opendevbrowser 0.0.16 → 0.0.18

package/skills/opendevbrowser-best-practices/artifacts/parity-gates.md

@@ -12,7 +12,8 @@ Define hard pass/fail gates so CLI, tool, and runtime surfaces stay aligned.
 | Navigation + refs loop | managed, extension, cdpConnect | CLI + tools + runtime | `goto/wait/snapshot` parity |
 | Interaction | managed, extension, cdpConnect | CLI + tools + runtime | click/type/select/scroll/press/check/uncheck parity |
 | Targets + pages | managed, extension, cdpConnect | CLI + tools + runtime | target/page command parity |
-| DOM + diagnostics + export | managed, extension, cdpConnect | CLI + tools + runtime | dom/perf/screenshot/console/network/clone parity |
+| DOM + diagnostics + export | managed, extension, cdpConnect | CLI + tools + runtime | dom/perf/screenshot/screencast/browser replay/console/network/clone parity |
+| Desktop observation | local desktop runtime | CLI + tools + daemon | desktop status/window/capture/accessibility parity |
 | Relay channels | extension (default) + extension-legacy | `/ops` + `/cdp` | `/ops` namespace coverage + `/cdp` envelope compatibility |
 
 ## Surface Rules
@@ -30,7 +31,13 @@ npm run test -- tests/tools.test.ts tests/daemon-command.test.ts
 npm run test -- tests/providers-performance-gate.test.ts
 ```
 
+## Contract gates vs live release proof
+
+- `tests/parity-matrix.test.ts` is contract coverage for CLI/tool/runtime surface parity.
+- `node scripts/provider-direct-runs.mjs --release-gate --out artifacts/release/vX.Y.Z/provider-direct-runs.json` and `node scripts/live-regression-direct.mjs --release-gate --out artifacts/release/vX.Y.Z/live-regression-direct.json` are the live release-proof lane.
+- Treat grouped contract checks and direct-run release proof as complementary, not interchangeable.
+
 ## Release Requirement
 
 Ship only when parity tests pass and docs (`README.md`, `docs/CLI.md`, `docs/ARCHITECTURE.md`, `docs/SURFACE_REFERENCE.md`) reflect the same surface map.
-Use `docs/RELEASE_PARITY_CHECKLIST.md` as the release gate source of truth.
+Use `docs/RELEASE_RUNBOOK.md` and the current version-scoped release evidence ledger as the release gate source of truth.

package/skills/opendevbrowser-best-practices/artifacts/provider-workflows.md

@@ -82,6 +82,12 @@ Expected output:
 - `workerStats[]` with `{ sessionId, processed, failures }`
 - `frontierStats` and checkpoint state
 
+## Release evidence lane
+
+- Use `node scripts/provider-direct-runs.mjs --release-gate --out artifacts/release/vX.Y.Z/provider-direct-runs.json` for provider live release proof.
+- Use `node scripts/live-regression-direct.mjs --release-gate --out artifacts/release/vX.Y.Z/live-regression-direct.json` for cross-surface live release proof.
+- Treat parity matrix tests as contract coverage, not live release proof.
+
 ## Failure Policy
 
 - stale refs: re-snapshot and retry once

package/skills/opendevbrowser-best-practices/artifacts/skill-runtime-surface-matrix.md

@@ -0,0 +1,58 @@
+# Skill Runtime Surface Matrix
+
+Canonical inventory of repo-local OpenDevBrowser skill packs and the runtime surfaces they must prove with real workflow execution.
+
+## Canonical skill packs
+
+| Pack | Type | Validator | Runtime surfaces | Real workflow proof lane | External boundary |
+|---|---|---|---|---|---|
+| `opendevbrowser-best-practices` | `governance` | `./skills/opendevbrowser-best-practices/scripts/validate-skill-assets.sh` | surface docs, workflow router, release evidence policy, CLI or tool or `/ops` or `/canvas` inventory | `node scripts/docs-drift-check.mjs`, `./skills/opendevbrowser-best-practices/scripts/run-robustness-audit.sh`, `node scripts/cli-smoke-test.mjs`, `node scripts/provider-direct-runs.mjs`, `node scripts/live-regression-direct.mjs`, `node scripts/canvas-competitive-validation.mjs` | extension unavailable at start, auth walls, anti-bot pressure, rate limits, upstream outage |
+| `opendevbrowser-continuity-ledger` | `doc_only` | `./skills/opendevbrowser-continuity-ledger/scripts/validate-skill-assets.sh` | continuity ownership, ledger template, reply protocol | validator output plus `skill-discovery` and `docs-drift`; no live browser probe | not applicable |
+| `opendevbrowser-data-extraction` | `workflow` | `./skills/opendevbrowser-data-extraction/scripts/validate-skill-assets.sh` | snapshot, DOM text/html extraction, pagination, quality gates, structured extraction | `node scripts/cli-smoke-test.mjs` plus `node scripts/product-video-fixture-live-probe.mjs` for structured extraction on a repo-local product page | extension unavailable at start if extension mode is audited separately |
+| `opendevbrowser-design-agent` | `browser_surface` | `./skills/opendevbrowser-design-agent/scripts/validate-skill-assets.sh` | `/canvas`, annotate send/stored semantics, design contract workflow, real-surface validation | `node scripts/live-regression-direct.mjs`, `node scripts/canvas-competitive-validation.mjs` | extension unavailable at start, optional Figma live smoke |
+| `opendevbrowser-form-testing` | `workflow` | `./skills/opendevbrowser-form-testing/scripts/validate-skill-assets.sh` | snapshot -> type/click -> validation loop, multi-step forms, challenge checkpoints, network correlation | `node scripts/cli-smoke-test.mjs` plus `node scripts/login-fixture-live-probe.mjs` for invalid-submit, MFA, and persistence branches | extension unavailable at start if extension mode is audited separately |
+| `opendevbrowser-login-automation` | `workflow` | `./skills/opendevbrowser-login-automation/scripts/validate-skill-assets.sh` | login branching, invalid credential handling, MFA step-up, session validation | `node scripts/login-fixture-live-probe.mjs` | none; proof lane is repo-local |
+| `opendevbrowser-product-presentation-asset` | `workflow` | `./skills/opendevbrowser-product-presentation-asset/scripts/validate-skill-assets.sh` | `product-video run`, asset-pack assembly, screenshots, evidence mapping | `node scripts/product-video-fixture-live-probe.mjs` | none; proof lane is repo-local |
+| `opendevbrowser-research` | `workflow` | `./skills/opendevbrowser-research/scripts/validate-skill-assets.sh` | `research run`, timebox resolution, multi-source artifact generation | `opendevbrowser research run --topic "<topic>" --source-selection auto --mode json` via `scripts/skill-runtime-audit.mjs` | auth walls, rate limits, upstream source failure |
+| `opendevbrowser-shopping` | `workflow` | `./skills/opendevbrowser-shopping/scripts/validate-skill-assets.sh` | `shopping run`, offer normalization, market analysis, direct provider workflows | `node scripts/provider-direct-runs.mjs` | auth walls, anti-bot challenges, rate limits, upstream outage |
+
+## Shared runtime families
+
+| Runtime family | Representative CLI surface | Representative tool surface | Real task | Proof lane |
+|---|---|---|---|---|
+| Session lifecycle and daemon control | `serve`, `status`, `launch`, `disconnect` | `opendevbrowser_launch`, `opendevbrowser_status`, `opendevbrowser_disconnect` | start a session, inspect state, then close it cleanly | `node scripts/cli-smoke-test.mjs`, `node scripts/live-regression-direct.mjs` |
+| Navigation and interaction | `goto`, `wait`, `click`, `hover`, `press`, `type`, `select`, `scroll`, `scroll-into-view` | matching `opendevbrowser_*` interaction tools | move through an interactive page and complete an action loop | `node scripts/cli-smoke-test.mjs`, `node scripts/login-fixture-live-probe.mjs` |
+| Pointer controls | `pointer-move`, `pointer-down`, `pointer-up`, `pointer-drag` | `opendevbrowser_pointer_move`, `opendevbrowser_pointer_down`, `opendevbrowser_pointer_up`, `opendevbrowser_pointer_drag` | low-level pointer movement for challenge-aware or canvas-aligned surfaces | `node scripts/login-fixture-live-probe.mjs` plus pointer-aware source inventory |
+| DOM and extraction | `dom-html`, `dom-text`, `dom-attr`, `dom-value`, `dom-visible`, `dom-enabled`, `dom-checked` | matching `opendevbrowser_dom_*` tools | extract structured fields and validate state transitions | `node scripts/cli-smoke-test.mjs`, `node scripts/product-video-fixture-live-probe.mjs` |
+| Targets and pages | `targets-list`, `target-use`, `target-new`, `target-close`, `page`, `pages`, `page-close` | matching `opendevbrowser_target_*` tools | switch tabs/pages during a real flow | `node scripts/cli-smoke-test.mjs` |
+| Diagnostics and export | `perf`, `screenshot`, `console-poll`, `network-poll`, `clone-page`, `clone-component`, `debug-trace-snapshot` | matching diagnostics/export tools | capture browser evidence after a real workflow step | `node scripts/cli-smoke-test.mjs`, `node scripts/live-regression-direct.mjs` |
+| Browser replay and desktop observation | `screencast-start`, `screencast-stop`, `desktop-status`, `desktop-capture-desktop` | matching replay/desktop tools | capture time-based browser evidence or read-only sibling desktop state during an investigation | `node scripts/live-regression-direct.mjs`, `node scripts/docs-drift-check.mjs` |
+| Workflow wrappers | `research run`, `shopping run`, `product-video run` | `opendevbrowser_research_run`, `opendevbrowser_shopping_run`, `opendevbrowser_product_video_run` | run end-to-end research, shopping, and product asset workflows | `scripts/skill-runtime-audit.mjs`, `scripts/provider-direct-runs.mjs`, `scripts/product-video-fixture-live-probe.mjs` |
+| Canvas and design relay | `canvas` CLI and `/canvas` commands | `opendevbrowser_canvas` | open a canvas session, mutate safely, render preview, and validate feedback | `node scripts/live-regression-direct.mjs`, `node scripts/canvas-competitive-validation.mjs` |
+| Extension `/ops` relay | `/ops` session, target, nav, interact, pointer, DOM, overlay, preview bridge envelopes | extension-backed tool parity via daemon | attach the extension, verify `/ops` readiness, and run real command loops | `node scripts/live-regression-direct.mjs`, `node scripts/docs-drift-check.mjs` |
+| Skill discovery and loading | bundled `skills/` directories and loader search paths | `opendevbrowser_skill_list`, `opendevbrowser_skill_load` | enumerate and load the canonical packs | `node scripts/skill-runtime-audit.mjs` |
+
+## Audit domains
+
+| Audit domain | Covers | Proof lanes | Contract tests | Targeted reruns |
+|---|---|---|---|---|
+| `skills-assets-discovery` | bundled skills, validator assets, loader discovery, install targets | `skill-discovery`, `docs-drift` | `tests/skill-loader.test.ts`, `tests/skill-workflow-packs.test.ts`, `tests/cli-skills-installer.test.ts` | `./skills/opendevbrowser-best-practices/scripts/validate-skill-assets.sh`, `node scripts/skill-runtime-audit.mjs --smoke --out artifacts/skill-runtime-audit/smoke.json` |
+| `cli-tools-surface` | CLI args/help, tool registry, surface inventory docs | `docs-drift`, `cli-smoke` | `tests/cli-help.test.ts`, `tests/cli-help-parity.test.ts`, `tests/daemon-commands.integration.test.ts` | `node scripts/docs-drift-check.mjs`, `node scripts/cli-smoke-test.mjs` |
+| `scripts-and-governance` | audit scripts, workflow router, drift and robustness policy | `docs-drift`, `best-practices-robustness`, `skill-discovery` | `tests/docs-drift-check.test.ts`, `tests/skill-runtime-audit.test.ts`, `tests/audit-zombie-files.test.ts` | `./skills/opendevbrowser-best-practices/scripts/run-robustness-audit.sh`, `node scripts/docs-drift-check.mjs` |
+| `browser-snapshot-interaction` | browser lifecycle, snapshot refs, DOM reads, click/type flows | `cli-smoke`, `login-fixture`, `product-video-fixture` | `tests/tools-workflows.test.ts`, `tests/tools-workflows-branches.test.ts`, `tests/browser-manager.test.ts` | `node scripts/cli-smoke-test.mjs`, `node scripts/login-fixture-live-probe.mjs --out artifacts/skill-runtime-audit/lanes/login-fixture.json` |
+| `canvas-annotate-design` | `/canvas`, annotate delivery, design-agent workflow, extension canvas runtime | `live-regression`, `canvas-competitive` | `tests/canvas-command-inventory.test.ts`, `tests/canvas-live-workflow-script.test.ts`, `tests/annotate-live-probe-script.test.ts` | `node scripts/live-regression-direct.mjs --out artifacts/skill-runtime-audit/lanes/live-regression.json`, `node scripts/canvas-competitive-validation.mjs --out artifacts/skill-runtime-audit/lanes/canvas-competitive.json` |
+| `extension-relay-cdp` | extension `/ops`, relay contracts, legacy CDP, target-session routing | `live-regression`, `docs-drift` | `tests/parity-matrix.test.ts`, `tests/relay-server.test.ts`, `tests/ops-browser-manager.test.ts` | `node scripts/live-regression-direct.mjs --out artifacts/skill-runtime-audit/lanes/live-regression.json`, `./skills/opendevbrowser-best-practices/scripts/odb-workflow.sh cdp-channel-check` |
+| `providers-macros-workflows` | providers, workflow wrappers, macro resolve or execute, product-video | `provider-direct`, `research-live`, `product-video-fixture` | `tests/provider-direct-runs.test.ts`, `tests/macro-resolve.test.ts`, `tests/cli-macro-resolve.test.ts` | `node scripts/provider-direct-runs.mjs --smoke --out artifacts/skill-runtime-audit/lanes/provider-direct.json`, `npm run test -- tests/macro-resolve.test.ts tests/cli-macro-resolve.test.ts` |
+| `challenges-and-guardrails` | challenge coordinator, browser-scoped `challengeAutomationMode` computer-use boundary, login/form challenge branches, blocker envelopes | `login-fixture`, `provider-direct`, `research-live`, `live-regression` | `tests/challenges-capability-matrix.test.ts`, `tests/browser-manager-challenge-runtime-handle.test.ts`, `tests/ops-browser-manager-challenge-runtime-handle.test.ts` | `node scripts/login-fixture-live-probe.mjs --out artifacts/skill-runtime-audit/lanes/login-fixture.json`, `node scripts/provider-direct-runs.mjs --smoke --out artifacts/skill-runtime-audit/lanes/provider-direct.json` |
+| `runtime-infrastructure` | bootstrap, runtime factory, daemon client, shared hub utilities | `cli-smoke`, `live-regression` | `tests/core-bootstrap.test.ts`, `tests/providers-runtime-factory.test.ts`, `tests/daemon-client.test.ts` | `npm run test -- tests/core-bootstrap.test.ts tests/providers-runtime-factory.test.ts tests/daemon-client.test.ts`, `node scripts/cli-smoke-test.mjs` |
+
+## Acceptance rules
+
+- A pack is `fail` when discovery/load parity fails, the validator fails, the required live probe is missing, or the real workflow probe reports a repo-owned defect.
+- A pack is `env_limited` only when the probe exists, ran, and hit a real external blocker.
+- `scripts/skill-runtime-audit.mjs` smoke mode may use isolated temp harnesses, but smoke `live-regression` failures must be rerun against the current configured daemon before they count as repo-owned defects.
+- Full-mode `provider-direct` and `live-regression` lanes must reuse the current configured daemon/environment so extension and auth-backed coverage is real when available.
+- Non-release provider-direct profiles may emit skipped coverage-gap advisories when reduced mode coverage omits provider ids; release-gate mode upgrades the same gap to a failure.
+- A shared runtime family is considered covered only when at least one live proof lane exercised that family during the same audit pass.
+- An audit domain is `fail` when any mapped proof lane or mapped pack reports a repo-owned defect.
+- An audit domain is `env_limited` when it has no repo defects but a mapped proof lane hit real external blockers.

package/skills/opendevbrowser-best-practices/assets/templates/canvas-blocker-checklist.json

@@ -0,0 +1,70 @@
+{
+  "schemaVersion": "1.0",
+  "canvasSessionId": "<canvas-session-id>",
+  "documentId": "<document-id>",
+  "blockers": [
+    {
+      "auditId": "CANVAS-01",
+      "code": "plan_required",
+      "blockingCommand": "canvas.document.patch",
+      "requiredNextCommands": [
+        "canvas.plan.set"
+      ],
+      "status": "pending"
+    },
+    {
+      "auditId": "CANVAS-02",
+      "code": "governance_required",
+      "blockingCommand": "canvas.document.save",
+      "requiredNextCommands": [
+        "canvas.capabilities.get"
+      ],
+      "status": "pending"
+    },
+    {
+      "auditId": "CANVAS-03",
+      "code": "generation_plan_invalid",
+      "blockingCommand": "canvas.plan.set",
+      "requiredNextCommands": [
+        "canvas.plan.set"
+      ],
+      "status": "pending"
+    },
+    {
+      "auditId": "CANVAS-04",
+      "code": "policy_violation",
+      "blockingCommand": "canvas.document.patch",
+      "requiredNextCommands": [
+        "canvas.capabilities.get"
+      ],
+      "status": "pending"
+    },
+    {
+      "auditId": "CANVAS-05",
+      "code": "unsupported_target",
+      "blockingCommand": "canvas.overlay.mount",
+      "requiredNextCommands": [
+        "canvas.tab.open"
+      ],
+      "status": "pending"
+    },
+    {
+      "auditId": "CANVAS-06",
+      "code": "budget_exceeded",
+      "blockingCommand": "canvas.preview.render",
+      "requiredNextCommands": [
+        "canvas.preview.refresh"
+      ],
+      "status": "pending"
+    },
+    {
+      "auditId": "CANVAS-07",
+      "code": "feedback_metadata_missing",
+      "blockingCommand": "canvas.feedback.poll",
+      "requiredNextCommands": [
+        "canvas.feedback.poll"
+      ],
+      "status": "pending"
+    }
+  ]
+}

package/skills/opendevbrowser-best-practices/assets/templates/canvas-feedback-eval.json

@@ -0,0 +1,73 @@
+{
+  "schemaVersion": "1.0",
+  "canvasSessionId": "<canvas-session-id>",
+  "documentId": "<document-id>",
+  "targetIds": [
+    "<target-id>"
+  ],
+  "afterCursor": null,
+  "categories": [
+    "render",
+    "console",
+    "network",
+    "validation",
+    "performance",
+    "asset",
+    "export"
+  ],
+  "requiredEventTypes": [
+    "feedback.item",
+    "feedback.heartbeat",
+    "feedback.complete"
+  ],
+  "requiredFieldsPerItem": [
+    "documentId",
+    "pageId",
+    "prototypeId",
+    "targetId",
+    "documentRevision",
+    "severity",
+    "class",
+    "message",
+    "evidenceRefs"
+  ],
+  "requiredIssueClasses": [
+    "CANVAS-01",
+    "CANVAS-02",
+    "CANVAS-03",
+    "CANVAS-04",
+    "CANVAS-05",
+    "CANVAS-06",
+    "CANVAS-07"
+  ],
+  "checks": [
+    {
+      "auditId": "CANVAS-01",
+      "description": "Reject feedback-based mutation when handshake evidence is missing."
+    },
+    {
+      "auditId": "CANVAS-02",
+      "description": "Carry governance warnings through save/export evaluation."
+    },
+    {
+      "auditId": "CANVAS-03",
+      "description": "Treat malformed generation plans as blocking plan validation failures."
+    },
+    {
+      "auditId": "CANVAS-04",
+      "description": "Report library or icon-policy violations as structured validation findings."
+    },
+    {
+      "auditId": "CANVAS-05",
+      "description": "Capture unsupported target or overlay mount failures with target attribution."
+    },
+    {
+      "auditId": "CANVAS-06",
+      "description": "Verify preview downgrade and runtime budget warnings are surfaced."
+    },
+    {
+      "auditId": "CANVAS-07",
+      "description": "Require targetId, pageId, class, and evidenceRefs on feedback items."
+    }
+  ]
+}

package/skills/opendevbrowser-best-practices/assets/templates/canvas-generation-plan.v1.json

@@ -0,0 +1,67 @@
+{
+  "requestId": "req_plan_01",
+  "canvasSessionId": "<canvas-session-id>",
+  "leaseId": "<lease-id>",
+  "documentId": "<document-id>",
+  "generationPlan": {
+    "targetOutcome": {
+      "mode": "high-fi-live-edit",
+      "summary": "Refine hero hierarchy and CTA clarity"
+    },
+    "visualDirection": {
+      "profile": "cinematic-minimal",
+      "styleAxes": {
+        "contrast": "high",
+        "density": "airy"
+      }
+    },
+    "layoutStrategy": {
+      "approach": "hero-led-grid"
+    },
+    "contentStrategy": {
+      "source": "document-context"
+    },
+    "componentStrategy": {
+      "mode": "reuse-first",
+      "approvedLibraries": [
+        "shadcn"
+      ]
+    },
+    "motionPosture": {
+      "level": "subtle",
+      "allow3D": false,
+      "allowParallax": false,
+      "allowCustomSmoothScroll": false
+    },
+    "responsivePosture": {
+      "primaryViewport": "desktop",
+      "requiredViewports": [
+        "desktop",
+        "tablet",
+        "mobile"
+      ]
+    },
+    "accessibilityPosture": {
+      "target": "WCAG_2_2_AA",
+      "reducedMotion": "required",
+      "keyboardParity": true
+    },
+    "validationTargets": {
+      "blockOn": [
+        "contrast-failure"
+      ],
+      "warnOn": [
+        "responsive-mismatch"
+      ]
+    }
+  },
+  "requiredIssueClasses": [
+    "CANVAS-01",
+    "CANVAS-02",
+    "CANVAS-03",
+    "CANVAS-04",
+    "CANVAS-05",
+    "CANVAS-06",
+    "CANVAS-07"
+  ]
+}

package/skills/opendevbrowser-best-practices/assets/templates/canvas-handshake-example.json

@@ -0,0 +1,126 @@
+{
+  "canvasSessionId": "canvas_session_01",
+  "browserSessionId": "browser_session_01",
+  "documentId": "dc_01",
+  "leaseId": "lease_01",
+  "preflightState": "handshake_read",
+  "attachModes": [
+    "observer",
+    "lease_reclaim"
+  ],
+  "governanceRequirements": {
+    "requiredBeforeMutation": [
+      "intent",
+      "generationPlan",
+      "designLanguage",
+      "contentModel",
+      "layoutSystem",
+      "typographySystem",
+      "motionSystem",
+      "responsiveSystem",
+      "accessibilityPolicy"
+    ],
+    "requiredBeforeSave": [
+      "intent",
+      "generationPlan",
+      "designLanguage",
+      "contentModel",
+      "layoutSystem",
+      "typographySystem",
+      "colorSystem",
+      "surfaceSystem",
+      "iconSystem",
+      "motionSystem",
+      "responsiveSystem",
+      "accessibilityPolicy",
+      "libraryPolicy",
+      "runtimeBudgets"
+    ],
+    "optionalInherited": [
+      "colorSystem",
+      "surfaceSystem",
+      "iconSystem",
+      "libraryPolicy",
+      "runtimeBudgets"
+    ]
+  },
+  "generationPlanRequirements": {
+    "requiredBeforeMutation": [
+      "targetOutcome",
+      "visualDirection",
+      "layoutStrategy",
+      "contentStrategy",
+      "componentStrategy",
+      "motionPosture",
+      "responsivePosture",
+      "accessibilityPosture",
+      "validationTargets"
+    ]
+  },
+  "allowedLibraries": {
+    "icons": [
+      "3dicons",
+      "tabler",
+      "microsoft-fluent-ui-system-icons",
+      "@lobehub/fluent-emoji-3d"
+    ],
+    "components": [
+      "shadcn"
+    ],
+    "styling": [
+      "tailwindcss"
+    ],
+    "motion": [],
+    "threeD": []
+  },
+  "warningAuditIds": [
+    "CANVAS-01",
+    "CANVAS-02",
+    "CANVAS-03",
+    "CANVAS-04",
+    "CANVAS-05",
+    "CANVAS-06",
+    "CANVAS-07"
+  ],
+  "allowedBeforePlan": [
+    "canvas.capabilities.get",
+    "canvas.plan.get",
+    "canvas.plan.set",
+    "canvas.document.load",
+    "canvas.session.attach",
+    "canvas.session.status"
+  ],
+  "projectionModes": [
+    "canvas_html",
+    "bound_app_runtime"
+  ],
+  "annotationDispatch": {
+    "popupAndCanvasSend": "storage_backed_retrieval",
+    "retrievalCommand": "annotate --stored"
+  },
+  "documentContext": {
+    "status": "existing",
+    "existingGovernanceBlocks": [
+      "colorSystem",
+      "surfaceSystem",
+      "iconSystem",
+      "libraryPolicy",
+      "runtimeBudgets"
+    ],
+    "missingGovernanceBlocks": [
+      "intent",
+      "generationPlan",
+      "designLanguage",
+      "contentModel",
+      "layoutSystem",
+      "typographySystem",
+      "motionSystem",
+      "responsiveSystem",
+      "accessibilityPolicy"
+    ],
+    "tokensPresent": true,
+    "themesPresent": true,
+    "viewportsPresent": true,
+    "componentInventoryPresent": false
+  }
+}

package/skills/opendevbrowser-best-practices/assets/templates/robustness-checklist.json

@@ -2,6 +2,63 @@
   "schemaVersion": "1.0",
   "skill": "",
   "run_id": "",
+  "canvas": {
+    "enabled": false,
+    "canvasSessionId": "",
+    "documentId": "",
+    "targetIds": [],
+    "issueClasses": [
+      {
+        "auditId": "CANVAS-01",
+        "status": "pending",
+        "command": "canvas.document.patch",
+        "evidence": [],
+        "notes": ""
+      },
+      {
+        "auditId": "CANVAS-02",
+        "status": "pending",
+        "command": "canvas.document.save",
+        "evidence": [],
+        "notes": ""
+      },
+      {
+        "auditId": "CANVAS-03",
+        "status": "pending",
+        "command": "canvas.plan.set",
+        "evidence": [],
+        "notes": ""
+      },
+      {
+        "auditId": "CANVAS-04",
+        "status": "pending",
+        "command": "canvas.document.patch",
+        "evidence": [],
+        "notes": ""
+      },
+      {
+        "auditId": "CANVAS-05",
+        "status": "pending",
+        "command": "canvas.overlay.mount",
+        "evidence": [],
+        "notes": ""
+      },
+      {
+        "auditId": "CANVAS-06",
+        "status": "pending",
+        "command": "canvas.preview.render",
+        "evidence": [],
+        "notes": ""
+      },
+      {
+        "auditId": "CANVAS-07",
+        "status": "pending",
+        "command": "canvas.feedback.poll",
+        "evidence": [],
+        "notes": ""
+      }
+    ]
+  },
   "issues": [
     {
       "id": "ISSUE-01",