super-ux 0.26.5 → 0.27.1

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## 0.27.1 — 2026-08-05
+
+Re-cut of 0.27.0 on the correct base. The 0.27.0 tag was pushed from a tree
+that predated 0.26.2–0.26.5, so the GitHub release it produced was missing
+the MIT declarations, the `/ux-audit` front-matter fix, `displayName`, and
+the npm-publish workflow. Nothing was published to npm from it. The content
+of 0.27.0 is unchanged and listed below it; this release only puts it on top
+of the history it belongs to.
+
+## 0.27.0 — 2026-08-04
+
+An audit of 51 external UX, product and growth skills, kept only where they
+found something this catalog did not already say better. Most of the overlap
+went the other way — on monetization, forms and activation the catalog was
+the stronger of the two, and with sources where the others had none. Four
+gaps survived that test.
+
+### Added
+- **Growth loops and referral — BP-147..151.** BP-067 has been telling
+  readers since 0.19 that freemium only works when free users feed a growth
+  loop, while the catalog described no loop anywhere. BP-147 names the three
+  kinds and the reference now resolves. The rest: virality riding the
+  product's own output rather than a "refer a friend" page, planning for a
+  viral coefficient around 0.2 with the loop's cycle time treated as the
+  other multiplier, rewards paid in the product's own unit on the invitee's
+  milestone, and abuse designed against before launch.
+- **Empty states — BP-152.** Three layers after NN/g: what happened, what
+  this place is for, and a way in — including inspecting the feature on demo
+  data. A blank panel is a defect, not a neutral state.
+- **Authentication and form recovery — BP-153..156.** The word "password"
+  appeared zero times across 146 practices. NIST SP 800-63B rev 4 (August
+  2025) made paste normative and composition rules prohibited; the field must
+  not fight the password manager; a passwordless door where the account
+  allows one; and a rejected form keeps the work instead of clearing it
+  (WCAG 2.2 redundant entry).
+- **Audit reports: a required "Scope and limits" section**
+  (`scenario-format.md`, `templates/audit-report.md`, `ux-audit`). A batched
+  audit reads a slice of the code, so silence about the rest was being read
+  as coverage. Absence from a report never means PASS.
+- **`validate_catalog()` in `test/validate.py`.** The catalog's shape — five
+  fields per entry, unbroken ids, tags from the taxonomy, and every practice
+  reachable from `practice-selection.md` — was an invariant held by hand
+  since the first entry. A practice no skill routes to is a practice that
+  does not exist; nothing checked for that until now.
+
+### Changed
+- Tag taxonomy gains `virality`, `referral` (mechanism) and `auth` (domain);
+  source keys gain `[NIST]` and `[Viral26]`.
+
+Two figures from the source material were dropped rather than repeated — a
+15–30% referral conversion norm and a 60% fraud threshold, neither of which
+survived a check. A third was corrected in the opposite direction: a viral
+coefficient of 0.3–0.7 is a strong result, not the practical target the
+source called it.
+
+The contract stays **v4**: the report section is additive and no existing
+`docs/ux` file changes shape.
+
 ## 0.26.5 — 2026-07-30
 
 ### Added

package/README.md

@@ -186,7 +186,7 @@ The contracts every skill reads:
 | [scenario-format.md](plugins/super-ux/skills/references/scenario-format.md) | **The contract (ux-contract v4).** File layout, every field name, stable IDs (`P` `JTBD` `JRN` `ST` `FLW` `SCR` `SCN`), completeness checklists, the `draft → validated → implemented` lifecycle, audit verdicts and severities, the UX-plan format |
 | [system-map.md](plugins/super-ux/skills/references/system-map.md) | The whole system on one page — pipeline, files, skills, companions, and the four sync rules; every skill points here |
 | [ux-design-principles.md](plugins/super-ux/skills/references/ux-design-principles.md) | How the agent thinks: the design pipeline (forward and backwards), task analysis, flow rules, heuristics PRN-01..16, the improvement procedure, anti-patterns |
-| [best-practices.md](plugins/super-ux/skills/references/best-practices.md) | Living, tag-indexed catalog of 146 proven practices — subscription-app laws, mobile/web/voice guidance (Apple HIG 2025, M3 Expressive, NN/g, Baymard, WCAG 2.2), monetization economics (RevenueCat/PLG 2025 benchmarks, ASO, freemium boundaries), web funnels end to end (landing, pricing, checkout, dunning, cancel) and web2app (paid handoff, deferred deep links, storefront rules), motion and page weight (HTTP Archive field data, W3C sustainability), accessibility as it actually fails (WebAIM Million, EAA/ADA exposure), frustration telemetry, gamification and trend governance, visual craft, Figma structure |
+| [best-practices.md](plugins/super-ux/skills/references/best-practices.md) | Living, tag-indexed catalog of 156 proven practices — subscription-app laws, mobile/web/voice guidance (Apple HIG 2025, M3 Expressive, NN/g, Baymard, WCAG 2.2), monetization economics (RevenueCat/PLG 2025 benchmarks, ASO, freemium boundaries), web funnels end to end (landing, pricing, checkout, dunning, cancel) and web2app (paid handoff, deferred deep links, storefront rules), motion and page weight (HTTP Archive field data, W3C sustainability), accessibility as it actually fails (WebAIM Million, EAA/ADA exposure), frustration telemetry, gamification and trend governance, growth loops and referral mechanics, empty states, authentication (NIST SP 800-63B rev 4) and form recovery, visual craft, Figma structure |
 | [practice-selection.md](plugins/super-ux/skills/references/practice-selection.md) | The deterministic bridge: product profile → mandatory consideration sets → per-artifact checklists → a compliance table where every pulled practice gets a verdict. No silent skips, no cargo cult |
 | [component-guidelines.md](plugins/super-ux/skills/references/component-guidelines.md) | Which control for which job (radios/select/switch, sheet/alert, modal/disclosure, combobox, nav bar/rail, FAB, dates, toasts) and the platform rules — Apple HIG, Material 3, W3C ARIA APG, GOV.UK |
 | [visual-identity.md](plugins/super-ux/skills/references/visual-identity.md) | The visual layer and its owner: one style pack for the whole product, where it's recorded, how it meets Figma and code, and the division of labor with the craft floors |
@@ -228,7 +228,7 @@ edits to `plugins/super-ux/skills/references/` need
 
 Built by ssheleg — [sshlg.me](https://sshlg.me)
 
-- X / Twitter — [@fuck_this_year](https://x.com/fuck_this_year)
+- X / Twitter — [@sshlg93](https://x.com/sshlg93)
 - Telegram — [@sshlg](https://t.me/sshlg)
 
 Part of the [ssheleg skill family](https://github.com/ssheleg/sshlg-skills):

package/cursor/rules/ux-audit.mdc

@@ -13,6 +13,11 @@ rule) — there is nothing to audit against.
 **Evidence discipline:** every verdict cites `file:line`. Cannot verify →
 verdict BLOCKED with the exact reason. Never guess, never a courtesy PASS.
 
+**Scope and limits (required section):** the report ends with what was
+covered, what was left out and why, what could not be verified, and what the
+code cannot answer. An audit reads a slice; absence from the report never
+means PASS.
+
 ## Loop
 
 1. Read the base (and foundation/flows/screens when they exist); scope =

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-ux",
-  "version": "0.26.5",
+  "version": "0.27.1",
   "description": "Scenario-driven UI development for AI agents (Claude Code, Cursor, 70+ agents): a versioned design chain in docs/ux/, a scenario-first hard rule, a deterministic drift linter, and evidence-backed UX audits. This package is the installer CLI.",
   "bin": {
     "super-ux": "bin/super-ux.js"
@@ -20,7 +20,10 @@
     "url": "https://github.com/ssheleg/super-ux/issues"
   },
   "license": "MIT",
-  "author": "ssheleg",
+  "author": {
+    "name": "ssheleg",
+    "url": "https://x.com/sshlg93"
+  },
   "engines": {
     "node": ">=16"
   },

package/templates/audit-report.md

@@ -29,6 +29,16 @@ Heuristic findings (deep): [PRN-NN] (severity) node — issue -> fix
 | # | Scenario | Severity | Finding | Suggested fix |
 |---|----------|----------|---------|---------------|
 
+## Scope and limits
+
+<!-- Required. An audit reads a finite slice of the code; absence from this
+report never means PASS. -->
+
+- **Covered:**
+- **Not covered:**
+- **Could not verify:**
+- **Open questions:**
+
 ## Practice compliance (deep audits)
 
 | Practice | Verdict | How / why not |