npm - qualia-framework - Versions diffs - 5.9.1 → 6.2.7 - Mend

qualia-framework 5.9.1 → 6.2.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (81) hide show

package/AGENTS.md +2 -1
package/CLAUDE.md +2 -1
package/README.md +45 -29
package/agents/builder.md +1 -5
package/agents/plan-checker.md +1 -1
package/agents/planner.md +2 -6
package/agents/qa-browser.md +3 -3
package/agents/roadmapper.md +2 -2
package/agents/verifier.md +7 -9
package/agents/visual-evaluator.md +1 -3
package/bin/cli.js +370 -205
package/bin/erp-retry.js +11 -3
package/bin/install.js +383 -55
package/bin/knowledge-flush.js +25 -13
package/bin/knowledge.js +11 -1
package/bin/project-snapshot.js +293 -0
package/bin/qualia-ui.js +13 -2
package/bin/report-payload.js +137 -0
package/bin/slop-detect.mjs +81 -9
package/bin/state.js +8 -1
package/bin/statusline.js +14 -2
package/docs/archive/CHANGELOG-pre-v4.md +855 -0
package/docs/changelog-v6.html +864 -0
package/docs/ecosystem-operating-model.md +121 -0
package/docs/erp-contract.md +74 -21
package/docs/onboarding.html +2 -2
package/docs/release.md +44 -0
package/docs/reviews/v6.2.1-revival-audit.md +53 -0
package/docs/reviews/v6.2.2-memory-erp-audit.md +41 -0
package/docs/reviews/v6.2.3-erp-id-guard.md +15 -0
package/guide.md +28 -3
package/hooks/auto-update.js +20 -10
package/hooks/branch-guard.js +10 -2
package/hooks/env-empty-guard.js +15 -5
package/hooks/git-guardrails.js +10 -1
package/hooks/migration-guard.js +4 -1
package/hooks/pre-deploy-gate.js +11 -1
package/hooks/pre-push.js +43 -106
package/hooks/session-start.js +22 -14
package/hooks/stop-session-log.js +11 -3
package/hooks/supabase-destructive-guard.js +11 -1
package/hooks/vercel-account-guard.js +12 -3
package/package.json +4 -3
package/qualia-design/design-reference.md +2 -1
package/qualia-design/frontend.md +4 -4
package/rules/one-opinion.md +59 -0
package/rules/trust-boundary.md +35 -0
package/skills/qualia-feature/SKILL.md +5 -5
package/skills/qualia-flush/SKILL.md +5 -7
package/skills/qualia-hook-gen/SKILL.md +1 -1
package/skills/qualia-learn/SKILL.md +1 -0
package/skills/qualia-map/SKILL.md +2 -1
package/skills/qualia-milestone/SKILL.md +2 -2
package/skills/qualia-new/SKILL.md +6 -6
package/skills/qualia-optimize/SKILL.md +1 -1
package/skills/qualia-plan/SKILL.md +1 -1
package/skills/qualia-polish/REFERENCE.md +8 -6
package/skills/qualia-polish/SKILL.md +11 -9
package/skills/qualia-polish/scripts/loop.mjs +18 -6
package/skills/qualia-postmortem/SKILL.md +1 -1
package/skills/qualia-report/SKILL.md +6 -42
package/skills/qualia-road/SKILL.md +17 -5
package/skills/qualia-verify/SKILL.md +3 -3
package/skills/qualia-vibe/SKILL.md +226 -0
package/skills/qualia-vibe/scripts/extract.mjs +141 -0
package/skills/qualia-vibe/scripts/tokens.mjs +342 -0
package/templates/help.html +10 -3
package/templates/knowledge/agents.md +3 -3
package/templates/knowledge/index.md +1 -1
package/templates/tracking.json +3 -0
package/templates/work-packet.md +46 -0
package/tests/bin.test.sh +423 -25
package/tests/hooks.test.sh +1 -8
package/tests/install-smoke.test.sh +137 -0
package/tests/published-install-smoke.test.sh +126 -0
package/tests/refs.test.sh +43 -1
package/tests/run-all.sh +49 -0
package/tests/runner.js +19 -33
package/tests/slop-detect.test.sh +11 -5
package/tests/state.test.sh +4 -1
package/hooks/pre-compact.js +0 -125

package/docs/changelog-v6.html ADDED Viewed

@@ -0,0 +1,864 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Qualia Framework v6 — What changed</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400;9..144,500;9..144,700&family=Newsreader:opsz,wght@6..72,400;6..72,500;6..72,600&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet">
+<style>
+  :root {
+    --bg:        oklch(96.5% 0.012 78);
+    --bg-soft:   oklch(94% 0.014 78);
+    --ink:       oklch(22% 0.025 245);
+    --ink-soft:  oklch(40% 0.025 245);
+    --muted:     oklch(58% 0.018 245);
+    --rule:      oklch(85% 0.02 78);
+    --rule-soft: oklch(90% 0.014 78);
+    --accent:    oklch(52% 0.12 195);
+    --accent-d:  oklch(38% 0.10 195);
+    --warn:      oklch(58% 0.14 50);
+    --new:       oklch(55% 0.14 145);
+    --fix:       oklch(52% 0.14 25);
+    --tweak:     oklch(48% 0.05 245);
+    --space-1:   clamp(.25rem, .2rem + .25vw, .375rem);
+    --space-2:   clamp(.5rem, .4rem + .5vw, .75rem);
+    --space-3:   clamp(.75rem, .6rem + .75vw, 1.125rem);
+    --space-4:   clamp(1rem, .8rem + 1vw, 1.5rem);
+    --space-5:   clamp(1.5rem, 1.2rem + 1.5vw, 2.25rem);
+    --space-6:   clamp(2.25rem, 1.8rem + 2.25vw, 3.5rem);
+    --space-7:   clamp(3.5rem, 2.8rem + 3.5vw, 5.25rem);
+    --display:   "Fraunces", "Newsreader", Georgia, serif;
+    --body:      "Newsreader", Georgia, serif;
+    --mono:      "JetBrains Mono", ui-monospace, "SF Mono", monospace;
+  }
+  * { box-sizing: border-box; }
+  html { -webkit-text-size-adjust: 100%; scroll-behavior: smooth; }
+  body {
+    margin: 0;
+    background: var(--bg);
+    color: var(--ink);
+    font-family: var(--body);
+    font-size: clamp(15px, 14px + .25vw, 17px);
+    line-height: 1.55;
+    font-feature-settings: "kern", "liga", "ss01", "ss02";
+  }
+  main {
+    max-width: 64rem;
+    margin: 0 auto;
+    padding: var(--space-6) var(--space-4) var(--space-7);
+  }
+  /* Header */
+  .marque {
+    display: flex;
+    align-items: baseline;
+    gap: var(--space-3);
+    border-bottom: 1px solid var(--rule);
+    padding-bottom: var(--space-3);
+    margin-bottom: var(--space-6);
+  }
+  .marque .mark {
+    font-family: var(--mono);
+    font-size: .75rem;
+    letter-spacing: .14em;
+    text-transform: uppercase;
+    color: var(--accent);
+  }
+  .marque .title {
+    font-family: var(--mono);
+    font-size: .75rem;
+    letter-spacing: .14em;
+    text-transform: uppercase;
+    color: var(--ink-soft);
+  }
+  .marque .meta {
+    font-family: var(--mono);
+    font-size: .75rem;
+    color: var(--muted);
+    margin-left: auto;
+  }
+  /* Hero */
+  .hero { margin-bottom: var(--space-7); }
+  .hero h1 {
+    font-family: var(--display);
+    font-weight: 500;
+    font-size: clamp(2.5rem, 1.5rem + 5vw, 5.25rem);
+    line-height: .95;
+    letter-spacing: -.025em;
+    margin: 0 0 var(--space-3);
+    font-variation-settings: "opsz" 144;
+  }
+  .hero h1 em {
+    font-style: italic;
+    color: var(--accent);
+    font-weight: 400;
+  }
+  .hero .lede {
+    font-family: var(--display);
+    font-weight: 400;
+    font-size: clamp(1.125rem, 1rem + .5vw, 1.5rem);
+    line-height: 1.45;
+    max-width: 50ch;
+    color: var(--ink-soft);
+    margin: 0;
+  }
+  .hero .stats {
+    display: flex;
+    gap: var(--space-5);
+    margin-top: var(--space-5);
+    flex-wrap: wrap;
+  }
+  .stat {
+    font-family: var(--mono);
+    font-size: .8rem;
+    color: var(--muted);
+  }
+  .stat strong {
+    display: block;
+    font-family: var(--display);
+    font-weight: 500;
+    font-size: 1.75rem;
+    color: var(--ink);
+    margin-bottom: .15em;
+  }
+  /* Release */
+  .release {
+    border-top: 1px solid var(--rule);
+    padding-top: var(--space-5);
+    margin-top: var(--space-6);
+  }
+  .release-head {
+    display: flex;
+    align-items: baseline;
+    gap: var(--space-3);
+    margin-bottom: var(--space-4);
+    flex-wrap: wrap;
+  }
+  .release-version {
+    font-family: var(--display);
+    font-weight: 500;
+    font-size: clamp(1.75rem, 1.4rem + 1.5vw, 2.75rem);
+    line-height: 1;
+    letter-spacing: -.02em;
+    color: var(--ink);
+    margin: 0;
+  }
+  .release-tagline {
+    font-family: var(--display);
+    font-style: italic;
+    color: var(--accent);
+    font-size: clamp(1rem, .9rem + .4vw, 1.25rem);
+  }
+  .release-date {
+    font-family: var(--mono);
+    font-size: .75rem;
+    color: var(--muted);
+    margin-left: auto;
+    letter-spacing: .08em;
+  }
+  .release-intro {
+    font-family: var(--display);
+    font-size: clamp(1rem, .95rem + .25vw, 1.125rem);
+    line-height: 1.55;
+    color: var(--ink-soft);
+    max-width: 60ch;
+    margin: 0 0 var(--space-5);
+  }
+  /* Sections within a release */
+  .change-group { margin-bottom: var(--space-5); }
+  .change-group h3 {
+    font-family: var(--mono);
+    font-size: .7rem;
+    letter-spacing: .14em;
+    text-transform: uppercase;
+    color: var(--muted);
+    margin: 0 0 var(--space-3);
+    padding-bottom: var(--space-2);
+    border-bottom: 1px solid var(--rule-soft);
+  }
+  /* Change card */
+  .change {
+    padding: var(--space-3) 0;
+    border-bottom: 1px solid var(--rule-soft);
+  }
+  .change:last-child { border-bottom: none; }
+  .change-head {
+    display: flex;
+    align-items: baseline;
+    gap: var(--space-2);
+    margin-bottom: var(--space-2);
+    flex-wrap: wrap;
+  }
+  .badge {
+    font-family: var(--mono);
+    font-size: .65rem;
+    letter-spacing: .12em;
+    text-transform: uppercase;
+    padding: .15em .55em;
+    border: 1px solid currentColor;
+    border-radius: 2px;
+    flex-shrink: 0;
+  }
+  .badge.new { color: var(--new); }
+  .badge.fix { color: var(--fix); }
+  .badge.tweak { color: var(--tweak); }
+  .change-title {
+    font-family: var(--display);
+    font-weight: 500;
+    font-size: clamp(1.125rem, 1rem + .35vw, 1.35rem);
+    line-height: 1.25;
+    color: var(--ink);
+    margin: 0;
+  }
+  .change-body {
+    font-family: var(--body);
+    line-height: 1.55;
+    color: var(--ink-soft);
+    margin: 0 0 var(--space-2);
+  }
+  .change-body code {
+    font-family: var(--mono);
+    font-size: .85em;
+    background: var(--bg-soft);
+    padding: .1em .35em;
+    border-radius: 2px;
+    color: var(--ink);
+  }
+  .change pre {
+    font-family: var(--mono);
+    font-size: .8rem;
+    line-height: 1.5;
+    background: var(--ink);
+    color: oklch(92% 0.012 78);
+    padding: var(--space-3) var(--space-4);
+    border-radius: 4px;
+    margin: var(--space-3) 0 0;
+    overflow-x: auto;
+  }
+  .change pre .comment { color: oklch(58% 0.018 245); }
+  /* Migration */
+  .migration {
+    margin-top: var(--space-6);
+    padding: var(--space-5);
+    background: var(--bg-soft);
+    border-left: 3px solid var(--accent);
+  }
+  .migration h2 {
+    font-family: var(--display);
+    font-weight: 500;
+    font-size: clamp(1.5rem, 1.3rem + .8vw, 2rem);
+    margin: 0 0 var(--space-3);
+    color: var(--ink);
+  }
+  .migration p {
+    font-family: var(--display);
+    color: var(--ink-soft);
+    margin: 0 0 var(--space-3);
+  }
+  .migration pre {
+    font-family: var(--mono);
+    font-size: .85rem;
+    line-height: 1.6;
+    background: var(--ink);
+    color: oklch(92% 0.012 78);
+    padding: var(--space-3) var(--space-4);
+    border-radius: 4px;
+    margin: 0;
+    overflow-x: auto;
+  }
+  /* Footer */
+  footer {
+    margin-top: var(--space-7);
+    padding-top: var(--space-4);
+    border-top: 1px solid var(--rule);
+    font-family: var(--mono);
+    font-size: .75rem;
+    color: var(--muted);
+    display: flex;
+    justify-content: space-between;
+    flex-wrap: wrap;
+    gap: var(--space-3);
+  }
+  footer a {
+    color: var(--accent);
+    text-decoration: none;
+  }
+  footer a:hover { text-decoration: underline; }
+</style>
+</head>
+<body>
+<main>
+  <header class="marque">
+    <span class="mark">Qualia Framework</span>
+    <span class="title">Changelog · v6</span>
+    <span class="meta">2026-05-21</span>
+  </header>
+  <section class="hero">
+    <h1>v6.2.6 <em>Project snapshot upload.</em></h1>
+    <p class="lede">
+      Nine v6 releases. Zero new flagship feature in v6.0 (audit + cleanup of the whole surface).
+      One real new tool in v6.1 (<code>/qualia-vibe</code> for fast aesthetic pivots).
+      v6.2 removes hook-created bot commits. v6.2.1 guards the active surfaces so stale claims cannot return.
+      v6.2.2 makes the Framework/Memory/ERP boundary explicit for admin and employee tracking.
+      v6.2.3 guards ERP UUID fields so slug-like local IDs cannot break report uploads.
+      v6.2.4 turns that payload contract into a shipped, tested script.
+      v6.2.5 adds an explicit project-level snapshot for ERP/admin 0-to-100 tracking.
+      v6.2.6 uploads that snapshot to ERP's project intake.
+    </p>
+    <div class="stats">
+      <div class="stat"><strong>33</strong>skills (was 32)</div>
+      <div class="stat"><strong>8</strong>rules (was 6)</div>
+      <div class="stat"><strong>513</strong>tests passing (was 489)</div>
+      <div class="stat"><strong>~500</strong>tokens saved per phase</div>
+      <div class="stat"><strong>851</strong>changelog lines archived</div>
+    </div>
+  </section>
+  <!-- ─────────────── v6.2.6 ─────────────── -->
+  <section class="release">
+    <div class="release-head">
+      <h2 class="release-version">v6.2.6</h2>
+      <span class="release-tagline">project snapshot upload</span>
+      <span class="release-date">2026-05-21</span>
+    </div>
+    <p class="release-intro">
+      <code>qualia-framework project-snapshot --upload</code> sends the current 0-to-100
+      project snapshot to ERP's <code>/api/v1/project-snapshots</code> intake so admin
+      dashboards can show the latest Framework progress without manual import.
+    </p>
+  </section>
+  <!-- ─────────────── v6.2.5 ─────────────── -->
+  <section class="release">
+    <div class="release-head">
+      <h2 class="release-version">v6.2.5</h2>
+      <span class="release-tagline">project snapshot export</span>
+      <span class="release-date">2026-05-21</span>
+    </div>
+    <p class="release-intro">
+      <code>qualia-framework project-snapshot --write</code> creates a single
+      <code>.planning/snapshots/project-snapshot-*.json</code> rollup for ERP/admin import,
+      including shared IDs, current milestone/phase, closed milestones, lifetime counters, and
+      a 0-to-100 progress percentage.
+    </p>
+  </section>
+  <!-- ─────────────── v6.2.4 ─────────────── -->
+  <section class="release">
+    <div class="release-head">
+      <h2 class="release-version">v6.2.4</h2>
+      <span class="release-tagline">report payload contract</span>
+      <span class="release-date">2026-05-21</span>
+    </div>
+    <p class="release-intro">
+      <code>/qualia-report</code> now calls the shipped <code>report-payload.js</code> builder.
+      Tests prove ERP UUID fields are sent only when canonical, while local slugs stay in
+      <code>project_id</code> and <code>team_id</code>.
+    </p>
+  </section>
+  <!-- ─────────────── v6.2.3 ─────────────── -->
+  <section class="release">
+    <div class="release-head">
+      <h2 class="release-version">v6.2.3</h2>
+      <span class="release-tagline">ERP ID guard</span>
+      <span class="release-date">2026-05-21</span>
+    </div>
+    <p class="release-intro">
+      <code>/qualia-report</code> now sends ERP-native IDs only when they are UUID-shaped.
+      Local slugs stay in <code>project_id</code> and <code>team_id</code>.
+    </p>
+  </section>
+  <!-- ─────────────── v6.2.2 ─────────────── -->
+  <section class="release">
+    <div class="release-head">
+      <h2 class="release-version">v6.2.2</h2>
+      <span class="release-tagline">memory / ERP operating model</span>
+      <span class="release-date">2026-05-21</span>
+    </div>
+    <p class="release-intro">
+      The framework now documents the clean operating model: Framework builds, Memory remembers,
+      ERP operates. ERP work packets seed sessions; reports can carry ERP-native IDs.
+    </p>
+    <div class="change-group">
+      <h3>Added</h3>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge new">New</span>
+          <h4 class="change-title">Ecosystem operating model and work packet</h4>
+        </header>
+        <p class="change-body">
+          <code>docs/ecosystem-operating-model.md</code> records the Framework/Memory/ERP boundary.
+          <code>templates/work-packet.md</code> gives ERP/admins an approved context handoff into Claude or Codex.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Changed</span>
+          <h4 class="change-title">ERP-native IDs flow through reports when present</h4>
+        </header>
+        <p class="change-body">
+          <code>tracking.json</code> now preserves <code>erp_project_id</code>, <code>client_id</code>, and
+          <code>workspace_id</code>. <code>/qualia-report</code> sends them only when populated.
+        </p>
+      </article>
+    </div>
+  </section>
+  <!-- ─────────────── v6.2.1 ─────────────── -->
+  <section class="release">
+    <div class="release-head">
+      <h2 class="release-version">v6.2.1</h2>
+      <span class="release-tagline">revival audit guard</span>
+      <span class="release-date">2026-05-21</span>
+    </div>
+    <p class="release-intro">
+      v6.2 removed the bot commits. v6.2.1 makes the visible framework surface tell the same truth:
+      ERP sync is explicit through <code>/qualia-report</code>, <code>tracking.json</code> is local/report
+      telemetry, <code>INSUFFICIENT EVIDENCE</code> is fail-closed, and the package now identifies as 6.2.1.
+    </p>
+    <div class="change-group">
+      <h3>Changed</h3>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">Active surfaces no longer describe the old ERP model</h4>
+        </header>
+        <p class="change-body">
+          README, guide, onboarding, ERP contract, road, milestone, and roadmapper wording now describe
+          <code>tracking.json</code> as local/report telemetry. No active surface claims that the ERP passively
+          reads it from git.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">Verification language is fail-closed</h4>
+        </header>
+        <p class="change-body">
+          <code>/qualia-verify</code> no longer repeats the old false-pass wording. Any
+          <code>INSUFFICIENT EVIDENCE</code> line downgrades verification to FAIL before the phase can pass.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge new">New guard</span>
+          <h4 class="change-title">refs.test.sh now catches stale operational claims</h4>
+        </header>
+        <p class="change-body">
+          The surface-drift guard now fails on passive ERP-tracking claims, removed pre-compact guidance,
+          stale skill counts, stale README version, old <code>INSUFFICIENT EVIDENCE</code> wording, and
+          silent optional gate language.
+        </p>
+      </article>
+    </div>
+  </section>
+  <!-- ─────────────── v6.2 ─────────────── -->
+  <section class="release">
+    <div class="release-head">
+      <h2 class="release-version">v6.2.0</h2>
+      <span class="release-tagline">no bot commits</span>
+      <span class="release-date">2026-05-20</span>
+    </div>
+    <p class="release-intro">
+      Two hooks were creating bot commits to feed a phantom consumer. The ERP does not read
+      <code>tracking.json</code> from GitHub, and <code>state.js</code> already protects disk state with
+      atomic writes plus a journal. v6.2 strips the false machinery.
+    </p>
+    <div class="change-group">
+      <h3>Removed</h3>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Removed</span>
+          <h4 class="change-title">pre-push no longer creates tracking commits</h4>
+        </header>
+        <p class="change-body">
+          <code>pre-push.js</code> still stamps local telemetry for statusline, stop-session-log, and
+          <code>/qualia-report</code>, but it does not run <code>git add</code> or create bot commits.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Removed</span>
+          <h4 class="change-title">pre-compact hook deleted</h4>
+        </header>
+        <p class="change-body">
+          Context compaction is in-memory. Disk state survives through <code>state.js</code> atomic writes and
+          write-ahead journal recovery, so committing on compaction was noisy and redundant.
+        </p>
+      </article>
+    </div>
+  </section>
+  <!-- ─────────────── v6.1 ─────────────── -->
+  <section class="release">
+    <div class="release-head">
+      <h2 class="release-version">v6.1.0</h2>
+      <span class="release-tagline">design pivot path</span>
+      <span class="release-date">2026-05-17</span>
+    </div>
+    <p class="release-intro">
+      The design path was missing a fast pivot. <code>/qualia-polish</code> polishes within the current vibe;
+      <code>/qualia-polish --redesign</code> rebuilds from scratch (~30 min). When a client says "different vibe"
+      and the right move is a 3-minute token swap, neither fit. v6.1 adds the impeccable middle path.
+    </p>
+    <div class="change-group">
+      <h3>New</h3>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge new">New skill</span>
+          <h4 class="change-title">/qualia-vibe — layout-preserving aesthetic pivot</h4>
+        </header>
+        <p class="change-body">
+          Swap design tokens (color, type, depth, motion) without touching component structure.
+          Default mode proposes ONE direction with justification — never a menu.
+          Hard contract: vibe NEVER touches JSX, routing, data flow, or layout grid. Tokens only.
+          If a pivot needs structural change, it routes you to <code>--redesign</code> and stops.
+        </p>
+<pre>/qualia-vibe                              <span class="comment"># propose ONE pivot, apply on approval</span>
+/qualia-vibe brutalist                    <span class="comment"># explicit named direction</span>
+/qualia-vibe --variants 3                 <span class="comment"># opt-in A/B/C menu (rare)</span>
+/qualia-vibe --extract https://stripe.com <span class="comment"># reverse-engineer DESIGN.md from a reference</span>
+/qualia-vibe --extract ./inspo.png        <span class="comment"># same, from a local screenshot</span>
+/qualia-vibe --sync                       <span class="comment"># show drift between code and DESIGN.md</span>
+/qualia-vibe --sync --write               <span class="comment"># patch DESIGN.md to match code, commit</span></pre>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge new">New rule</span>
+          <h4 class="change-title">rules/one-opinion.md — the EventMaster discipline</h4>
+        </header>
+        <p class="change-body">
+          Codified the canonical session lesson (user pivoted aesthetic 3 times in one block and finally said
+          <em>"ANYTHING JUST CHANGE IT STOP ASKING"</em>). When proposing a design decision the user hasn't named,
+          propose ONE direction with justification — never a menu. If rejected, ask what didn't fit and propose
+          ONE replacement. Lazy-loaded by design-adjacent skills only.
+        </p>
+      </article>
+    </div>
+    <div class="change-group">
+      <h3>Slop-detect upgrades</h3>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge tweak">Enhanced</span>
+          <h4 class="change-title">More banned fonts caught</h4>
+        </header>
+        <p class="change-body">
+          Added Montserrat, Poppins, Lato, Open Sans — already banned in <code>design-brand.md</code> but missed
+          by the linter. These are the "looks AI-generated" font giveaways.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge new">New flag</span>
+          <h4 class="change-title">slop-detect --watch for live editing</h4>
+        </header>
+        <p class="change-body">
+          Proactive single-file mode with 200ms debounce. Watches tracked extensions
+          (<code>tsx, jsx, ts, js, css, scss, html, svelte, vue, astro</code>) and re-scans on change.
+          Default scan paths also extended to <code>packages/</code> and <code>apps/</code> for monorepo conventions.
+        </p>
+      </article>
+    </div>
+    <div class="change-group">
+      <h3>Design-surface bugs from v6.0 audit</h3>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">Polish loop desktop viewport — 1280 → 1440</h4>
+        </header>
+        <p class="change-body">
+          SKILL.md Stage 4 said 1280px. Scripts, REFERENCE.md, and the visual evaluator all use 1440. Aligned to 1440 — file-not-found errors gone.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">Polish loop slop-detect path</h4>
+        </header>
+        <p class="change-body">
+          Was hardcoded to <code>~/.claude/bin/slop-detect.mjs</code> and silently skipped the gate if missing.
+          Now searches env var, home, then framework-relative path. Miss is logged, not silent.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">Polish loop commit-fix on fresh clones</h4>
+        </header>
+        <p class="change-body">
+          Was failing with <em>"Please tell me who you are"</em> when global git config wasn't set.
+          Now sets <code>user.name</code> / <code>user.email</code> inline so the commit always works.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">Dead /qualia-design references removed</h4>
+        </header>
+        <p class="change-body">
+          That command was deleted in v4.5 but <code>qualia-design/frontend.md</code> still listed it as active.
+          Replaced with <code>/qualia-polish</code> + <code>/qualia-vibe</code>.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">--ease-spring bounce token removed</h4>
+        </header>
+        <p class="change-body">
+          <code>design-reference.md</code> shipped <code>--ease-spring: cubic-bezier(0.34, 1.56, 0.64, 1)</code>
+          as a generic token — but <code>design-laws.md</code> §6 and slop-detect's MED-BOUNCE-EASING rule
+          ban that exact curve. Self-contradicting. Removed.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">Polish brief no longer offers a menu</h4>
+        </header>
+        <p class="change-body">
+          Stage 0 brief format listed <code>{editorial · brutalist · luxury · maximalist · …}</code> as options.
+          Per <code>rules/one-opinion.md</code>, agent now proposes ONE direction inferred from <code>PRODUCT.md</code>.
+          Pushback routes to <code>/qualia-vibe</code>, not enumeration.
+        </p>
+      </article>
+    </div>
+  </section>
+  <!-- ─────────────── v6.0 ─────────────── -->
+  <section class="release">
+    <div class="release-head">
+      <h2 class="release-version">v6.0.0</h2>
+      <span class="release-tagline">audit, cleanup, reliability</span>
+      <span class="release-date">2026-05-17</span>
+    </div>
+    <p class="release-intro">
+      Wide-surface audit pass. No new flagship feature. Every change is a real bug, a silent failure surfaced into a trace,
+      an outdated reference replaced, or a token-budget reduction. Same 32 skills (at the time), same road, same behavior —
+      just the broken edges fixed.
+    </p>
+    <div class="change-group">
+      <h3>Engine bugs</h3>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">Uninstall + migrate manifests now match what ships</h4>
+        </header>
+        <p class="change-body">
+          Uninstall used to leave 3 hooks + 1 agent orphaned on disk
+          (<code>env-empty-guard</code>, <code>supabase-destructive-guard</code>, <code>vercel-account-guard</code>,
+          <code>visual-evaluator</code>). Migrate silently skipped wiring the same 3 hooks. Both flows now
+          match the 12-hooks + 9-agents that actually ship.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">Silent catches in hooks now write traces</h4>
+        </header>
+        <p class="change-body">
+          <code>auto-update.js</code> had two bare <code>catch {}</code> blocks. <code>pre-compact.js</code>
+          had one around the commit logic. All three swallowed errors invisibly. Now each writes to
+          <code>~/.claude/.qualia-traces/</code> so failures are debuggable instead of vanishing.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">env-empty-guard no longer false-blocks</h4>
+        </header>
+        <p class="change-body">
+          Was exiting 2 (BLOCK) on any unparseable stdin payload — a malformed JSON from an unrelated tool call
+          could block the user from running <code>vercel env</code>. Now allows on parse error and only blocks
+          when the command actually matched a <code>vercel env add</code> with an empty value.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">Four broken skills</h4>
+        </header>
+        <p class="change-body">
+          <code>/qualia-learn</code> declared the wrong tools and couldn't run its own <code>node</code> + <code>git</code> calls (missing Bash).
+          <code>/qualia-map</code> described an <code>AskUserQuestion</code> prompt it couldn't render.
+          <code>/qualia-plan</code> Rule 2 said "max 3 revision cycles" while the process said "max 2." Reconciled.
+          <code>/qualia-postmortem</code> referenced <code>skills/qualia-design/SKILL.md</code> — that path was deleted long ago.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">Agent MCP tool frontmatter gaps</h4>
+        </header>
+        <p class="change-body">
+          <code>planner.md</code> used <code>mcp__context7__*</code> tools without declaring them.
+          <code>qa-browser.md</code> used <code>mcp__playwright__*</code> tools without declaring them.
+          Both would have failed silently. Both now declared.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">Hardcoded /tmp paths replaced</h4>
+        </header>
+        <p class="change-body">
+          Verifier drift audit used <code>/tmp/used-tokens</code> + <code>/tmp/declared</code> directly
+          (Windows-incompatible, symlink-attackable on multi-user systems). QA-browser dev-server log
+          had the same issue. Now uses <code>mktemp</code> / <code>$TMPDIR/qualia-dev-server-$$.log</code>.
+        </p>
+      </article>
+    </div>
+    <div class="change-group">
+      <h3>Token efficiency</h3>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge new">Extracted</span>
+          <h4 class="change-title">rules/trust-boundary.md — shared injection-defence</h4>
+        </header>
+        <p class="change-body">
+          The trust-boundary security block was copy-pasted into 4 agents (builder, planner, verifier,
+          visual-evaluator) — ~150 tokens each, ~600 tokens duplicated total. Extracted to a single rule file.
+          Agents reference it with one line plus role-specific reporting shape. <strong>Net: ~500 tokens
+          saved per phase that spawns the full agent set.</strong>
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge tweak">Cleaned</span>
+          <h4 class="change-title">Stale version stamps stripped</h4>
+        </header>
+        <p class="change-body">
+          User-facing skill surfaces had "v4.5+" / "v5.0+" / "v5.1+" / "v5.3+" annotations everywhere
+          (<code>/qualia-road</code>, <code>/qualia-new</code>, <code>/qualia-polish</code>,
+          <code>/qualia-verify</code>, <code>/qualia-flush</code>, <code>/qualia-milestone</code>,
+          <code>/qualia-hook-gen</code>, <code>/qualia-feature</code>). At v6 they were noise.
+        </p>
+      </article>
+    </div>
+    <div class="change-group">
+      <h3>Tests + docs</h3>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge new">New runner</span>
+          <h4 class="change-title">tests/run-all.sh — fail-collect orchestrator</h4>
+        </header>
+        <p class="change-body">
+          Old runner chained 8 suites with <code>&amp;&amp;</code> — first failure aborted everything, so you only ever saw
+          the failure of the earliest-failing suite. New runner collects all failures and reports which suites failed.
+          Also stripped silent <code>|| true</code> from slop-detect tests so real crashes can't pass invisibly.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge fix">Fixed</span>
+          <h4 class="change-title">Phantom rules/frontend.md references</h4>
+        </header>
+        <p class="change-body">
+          <code>CLAUDE.md</code>, <code>AGENTS.md</code>, and <code>/qualia-feature</code> all pointed at
+          <code>rules/frontend.md</code> — which has not existed since the design substrate moved to
+          <code>qualia-design/</code> in v4.5. Agents loading these references hit a dead end. Now points
+          at <code>qualia-design/frontend.md</code>. Also added <code>rules/architecture.md</code> to the
+          discoverable substrate list.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge tweak">Cleaned</span>
+          <h4 class="change-title">help.html + onboarding.html version drift</h4>
+        </header>
+        <p class="change-body">
+          <code>templates/help.html</code> showed "28 skills" (actual 32) and was missing 6 newer skill entries
+          (<code>qualia-hook-gen</code>, <code>qualia-issues</code>, <code>qualia-road</code>,
+          <code>qualia-triage</code>, <code>qualia-zoom</code>, <code>zoho-workflow</code>).
+          <code>docs/onboarding.html</code> was stamped v5.5. Both updated.
+        </p>
+      </article>
+      <article class="change">
+        <header class="change-head">
+          <span class="badge tweak">Archived</span>
+          <h4 class="change-title">Pre-v4 CHANGELOG entries moved out of the main file</h4>
+        </header>
+        <p class="change-body">
+          CHANGELOG was 2,726 lines going back to v2.0.0. Pre-v4.0.0 entries (851 lines of archaeological history)
+          moved to <code>docs/archive/CHANGELOG-pre-v4.md</code>. Main CHANGELOG dropped to 1,875 lines.
+        </p>
+      </article>
+    </div>
+  </section>
+  <!-- ─────────────── Migration ─────────────── -->
+  <section class="migration">
+    <h2>What you need to do</h2>
+    <p>
+      Update on your machine. Restart Claude Code. That is the whole migration. No code change required in any project.
+      ERP integration is explicit through the same <code>/qualia-report</code> contract. <code>tracking.json</code>
+      remains local/report telemetry, not a passive git feed.
+    </p>
+<pre>npx qualia-framework@latest install   <span class="comment"># also remembers your team code</span>
+<span class="comment"># then quit Claude Code and open a new terminal</span>
+npx qualia-framework@latest version   <span class="comment"># verify shows 6.2.6</span></pre>
+    <p style="margin-top: var(--space-3); font-size: .9rem;">
+      If you had a previous uninstall leave orphan files, re-run uninstall to clean them up cleanly.
+      If you still see old commands (<code>/qualia-quick</code>, <code>/qualia-task</code>, <code>/qualia-prd</code>,
+      <code>/qualia-polish-loop</code>) in your skill list after install, those are stale folders on disk —
+      delete with <code>rm -rf ~/.claude/skills/qualia-{quick,task,prd,polish-loop}</code> then restart.
+    </p>
+  </section>
+  <footer>
+    <span>Qualia Framework v6.2.7 · Plan, build, verify, ship.</span>
+    <span><a href="https://github.com/Qualiasolutions/qualia-framework">github.com/Qualiasolutions/qualia-framework</a></span>
+  </footer>
+</main>
+</body>
+</html>