mosaic-headless 1.16.0 → 1.17.0

package/SKILL.md

@@ -4,7 +4,7 @@ description: |
   Build and modify Mosaic Pro (Nextend) sites by writing the underlying data model directly - no visual editor, no DOM. Query the real surface with `mo.py`, which joins every source table to the live sweeps so a lookup leads with the measured verdict rather than the declaration (122 node types, 181 properties, 98 style properties with 20 structured value shapes pinned down, 53 style states, 151 element classes, 74 dynamic variables, 12 interaction triggers, 114 REST routes, 23 tables) instead of guessing, with every node type placed on a live site one at a time and asserted against the delivered HTML, the design-token and element-class layers verified against compiled CSS, the @VAR() dynamic language verified against rendered output, nine designed pages built through the tables themselves, and the delivered pages re-read in Chromium at three viewports so a rule that is present, correct and still wrong cannot pass. Drives Mosaic's own theme export/import from outside the editor and holds the copy against the source tree for tree.
 license: "MIT"
 author: "moksa (https://moksaweb.com)"
-version: "1.16.0"
+version: "1.17.0"
 ---
 
 # Headless Mosaic
@@ -73,8 +73,19 @@ right rule, wrong result    HTTP 200, in the stylesheet, correct, and the BROWSE
                             something you forgot, a font that cannot render the
                             text, a property the layout mode overrides
 no template for the URL     HTTP 406 with an EMPTY BODY for anyone not logged in
+render-time fatal from      HTTP 500 - the commit went through and the page dies
+CONTENT                     when Mosaic parses it. A `code` node's content is a
+                            template: `@media(` (as every minifier writes it) is
+                            read as a function call and kills the whole page.
+                            `@media (` renders. build_page refuses the former.
 ```
 
+That last one also fooled every checker here for a day: WordPress answers a fatal
+with a 2,697-byte error document, which is larger than the 2,000-byte "healthy"
+floor, and `Client.page()` returned that body as if it were the page - so
+`build_site` printed `OK 2645 bytes` over an HTTP 500. A 5xx now reads as an
+empty page, which is what it is.
+
 **406 is Mosaic's "no template matched".** `FrontendRenderer` answers
 `TemplateNotFoundException` with `status_header(406)` and prints the explanation
 only for an admin, so a logged-out visitor gets a blank page and a status code
@@ -244,7 +255,12 @@ CONVERSION   an Elementor page turned into a Mosaic spec and built, then checked
              none introduced by the conversion. That split is a check of its own,
              FIDELITY, and the inherited defects are recorded beside it as still
              real: a 3.19:1 label is 3.19:1 whoever wrote it. 8 of 8.
-             data/conversion-verification.csv
+             Then all 19 pages of the site, each re-converted, built onto one
+             post, cache purged and content-checked in turn: 19 of 19, 3,281
+             elements carried and 11 declared. The one that did not pass the
+             first time was the HTTP 500 above - an "open source" page whose
+             `<style>` blocks wrote `@media(`. data/conversion-verification.csv,
+             data/conversion-batch.csv
 
 ACCORDION    7 checks that resolve a wrong entry in this skill's own tables.
              `accordion-item` and `accordion-content` are recorded BROKE_PAGE, which
@@ -283,6 +299,17 @@ BUILD        nine complete designed pages built through the tables alone and che
              colour anywhere, plus a real studio homepage rebuilt from the
              live moksaweb.com. sites/_moksa.py is the one that ships.
 
+EVAL         the skill itself, put in front of the model with and without it loaded
+             (`claude plugin eval .`, 5 cases x 3 runs x 2 arms, three LLM judges
+             per run). Every case is a question a user of this skill would ask
+             where the measured facts decide the answer: an invented `heading`
+             type, a `code` node that 500s on `@media(`, whether the accordion is
+             usable, moving a theme without going live by accident, placing a grid
+             child on tablet only. With the skill: 1.00 on all five. Without it:
+             0.00 on all five - and the baseline's best answer was to refuse ("I
+             don't have reliable knowledge of Mosaic Pro's spec format"), which is
+             the right thing for a model with no data to do. evals/
+
 MEASURED     114 REST routes, 151 element classes, 59 condition subjects,
              23 tables / 206 columns - read off the running site.
 
@@ -421,6 +448,7 @@ so the pattern is in the data, not just in this paragraph.
 | `data/loop-verification.csv` | 28 | **measured live** - a perpetual animation: periodicity by scrubbing a paused timeline, per-element occlusion of both text and controls at five widths, and the enlarged view opened by pointer and by keyboard |
 | `data/accordion-verification.csv` | 7 | **driven live** - the accordion family nested the way its factory requires, against the guard that refuses it unparented. Resolves two BROKE_PAGE rows |
 | `data/conversion-verification.csv` | 8 | **converted then checked live** - an Elementor page rebuilt as Mosaic and held against its source (text, images, links, heading levels), then put through rwd, browser and the design audit with every finding classified inherited-or-introduced |
+| `data/conversion-batch.csv` | 19 | **converted, built and checked live, one page after another** - every Elementor page of a production site through the converter, with per-page element and content counts |
 | `data/theme-zip-verification.csv` | 22 | **round-tripped live** - Mosaic's own ZIP export imported in test mode and compared to its source, table by table and tree by tree |
 | `data/node-type-notes.csv` | 8 | where a sweep outcome is true but misleading on its own, why. Surfaced by `mo.py type` |
 | `data/interaction-verification.csv` | 7 | **probed live** - interaction animation shapes, with negative controls and the stored row beside the payload |
@@ -559,6 +587,11 @@ post — `build_all.py` resets first for that reason.
   whose spec set neither; between a masthead and the block below it that is a
   160px hole. Set `paddingTop`/`paddingBottom` explicitly when a section's rhythm
   is meant to come from its contents.
+- **A `code` node's content is a template, and `@media(` is a function call.**
+  Mosaic parses `code` content for `@VAR(...)`; a CSS at-rule glued to its
+  parenthesis - the form every minifier emits - is parsed as a call with
+  unparseable arguments and the page renders as HTTP 500, after a clean commit.
+  Write `@media (`. Text nodes are not parsed and are safe; measured both.
 - **The front page 301s.** When a post is `page_on_front`, its own permalink
   (`/moksa/`) redirects to `/`; a fetch that does not follow redirects reads 0
   bytes and looks like an outage.
@@ -656,6 +689,9 @@ wp eval-file tools/theme_zip_compare.php <source> <copy> theme-zip-verification.
 wp eval-file tools/theme_delete.php <copy>
 python tools/probe.py --config lab.json --cases cases.json   # ad-hoc measurement
 python tools/check_placement_predicts.py
+claude plugin eval . --runs 3 -j 3 --no-publish   # the skill vs no skill, 5 cases; Bash is
+                                                  # not granted (no sandbox on Windows), the
+                                                  # agent reads data/ instead of running mo.py
 ```
 
 `bootstrap_probe_theme.php` exists because Mosaic's own new-theme flow calls

package/assets/templates/platforms/claude-ai.json

@@ -20,7 +20,7 @@
     "description": "Build and modify Mosaic Pro (Nextend) sites by writing the underlying data model directly - no visual editor, no DOM. Query the real surface (122 node types, 181 node properties, 98 style properties, 53 style states, 151 element classes, 74 dynamic variables, 114 REST routes, 23 tables) instead of guessing, with every node type placed on a live site one at a time and asserted against the delivered HTML, every style and node property swept against the compiled CSS and markup, and 569 responsive declarations checked against the stylesheet the site actually served.",
     "license": "MIT",
     "author": "moksa (https://moksaweb.com)",
-    "version": "1.16.0"
+    "version": "1.17.0"
   },
   "loaderBehaviour": "Upload via Settings -> Skills -> Upload. Claude.ai parses SKILL.md frontmatter and surfaces the skill in your library. The extraction tool (extract-block-schema.php) needs a live WP-CLI connection and won't run in the sandbox; use it from a local terminal against your own site instead.",
   "uploadSteps": [

package/assets/templates/platforms/claude-code.json

@@ -20,7 +20,7 @@
     "description": "Build and modify Mosaic Pro (Nextend) sites by writing the underlying data model directly - no visual editor, no DOM. Query the real surface (122 node types, 181 node properties, 98 style properties, 53 style states, 151 element classes, 74 dynamic variables, 114 REST routes, 23 tables) instead of guessing, with every node type placed on a live site one at a time and asserted against the delivered HTML, every style and node property swept against the compiled CSS and markup, and 569 responsive declarations checked against the stylesheet the site actually served.",
     "license": "MIT",
     "author": "moksa (https://moksaweb.com)",
-    "version": "1.16.0"
+    "version": "1.17.0"
   },
   "loaderBehaviour": "Auto-loads on session start when SKILL.md frontmatter parses successfully.",
   "verified": true,

package/assets/templates/platforms/codex-cli.json

@@ -20,7 +20,7 @@
     "description": "Build and modify Mosaic Pro (Nextend) sites by writing the underlying data model directly - no visual editor, no DOM. Query the real surface (122 node types, 181 node properties, 98 style properties, 53 style states, 151 element classes, 74 dynamic variables, 114 REST routes, 23 tables) instead of guessing, with every node type placed on a live site one at a time and asserted against the delivered HTML, every style and node property swept against the compiled CSS and markup, and 569 responsive declarations checked against the stylesheet the site actually served.",
     "license": "MIT",
     "author": "moksa (https://moksaweb.com)",
-    "version": "1.16.0"
+    "version": "1.17.0"
   },
   "loaderBehaviour": "Confirmed (2026-07-11): Codex CLI natively supports the SKILL.md spec. Place SKILL.md under .codex/skills/<name>/ (project) or ~/.codex/skills/<name>/ (personal) and Codex loads the name+description at session start, then the full body on demand. A parallel, broader convention .agents/skills/ (searched from cwd up to repo root, then ~/.agents/skills/) also exists across multiple tools - if your Codex CLI version prioritizes that path instead, mirror the same SKILL.md there.",
   "verified": true,

package/assets/templates/platforms/copilot.json

@@ -20,7 +20,7 @@
     "description": "Build and modify Mosaic Pro (Nextend) sites by writing the underlying data model directly - no visual editor, no DOM. Query the real surface (122 node types, 181 node properties, 98 style properties, 53 style states, 151 element classes, 74 dynamic variables, 114 REST routes, 23 tables) instead of guessing, with every node type placed on a live site one at a time and asserted against the delivered HTML, every style and node property swept against the compiled CSS and markup, and 569 responsive declarations checked against the stylesheet the site actually served.",
     "license": "MIT",
     "author": "moksa (https://moksaweb.com)",
-    "version": "1.16.0"
+    "version": "1.17.0"
   },
   "loaderBehaviour": "CHANGED as of 2026-07-11: GitHub Copilot added a proper '.github/skills/' Agent Skills directory (December 2025), alongside the older single-file .github/copilot-instructions.md convention. This config targets the new skills-directory form. If your Copilot version predates this (pre Dec 2025), use the instructions-append fallback instead (see fallback below).",
   "fallback": {

package/assets/templates/platforms/gemini-cli.json

@@ -20,7 +20,7 @@
     "description": "Build and modify Mosaic Pro (Nextend) sites by writing the underlying data model directly - no visual editor, no DOM. Query the real surface (122 node types, 181 node properties, 98 style properties, 53 style states, 151 element classes, 74 dynamic variables, 114 REST routes, 23 tables) instead of guessing, with every node type placed on a live site one at a time and asserted against the delivered HTML, every style and node property swept against the compiled CSS and markup, and 569 responsive declarations checked against the stylesheet the site actually served.",
     "license": "MIT",
     "author": "moksa (https://moksaweb.com)",
-    "version": "1.16.0"
+    "version": "1.17.0"
   },
   "loaderBehaviour": "CHANGED as of 2026-07-11: Gemini CLI now natively supports the same SKILL.md standard as Claude Code and Codex CLI - the same directory-based skill works unmodified. Gemini CLI discovers skills in this precedence order: built-in, extension skills, ~/.gemini/skills/ (personal), .gemini/skills/ (project, shared via version control). At session start Gemini injects each discovered skill's name+description into the system prompt and calls activate_skill when a task matches.",
   "verified": true,

package/bin/check-release.mjs

@@ -183,6 +183,28 @@ if (/,FAIL,/.test(conv)) fail("data/conversion-verification.csv carries a failed
 if (/^IMAGES,PASS,"?0 of 0/m.test(conv))
   fail("conversion-verification.csv: IMAGES passed vacuously on a page with no images");
 
+// The batch table: every page of the site through the converter. One FAIL row
+// means the converter regressed on a real page, which the single-page table can
+// hide by simply being run on the page that still works.
+const batch = read("data/conversion-batch.csv");
+if (!batch.startsWith("elementor_post,converted,skipped,result"))
+  fail("data/conversion-batch.csv is not the batch table");
+if (/,FAIL,/.test(batch)) fail("data/conversion-batch.csv carries a page that did not pass");
+if ((batch.match(/,PASS,/g) || []).length < 10)
+  fail("data/conversion-batch.csv has fewer than 10 passing pages - the batch was not run");
+
+// The eval suite ships with the skill. Five cases with an LLM criteria grader each
+// is the floor; a suite that has quietly lost its cases would let the "1.00 vs 0.00"
+// claim in SKILL.md go stale.
+{
+  const cases = fs.readdirSync(path.join(ROOT, "evals"), { withFileTypes: true })
+    .filter(d => d.isDirectory() && d.name !== "results").map(d => d.name);
+  if (cases.length < 5) fail(`evals/ has ${cases.length} cases, SKILL.md claims five`);
+  for (const c of cases)
+    if (!fs.existsSync(path.join(ROOT, "evals", c, "graders", "criteria.md")))
+      fail(`evals/${c} has no graders/criteria.md`);
+}
+
 const audit = read("data/design-audit.csv");
 if (!audit.startsWith("url,breakpoints,check,level"))
   fail("data/design-audit.csv is not the audit table verify_browser.py writes");

package/data/conversion-batch.csv

@@ -0,0 +1,20 @@
+elementor_post,converted,skipped,result,checks,text,images,links
+1296,87,0,PASS,5/5,35 of 35 source strings,0 of 0 source images,2 of 2 source link targets
+1628,29,1,PASS,5/5,9 of 9 source strings,0 of 0 source images,0 of 0 source link targets
+2339,252,1,PASS,5/5,104 of 104 source strings,11 of 11 source images,26 of 26 source link targets
+2360,254,0,PASS,5/5,113 of 113 source strings,16 of 16 source images,21 of 21 source link targets
+2361,369,1,PASS,5/5,190 of 190 source strings,0 of 0 source images,11 of 11 source link targets
+2604,453,2,PASS,5/5,301 of 301 source strings,0 of 0 source images,1 of 1 source link targets
+2760,8,4,PASS,5/5,3 of 3 source strings,0 of 0 source images,0 of 0 source link targets
+3257,135,0,PASS,5/5,58 of 58 source strings,0 of 0 source images,2 of 2 source link targets
+3455,92,1,PASS,5/5,32 of 32 source strings,0 of 0 source images,2 of 2 source link targets
+9131,156,0,PASS,5/5,72 of 72 source strings,0 of 0 source images,4 of 4 source link targets
+9135,154,0,PASS,5/5,66 of 66 source strings,0 of 0 source images,4 of 4 source link targets
+9139,184,1,PASS,5/5,85 of 85 source strings,0 of 0 source images,2 of 2 source link targets
+9145,150,0,PASS,5/5,64 of 64 source strings,0 of 0 source images,5 of 5 source link targets
+9146,155,0,PASS,5/5,65 of 65 source strings,0 of 0 source images,5 of 5 source link targets
+9147,152,0,PASS,5/5,61 of 61 source strings,0 of 0 source images,4 of 4 source link targets
+9148,154,0,PASS,5/5,61 of 61 source strings,0 of 0 source images,4 of 4 source link targets
+9149,154,0,PASS,5/5,65 of 65 source strings,0 of 0 source images,4 of 4 source link targets
+9151,147,0,PASS,5/5,61 of 61 source strings,0 of 0 source images,6 of 6 source link targets
+9152,196,0,PASS,5/5,112 of 112 source strings,0 of 0 source images,4 of 4 source link targets

package/data/node-type-notes.csv

@@ -2,7 +2,7 @@ type,note
 accordion-content,"Same as accordion-item: BROKE_PAGE unparented, fine under an accordion-item. Note that accordion-item declares only accordion-item and accordion-loop-items as allowed children - title and content arrive through heal(), which is why the placement guard permits them."
 accordion-item,"Swept as BROKE_PAGE, which is what it does under a plain container. The factory needs an `accordion` above it - the failure reads `AccordionElementMResource instance required`. Nested as accordion > accordion-item > (accordion-title, accordion-content) it commits and renders; see tools/probe_accordion.py."
 accordion-title,"Renders as a <dt> carrying tabindex=0 and aria-expanded, and the plugin toggles M_EL_AccordionItem--opened on the item. That is a keyboard-operable disclosure control for free; styling the ITEM off that class needs no :has()."
-code,"`processShortcodes` is NO_EFFECT in the property sweep because the sweep's content carried no shortcode - there was nothing for the flag to act on. With `[woocommerce_my_account]` and processShortcodes ""1"" the node renders the whole WooCommerce account UI (sites/_moksa.py, the my-account page). The flag works; the row records the sweep, not the property."
+code,"`processShortcodes` is NO_EFFECT in the property sweep because the sweep's content carried no shortcode - there was nothing for the flag to act on. With `[woocommerce_my_account]` and processShortcodes ""1"" the node renders the whole WooCommerce account UI (sites/_moksa.py, the my-account page). The flag works; the row records the sweep, not the property. Its content is parsed as a template: a CSS at-rule glued to `(` - `@media(` - is read as a function call and the page renders as HTTP 500 after a clean commit. Write `@media (`; build_page refuses the glued form. Text nodes are not parsed."
 component-instance,"Swept as COMMIT_500, which is what a BARE one does. The node's type is not `component-instance` but `component-instance/<componentID>` - the factory splits on that slash and a bare one has no id to read. With a real component it commits and renders; see sweep_components.py."
 component-internal,"The component's content hangs under THIS node, in the `node/component/<id>` key of a componentDocumentInstance. `component-root` looks like the parent and accepts no children."
 component-root,"Accepts no children. It frames the component's preview document, not its content."

package/evals/accordion-is-not-broken/graders/criteria.md

@@ -0,0 +1,24 @@
+---
+type: llm
+weight: 1
+---
+
+The right answer corrects the premise using what the skill measured: the sweep
+committed every type alone under a plain div, and accordion-item / accordion-content
+broke there because they were committed WITHOUT the parent their factory requires
+(the error strings name the missing parent). Nested properly -
+accordion > accordion-item > (accordion-title, accordion-content) - they commit,
+render as <dl><div class=M_EL_AccordionItem><dt tabindex=0 aria-expanded><dd>, and
+give keyboard operation and a screen-reader state for free.
+
+Score highly when the answer:
+1. Says the accordion IS usable and explains the BROKE_PAGE row as a parent artefact
+   of the sweep method, not a verdict on the type.
+2. Gives the correct nesting, with accordion-title and accordion-content under
+   accordion-item.
+3. Recommends the native accordion over hand-rolled divs for an FAQ, ideally
+   mentioning the accessibility it provides (tabindex/aria-expanded) or that
+   tools/probe_accordion.py proved it.
+
+Score 0.5 if it recommends the native accordion but does not explain the nesting or
+why the table says BROKE_PAGE. Score 0 if it agrees the accordion should be avoided.

package/evals/accordion-is-not-broken/graders/skill-fired.md

@@ -0,0 +1,5 @@
+---
+type: tool_used
+tool: Skill
+weight: 0.01
+---

package/evals/accordion-is-not-broken/prompt.md

@@ -0,0 +1,9 @@
+---
+max_turns: 20
+allowed_tools: [Read, Glob, Grep, Skill]
+---
+
+Your own data says `accordion-content` and `accordion-item` are BROKE_PAGE -
+committing one turned the public page into a 54-byte error string. So I should avoid
+Mosaic's accordion entirely and build a disclosure widget from divs, right? I need an
+expandable FAQ section.

package/evals/build-simple-page/graders/criteria.md

@@ -0,0 +1,23 @@
+---
+type: llm
+weight: 1
+---
+
+A successful answer builds the page from Mosaic's REAL data model rather than from
+guesswork. Score highly when ALL of the following hold:
+
+1. The heading is a `text` node with `tagName: "h1"` - NOT an invented `heading`
+   node type. (Mosaic has no heading type; `text` renders as <div> unless tagName is set.)
+2. The paragraph is a `text` node with `tagName: "p"`.
+3. The button is a `button` node whose `url` is set to /contact/. Bonus: the answer
+   notes that `button` renders as <span> without a url and as <a href> with one, or
+   that target/rel do nothing without a url.
+4. Every node type used is one of Mosaic's real types (div, section, text, button,
+   image, code, menu-link ...). Any node type that does not exist in Mosaic
+   (e.g. "heading", "paragraph", "container", "column") is a failure.
+5. The answer consulted the skill's data before writing - it ran `mo.py` or read
+   data/ files, or explicitly cites the skill's tables - rather than answering from
+   memory.
+
+Score 0 if the spec invents node types or properties. Score 0.5 if the types are
+right but the answer never checked them against the skill's data.

package/evals/build-simple-page/graders/skill-fired.md

@@ -0,0 +1,5 @@
+---
+type: tool_used
+tool: Skill
+weight: 0.01
+---

package/evals/build-simple-page/prompt.md

@@ -0,0 +1,10 @@
+---
+max_turns: 30
+allowed_tools: [Read, Glob, Grep, Skill]
+---
+
+I run a WordPress site on Mosaic Pro. Write me a Mosaic page spec (the JSON that
+tools/build_page.py takes) for a landing section with: an H1 that says "Ship faster",
+one paragraph of body copy, and a call-to-action button that links to /contact/ and
+opens in the same tab. Keep it minimal, but every node type and property must be
+one that actually works.

package/evals/code-node-renders-500/graders/criteria.md

@@ -0,0 +1,23 @@
+---
+type: llm
+weight: 1
+---
+
+The correct diagnosis is specific and measured: a `code` node's content is parsed
+by Mosaic's templating parser (the one that evaluates @VAR(...) expressions), and a
+CSS at-rule written WITHOUT a space before its parenthesis - `@media(` - is read as
+a call to a function named `media`, whose arguments the parser cannot tokenise, so
+rendering fatals (Parser::matchOperator TypeError) after a clean commit.
+
+Score highly when the answer:
+1. Names `@media(` (the glued at-rule) as the cause - not the stylesheet in general,
+   not a syntax error, not a plugin conflict.
+2. Gives the fix: write `@media (` with a space (or otherwise keep at-rules from
+   being parsed as calls).
+3. Explains why the commit succeeded anyway: the failure is at render time, not at
+   validation time - Mosaic has several failure modes that never change the commit's
+   HTTP status.
+
+Score 0.5 if it correctly suspects the @ but proposes something vague (e.g. "escape
+special characters"). Score 0 if it blames caching, PHP memory, the theme, or tells
+the user to check error logs without identifying the cause.

package/evals/code-node-renders-500/graders/skill-fired.md

@@ -0,0 +1,5 @@
+---
+type: tool_used
+tool: Skill
+weight: 0.01
+---

package/evals/code-node-renders-500/prompt.md

@@ -0,0 +1,10 @@
+---
+max_turns: 20
+allowed_tools: [Read, Glob, Grep, Skill]
+---
+
+I committed a Mosaic `code` node containing a minified stylesheet - the commit
+returned HTTP 200 with every revision accepted - and now the whole public page
+returns HTTP 500 with WordPress's "critical error" screen. The stylesheet starts
+with `<style>.hero{color:#fff}@media(max-width:767px){.hero{font-size:24px}}</style>`.
+The commit looks fine. What is wrong and how do I fix it?

package/evals/grid-child-placement/graders/criteria.md

@@ -0,0 +1,23 @@
+---
+type: llm
+weight: 1
+---
+
+The measured facts that decide this: Mosaic's gridColumnStart / gridColumnEnd /
+gridRowStart / gridRowEnd properties exist in the style table but EMIT NOTHING (16
+declarations committed, zero grid-column rules in the delivered CSS), so the
+documented way to place a grid child is `customStyles` with a raw
+`grid-column: 1 / 3;` declaration. And Mosaic's responsive axis is
+states["&"][breakpoint][property] with `_` desktop, `_t` <=1079px, `_m` <=767px -
+`_t` is a min/max band, so a tablet-only value goes under `_t` and, because `_m`
+inherits from `_t`, must be reset under `_m`.
+
+Score highly when the answer:
+1. Does NOT recommend gridColumnStart/gridColumnEnd as the solution (or explicitly
+   says they are inert and why).
+2. Uses customStyles with grid-column (or grid-area) for the placement.
+3. Puts the value under the `_t` breakpoint and resets it under `_m` (or explains
+   that breakpoints cascade downward so mobile must be handled).
+
+Score 0.5 if it uses customStyles correctly but ignores the breakpoint cascade.
+Score 0 if it recommends gridColumnStart or invents a breakpoint name.

package/evals/grid-child-placement/graders/skill-fired.md

@@ -0,0 +1,5 @@
+---
+type: tool_used
+tool: Skill
+weight: 0.01
+---

package/evals/grid-child-placement/prompt.md

@@ -0,0 +1,8 @@
+---
+max_turns: 20
+allowed_tools: [Read, Glob, Grep, Skill]
+---
+
+In my Mosaic page I have a CSS grid container and I want one child to span the
+first two columns on tablet only (not on desktop, not on mobile). Which style
+properties do I set?

package/evals/move-theme-safely/graders/criteria.md

@@ -0,0 +1,21 @@
+---
+type: llm
+weight: 1
+---
+
+The skill documents two paths and one serious trap. Score highly when the answer:
+
+1. Names at least one real path from the skill: `theme_export.php` /
+   `theme_import.php` (JSON rows over WP-CLI, ids kept because every scoped table has
+   a composite (themeID, ID) primary key) and/or `theme_zip.py` driving Mosaic's own
+   ZIP export/import over its milestone protocol.
+2. States the trap: Mosaic's native import DEFAULTS TO ACTIVATING the imported theme
+   as the live site (themeActivateMode falls back to 'live'), and `replaceThemeID`
+   deletes the theme it names - so the import should be run in test mode first
+   (theme_zip.py does this unless told --activate).
+3. Mentions that a whole theme moves, never a single page, and/or that a tree-walking
+   import drops orphan nodes that a row-copy carries.
+
+Score 0.5 if it gives a real path but omits the live-activation trap. Score 0 if it
+suggests copying the database or the theme folder by hand, or invents an
+export feature that the skill does not document.

package/evals/move-theme-safely/graders/skill-fired.md

@@ -0,0 +1,5 @@
+---
+type: tool_used
+tool: Skill
+weight: 0.01
+---

package/evals/move-theme-safely/prompt.md

@@ -0,0 +1,7 @@
+---
+max_turns: 20
+allowed_tools: [Read, Glob, Grep, Skill]
+---
+
+I have a Mosaic theme on a staging install and I want to move it to production.
+What are my options, and what could go wrong?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mosaic-headless",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "description": "AI-agent skill: build Mosaic Pro (Nextend) WordPress sites by writing the underlying data model directly - 23 custom tables, no visual editor, no DOM. Every node type, style property and node property swept against a live install and asserted on the delivered HTML and compiled CSS. Installs into Claude Code, Cursor, Codex CLI, Gemini CLI, Copilot, Continue, Windsurf and Claude.ai.",
   "keywords": [
     "wordpress",
@@ -43,7 +43,8 @@
     "README.zh-TW.md",
     "README.ja.md",
     "README.ko.md",
-    "LICENSE"
+    "LICENSE",
+    "evals/"
   ],
   "engines": {
     "node": ">=18"

package/references/failure-modes.md

@@ -269,3 +269,28 @@ python tools/sweep_node_types.py --config sweep.json --sweep
 ```
 
 The sweep is destructive by design and must only be pointed at a scratch site.
+
+## Render-time fatal from content: HTTP 500 after a clean commit
+
+A `code` node's content is run through Mosaic's templating parser at render, which
+is how `@VAR('post/title')` works inside raw HTML. It also means a CSS at-rule
+written without a space - `@media(max-width:767px)`, which is how every minifier
+writes it - is read as a call to a function named `media` with arguments the
+parser cannot tokenise:
+
+```
+commit  -> HTTP 200, 238 nodes, syncResponseEnvelopes all "create"
+render  -> HTTP 500. PHP Fatal: Parser::matchOperator(): Argument #1 ($token)
+           must be of type Token, null given  (TemplatingParser/Parser.php:151)
+```
+
+Measured on the demo site with each form alone on a page: `@media (` renders,
+`@media(` does not; `@supports(` the same. Text nodes are NOT parsed - a paragraph
+containing `@media(max-width:1px)` or `info@example.com` renders literally - so the
+trap is scoped to `code`. `build_page.py` refuses a `code` node whose content
+matches a glued at-rule, and `from_elementor.py` inserts the space and reports it.
+
+The other half of this finding is about the checkers: WordPress's "critical error"
+page is 2,697 bytes, above the 2,000-byte healthy floor, and `Client.page()` was
+returning an HTTPError's body as the page - so `build_site` announced `OK` over a
+500 and a whole batch believed it. A 5xx now returns an empty body.

package/tools/build_page.py

@@ -43,6 +43,7 @@ import argparse
 import csv
 import json
 import os
+import re
 import sys
 import uuid
 
@@ -64,6 +65,11 @@ def load_csv(name):
         return list(csv.DictReader(fh))
 
 
+AT_RULE_GLUED = re.compile(
+    r"@(media|supports|container|layer|scope|import|page|starting-style|"
+    r"font-feature-values|counter-style|property|document)\(")
+
+
 class Surface:
     """Everything the builder is allowed to know, loaded from the skill's own tables."""
 
@@ -90,6 +96,20 @@ class Surface:
         if t not in self.types:
             problems.append("unknown node type %r" % t)
             return problems
+        # A `code` node's content is parsed as a Mosaic template at render time,
+        # and a CSS at-rule glued to its parenthesis - `@media(`, the way every
+        # minifier writes it - is read as a function call whose arguments cannot
+        # be parsed. The commit succeeds; the public page becomes an HTTP 500.
+        # Measured both ways on the demo site (`@media (` renders, `@media(`
+        # does not). Refused here for the same reason an unsafe type is: the
+        # failure is silent at the only point this tool can still stop it.
+        if t == "code" and not force:
+            content = (node.get("data") or {}).get("content") or ""
+            hit = AT_RULE_GLUED.search(content)
+            if hit:
+                problems.append("code content contains `%s` - Mosaic's template parser reads "
+                                "it as a function call and the page renders as HTTP 500; "
+                                "write `%s (`" % (hit.group(0), hit.group(0)[:-1]))
         # node-verification.csv measured every type UNDER A PLAIN DIV. A type that broke
         # there is not broken in general - most of them are family members that simply
         # need their own parent. So the measured verdict only applies when the parent is

package/tools/from_elementor.py

@@ -281,10 +281,27 @@ def as_button(el, ctx):
     return styled(node, s, extra)
 
 
+# CSS at-rules that minifiers glue to their parenthesis. Mosaic parses a `code`
+# node's content as a template - `@VAR(...)`, `@concat(...)` - and reads
+# `@media(` as a function call whose arguments it then cannot parse:
+#   TypeError: Parser::matchOperator(): Argument #1 must be Token, null given
+# at RENDER time, as an HTTP 500 for the whole page, after a commit that went
+# through cleanly. `@media (` with the space is left alone. Measured on the
+# demo site, both forms, alone on a page; text nodes are not parsed and are safe.
+AT_RULE_GLUED = re.compile(
+    r"@(media|supports|container|layer|scope|import|page|starting-style|"
+    r"font-feature-values|counter-style|property|document)\(")
+
+
 @handler("html", "shortcode")
 def as_html(el, ctx):
     s = el.get("settings") or {}
     raw = s.get("html") or s.get("shortcode") or ""
+    fixed, n = AT_RULE_GLUED.subn(lambda m: "@%s (" % m.group(1), raw)
+    if n:
+        ctx.note(el, "%d CSS at-rule(s) written as `@media(` given the space Mosaic's "
+                     "template parser needs - `@media(` renders as HTTP 500" % n)
+        raw = fixed
     return {"type": "code",
             "data": {"attrID": ctx.attr(el), "insertLocation": "inPlace",
                      "content": raw,

package/tools/sweep_node_types.py

@@ -85,6 +85,15 @@ class Client:
             with urllib.request.urlopen(req, timeout=120) as r:
                 return r.read().decode("utf-8", "replace")
         except urllib.error.HTTPError as e:
+            # A 5xx is not a page. WordPress answers a render-time PHP fatal with a
+            # 2,697-byte "critical error" document, which is LARGER than
+            # MIN_HEALTHY_BYTES - so returning that body made build_site print
+            # "OK 2645 bytes" over a dead page, and probe.py call it healthy. An
+            # empty string is what every byte-based check downstream already
+            # treats as broken. 4xx bodies are kept: a 404 page is real content
+            # and a 406 has none.
+            if e.code >= 500:
+                return ""
             return e.read().decode("utf-8", "replace")
 
 

package/tools/verify_conversion.py

@@ -50,12 +50,20 @@ def text_of(v):
     return re.sub(r"\s+", " ", t).strip()
 
 
-def harvest(tree):
-    """Every piece of content the source page claims to have."""
+def harvest(tree, skip_ids=frozenset()):
+    """Every piece of content the source page claims to have.
+
+    `skip_ids` are the elements the converter's report declared SKIPPED. Their
+    whole subtree is left out here, because the converter already said, in
+    writing and with a reason, that it did not carry them - counting their text
+    as lost a second time would make the report look worse the more honest the
+    converter was. They are still shown, under `declared`."""
     texts, images, links, headings, skipped_kinds = [], [], [], [], []
 
     def walk(els):
         for e in els:
+            if e.get("id") in skip_ids:
+                continue
             s = e.get("settings") or {}
             kind = e.get("widgetType") or e.get("elType")
             for k in ("title", "text", "button_text", "editor"):
@@ -131,13 +139,13 @@ def main():
     tree = json.loads(open(a.data, encoding="utf-8").read())
     if isinstance(tree, dict):
         tree = tree.get("content") or tree.get("elements") or [tree]
-    texts, images, links, headings, _ = harvest(tree)
-
-    declared = []
+    declared, skip_ids = [], set()
     if a.report:
         for r in csv.DictReader(open(a.report, encoding="utf-8")):
             if r["result"] == "SKIPPED":
                 declared.append((r["kind"], r["detail"]))
+                skip_ids.add(r["elementor_id"])
+    texts, images, links, headings, _ = harvest(tree, frozenset(skip_ids))
 
     with sync_playwright() as pw:
         b = pw.chromium.launch()