stillmade-sdk 0.1.26 → 0.1.28

package/AGENTS.md

@@ -4,7 +4,7 @@ This folder is the StillMade Block SDK. Read this file before writing code; it i
 
 ## Readiness gate
 
-Do not tell the user a Block is ready, done or working until `node packages/block-cli/cli.js gate .` passes after your last edit, and report the exact status it prints. In this folder Claude Code (`.claude/settings.json`) and Cursor (`.cursor/hooks.json`) run the gate when you finish a turn and send any failures back to you, but only in a session started in this folder: if you downloaded the SDK during the current session, run the gate yourself. Other agents must also run it themselves. If you cannot fix a failure, say plainly that the Block is not ready and list the failing checks.
+Do not tell the user a Block is ready, done or working until `node packages/block-cli/cli.js gate .` passes after your last edit, and report the exact status it prints. In this folder Claude Code (`.claude/settings.json`) and Cursor (`.cursor/hooks.json`) run the gate when you finish a turn and send any failures back to you, but only in a session started in this folder: if you downloaded the SDK during the current session, run the gate yourself. Other agents must also run it themselves. A module Block runs code, so the gate a hook starts does not run it and says so: run `gate` or `ready` on it yourself. If you cannot fix a failure, say plainly that the Block is not ready and list the failing checks.
 
 Contract `stillmade.block-builder@1.6.1`. Humans, coding agents, imported source, GitHub repositories and generated code all adapt to the Block platform; anything that becomes a StillMade Block obeys this contract.
 

package/blocks/narration/versions/1.0.0/package.js

@@ -179,7 +179,7 @@ export default {
   },
   "view": {
     "runtime": "frame",
-    "html": "<main class=\"sm-block nr\">\n  <section class=\"sm-stage nr-stage\" id=\"stage\" aria-live=\"polite\">\n    <div class=\"sm-empty\" id=\"empty\">\n      <span class=\"sm-glyph\" data-glyph=\"audio\" aria-hidden=\"true\"></span>\n      <p>No narration yet</p>\n    </div>\n    <div class=\"nr-take\" id=\"take\" hidden>\n      <audio id=\"player\" controls preload=\"metadata\"></audio>\n      <p class=\"nr-meta\"><span id=\"length\"></span><span id=\"from\"></span></p>\n    </div>\n  </section>\n  <div class=\"sm-field\">\n    <span class=\"sm-label\"><label for=\"facts\">Facts</label><details class=\"sm-hint\"><summary aria-label=\"About the facts\" title=\"About the facts\"></summary><p>What the voice may say: the thing, its details, who it is for, how long, and how to reach you. Chat fills this from your conversation; change it here.</p></details><span class=\"sm-status\" id=\"facts-state\"></span></span>\n    <textarea id=\"facts\" rows=\"3\" maxlength=\"6000\" data-stillmade-share=\"facts\" placeholder=\"2021 Toyota RAV4 XLE, $27,995, 31,200 miles, one owner. Sunrise Motors, (555) 201-7788.\"></textarea>\n  </div>\n  <div class=\"sm-field\">\n    <span class=\"sm-label\"><label for=\"words\">Script</label><span class=\"sm-status\" id=\"words-state\"></span></span>\n    <textarea id=\"words\" rows=\"7\" maxlength=\"3800\" data-stillmade-share=\"words\" placeholder=\"Written from the facts, or type what the voice says.\"></textarea>\n  </div>\n  <fieldset class=\"sm-choices\" data-compact id=\"voice\" data-stillmade-share=\"voice\">\n    <legend>Voice</legend>\n    <label><input type=\"radio\" name=\"voice\" value=\"onyx\" checked><span class=\"sm-glyph\" data-glyph=\"audio\" aria-hidden=\"true\"></span><span>Onyx <small>deep</small></span></label>\n    <label><input type=\"radio\" name=\"voice\" value=\"nova\"><span class=\"sm-glyph\" data-glyph=\"audio\" aria-hidden=\"true\"></span><span>Nova <small>bright</small></span></label>\n    <label><input type=\"radio\" name=\"voice\" value=\"alloy\"><span class=\"sm-glyph\" data-glyph=\"audio\" aria-hidden=\"true\"></span><span>Alloy <small>even</small></span></label>\n  </fieldset>\n  <div class=\"sm-actions\">\n    <button type=\"button\" class=\"sm-primary\" id=\"action\" data-stillmade-action=\"run\">Write script</button>\n    <button type=\"button\" class=\"sm-quiet\" id=\"again\" hidden>Write again</button>\n    <p class=\"sm-status\" id=\"status\" role=\"status\"></p>\n    <details class=\"sm-hint\" id=\"why\" hidden><summary aria-label=\"Why\" title=\"Why\"></summary><p id=\"why-text\"></p></details>\n  </div>\n  <details class=\"sm-more\" id=\"more\">\n    <summary>More</summary>\n    <div class=\"sm-settings\">\n      <fieldset class=\"sm-choices\" data-compact id=\"tone\" data-stillmade-share=\"tone\">\n        <legend>Tone</legend>\n        <label><input type=\"radio\" name=\"tone\" value=\"warm\" checked><span>Warm</span></label>\n        <label><input type=\"radio\" name=\"tone\" value=\"friendly\"><span>Friendly</span></label>\n        <label><input type=\"radio\" name=\"tone\" value=\"no-nonsense\"><span>No-nonsense</span></label>\n        <label><input type=\"radio\" name=\"tone\" value=\"luxury\"><span>Luxury</span></label>\n      </fieldset>\n      <fieldset class=\"sm-choices\" data-segmented id=\"speed\" data-stillmade-share=\"speed\">\n        <legend>Speed</legend>\n        <label><input type=\"radio\" name=\"speed\" value=\"0.9\"><span>Slower</span></label>\n        <label><input type=\"radio\" name=\"speed\" value=\"1\" checked><span>Normal</span></label>\n        <label><input type=\"radio\" name=\"speed\" value=\"1.15\"><span>Faster</span></label>\n      </fieldset>\n      <div class=\"sm-field\"><label for=\"rules\">Own rules</label><input id=\"rules\" type=\"text\" maxlength=\"300\" data-stillmade-share=\"rules\" placeholder=\"Short sentences, no exclamation marks\"></div>\n    </div>\n  </details>\n</main>\n",
+    "html": "<main class=\"sm-block nr\">\n  <section class=\"sm-stage nr-stage\" id=\"stage\" aria-live=\"polite\">\n    <div class=\"sm-empty\" id=\"empty\">\n      <span class=\"sm-glyph\" data-glyph=\"audio\" aria-hidden=\"true\"></span>\n      <p>No narration yet</p>\n    </div>\n    <div class=\"nr-take\" id=\"take\" hidden>\n      <audio id=\"player\" controls preload=\"metadata\"></audio>\n      <p class=\"nr-meta\"><span id=\"length\"></span><span id=\"from\"></span></p>\n    </div>\n  </section>\n  <div class=\"sm-field\">\n    <span class=\"sm-label\"><label for=\"facts\">Facts</label><details class=\"sm-hint\"><summary aria-label=\"About the facts\" title=\"About the facts\"></summary><p>What the voice may say: the thing, its details, who it is for, how long, and how to reach you. Chat fills this from your conversation; change it here.</p></details><span class=\"sm-status\" id=\"facts-state\"></span></span>\n    <textarea id=\"facts\" rows=\"3\" maxlength=\"6000\" data-stillmade-share=\"facts\" placeholder=\"What it is, its details, who it is for, and how to reach you.\"></textarea>\n  </div>\n  <div class=\"sm-field\">\n    <span class=\"sm-label\"><label for=\"words\">Script</label><span class=\"sm-status\" id=\"words-state\"></span></span>\n    <textarea id=\"words\" rows=\"7\" maxlength=\"3800\" data-stillmade-share=\"words\" placeholder=\"Written from the facts, or type what the voice says.\"></textarea>\n  </div>\n  <fieldset class=\"sm-choices\" data-compact id=\"voice\" data-stillmade-share=\"voice\">\n    <legend>Voice</legend>\n    <label><input type=\"radio\" name=\"voice\" value=\"onyx\" checked><span class=\"sm-glyph\" data-glyph=\"audio\" aria-hidden=\"true\"></span><span>Onyx <small>deep</small></span></label>\n    <label><input type=\"radio\" name=\"voice\" value=\"nova\"><span class=\"sm-glyph\" data-glyph=\"audio\" aria-hidden=\"true\"></span><span>Nova <small>bright</small></span></label>\n    <label><input type=\"radio\" name=\"voice\" value=\"alloy\"><span class=\"sm-glyph\" data-glyph=\"audio\" aria-hidden=\"true\"></span><span>Alloy <small>even</small></span></label>\n  </fieldset>\n  <div class=\"sm-actions\">\n    <button type=\"button\" class=\"sm-primary\" id=\"action\" data-stillmade-action=\"run\">Write script</button>\n    <button type=\"button\" class=\"sm-quiet\" id=\"again\" hidden>Write again</button>\n    <p class=\"sm-status\" id=\"status\" role=\"status\"></p>\n    <details class=\"sm-hint\" id=\"why\" hidden><summary aria-label=\"Why\" title=\"Why\"></summary><p id=\"why-text\"></p></details>\n  </div>\n  <details class=\"sm-more\" id=\"more\">\n    <summary>More</summary>\n    <div class=\"sm-settings\">\n      <fieldset class=\"sm-choices\" data-compact id=\"tone\" data-stillmade-share=\"tone\">\n        <legend>Tone</legend>\n        <label><input type=\"radio\" name=\"tone\" value=\"warm\" checked><span>Warm</span></label>\n        <label><input type=\"radio\" name=\"tone\" value=\"friendly\"><span>Friendly</span></label>\n        <label><input type=\"radio\" name=\"tone\" value=\"no-nonsense\"><span>No-nonsense</span></label>\n        <label><input type=\"radio\" name=\"tone\" value=\"luxury\"><span>Luxury</span></label>\n      </fieldset>\n      <fieldset class=\"sm-choices\" data-segmented id=\"speed\" data-stillmade-share=\"speed\">\n        <legend>Speed</legend>\n        <label><input type=\"radio\" name=\"speed\" value=\"0.9\"><span>Slower</span></label>\n        <label><input type=\"radio\" name=\"speed\" value=\"1\" checked><span>Normal</span></label>\n        <label><input type=\"radio\" name=\"speed\" value=\"1.15\"><span>Faster</span></label>\n      </fieldset>\n      <div class=\"sm-field\"><label for=\"rules\">Own rules</label><input id=\"rules\" type=\"text\" maxlength=\"300\" data-stillmade-share=\"rules\" placeholder=\"Short sentences, no exclamation marks\"></div>\n    </div>\n  </details>\n</main>\n",
     "css": "/* The Block kit (injected by the host) carries the layout; this file only draws\n   the voiceover on the stage: the player and its two facts. */\n.nr [hidden] { display: none !important; }\n.nr-stage { display: grid; align-content: center; justify-items: stretch; gap: var(--s-2, 8px); min-height: 180px; }\n/* A voiceover is short: on a wide screen the stage hugs the player instead of stretching down the column. */\n@container (min-width: 860px) { .sm-block:not([data-layout]) > .nr-stage { align-self: start; min-height: 220px; } }\n.nr-stage > .sm-empty { justify-self: center; }\n.nr-take { display: grid; gap: var(--s-2, 8px); width: 100%; }\n.nr-take audio { width: 100%; }\n.nr-meta { display: flex; justify-content: space-between; gap: var(--s-3, 12px); margin: 0; color: var(--fg-muted); font-size: var(--fs-body-s, .875rem); font-variant-numeric: tabular-nums; }\n#voice { --sm-tile: 120px; }\n#voice small { color: var(--fg-subtle); font-size: var(--fs-caption, .8125rem); margin-inline-start: 4px; }\n#tone { --sm-tile: 110px; }\n",
     "javascript": "(()=>{\n\"use strict\";\n// The Narration interface on the Block kit: the voiceover on the stage, the\n// facts and the script on the left, the voice as chips, and one button that\n// names the next step: Write script, then Make voiceover, or Use my recording.\n// The status beside it says the state in a few words; the price is StillMade's.\nconst $ = id => document.getElementById(id);\nconst state = { input: {}, outputs: {}, busy: false, previewUrl: null, previewFor: null, factsFromChat: false };\nconst message = error => String(error && error.message || error || 'Something went wrong.');\nconst say = (id, text) => { $(id).textContent = text || ''; };\nconst trimmed = value => String(value || '').trim();\nconst wordCount = text => trimmed(text) ? trimmed(text).split(/\\s+/).length : 0;\nconst clock = seconds => { const whole = Math.max(0, Math.round(seconds)); return Math.floor(whole / 60) + ':' + String(whole % 60).padStart(2, '0'); };\nconst spoken = text => 'about ' + clock(wordCount(text) / 150 * 60);\nconst picked = name => { const node = document.querySelector('input[name=\"' + name + '\"]:checked'); return node ? node.value : ''; };\nconst pick = (name, value) => { const node = document.querySelector('input[name=\"' + name + '\"][value=\"' + value + '\"]'); if (node) node.checked = true; };\n// A brief or script value is {schemaVersion: 1, text}; older briefs carry a topic.\nconst words = value => typeof value === 'string' ? value : value && typeof value === 'object' ? trimmed(value.text || value.topic || value.summary || '') : '';\nconst facts = () => trimmed($('facts').value);\nconst script = () => trimmed($('words').value);\nconst sameWords = (a, b) => trimmed(a).replace(/\\s+/g, ' ') === trimmed(b).replace(/\\s+/g, ' ');\n\nfunction status(text, tone, why) {\n  const node = $('status');\n  node.textContent = text || '';\n  if (tone) node.dataset.state = tone; else delete node.dataset.state;\n  $('why').hidden = !why; $('why').open = false; say('why-text', why || '');\n}\n// A field the host shares is written through its own input event, so the edit is kept.\nfunction setField(id, value) {\n  const node = $(id);\n  if (node.value === value) return;\n  node.value = value;\n  node.dispatchEvent(new Event('input', { bubbles: true }));\n  node.dispatchEvent(new Event('change', { bubbles: true }));\n}\n\n// ── What the person is about to do ──────────────────────────────────────\nfunction phase() {\n  if (!script()) return 'write';\n  if (state.input.take) return 'take';\n  const audio = state.outputs.audio, made = state.outputs.script;\n  return audio && made && sameWords(words(made), script()) ? 'ready' : 'voice';\n}\nfunction render() {\n  const p = phase(), count = wordCount(script());\n  say('words-state', count ? count + ' words · ' + spoken(script()) : '');\n  say('facts-state', facts() ? (state.factsFromChat ? 'From Chat' : '') : 'Needed');\n  const labels = { write: 'Write script', voice: 'Make voiceover', ready: 'Make voiceover again', take: 'Use my recording' };\n  say('action', labels[p]);\n  $('again').hidden = p === 'write';\n  $('action').disabled = state.busy || (p === 'write' && !facts());\n  $('again').disabled = state.busy;\n  if (state.busy) return;\n  if (p === 'write') status(facts() ? 'Written from the facts' : 'Add the facts first', facts() ? '' : 'waiting', facts() ? 'The script uses only what the facts say; you can change every word before the voice runs.' : 'Chat usually fills the facts from your conversation. Type them here when it has not.');\n  else if (p === 'take') status('Your recording will be used', '', 'The audio you supplied becomes the voiceover; nothing is generated.');\n  else if (p === 'voice') status(state.outputs.audio ? 'Script changed, so the voice runs again' : 'Script is done, so only the voice runs', '', 'Only the voice is generated now; the words stay as written.');\n  else status('Voiceover ready', 'success', '');\n}\n\n// ── The stage: the voiceover, when there is one ───────────────────────────\nasync function showAudio(reference, from) {\n  if (!reference) { $('take').hidden = true; $('empty').hidden = false; return; }\n  $('empty').hidden = true; $('take').hidden = false;\n  say('from', from || '');\n  say('length', Number.isFinite(reference.duration) ? clock(reference.duration) : spoken(script()));\n  const key = reference.assetId + '/' + reference.versionId;\n  if (state.previewFor === key) return;\n  if (state.previewUrl) { try { StillMade.releaseMedia(state.previewUrl); } catch {} state.previewUrl = null; }\n  state.previewFor = key;\n  try {\n    const preview = await StillMade.previewMedia(reference);\n    if (state.previewFor !== key) { try { StillMade.releaseMedia(preview.url); } catch {} return; }\n    state.previewUrl = preview.url; $('player').src = preview.url;\n  } catch (error) {\n    if (typeof reference.url === 'string' && /^https?:|^\\//.test(reference.url)) $('player').src = reference.url;\n    else status(message(error), 'error', '');\n  }\n}\n\n// ── Running ───────────────────────────────────────────────────────────────\nfunction values(forVoice) {\n  const value = {};\n  if (facts()) value.brief = { schemaVersion: 1, text: facts() };\n  value.tone = picked('tone') || 'warm';\n  const rules = trimmed($('rules').value); if (rules) value.rules = rules;\n  if (forVoice) {\n    value.script = { schemaVersion: 1, text: script() };\n    value.voice = picked('voice') || 'onyx';\n    value.speed = Number(picked('speed')) || 1;\n    if (state.input.take) value.take = state.input.take;\n  }\n  return value;\n}\nasync function act(writeAgain) {\n  if (state.busy) return;\n  const p = writeAgain ? 'write' : phase();\n  state.busy = true; render();\n  status(p === 'write' ? 'Writing the script' : p === 'take' ? 'Keeping your recording' : 'Making the voice', 'loading', '');\n  try {\n    const result = await StillMade.run(values(p !== 'write'));\n    state.outputs = { ...state.outputs, ...result };\n    if (p === 'write') { setField('words', words(result.script)); await showAudio(null); }\n    else await showAudio(result.audio, p === 'take' ? 'Your recording' : voiceName());\n  } catch (error) {\n    status(message(error), 'error', '');\n    state.busy = false; render(); return;\n  }\n  state.busy = false; render();\n}\nconst voiceName = () => { const node = document.querySelector('input[name=\"voice\"]:checked'); return node ? node.parentElement.textContent.trim().split(/\\s+/)[0] : 'Voice'; };\n$('action').addEventListener('click', () => act(false));\n$('again').addEventListener('click', () => act(true));\nfor (const id of ['facts', 'words', 'rules']) $(id).addEventListener('input', () => { if (id === 'facts') state.factsFromChat = false; render(); });\nfor (const name of ['tone', 'voice', 'speed']) for (const node of document.querySelectorAll('input[name=\"' + name + '\"]')) node.addEventListener('change', render);\n\n// ── What the host gives: the Step's inputs and what was saved before ──────\nStillMade.onInput(input => {\n  state.input = input || {};\n  fillFromInput();\n  if (typeof state.input.tone === 'string' && state.input.tone in { warm: 1, friendly: 1, 'no-nonsense': 1, luxury: 1 }) pick('tone', state.input.tone);\n  if (typeof state.input.voice === 'string') pick('voice', state.input.voice);\n  render();\n});\n// The host's shared fields start from the saved shared state, which can arrive after the\n// Step's input did and leave a bound field empty; what the input gave is put back then.\nfunction fillFromInput() {\n  const brief = words(state.input.brief);\n  if (brief && !facts()) { setField('facts', brief); state.factsFromChat = true; }\n  const given = words(state.input.script);\n  if (given && !script()) setField('words', given);\n}\nfunction adopt(snapshot) {\n  const outputs = snapshot && snapshot.outputs || {};\n  state.outputs = outputs;\n  fillFromInput();\n  if (outputs.script && !script()) setField('words', words(outputs.script));\n  if (outputs.audio) showAudio(outputs.audio, state.input.take ? 'Your recording' : voiceName()); else showAudio(null);\n  render();\n}\nif (typeof StillMade.onShared === 'function') StillMade.onShared(adopt);\ntry { if (typeof StillMade.getShared === 'function') { const shared = StillMade.getShared(); if (shared && typeof shared.then === 'function') shared.then(adopt, () => {}); else adopt(shared); } } catch {}\nrender();\n\n})();\n"
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stillmade-sdk",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "StillMade Block SDK, CLI and examples",
   "license": "PolyForm-Shield-1.0.0",
   "type": "module",

package/packages/block-cli/cli.js

@@ -248,7 +248,11 @@ export async function main(rawArgs) {
       const source=await defineBrowserApplicationSource(pkg);
       throw Object.assign(new Error(`${source.manifest.name} passed the local browser-application source contract. Browser applications are judged only by StillMade's isolated review: import this exact package in the StillMade desktop app and run its review. It is not ready until that review passes.`),{code:'APPLICATION_REVIEW_REQUIRED'});
     }
-    const readiness=await assessBlockReadiness(pkg);
+    // On the creator's own machine a module Block runs in the SDK's Node executor with the
+    // stand-in host that answers from tests/mocks.json, as test and preview do (October 20,
+    // 2026: ready refused every module Block at DOD-01, so none could pass the gate from the SDK).
+    const mock=pkg.manifest?.runtime==='module'?await standIns(path,pkg,true):null;
+    const readiness=await assessBlockReadiness(pkg,{moduleExecution:true,files:moduleFiles.get(pkg),...(mock?{host:mock.host}:{})});
     if(['FAILED','BLOCKED BY PLATFORM CAPABILITY'].includes(readiness.status))throw Object.assign(new Error(`Block readiness: ${readiness.status}`),{report:readiness});
     return readiness;
   }

package/packages/block-cli/ready-gate.js

@@ -9,6 +9,7 @@ import {readFile,readdir,writeFile,mkdir,lstat} from 'node:fs/promises';
 import {realpathSync} from 'node:fs';
 import {join,relative,resolve,sep} from 'node:path';
 import {fileURLToPath} from 'node:url';
+import {BUILDER_CONTRACT_STAMP} from '../block-sdk/builder-contract.js';
 
 export const READY_GATE_STATE='.stillmade';
 // Shipped in the SDK download: Claude Code and Cursor run the gate whenever the
@@ -81,11 +82,16 @@ export async function sdkBaselineForFiles(files){
 async function readJson(path,fallback){try{return JSON.parse(await readFile(path,'utf8'));}catch{return fallback;}}
 const summarize=readiness=>(readiness?.items||[]).filter(item=>['failed','blocked'].includes(item.state)).slice(0,6).map(item=>`${item.id} ${item.title}: ${String(item.reason||'').slice(0,300)}`);
 
-async function judge(path,main){
+// A module Block's code runs in a Node worker, which is no isolation boundary, so only a gate the
+// person or agent started themselves runs it (`gate`, `ready`); the gate a hook starts at the end
+// of a turn does not, and says so (October 20, 2026).
+export const RUN_READY_YOURSELF='RUN READY YOURSELF';
+async function judge(path,main,{executeModules=true}={}){
  try{
-  const readiness=await main(['ready',path]);
   // Every new or edited Block carries its feature map (builder-contract); search, matching and its listing read it.
   const manifest=(await main(['inspect',path]).catch(()=>null))?.manifest;
+  if(!executeModules&&manifest?.runtime==='module')return {ok:false,status:RUN_READY_YOURSELF,failures:['This Block runs code, so the gate a hook starts does not run it. Run `stillmade-block gate .` (`npx stillmade-block gate .` in an npm project) yourself and report the status it prints.'],limitations:0};
+  const readiness=await main(['ready',path]);
   // The starting map create writes (one entry copied from the description) does not count until it is rewritten.
   const placeholder=features=>features.length===1&&features[0].id==='main'&&features[0].asks?.length===1&&features[0].asks[0]===features[0].does;
   if(PASSING.has(readiness.status)&&manifest&&!(Array.isArray(manifest.features)&&manifest.features.length&&!placeholder(manifest.features)))
@@ -103,7 +109,7 @@ async function judge(path,main){
 }
 
 /** Judge every changed package. Never throws for a failing Block; returns a verdict. */
-export async function runReadyGate({root=process.cwd(),main}={}){
+export async function runReadyGate({root=process.cwd(),main,executeModules=true}={}){
  root=resolve(root);
  main??=(await import('./cli.js')).main;
  const baseline=(await readJson(join(root,SDK_BASELINE_FILE),{packages:{}})).packages||{};
@@ -113,8 +119,12 @@ export async function runReadyGate({root=process.cwd(),main}={}){
   const name=posix(relative(root,path)),digest=await packageDigest(path);
   if(baseline[name]===digest)continue;
   const cached=cache.entries[name];
-  const verdict=cached?.digest===digest?cached:{digest,...await judge(path,main),checkedAt:new Date().toISOString()};
-  cache.entries[name]=verdict;
+  // A verdict is reused only for the same package under the same contract: a newer SDK judges again
+  // (October 20, 2026: a FAILED verdict from the SDK that could not run module Blocks outlived the fix).
+  const verdict=cached?.digest===digest&&cached?.contract===BUILDER_CONTRACT_STAMP?cached:{digest,contract:BUILDER_CONTRACT_STAMP,...await judge(path,main,{executeModules}),checkedAt:new Date().toISOString()};
+  // A verdict the hook could not reach (a module Block it did not run) is not kept: the person's own
+  // gate run judges it, and that verdict then answers the hook too.
+  if(verdict.status!==RUN_READY_YOURSELF)cache.entries[name]=verdict;
   results.push({package:name,...verdict});
  }
  await mkdir(join(root,READY_GATE_STATE),{recursive:true});
@@ -131,7 +141,7 @@ export function gateMessage(verdict){
 /** Hook entry. `agent` is claude, cursor or plain. Returns {exitCode, stdout}. */
 export async function readyGateHook({agent='plain',input={},root,main}={}){
  root=resolve(root||(agent==='cursor'?process.env.CURSOR_PROJECT_DIR||input.workspace_roots?.[0]:process.env.CLAUDE_PROJECT_DIR||input.cwd)||process.cwd());
- const verdict=await runReadyGate({root,main});
+ const verdict=await runReadyGate({root,main,executeModules:false});
  const statePath=join(root,READY_GATE_STATE,'gate-state.json'),state=await readJson(statePath,{});
  if(verdict.passed){
   await writeFile(statePath,'{}\n');

package/packages/block-platform/block-readiness.js

@@ -81,7 +81,8 @@ function rehearsalContext(packages){
  * @param options.liveReceipt {digest} of a reviewed live hosted run for this exact package
  * @param options.unsupported {reason,gapClass,primitive} when authoring reported a platform gap
  */
-export async function assessBlockReadiness(pkg,{catalog=FIRST_PARTY_SDK_PACKAGES,admission,platformChecks,sharedEditing,liveReceipt,unsupported,budgetMs=20000,signal,moduleExecution=false}={}){
+// files: a module Block's folder files (path -> bytes), run only when moduleExecution is true (the creator's own machine).
+export async function assessBlockReadiness(pkg,{catalog=FIRST_PARTY_SDK_PACKAGES,admission,platformChecks,sharedEditing,liveReceipt,unsupported,budgetMs=20000,signal,moduleExecution=false,files,host}={}){
  const deadline=Date.now()+budgetMs,left=()=>deadline-Date.now(),items=new Map(),composition={};
  const set=(id,state,detail={})=>{if(!items.has(id)||items.get(id).state!=='failed')items.set(id,{id,title:TITLES[id],state,...detail});};
  const verified=(id,evidence)=>set(id,'verified',{evidence});
@@ -103,7 +104,7 @@ export async function assessBlockReadiness(pkg,{catalog=FIRST_PARTY_SDK_PACKAGES
 
  const manifest=pkg.manifest,sourceDigest=await digest(pkg),hosted=!offline(pkg);
  let report=admission;
- if(!report){try{report=await admitLocalPackage(pkg,{timeoutMs:Math.max(1000,Math.min(15000,left())),moduleExecution:moduleExecution===true});}catch(error){
+ if(!report){try{report=await admitLocalPackage(pkg,{timeoutMs:Math.max(1000,Math.min(15000,left())),moduleExecution:moduleExecution===true,...(files?{files}:{}),...(host?{host}:{})});}catch(error){
   // Admission running out of this check's own time budget is not a Block defect.
   const exhausted=error.code==='TIMEOUT'&&/shared budget/.test(error.message||'');
   report={passed:false,results:[{name:'Admission',passed:false,code:exhausted?'READINESS_BUDGET':error.code,message:message(error)}]};

package/packages/block-sdk/builder-contract.js

@@ -152,5 +152,5 @@ export function renderBuilderContract(form='compact',{scope='all'}={}){
   `## Platform gap classes\n\n${Object.entries(GAP_CLASSES).map(([key,label])=>`- ${key}: ${label}`).join('\n')}`,
  ].join('\n\n');
  if(form==='full')return `# StillMade Block builder contract\n\n${body}`;
- return `# Building StillMade Blocks in this folder\n\nThis folder is the StillMade Block SDK. Read this file before writing code; it is the same contract StillMade's own AI and importers follow. Commands below use the downloaded SDK folder form \`node packages/block-cli/cli.js\`; when the SDK came from \`npm install --save-dev stillmade-sdk\`, type \`npx stillmade-block\` in its place. Scaffold with \`node packages/block-cli/cli.js create my-block javascript\`, then iterate with \`validate my-block\` and \`test my-block\`, check admission with \`pack my-block /tmp/my-block.stillmade-block --original\`, and finish with \`ready my-block\`, the same readiness check StillMade runs before an install or a release. \`SDK.md\` is the complete reference and \`PASTE_TO_LLM.md\` the detailed authoring guide.\n\n## Readiness gate\n\nDo not tell the user a Block is ready, done or working until \`node packages/block-cli/cli.js gate .\` passes after your last edit, and report the exact status it prints. In this folder Claude Code (\`.claude/settings.json\`) and Cursor (\`.cursor/hooks.json\`) run the gate when you finish a turn and send any failures back to you, but only in a session started in this folder: if you downloaded the SDK during the current session, run the gate yourself. Other agents must also run it themselves. If you cannot fix a failure, say plainly that the Block is not ready and list the failing checks.\n\n${body}`;
+ return `# Building StillMade Blocks in this folder\n\nThis folder is the StillMade Block SDK. Read this file before writing code; it is the same contract StillMade's own AI and importers follow. Commands below use the downloaded SDK folder form \`node packages/block-cli/cli.js\`; when the SDK came from \`npm install --save-dev stillmade-sdk\`, type \`npx stillmade-block\` in its place. Scaffold with \`node packages/block-cli/cli.js create my-block javascript\`, then iterate with \`validate my-block\` and \`test my-block\`, check admission with \`pack my-block /tmp/my-block.stillmade-block --original\`, and finish with \`ready my-block\`, the same readiness check StillMade runs before an install or a release. \`SDK.md\` is the complete reference and \`PASTE_TO_LLM.md\` the detailed authoring guide.\n\n## Readiness gate\n\nDo not tell the user a Block is ready, done or working until \`node packages/block-cli/cli.js gate .\` passes after your last edit, and report the exact status it prints. In this folder Claude Code (\`.claude/settings.json\`) and Cursor (\`.cursor/hooks.json\`) run the gate when you finish a turn and send any failures back to you, but only in a session started in this folder: if you downloaded the SDK during the current session, run the gate yourself. Other agents must also run it themselves. A module Block runs code, so the gate a hook starts does not run it and says so: run \`gate\` or \`ready\` on it yourself. If you cannot fix a failure, say plainly that the Block is not ready and list the failing checks.\n\n${body}`;
 }

package/packages/block-sdk/local-admission.js

@@ -18,7 +18,9 @@ function moduleFilesOf(pkg,files){
 // isolation boundary. Only a caller that owns the code asks for it: the SDK CLI
 // on the creator's own machine (`moduleExecution:true`), never a server path
 // admitting someone else's upload (imports, AI authoring, readiness from the API).
-export async function admitLocalPackage(pkg,{timeoutMs=15000,files,moduleExecution=false}={}){
+// host: the stand-in host a module runs against (the CLI's, which answers from tests/mocks.json);
+// without one, the recorded stand-ins.
+export async function admitLocalPackage(pkg,{timeoutMs=15000,files,moduleExecution=false,host}={}){
  const moduleFiles=moduleExecution===true&&pkg?.manifest?.runtime==='module'?moduleFilesOf(pkg,files):null;
  assert(['recipe','javascript','capability','comfyui'].includes(pkg?.manifest?.runtime)||moduleFiles,'RUNTIME_RESTRICTED',pkg?.manifest?.runtime==='module'?'Local admission runs a module Block only on your own machine (the SDK CLI); StillMade runs it in the browser sandbox after review.':'Local admission supports recipes, isolated JavaScript, declarative capabilities and ComfyUI workflows. Hosted execution still requires account review.');
  assert(Number.isFinite(timeoutMs)&&timeoutMs>0&&timeoutMs<=15000,'TIMEOUT','Local admission needs a positive budget of at most 15 seconds');
@@ -36,7 +38,7 @@ export async function admitLocalPackage(pkg,{timeoutMs=15000,files,moduleExecuti
   // hosted calls, media and files; the digests are checked before anything runs.
   // Loaded only for a module package: the Node executor needs worker threads, which the
  // App's bundle (this file is part of it) must never pull in statically.
- const module=moduleFiles?await (async()=>{const [{createNodeModuleExecutor},{createMockHost}]=await Promise.all([import('./module-node.js'),import('./mock-host.js')]);return createNodeModuleExecutor({files:moduleFiles,host:createMockHost({manifest:pkg.manifest}).host});})():undefined;
+ const module=moduleFiles?await (async()=>{const [{createNodeModuleExecutor},{createMockHost}]=await Promise.all([import('./module-node.js'),import('./mock-host.js')]);return createNodeModuleExecutor({files:moduleFiles,host:host||createMockHost({manifest:pkg.manifest}).host});})():undefined;
   const report=await admitPackage(pkg,{
    test:content=>testPackage(content,{timeoutMs:remaining(),...(module?{module}:{})}),
    run:(content,input,options)=>{remaining();return runPackageAsync(content,input,{...options,signal:controller.signal,...(module?{module}:{})});},