after project commands finish.
+
+- Refine website spacing and long-text wrapping across the full catalog; add page transitions, section entrances, animated menus and pickers, state feedback, reduced-motion handling, and layout/navigation regression checks.
+- Default all frontend workflows to no emojis unless explicitly requested; route UI, React, Vite, design, polish, matching and UI copy through shared iconography guidance, including general workflows and role profiles used for frontend work.
+- Replace website text-glyph icons with Lucide SVGs and preserve icon markup when copy-button feedback resets.
+- Add a public website with installation guides, an editable prompt builder, searchable command and role libraries, and catalog-generated scope and verification documentation.
+- Add the just-vibe visual identity, generated logo and brand assets, responsive layouts, static-page/link checks, and browser accessibility and interaction checks.
+- Configure Vercel deployment independently of GitHub Actions and the npm CLI release process.
 
 ## 0.8.1
 

package/README.md

@@ -2,7 +2,9 @@
 
 Tools, skills, and commands for coding agents.
 
-**v0.8.1 contains 112 engineering profiles and 216 skill names backed by 213 canonical workflows** for Codex and Claude Code: focused skills for development, architecture, decisions, Git/GitHub, Vercel, Vite, React, UI, backend, APIs, databases, data, ML, LLMs, testing, security, and operations. Each canonical workflow has selection guidance, scope, concrete decision branches, evidence requirements, outputs, verification, recovery conditions and at least three example requests. Each entry point also contains an authored technical method: evidence to inspect, a procedure, a likely misdiagnosis and a discriminating check. Applied methods live in 22 pack guides. The v0.8.1 prompt update adds explicit infer/default/ask policies, a conditional worked example for each pack, and guidance for preserving corrections across turns; see [prompt improvements](docs/prompt-improvements.md).
+[Website](https://just-vibe-tools.vercel.app/) · [Documentation](https://just-vibe-tools.vercel.app/docs/) · [Command library](https://just-vibe-tools.vercel.app/commands/) · [Engineering profiles](https://just-vibe-tools.vercel.app/profiles/)
+
+**v0.9.0 contains 112 engineering profiles and 216 skill names backed by 213 canonical workflows** for Codex and Claude Code: focused skills for development, architecture, decisions, Git/GitHub, Vercel, Vite, React, UI, backend, APIs, databases, data, ML, LLMs, testing, security, and operations. Each canonical workflow has selection guidance, scope, concrete decision branches, evidence requirements, outputs, verification, recovery conditions and at least three example requests. Each entry point also contains an authored technical method: evidence to inspect, a procedure, a likely misdiagnosis and a discriminating check. Applied methods live in 22 pack guides. The v0.8.1 prompt update adds explicit infer/default/ask policies, a conditional worked example for each pack, and guidance for preserving corrections across turns; see [prompt improvements](docs/prompt-improvements.md).
 
 The [technical audit](docs/technical-audit.md) and [complete coverage inventory](docs/technical-coverage.md) document the latest expansion across every canonical workflow. Review/security commands now route to concrete vulnerability, framework, language and scanner guides. [Security fixture controls](evals/security/README.md) distinguish seeded defects from legitimate behavior; they do not claim model-review accuracy.
 
@@ -11,6 +13,14 @@ The active coding agent executes the workflows with its available tools. The dep
 v0.7 adds a quick path for simple work, a small starter catalog, contextual routing with reasons, project preferences and checkpoints, explicit evidence collectors, and optional project hooks. Detailed auth, component, training and delivery scenarios load only when relevant. See [daily workflows](plugins/just-vibe/references/daily-workflows.md) for configuration and examples, and the [v0.7 validation record](evals/releases/0.7.0.md) for tested scope and limits.
 
 
+## Automatic assistance
+
+Describe the outcome normally: “Fix the mobile menu,” “Why is training unstable?” or “Address this PR’s feedback.” Trusted native hooks now route each request to a focused shortlist, restore selected work after compaction, and direct the agent to discover and use its actual tools. Command names remain optional.
+
+The agent loads the relevant full workflow with versioned personal/project feedback. Explicit corrections and endorsements can change instructions, routing triggers, preferred tools and required checks. History, rollback, retirement and forgetting are supported. Silence and passing tests do not create preferences. Source and artifact changes invalidate old evidence; completion can request one bounded follow-up for missing evidence, then reports unresolved work honestly.
+
+Automatic assistance is included starting in **v0.9.0**. Native hook support and host trust are required; setup does not grant that trust. Personal state lives under `~/.just-vibe/adaptive`, outside repositories, with bounded task retention. No additional model service or runtime dependency is used. See [automatic assistance, schemas and limits](plugins/just-vibe/references/adaptive.md) and [validation](docs/adaptive-assistance.md).
+
 ## Intent, evidence and reversible work
 
 v0.8.0 adds working runtime helpers behind natural-language skill requests:
@@ -24,12 +34,12 @@ v0.8.0 adds working runtime helpers behind natural-language skill requests:
 
 See the [workflow guide](plugins/just-vibe/references/intent-workflows.md) for examples, boundaries and recovery. Users provide ordinary briefs; the agent prepares the helper inputs. These features support judgment rather than claiming an objective quality score.
 
-**Release status:** This checkout prepares v0.8.1. The previous [v0.8.0 publication](evals/releases/0.8.0-publication.json) was verified on npm. For this release, the maintainer again waived unavailable GitHub Actions because of the account minutes limit; local checks and exact-archive verification remain required. See the [v0.8.1 validation record](evals/releases/0.8.1.md).
+**Release information:** Check [npm for just-vibe 0.9.0](https://www.npmjs.com/package/just-vibe/v/0.9.0) and the [release validation record](evals/releases/0.9.0.md) for registry verification and tested scope. This release uses the maintainer-authorized local-check exception because GitHub Actions minutes are unavailable; no CI pass is claimed.
 
 
 ## Use the workflows
 
-In Claude Code, use a command followed by as much context as needed:
+With trusted hooks, use an ordinary request. For explicit shortcuts, Claude Code supports a command followed by as much context as needed:
 
 ```text
 /just-vibe:auto fix checkout, add regression coverage, and verify.
@@ -265,7 +275,7 @@ The [conversation harness](evals/conversation/README.md) records review, selecte
 
 The [v0.6 results](evals/releases/0.6.0.md) record 32 controlled implementation trials and eight revised-command development trials. All passed their bounded checks; this does not rank overall output quality or convenience. The tasks supplied detailed contracts and did not measure user effort or preference. The [command-depth review](docs/command-quality.md#focused-depth-review) explains 27 focused revisions, and the [contextual review guide](docs/command-quality.md#output-quality-and-convenience) covers judgment, clarity, discovery and correction burden. [Benchmark protocol and supporting metrics](evals/benchmark/README.md) remain available for reproduction. External integration, browser and deployment checks require the relevant task environment.
 
-The [technical-guidance validation record](evals/releases/0.8.0-technical-guidance.md) covers the latest command expansion and security controls. The earlier [v0.8 validation record](evals/releases/0.8.0.md) covers the new intent helpers, real browser reports, installation checks and the pending Windows confirmation. GitHub CI remains blocked by account billing. The maintainer waived that gate for the [verified npm publication](evals/releases/0.8.0-publication.json); Windows validation remains pending.
+The [technical-guidance validation record](evals/releases/0.8.0-technical-guidance.md) covers the v0.8.0 command expansion and security controls. The earlier [v0.8 validation record](evals/releases/0.8.0.md) covers the new intent helpers, real browser reports, installation checks and the pending Windows confirmation. GitHub CI remains blocked by account billing. The [v0.9.0 release record](evals/releases/0.9.0.md) records the current local checks and release-specific waiver; Windows validation remains pending.
 
 ### Repository layout
 
@@ -283,7 +293,7 @@ The [technical-guidance validation record](evals/releases/0.8.0-technical-guidan
 | `scripts/` and `tests/` | Validation and lifecycle tests |
 | `evals/` | Behavior scenarios and isolated project/data fixtures |
 
-The installer has no runtime npm dependencies or lifecycle install scripts. Optional bundled hooks do no work until configured and trusted for a project; native host trust also applies. It adds no MCP servers, rules or permissions. Provider/check commands use argument arrays rather than interpolating user input into a shell. Host CLIs own installation state and caches. Local planning and naming documents are excluded from both Git and the npm archive.
+The installer has no runtime npm dependencies or lifecycle install scripts. Automatic routing hooks use native host trust and keep personal task records. Optional project check/formatter hooks still do no work until separately configured and trusted. It adds no MCP servers, rules or permissions. Provider/check commands use argument arrays rather than interpolating user input into a shell. Host CLIs own installation state and caches. Local planning and naming documents are excluded from both Git and the npm archive.
 
 ## Troubleshooting
 

package/docs/adaptive-assistance.md

@@ -0,0 +1,44 @@
+# Automatic assistance implementation and validation
+
+Included starting in version 0.9.0. User operation and JSON schemas live in the packaged [adaptive reference](../plugins/just-vibe/references/adaptive.md). The website has a matching guide.
+
+## Implementation
+
+| Need | Implementation | Important boundary |
+| --- | --- | --- |
+| Ordinary conversation activates workflows | Bundled UserPromptSubmit hook, shared assistant runtime, local request/context routing | Shortlist retrieval is heuristic; the host resolves meaning, scope and mode. |
+| Only relevant methods are loaded | Compact injected entry point, select/load protocol, full canonical workflow retrieval | Existing direct skills remain available; native catalog truncation cannot remove the hook's runtime path. |
+| Agents discover and use real tools | Capability-specific guidance with observed/unknown state; existing host capability-report validation; full workflow methods | The hook cannot enumerate every host connector; the active agent uses its native discovery tools. |
+| Missing steps remain visible | Per-task requirements, attributed evidence, tool-event metadata, source/artifact hashes, one bounded Stop continuation | Delivery and activity do not prove model compliance; host reports remain labeled. |
+| Corrections change future behavior | Project/user learning records, trigger preference/suppression, effective workflow overlays and additional requirements | Only explicit user feedback is eligible; interpretation is performed by the host. |
+| Updates are explainable and reversible | Per-lesson source excerpts, revisions, version history, rollback, retirement and forgetting | User-scope learning requires explicit cross-project language. |
+| Context survives compaction | SessionStart resume/compact restores the same task, selection and access to current evidence | Context does not restore authorization or assert freshness. |
+| Controls remain usable without memorizing commands | Natural-language personalization routing and a shared agent guide | Ambiguous maintenance targets must be resolved first. |
+
+All runtime code is dependency-free Node. It uses the existing atomic state, bounded reads, path protection, discovery and fingerprint utilities. Hooks never execute project scripts themselves; existing optional check/formatter automation retains its separate trust gate. No account identity or host permission settings are changed by this feature.
+
+The packaged command bodies remain canonical. Effective instructions are assembled on load with versioned personal overrides; `show` uses the same loader. Direct skills reach that loader through shared execution guidance. This avoids writing personal preferences into installed plugin caches that are replaced during upgrades.
+
+## Host support
+
+The adapter uses the common `session_id`, `cwd`, `hook_event_name`, `prompt`, tool-event and Stop output shapes. Codex turn IDs also prevent late events from crossing task boundaries. Plugin hooks use `CLAUDE_PLUGIN_ROOT`, which Codex supplies for compatibility. Host hook review/trust is not bypassed by the installer.
+
+Codex can represent a Stop continuation as another incoming prompt. The runtime recognizes its own exact emitted reminder by hash, adopts a fresh host turn ID when supplied, and preserves the existing task and retry budget. That reminder cannot become a new user-feedback source. Native host events remain distinct from manually supplied CLI inputs; local records are provenance aids, not cryptographic attestations against a process with filesystem access.
+
+References checked during implementation: [Codex hooks](https://learn.chatgpt.com/docs/hooks), [Codex skills](https://learn.chatgpt.com/docs/build-skills), [Claude hooks](https://code.claude.com/docs/en/hooks) and [Claude plugin discovery](https://code.claude.com/docs/en/plugins-reference).
+
+## Validation
+
+- `tests/adaptive.test.mjs` exercises ordinary UI/ML/GitHub/backend requests, unrelated requests, negative clauses, both adapter shapes, effective command loading, tool discovery uncertainty, artifact/source freshness, scoped learning, positive feedback, rollback, user-message provenance and bounded completion.
+- The test drives the real hook entry point and CLI through request, selection, load, evidence and completion in an isolated project. It checks that generated continuation prompts do not create feedback or restart retries, that new continuation turn IDs remain attached to the task, that task-only restrictions cannot be omitted from quoted feedback, and that optional project-hook failures or mutations do not suppress or prematurely certify completion.
+- Existing project-automation, routing, installation, package and full-runtime regression tests cover interaction with previous features.
+- `npm run test:hosts` installs, repeats, upgrades, checks, uninstalls and reinstalls through native Codex/Claude plugin managers in isolated configuration directories. It verifies the installed payload without changing the user's active installation.
+- Website production build and static documentation/link checks cover the new guide and navigation.
+
+These are deterministic/runtime and installation checks. They do not establish that every host version delivers every event, that a model always chooses the right workflow, or that users subjectively prefer every learned change. No new model-behavior score or comparison with another toolkit is claimed.
+
+Validation run on September 20, 2026: 202 root tests passed, one Windows-only test skipped on macOS; 27 of those passing tests cover this feature. Both native lifecycles passed with Codex CLI 0.152.0 and Claude Code 2.1.258. Skill/plugin validators passed during development. The website built 345 pages and passed all four static catalog/link/metadata tests on Node 24.21.0. The new documentation page was inspected in the browser at desktop and mobile widths during development; its mobile content did not overflow the viewport. These checks used isolated state and did not update the user's active installation. See the [v0.9.0 release record](../evals/releases/0.9.0.md) for publication verification.
+
+## Manual acceptance checks
+
+In a host with the plugin enabled and its hooks reviewed, send an ordinary task without a workflow name. Confirm the hook context has a task ID, the agent selects and loads the relevant method, uses actual tools, and reports concrete evidence. Follow with an explicit correction; inspect its source/version, start another session, and verify the next effective workflow includes it. Roll back the lesson and verify the prior behavior returns. Repeat with a conceptual question and an unrelated conversation to assess unnecessary activation and user effort.

package/docs/compatibility.md

@@ -24,7 +24,7 @@ The profile/profile-discovery skills and all 112 role guides ship in both host p
 
 Project state and contextual routing use the bundled Node utilities on all supported runtime platforms. State is schema-versioned and bound to the selected project path. Partial snapshot coverage always requires revalidation. `tools` now shows a starter selection; use `tools --all` for the previous full inventory.
 
-Optional hooks use PostToolUse and Stop and ship at the native plugin hook location. They remain inactive until project configuration and separate local trust are present. Codex also requires native hook trust. Native installation on macOS is verified separately from actual hook-event delivery on every host/OS. A direct hook runner test establishes handler behavior, not host parity. Command arrays support native executables and standard npm Windows wrappers through the shared process helper.
+The v0.7 project check/formatter hooks use PostToolUse and Stop and ship at the native plugin hook location. They remain inactive until project configuration and separate local trust are present. Codex also requires native hook trust. Native installation on macOS is verified separately from actual hook-event delivery on every host/OS. A direct hook runner test establishes handler behavior, not host parity. Command arrays support native executables and standard npm Windows wrappers through the shared process helper.
 
 GitHub evidence needs authenticated gh; Vercel evidence needs authenticated vercel and an explicit deployment identity. Browser evidence needs project-installed Playwright and Chromium, with authorized interactions. SQL migration evidence inspects local SQL and an optional supplied applied-history export; it does not connect to a live database. The package installs no optional provider or browser dependencies automatically. See the [daily workflow reference](../plugins/just-vibe/references/daily-workflows.md).
 
@@ -33,3 +33,11 @@ GitHub evidence needs authenticated gh; Vercel evidence needs authenticated verc
 The new memory/guard, task, lab, proof, practice, experiment and decision helpers use the existing Node runtime without added runtime dependencies. Labs/practice/local undo require Git and a committed project root. Preview commands must run foreground loopback servers; the worker owns their process lifetime. These worktrees are not security sandboxes. Selected file and snapshot bounds can require a narrower task; incomplete coverage never grants selection/cleanup authority.
 
 The 216-skill payload passed isolated native Codex/Claude lifecycle checks on macOS. ML imports use supplied local exports, and browser proof screenshots use already-installed Playwright/Chromium. Native teaching questions still depend on the active host mode; exercise assessment does not fabricate question-tool availability. See the [v0.8 validation record](../evals/releases/0.8.0.md) and [workflow guides](../plugins/just-vibe/references/intent-workflows.md).
+
+## v0.9 automatic assistance
+
+Version 0.9.0 adds request routing, resume/compaction restoration, tool-activity records, scoped feedback overlays and bounded completion reminders. Supported hosts must deliver UserPromptSubmit, SessionStart, PostToolUse and Stop events and trust the plugin's native hooks. The installer does not grant native trust. Existing optional project checks still require their separate configuration and trust.
+
+Codex supplies the CLAUDE_PLUGIN_ROOT compatibility variable used by the shared hook command. Both adapters are exercised with fixture events; native install/update/uninstall lifecycle checks run separately on macOS. This does not establish every event on every host/OS or perfect model adherence. Hosted tools and some specialized paths can be absent from tool-hook observations. Use actual attributed evidence rather than inferring success from missing or returned tool events.
+
+Personal learning and task state live under ~/.just-vibe/adaptive (or JUST_VIBE_HOME), keyed by canonical project and host/session. See the [adaptive reference](../plugins/just-vibe/references/adaptive.md) and [implementation/validation record](adaptive-assistance.md).

package/docs/prompt-improvements.md

@@ -16,4 +16,4 @@ The `requiredInputs` fields identify evidence for the selected outcome; they are
 
 The catalog resolves pack input policies before alias materialization. CLI contracts, generated skills and evaluation specifications therefore see the same policy. Validation rejects missing policies, profile contributions, independent alias behavior and a second runtime procedure. Structural checks cannot establish that the prose is useful; the [conversation evaluation](../evals/conversation/README.md) records actual responses, selected edits and independent checks.
 
-Examples are authored guidance, not measured results. Role contributions are expected artifacts, not credentials. The [observed development record](../evals/releases/prompt-improvements.md) distinguishes executable controls, real agent outcomes and untested environments. These changes are included in the v0.8.1 release candidate; see its [validation and publication status](../evals/releases/0.8.1.md).
+Examples are authored guidance, not measured results. Role contributions are expected artifacts, not credentials. The [observed development record](../evals/releases/prompt-improvements.md) distinguishes executable controls, real agent outcomes and untested environments. These changes are published in v0.8.1; see its [validation and publication status](../evals/releases/0.8.1.md).

package/docs/releases.md

@@ -54,4 +54,4 @@ Official references: [npm publishing](https://docs.npmjs.com/creating-and-publis
 
 The default publisher still requires successful CI. An explicit maintainer instruction can waive unavailable CI for a specific release without recording a fictitious pass or disabling Actions globally. Keep the local checks and exact-archive verification: match the clean source commit, package/manifests, SHA-256 release record and tested tarball; check whether that version already exists before publication. Publish only those verified bytes, complete npm account verification, then compare registry integrity and execute the exact version from a fresh temporary directory/cache outside the source checkout. `npm exec` inside the package checkout can select the local package and fail to resolve its bin.
 
-Record the reason, maintainer authorization, source commit, artifact hashes, local checks and outstanding platform coverage. Tag the actual published source revision. Never overwrite a published version or weaken the normal CI check for future releases. The [0.8.0 publication record](../evals/releases/0.8.0-publication.json) documents this release-specific exception.
+Record the reason, maintainer authorization, source commit, artifact hashes, local checks and outstanding platform coverage. Tag the actual published source revision. Never overwrite a published version or weaken the normal CI check for future releases. The [0.8.0 publication record](../evals/releases/0.8.0-publication.json) and [0.8.1 publication record](../evals/releases/0.8.1-publication.json) document separately authorized release-specific exceptions.

package/docs/technical-coverage.md

@@ -28,10 +28,10 @@ Generated from the canonical catalog. This is an inventory of authored guidance
 | [migrate](../plugins/just-vibe/skills/migrate/SKILL.md) | Updating a version string does not migrate runtime semantics; code rollback may not read new persisted data. | [Language and runtime review methods](../plugins/just-vibe/references/scenarios/language-review.md) |
 | [automate](../plugins/just-vibe/skills/automate/SKILL.md) | A script that retries uncertain mutations or interpolates user text into shell source can amplify failures. | Technical method and pack guide in entry point |
 | [cleanup](../plugins/just-vibe/skills/cleanup/SKILL.md) | Static search can miss reflection, routing conventions, plugins or public consumers. | Technical method and pack guide in entry point |
-| [design](../plugins/just-vibe/skills/design/SKILL.md) | Attractive static composition can conceal inaccessible controls, content overflow or missing recovery states. | Technical method and pack guide in entry point |
-| [polish](../plugins/just-vibe/skills/polish/SKILL.md) | Arbitrary token changes can improve one screen while breaking sibling components or dense content. | Technical method and pack guide in entry point |
-| [match](../plugins/just-vibe/skills/match/SKILL.md) | A different viewport or unloaded font can masquerade as implementation error; screenshot similarity does not prove behavior. | Technical method and pack guide in entry point |
-| [copy](../plugins/just-vibe/skills/copy/SKILL.md) | Friendly copy that says a failed operation succeeded or hides irreversible consequences misleads users. | Technical method and pack guide in entry point |
+| [design](../plugins/just-vibe/skills/design/SKILL.md) | Attractive static composition can conceal inaccessible controls, content overflow or missing recovery states. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [polish](../plugins/just-vibe/skills/polish/SKILL.md) | Arbitrary token changes can improve one screen while breaking sibling components or dense content. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [match](../plugins/just-vibe/skills/match/SKILL.md) | A different viewport or unloaded font can masquerade as implementation error; screenshot similarity does not prove behavior. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [copy](../plugins/just-vibe/skills/copy/SKILL.md) | Friendly copy that says a failed operation succeeded or hides irreversible consequences misleads users. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
 | [review](../plugins/just-vibe/skills/review/SKILL.md) | Style preferences, file length or theoretical edge cases without a trigger are not automatically defects. | [Review selection and evidence](../plugins/just-vibe/references/security/review.md); [Language and runtime review methods](../plugins/just-vibe/references/scenarios/language-review.md) |
 | [test](../plugins/just-vibe/skills/test/SKILL.md) | Mock call assertions or tests mirroring helper logic can pass while behavior is wrong. | Technical method and pack guide in entry point |
 | [verify](../plugins/just-vibe/skills/verify/SKILL.md) | A green command on another revision or a screenshot of one state cannot establish all acceptance criteria. | [Requirement evidence](../plugins/just-vibe/references/proofs.md) |
@@ -55,7 +55,7 @@ Generated from the canonical catalog. This is an inventory of authored guidance
 | [doctor](../plugins/just-vibe/skills/doctor/SKILL.md) | Finding an executable or directory does not prove the plugin is enabled or the current session loaded its latest skills. | Technical method and pack guide in entry point |
 | [help](../plugins/just-vibe/skills/help/SKILL.md) | Dumping every command creates search burden; a lexical match does not establish capability availability. | [Discovery and daily utilities](../plugins/just-vibe/references/daily-workflows.md) |
 | [tools](../plugins/just-vibe/skills/tools/SKILL.md) | An installed CLI is not authenticated access; a skill description is not an executable scanner. | [Discovery and daily utilities](../plugins/just-vibe/references/daily-workflows.md) |
-| [auto](../plugins/just-vibe/skills/auto/SKILL.md) | Lexical routing is a suggestion, not authorization or a reason to execute every matching command. | [Daily workflow paths](../plugins/just-vibe/references/daily-workflows.md); [Intent and evidence workflows](../plugins/just-vibe/references/intent-workflows.md) |
+| [auto](../plugins/just-vibe/skills/auto/SKILL.md) | Lexical routing is a suggestion, not authorization or a reason to execute every matching command. | [Adaptive assistance](../plugins/just-vibe/references/adaptive.md); [Daily workflow paths](../plugins/just-vibe/references/daily-workflows.md); [Intent and evidence workflows](../plugins/just-vibe/references/intent-workflows.md) |
 | [profiles](../plugins/just-vibe/skills/profiles/SKILL.md) | A job title is neither a credential nor evidence that all specialty checks were performed. | Technical method and pack guide in entry point |
 | [profile](../plugins/just-vibe/skills/profile/SKILL.md) | Agent inference cannot clear a user pin, and a principal role does not authorize broader architecture changes. | [Project continuity](../plugins/just-vibe/references/daily-workflows.md) |
 
@@ -128,40 +128,40 @@ Generated from the canonical catalog. This is an inventory of authored guidance
 
 | Workflow | Specific failure or ambiguity addressed | Conditional references |
 |---|---|---|
-| [vite-setup](../plugins/just-vibe/skills/vite-setup/SKILL.md) | Copying a config for another major or adding a second package manager can create a setup that only works on one machine. | Technical method and pack guide in entry point |
-| [vite-config](../plugins/just-vibe/skills/vite-config/SKILL.md) | A config file can execute arbitrary imports; read-only inspection should not evaluate it just to discover values. | Technical method and pack guide in entry point |
-| [vite-hmr](../plugins/just-vibe/skills/vite-hmr/SKILL.md) | Full page reload and preserved hot state are different outcomes; disabling host checks is not a generic websocket repair. | Technical method and pack guide in entry point |
-| [vite-env](../plugins/just-vibe/skills/vite-env/SKILL.md) | Prefixing a secret with VITE_ makes it public; booleans read from env may be strings with surprising truthiness. | [Framework-specific review branches](../plugins/just-vibe/references/security/frameworks.md) |
-| [vite-bundle](../plugins/just-vibe/skills/vite-bundle/SKILL.md) | Removing a named import or counting source file sizes does not prove tree-shaking or network improvement. | Technical method and pack guide in entry point |
-| [vite-chunks](../plugins/just-vibe/skills/vite-chunks/SKILL.md) | A smaller entry chunk can add serial requests or cause a stale HTML document to reference a deleted old chunk. | Technical method and pack guide in entry point |
-| [vite-assets](../plugins/just-vibe/skills/vite-assets/SKILL.md) | A leading slash can escape a subpath deployment; a concatenated filename may never enter the build graph. | Technical method and pack guide in entry point |
-| [vite-upgrade](../plugins/just-vibe/skills/vite-upgrade/SKILL.md) | A passing install with ignored peer conflicts does not establish refresh or production compatibility. | Technical method and pack guide in entry point |
+| [vite-setup](../plugins/just-vibe/skills/vite-setup/SKILL.md) | Copying a config for another major or adding a second package manager can create a setup that only works on one machine. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [vite-config](../plugins/just-vibe/skills/vite-config/SKILL.md) | A config file can execute arbitrary imports; read-only inspection should not evaluate it just to discover values. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [vite-hmr](../plugins/just-vibe/skills/vite-hmr/SKILL.md) | Full page reload and preserved hot state are different outcomes; disabling host checks is not a generic websocket repair. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [vite-env](../plugins/just-vibe/skills/vite-env/SKILL.md) | Prefixing a secret with VITE_ makes it public; booleans read from env may be strings with surprising truthiness. | [Framework-specific review branches](../plugins/just-vibe/references/security/frameworks.md); [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [vite-bundle](../plugins/just-vibe/skills/vite-bundle/SKILL.md) | Removing a named import or counting source file sizes does not prove tree-shaking or network improvement. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [vite-chunks](../plugins/just-vibe/skills/vite-chunks/SKILL.md) | A smaller entry chunk can add serial requests or cause a stale HTML document to reference a deleted old chunk. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [vite-assets](../plugins/just-vibe/skills/vite-assets/SKILL.md) | A leading slash can escape a subpath deployment; a concatenated filename may never enter the build graph. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [vite-upgrade](../plugins/just-vibe/skills/vite-upgrade/SKILL.md) | A passing install with ignored peer conflicts does not establish refresh or production compatibility. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
 
 ## React
 
 | Workflow | Specific failure or ambiguity addressed | Conditional references |
 |---|---|---|
-| [react-audit](../plugins/just-vibe/skills/react-audit/SKILL.md) | Missing memoization is not automatically a defect, and ordinary JSX text is escaped by React. | [Framework-specific review branches](../plugins/just-vibe/references/security/frameworks.md) |
-| [react-rerenders](../plugins/just-vibe/skills/react-rerenders/SKILL.md) | Render counts include harmless work and development checks; memoization can retain stale behavior or cost more than recomputation. | Technical method and pack guide in entry point |
-| [react-effects](../plugins/just-vibe/skills/react-effects/SKILL.md) | Suppressing dependency warnings conceals stale closures; aborting a request cannot undo a completed server mutation. | Technical method and pack guide in entry point |
-| [react-state](../plugins/just-vibe/skills/react-state/SKILL.md) | Copying props into state on every update can erase user edits; a module variable can leak state between instances or server requests. | Technical method and pack guide in entry point |
-| [react-component](../plugins/just-vibe/skills/react-component/SKILL.md) | ARIA labels alone do not implement keyboard behavior, focus management or controlled value semantics. | [dialog interaction](../plugins/just-vibe/references/scenarios/dialog.md); [combobox interaction](../plugins/just-vibe/references/scenarios/combobox.md); [date-picker interaction](../plugins/just-vibe/references/scenarios/date-picker.md) |
-| [react-forms](../plugins/just-vibe/skills/react-forms/SKILL.md) | A disabled button alone does not prevent retries or duplicate server effects; number parsing can turn an empty field into zero. | Technical method and pack guide in entry point |
-| [react-async](../plugins/just-vibe/skills/react-async/SKILL.md) | Canceling one waiter must not cancel shared work still owned by another; late rejection can delete a newer cache entry. | Technical method and pack guide in entry point |
-| [react-hydration](../plugins/just-vibe/skills/react-hydration/SKILL.md) | Suppressing hydration warnings does not repair invalid markup or mismatched event/state attachment. | Technical method and pack guide in entry point |
+| [react-audit](../plugins/just-vibe/skills/react-audit/SKILL.md) | Missing memoization is not automatically a defect, and ordinary JSX text is escaped by React. | [Framework-specific review branches](../plugins/just-vibe/references/security/frameworks.md); [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [react-rerenders](../plugins/just-vibe/skills/react-rerenders/SKILL.md) | Render counts include harmless work and development checks; memoization can retain stale behavior or cost more than recomputation. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [react-effects](../plugins/just-vibe/skills/react-effects/SKILL.md) | Suppressing dependency warnings conceals stale closures; aborting a request cannot undo a completed server mutation. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [react-state](../plugins/just-vibe/skills/react-state/SKILL.md) | Copying props into state on every update can erase user edits; a module variable can leak state between instances or server requests. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [react-component](../plugins/just-vibe/skills/react-component/SKILL.md) | ARIA labels alone do not implement keyboard behavior, focus management or controlled value semantics. | [dialog interaction](../plugins/just-vibe/references/scenarios/dialog.md); [combobox interaction](../plugins/just-vibe/references/scenarios/combobox.md); [date-picker interaction](../plugins/just-vibe/references/scenarios/date-picker.md); [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [react-forms](../plugins/just-vibe/skills/react-forms/SKILL.md) | A disabled button alone does not prevent retries or duplicate server effects; number parsing can turn an empty field into zero. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [react-async](../plugins/just-vibe/skills/react-async/SKILL.md) | Canceling one waiter must not cancel shared work still owned by another; late rejection can delete a newer cache entry. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [react-hydration](../plugins/just-vibe/skills/react-hydration/SKILL.md) | Suppressing hydration warnings does not repair invalid markup or mismatched event/state attachment. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
 
 ## UI and frontend
 
 | Workflow | Specific failure or ambiguity addressed | Conditional references |
 |---|---|---|
-| [ui-audit](../plugins/just-vibe/skills/ui-audit/SKILL.md) | A screenshot cannot establish keyboard behavior, contrast in every state or successful end-to-end completion. | Technical method and pack guide in entry point |
-| [ui-system](../plugins/just-vibe/skills/ui-system/SKILL.md) | Renaming colors without updating focus, disabled, dark-mode or data-visualization states leaves an incomplete system. | Technical method and pack guide in entry point |
-| [ui-states](../plugins/just-vibe/skills/ui-states/SKILL.md) | Replacing failed data with an empty-state message misrepresents the result and can encourage destructive user action. | Technical method and pack guide in entry point |
-| [ui-responsive](../plugins/just-vibe/skills/ui-responsive/SKILL.md) | Hiding overflow can conceal controls; hover-only affordances fail on touch or keyboard. | Technical method and pack guide in entry point |
-| [ui-accessibility](../plugins/just-vibe/skills/ui-accessibility/SKILL.md) | Passing an automated checker does not prove keyboard or screen-reader usability; positive tabindex creates fragile ordering. | Technical method and pack guide in entry point |
-| [ui-motion](../plugins/just-vibe/skills/ui-motion/SKILL.md) | A smooth animation can still hide focus, block input or cause discomfort; reduced motion must preserve outcome and feedback. | Technical method and pack guide in entry point |
-| [ui-visual-diff](../plugins/just-vibe/skills/ui-visual-diff/SKILL.md) | Approving a new screenshot merely because it differs converts a regression into the expected result. | Technical method and pack guide in entry point |
-| [ui-flow](../plugins/just-vibe/skills/ui-flow/SKILL.md) | Optimizing one screen can break cross-screen state or erase work when users navigate backward. | Technical method and pack guide in entry point |
+| [ui-audit](../plugins/just-vibe/skills/ui-audit/SKILL.md) | A screenshot cannot establish keyboard behavior, contrast in every state or successful end-to-end completion. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [ui-system](../plugins/just-vibe/skills/ui-system/SKILL.md) | Renaming colors without updating focus, disabled, dark-mode or data-visualization states leaves an incomplete system. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [ui-states](../plugins/just-vibe/skills/ui-states/SKILL.md) | Replacing failed data with an empty-state message misrepresents the result and can encourage destructive user action. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [ui-responsive](../plugins/just-vibe/skills/ui-responsive/SKILL.md) | Hiding overflow can conceal controls; hover-only affordances fail on touch or keyboard. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [ui-accessibility](../plugins/just-vibe/skills/ui-accessibility/SKILL.md) | Passing an automated checker does not prove keyboard or screen-reader usability; positive tabindex creates fragile ordering. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [ui-motion](../plugins/just-vibe/skills/ui-motion/SKILL.md) | A smooth animation can still hide focus, block input or cause discomfort; reduced motion must preserve outcome and feedback. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [ui-visual-diff](../plugins/just-vibe/skills/ui-visual-diff/SKILL.md) | Approving a new screenshot merely because it differs converts a regression into the expected result. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
+| [ui-flow](../plugins/just-vibe/skills/ui-flow/SKILL.md) | Optimizing one screen can break cross-screen state or erase work when users navigate backward. | [Frontend iconography](../plugins/just-vibe/references/frontend-icons.md) |
 
 ## Backend
 

package/evals/releases/0.8.1-publication.json

@@ -0,0 +1,38 @@
+{
+  "schemaVersion": 1,
+  "name": "just-vibe",
+  "version": "0.8.1",
+  "registry": "https://registry.npmjs.org/",
+  "sourceCommit": "e5498aea3ef12e67cdd5ca47cb667eadbb336ebf",
+  "sha256": "b33dfefe73894dc89a44bbcb2d0b7035fa49428dd629b2edf457ea53efd04151",
+  "integrity": "sha512-lcQuQuQB49UApPWpSi95RGGvUjtj1DjWJgYZhJ/64klEka0+zio+rpzl+Aoj4Si3Qk6s0vWrTt8leUoC3f9jCA==",
+  "shasum": "89c9b24f66578dda8c0fac5c50c26ab15ffb6bf5",
+  "verifiedAt": "2026-09-20T21:00:46.506Z",
+  "distTag": "latest",
+  "registryExecution": "0.8.1",
+  "ci": {
+    "status": "waived",
+    "authorization": "The maintainer explicitly requested publishing the changes and waiving GitHub Actions because of insufficient minutes.",
+    "reason": "GitHub reported that jobs could not start because recent account payments failed or the spending limit needed to be increased.",
+    "run": "https://github.com/Zachshotamartin/just-vibe/actions/runs/35537114846",
+    "scope": "v0.8.1 only. No CI pass is claimed; the normal release gate is unchanged."
+  },
+  "localValidation": {
+    "tests": 176,
+    "passed": 175,
+    "failed": 0,
+    "skipped": 1,
+    "skipReason": "Windows-only test on macOS",
+    "releaseNode": "v24.21.0",
+    "skillsValidated": 216,
+    "archiveFiles": 596,
+    "archivePackageManagers": [
+      "npm",
+      "pnpm 10.14.0",
+      "pnpm 12.5.1",
+      "Yarn 4.18.0"
+    ],
+    "record": "0.8.1.md"
+  },
+  "publicationNote": "npm accepted the upload before registry metadata propagated. Read-only reconciliation confirmed the original archive; no second upload was attempted."
+}

package/evals/releases/0.8.1.md

@@ -10,4 +10,6 @@ The release preparation reruns local checks, binds the archive to the clean sour
 
 The maintainer explicitly requested making these changes live and stated that GitHub Actions would fail because of insufficient minutes. This waives the CI gate for v0.8.1 only. It does not mark any Actions job as passed or disable the default CI requirement for future releases. Windows CI coverage remains unavailable; local macOS validation is retained.
 
-This document is prepared before publication. Confirm live status and exact source/artifact identities from the subsequent publication record, rather than inferring publication from a version bump or tarball.
+Published as npm latest on 2026-09-20T21:00:46.506Z. The [publication record](0.8.1-publication.json) confirms source commit e5498aea3ef12e67cdd5ca47cb667eadbb336ebf, archive SHA-256 b33dfefe73894dc89a44bbcb2d0b7035fa49428dd629b2edf457ea53efd04151, registry integrity and fresh-cache execution of v0.8.1. npm initially accepted the upload before its metadata propagated; verification used read-only retries and did not submit a second upload.
+
+The exact archive passed release preparation under Node v24.21.0: 176 tests, 175 passes, no failures and one Windows-only skip; 596 shipped files; npm, pnpm 10.14.0, pnpm 12.5.1 and Yarn 4.18.0 execution; persistent-payload checks after cache removal; and npm publication dry run. GitHub confirmed that jobs could not start because of account billing/spending restrictions. The default CI gate remains unchanged.

package/evals/releases/0.9.0.md

@@ -0,0 +1,19 @@
+# v0.9.0 release validation
+
+Version 0.9.0 adds ordinary-request activation, focused workflow loading, scoped feedback, reversible personal instructions and bounded completion evidence. It also includes the website, documentation, motion/spacing improvements and frontend iconography policy developed since 0.8.1. See the [changelog](../../CHANGELOG.md) and [automatic assistance design and limits](../../docs/adaptive-assistance.md).
+
+Release review fixed host turn handling during automatic continuation, feedback excerpts that omitted task-only restrictions, and interaction between optional project hooks and adaptive completion. Regression tests cover all three cases, including source changes during trusted project checks.
+
+## Verification process
+
+Local validation covers the complete runtime/package test suite, generated skills and references, isolated native Codex and Claude installation lifecycles, and the website build and static checks. Release preparation binds the archive to the clean source commit and tests that exact archive through npm, pnpm 10/12 and Yarn 4. Publication verification compares registry integrity to those bytes and executes the exact version using a fresh temporary directory and cache.
+
+These tests establish fixture and installation behavior. They do not establish universal routing accuracy, model adherence, subjective output quality or native hook delivery on every host and operating system. The Windows-only check is skipped on macOS.
+
+Review validation on September 20, 2026 passed 202 of 203 root tests with one Windows-only skip, 216 generated skills, archive allowlisting and credential-pattern checks. Both native lifecycle checks passed with Codex CLI 0.152.0 and Claude Code 2.1.258. The website built 345 pages and passed four static catalog/link/metadata tests on Node 24.21.0. The first website attempt used an x64 Node executable against installed arm64 dependencies; rerunning with the matching arm64 Node 24.21.0 resolved that local environment mismatch without dependency or lockfile changes.
+
+## CI exception
+
+The maintainer requested reviewing and publishing the newest version and pushing it to GitHub, retaining the earlier instruction to publish using local checks while GitHub Actions minutes are unavailable. The exception applies to v0.9.0 only; it does not record a fictitious CI pass or weaken the normal publisher gate. Remote Linux/Windows CI coverage remains unavailable.
+
+Registry publication is a separate step from preparation. The repository release record is updated with the actual source commit, artifact hashes, registry verification and test results after publication.

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "just-vibe",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Tools, skills, and commands for coding agents.",
+  "homepage": "https://just-vibe-tools.vercel.app/",
   "type": "module",
   "bin": {
     "just-vibe": "bin/just-vibe.mjs"
@@ -26,7 +27,10 @@
     "test:browser": "node scripts/smoke-browser.mjs",
     "release:publish": "node scripts/publish-release.mjs",
     "eval:security": "node evals/security/run.mjs",
-    "eval:conversation": "node evals/conversation/harness.mjs"
+    "eval:conversation": "node evals/conversation/harness.mjs",
+    "website:dev": "npm --prefix website run dev",
+    "website:build": "npm --prefix website run build",
+    "website:test": "npm --prefix website test"
   },
   "files": [
     "bin/",

package/plugins/just-vibe/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "just-vibe",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Engineering role profiles and coding workflows for development, architecture, delivery, data and ML.",
   "author": {
     "name": "Zachary Martin",

package/plugins/just-vibe/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "just-vibe",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Engineering role profiles and coding workflows for development, architecture, delivery, data and ML.",
   "author": {
     "name": "Zachary Martin",