website-build-skill 0.1.0 → 0.1.2

package/docs/bundles/method.md

@@ -4,7 +4,7 @@ Generated from the canonical manifest. Do not edit this file.
 
 Bare skill paths in the included instructions resolve from the canonical skill directory.
 For uploads, locate the named source section in these bundles; request an attachment when absent.
-Project paths resolve only in the authorized website workspace. Native loading is UNVERIFIED.
+Project paths resolve only in the authorized website workspace. See [host setup and evidence](../COMPATIBILITY.md).
 
 ## Contents
 
@@ -29,7 +29,7 @@ Project paths resolve only in the authorized website workspace. Native loading i
 
 ---
 name: website-build-skill
-description: Research, design, build, audit, and prepare websites for release. Use for a new website, redesign, or whole-site review, including brand extraction and three visual mockups before site code. For a small isolated fix, load only the relevant audit or playbook.
+description: "Current website-building expertise for an AI: research, design, code, accessibility, performance, search and security. Research, design, build, audit, and prepare websites for release. Use for a new website, redesign, or whole-site review, including brand extraction and three visual mockups before site code. For a small isolated fix, load only the relevant audit or playbook."
 ---
 
 # Website Build Skill
@@ -44,7 +44,7 @@ How do you want to work?
                           Needs Claude Code, Codex, Hermes, Antigravity, or Grok Bot.
                           One command installs their files; you open each session yourself.
 
-Not sure? Pick 1. Moving to 2 later costs you nothing you have already done.
+Not sure? Pick 1. Moving to 2 later keeps everything you have already done.
 
 Where should the work be saved?
 
@@ -139,18 +139,19 @@ An INTERNAL critique cannot pass independence or a completed ship checklist.
 Reproduce findings, record ROUND 1 dispositions, and test fixes without an automatic second audit.
 Keep all project content and generated output outside the installed method directory.
 
-## Missing capabilities and support status
+## Working with the tools you have
 
-Use the complete missing-capability table in playbooks/research-and-memory.md.
+Use the complete tool table in playbooks/research-and-memory.md.
 Return named artifacts and exact settling checks for unavailable tools.
-No images means the mockup gate remains incomplete; no execution means untested code.
+Complete the mockup gate with inspected images and mark code tested after execution.
 A saved-file claim requires a successful write and read-back; memory needs its own receipt.
-No deployment access yields an operator handoff, not a released site.
-Native loading, installation, automated team creation, permissions and host integrations
-are UNVERIFIED until a recorded test proves them on the chosen surface.
-The install question describes the intended setup; definitions do not start workers
-or supply an independent model provider. Portable role prose is not a permission boundary.
-
+Hand deployment to an authorized operator when deploy access is unavailable.
+Check the chosen host's loading, installation, team creation, permissions and integrations
+with a recorded trial. See the repository's docs/COMPATIBILITY.md for host evidence.
+After installation, open the role sessions and provide a different model family for
+independent review. Enforce permissions through the host's own controls.
+Role text guides behaviour; real permissions come from the host's own settings and
+tools. Definitions start no workers and supply no second model provider.
 
 <!-- END SOURCE: SKILL.md -->
 
@@ -170,7 +171,7 @@ How do you want to work?
                           Needs Claude Code, Codex, Hermes, Antigravity, or Grok Bot.
                           One command installs their files; you open each session yourself.
 
-Not sure? Pick 1. Moving to 2 later costs you nothing you have already done.
+Not sure? Pick 1. Moving to 2 later keeps everything you have already done.
 
 Where should the work be saved?
 
@@ -391,14 +392,20 @@ milliseconds in fetched_at use three digits before Z. If the environment cannot
 supply a UTC timestamp, leave that claim UNVERIFIED; never invent precision.
 An existing qualified ASK DATE does not authorize a fabricated fetch timestamp.
 
-**Check before reliance.** Run `website-build-skill check-library <root>/site-work`
-when a shell exists. From a repository checkout the equivalent is
-`node bin/website-build-skill.mjs check-library <site-work-dir>`. Save the exact
-command, exit code and output with the research gate evidence. Exit 0 means
+**Check before reliance.** Use this checker ladder:
+
+1. `website-build-skill check-library <root>/site-work`, when that command is on PATH.
+2. Otherwise `npx -y website-build-skill@<packageVersion> check-library <root>/site-work`, where `<packageVersion>` is read from the installed `manifest.json`. Never write the literal version into prose, or it goes stale on every bump.
+3. From a repository checkout: `node bin/website-build-skill.mjs check-library <site-work-dir>`.
+4. When no rung can run, meaning no shell, no PATH command and npx fails or has no network: Reviewer records the five-rule manual equivalent. Also record each rung tried, with its command, exit code and output, as the reason.
+
+For every rung that runs, save the command, exit code and output. PASS still needs exit 0 from a mechanical rung, or a recorded manual equivalent for rung 4. Acted-on UNVERIFIED claims still keep research acceptance BLOCKED.
+
+Save the ladder evidence with the research gate evidence. Exit 0 means
 receipt consistency, not proof that a passage is true or supports a decision;
 exit 2 reports problems, one per line. The checker lists UNVERIFIED rows even
 when it exits 0. Any acted-on UNVERIFIED claim keeps research acceptance BLOCKED.
-Without a shell, Reviewer records the same five checks in
+For rung 4, Reviewer records the same five checks in
 checklists/research.md by hand. Independent AD09 re-fetching remains required.
 
 Example: a provider's paid-tier export right needs the exact tier's current terms,
@@ -550,26 +557,25 @@ Reopen the received files at the next session and run the prior-library or resum
 freshness procedure as appropriate. Missing disk persistence still blocks research.
 Optional memory being unsupported does not invalidate a verified disk library.
 
-## Missing-capability table
+## Working with the tools you have
 
-| Missing capability | Still works | Cannot honestly complete | Recovery artifact |
-| --- | --- | --- | --- |
-| Web search | Request clarification, supplied-source review, query planning. | Current-to-ASK-DATE research or revalidation, including a prior library; gate stays BLOCKED. | `query-plan.md`, `unresolved-claims.md`, and BLOCKED receipt. |
-| URL retrieval | Pasted/uploaded core method. | Raw-URL bootstrap and unopened-source citations. | Self-contained bundles from the human. |
-| File writing | Draft prompts, specifications, named file bodies. | Saved disk research or a claimed local install. | Downloadable files or copyable labeled blocks. |
-| Persistent memory | Current-session workflow and project documents. | Automatic durable memory across future sessions. | `MEMORY.md` proposal plus explicit save/reattach steps. |
-| Image generation/viewing | Brief and wireframe planning. | Three inspected visual mockups and visual approval. | Designer handoff with required assets and criteria. |
-| Code execution/browser | Draft implementation and test plan. | Measured contrast, functional tests, lab scores, live QA. | Commands and exact expected evidence for a capable runner. |
-| Separate workers | Sequential SOLO jobs, role learning, and saved self-handoffs. | A claimed TEAM or concurrent worker independence. | SOLO capability receipt and role-boundary packets. |
-| Independent model family | Internal critique and review packet. | Independent adversarial gate. | AUDIT_BRIEF plus immutable artifact for another family. |
-| Deploy access | Reviewable local/preview artifact where available. | Production release and live verification. | Operations doc and authorized operator handoff. |
-
-
-Capability gaps accumulate. One working tool cannot stand in for another.
-A URL reader is not a browser, image inspector, response-header reader, or calculator.
-An installed role definition is not a worker, tool permission, or different model family.
-Actual host loading, orchestration, isolation, memory, and deployment support are
-UNVERIFIED until tested in that session. Record the probe and result separately.
+| Tool | What it enables | Next step when it is absent |
+| --- | --- | --- |
+| Web search | Current-to-ASK-DATE research and revalidation, including a prior library. | Clarify the request, review supplied sources and plan queries. Return `query-plan.md`, `unresolved-claims.md`, and a BLOCKED receipt; current research resumes with web evidence. |
+| URL retrieval | Raw-URL bootstrap and opened-source citations. | Use a pasted or uploaded core method and ask the human for self-contained bundles. Cite sources after opening them. |
+| File writing | Saved disk research and a local install confirmed by read-back. | Draft prompts, specifications and named file bodies. Return downloadable files or copyable labeled blocks for saving and read-back. |
+| Persistent memory | Durable memory across future sessions. | Continue the current-session workflow and project documents. Return a `MEMORY.md` proposal plus explicit save/reattach steps. |
+| Image generation/viewing | Three inspected visual mockups and visual approval. | Plan the brief and wireframes. Return a Designer handoff with required assets and criteria; complete visual approval after inspecting the images. |
+| Code execution/browser | Measured contrast, functional tests, lab scores and live QA. | Draft implementation and a test plan. Return commands and exact expected evidence for a capable runner; record measured results after execution. |
+| Separate workers | TEAM jobs and concurrent workers with verified independence. | Run sequential SOLO jobs, role learning and saved self-handoffs. Return a SOLO capability receipt and role-boundary packets. |
+| Independent model family | The independent adversarial gate. | Run an internal critique and prepare a review packet. Return AUDIT_BRIEF plus an immutable artifact for another family; that review completes the independent gate. |
+| Deploy access | Production release and live verification. | Prepare a reviewable local/preview artifact where available. Return an operations doc and authorized operator handoff for release and live checks. |
+
+Check each tool separately. A working URL reader still needs separate browser,
+image inspection, response-header and calculator checks. After installing role
+definitions, verify running workers, tool permissions and the actual model families.
+Record a session probe and result for host loading, orchestration, isolation,
+memory and deployment before relying on each capability.
 
 ## Verify and hand off
 
@@ -864,11 +870,15 @@ digits, underscores and hyphens. Escape literal cell pipes with a backslash.
 ```
 
 Published matches the receipt's published field exactly. Status is OPENED or
-UNVERIFIED; `Verified` without a receipt is a gate failure. Run
-`website-build-skill check-library <root>/site-work` and record command, exit code
-and output. Without a shell, record Reviewer's manual equivalent of the five
-rules in checklists/research.md. Zero exit does not release acted-on UNVERIFIED
-claims: those keep research acceptance BLOCKED.
+UNVERIFIED; `Verified` without a receipt is a gate failure. Use this checker ladder;
+the five-rule manual equivalent is in checklists/research.md:
+
+1. `website-build-skill check-library <root>/site-work`, when that command is on PATH.
+2. Otherwise `npx -y website-build-skill@<packageVersion> check-library <root>/site-work`, where `<packageVersion>` is read from the installed `manifest.json`. Never write the literal version into prose, or it goes stale on every bump.
+3. From a repository checkout: `node bin/website-build-skill.mjs check-library <site-work-dir>`.
+4. When no rung can run, meaning no shell, no PATH command and npx fails or has no network: Reviewer records the five-rule manual equivalent. Also record each rung tried, with its command, exit code and output, as the reason.
+
+For every rung that runs, save the command, exit code and output. PASS still needs exit 0 from a mechanical rung, or a recorded manual equivalent for rung 4. Acted-on UNVERIFIED claims still keep research acceptance BLOCKED.
 
 ## Reuse and expiry record
 

package/docs/bundles/playbooks.md

@@ -4,7 +4,7 @@ Generated from the canonical manifest. Do not edit this file.
 
 Bare skill paths in the included instructions resolve from the canonical skill directory.
 For uploads, locate the named source section in these bundles; request an attachment when absent.
-Project paths resolve only in the authorized website workspace. Native loading is UNVERIFIED.
+Project paths resolve only in the authorized website workspace. See [host setup and evidence](../COMPATIBILITY.md).
 
 ## Contents
 
@@ -1020,14 +1020,20 @@ milliseconds in fetched_at use three digits before Z. If the environment cannot
 supply a UTC timestamp, leave that claim UNVERIFIED; never invent precision.
 An existing qualified ASK DATE does not authorize a fabricated fetch timestamp.
 
-**Check before reliance.** Run `website-build-skill check-library <root>/site-work`
-when a shell exists. From a repository checkout the equivalent is
-`node bin/website-build-skill.mjs check-library <site-work-dir>`. Save the exact
-command, exit code and output with the research gate evidence. Exit 0 means
+**Check before reliance.** Use this checker ladder:
+
+1. `website-build-skill check-library <root>/site-work`, when that command is on PATH.
+2. Otherwise `npx -y website-build-skill@<packageVersion> check-library <root>/site-work`, where `<packageVersion>` is read from the installed `manifest.json`. Never write the literal version into prose, or it goes stale on every bump.
+3. From a repository checkout: `node bin/website-build-skill.mjs check-library <site-work-dir>`.
+4. When no rung can run, meaning no shell, no PATH command and npx fails or has no network: Reviewer records the five-rule manual equivalent. Also record each rung tried, with its command, exit code and output, as the reason.
+
+For every rung that runs, save the command, exit code and output. PASS still needs exit 0 from a mechanical rung, or a recorded manual equivalent for rung 4. Acted-on UNVERIFIED claims still keep research acceptance BLOCKED.
+
+Save the ladder evidence with the research gate evidence. Exit 0 means
 receipt consistency, not proof that a passage is true or supports a decision;
 exit 2 reports problems, one per line. The checker lists UNVERIFIED rows even
 when it exits 0. Any acted-on UNVERIFIED claim keeps research acceptance BLOCKED.
-Without a shell, Reviewer records the same five checks in
+For rung 4, Reviewer records the same five checks in
 checklists/research.md by hand. Independent AD09 re-fetching remains required.
 
 Example: a provider's paid-tier export right needs the exact tier's current terms,
@@ -1179,26 +1185,25 @@ Reopen the received files at the next session and run the prior-library or resum
 freshness procedure as appropriate. Missing disk persistence still blocks research.
 Optional memory being unsupported does not invalidate a verified disk library.
 
-## Missing-capability table
+## Working with the tools you have
 
-| Missing capability | Still works | Cannot honestly complete | Recovery artifact |
-| --- | --- | --- | --- |
-| Web search | Request clarification, supplied-source review, query planning. | Current-to-ASK-DATE research or revalidation, including a prior library; gate stays BLOCKED. | `query-plan.md`, `unresolved-claims.md`, and BLOCKED receipt. |
-| URL retrieval | Pasted/uploaded core method. | Raw-URL bootstrap and unopened-source citations. | Self-contained bundles from the human. |
-| File writing | Draft prompts, specifications, named file bodies. | Saved disk research or a claimed local install. | Downloadable files or copyable labeled blocks. |
-| Persistent memory | Current-session workflow and project documents. | Automatic durable memory across future sessions. | `MEMORY.md` proposal plus explicit save/reattach steps. |
-| Image generation/viewing | Brief and wireframe planning. | Three inspected visual mockups and visual approval. | Designer handoff with required assets and criteria. |
-| Code execution/browser | Draft implementation and test plan. | Measured contrast, functional tests, lab scores, live QA. | Commands and exact expected evidence for a capable runner. |
-| Separate workers | Sequential SOLO jobs, role learning, and saved self-handoffs. | A claimed TEAM or concurrent worker independence. | SOLO capability receipt and role-boundary packets. |
-| Independent model family | Internal critique and review packet. | Independent adversarial gate. | AUDIT_BRIEF plus immutable artifact for another family. |
-| Deploy access | Reviewable local/preview artifact where available. | Production release and live verification. | Operations doc and authorized operator handoff. |
-
-
-Capability gaps accumulate. One working tool cannot stand in for another.
-A URL reader is not a browser, image inspector, response-header reader, or calculator.
-An installed role definition is not a worker, tool permission, or different model family.
-Actual host loading, orchestration, isolation, memory, and deployment support are
-UNVERIFIED until tested in that session. Record the probe and result separately.
+| Tool | What it enables | Next step when it is absent |
+| --- | --- | --- |
+| Web search | Current-to-ASK-DATE research and revalidation, including a prior library. | Clarify the request, review supplied sources and plan queries. Return `query-plan.md`, `unresolved-claims.md`, and a BLOCKED receipt; current research resumes with web evidence. |
+| URL retrieval | Raw-URL bootstrap and opened-source citations. | Use a pasted or uploaded core method and ask the human for self-contained bundles. Cite sources after opening them. |
+| File writing | Saved disk research and a local install confirmed by read-back. | Draft prompts, specifications and named file bodies. Return downloadable files or copyable labeled blocks for saving and read-back. |
+| Persistent memory | Durable memory across future sessions. | Continue the current-session workflow and project documents. Return a `MEMORY.md` proposal plus explicit save/reattach steps. |
+| Image generation/viewing | Three inspected visual mockups and visual approval. | Plan the brief and wireframes. Return a Designer handoff with required assets and criteria; complete visual approval after inspecting the images. |
+| Code execution/browser | Measured contrast, functional tests, lab scores and live QA. | Draft implementation and a test plan. Return commands and exact expected evidence for a capable runner; record measured results after execution. |
+| Separate workers | TEAM jobs and concurrent workers with verified independence. | Run sequential SOLO jobs, role learning and saved self-handoffs. Return a SOLO capability receipt and role-boundary packets. |
+| Independent model family | The independent adversarial gate. | Run an internal critique and prepare a review packet. Return AUDIT_BRIEF plus an immutable artifact for another family; that review completes the independent gate. |
+| Deploy access | Production release and live verification. | Prepare a reviewable local/preview artifact where available. Return an operations doc and authorized operator handoff for release and live checks. |
+
+Check each tool separately. A working URL reader still needs separate browser,
+image inspection, response-header and calculator checks. After installing role
+definitions, verify running workers, tool permissions and the actual model families.
+Record a session probe and result for host loading, orchestration, isolation,
+memory and deployment before relying on each capability.
 
 ## Verify and hand off
 
@@ -1384,7 +1389,7 @@ When repeated structure or metadata requires recurring copy/edit work, revisit t
 scripted-static recipe before duplicating a growing set of pages.
 Record how shared navigation and discovery files remain consistent in the interim.
 
-## Limits and exit
+## When to move to a bigger stack
 
 Browser JavaScript cannot safely store server secrets or enforce private authorization.
 Use a separately justified endpoint or reconsider the framework branch for server state.
@@ -1467,7 +1472,7 @@ Keep adverse cases for quotes, script terminators, unsafe schemes, empty IDs,
 duplicate slugs, missing assets, long copy, and publication boundaries.
 Apply checklists/build.md and the remaining QA/security/ship gates.
 
-## Limits and exit
+## When to move to a bigger stack
 
 A generated page changes only when rebuilt and promoted.
 A browser interaction cannot keep a private server credential.
@@ -1550,7 +1555,7 @@ Keep client work small; add it for actual interaction rather than all page conte
 - Release: freeze a candidate, obtain different-family read-only review, reproduce findings,
   verify fixes, then promote the checked artifact within existing authorization.
 
-## Limits and exit
+## When to move to a bigger stack
 
 More runtime means more dependency, patching, secret, and operational responsibility.
 Record the upgrade cadence, watchers, failure recipient, and tested recovery commands.

package/docs/bundles/prompts.md

@@ -4,7 +4,7 @@ Generated from the canonical manifest. Do not edit this file.
 
 Bare skill paths in the included instructions resolve from the canonical skill directory.
 For uploads, locate the named source section in these bundles; request an attachment when absent.
-Project paths resolve only in the authorized website workspace. Native loading is UNVERIFIED.
+Project paths resolve only in the authorized website workspace. See [host setup and evidence](../COMPATIBILITY.md).
 
 ## Contents
 
@@ -70,7 +70,7 @@ SOLO PATH
 SAME GATES
 Both paths hit the same gates. Solo work does not lower a threshold or waive a
 missing check. An INTERNAL review leaves independence unmet and release blocked.
-Read the missing-capability table in playbooks/research-and-memory.md.
+Read the Working with the tools you have table in playbooks/research-and-memory.md.
 
 FIRST
 - Tell me which of these you can actually use: search, URL reading, image viewing,
@@ -99,8 +99,15 @@ SAVE
   OPENED from memory or a search snippet. Without a receipt it is UNVERIFIED;
   an acted-on UNVERIFIED claim keeps research acceptance BLOCKED.
 - Complete prompts/01-website-deep-research.md and its library before any other role.
-  Record `website-build-skill check-library <root>/site-work` command, exit code
-  and output, or Reviewer's five-rule manual equivalent when no shell exists.
+  Use this checker ladder; the five-rule manual equivalent is in checklists/research.md:
+
+  1. `website-build-skill check-library <root>/site-work`, when that command is on PATH.
+  2. Otherwise `npx -y website-build-skill@<packageVersion> check-library <root>/site-work`, where `<packageVersion>` is read from the installed `manifest.json`. Never write the literal version into prose, or it goes stale on every bump.
+  3. From a repository checkout: `node bin/website-build-skill.mjs check-library <site-work-dir>`.
+  4. When no rung can run, meaning no shell, no PATH command and npx fails or has no network: Reviewer records the five-rule manual equivalent. Also record each rung tried, with its command, exit code and output, as the reason.
+
+  For every rung that runs, save the command, exit code and output. PASS still needs exit 0 from a mechanical rung, or a recorded manual equivalent for rung 4. Acted-on UNVERIFIED claims still keep research acceptance BLOCKED.
+
 - After its gate passes, Coordinator confirms brief.md, capabilities.md, and status.md
   under site-work/. If file tools are missing, return named bodies for me to save
   and reattach; wait for saved library read-back before any design work.
@@ -332,11 +339,17 @@ B. Your memory: propose durable rules and the library location, then save throug
 RESEARCH GATE
 Apply checklists/research.md AD01 through AD08 and the canonical ASK DATE rule;
 record allowed rung/raw evidence, two-date claim coverage, matching openers,
-earliest expiry and per-claim reuse decisions. Run
-`website-build-skill check-library <root>/site-work` and save command, exit code
-and output; PASS needs exit 0. Without a shell record Reviewer's five-rule manual
-equivalent from checklists/research.md. Zero exit does not release acted-on
-UNVERIFIED claims: they keep research acceptance BLOCKED. Independent AD09 runs
+earliest expiry and per-claim reuse decisions. Use this checker ladder; the
+five-rule manual equivalent is in checklists/research.md:
+
+1. `website-build-skill check-library <root>/site-work`, when that command is on PATH.
+2. Otherwise `npx -y website-build-skill@<packageVersion> check-library <root>/site-work`, where `<packageVersion>` is read from the installed `manifest.json`. Never write the literal version into prose, or it goes stale on every bump.
+3. From a repository checkout: `node bin/website-build-skill.mjs check-library <site-work-dir>`.
+4. When no rung can run, meaning no shell, no PATH command and npx fails or has no network: Reviewer records the five-rule manual equivalent. Also record each rung tried, with its command, exit code and output, as the reason.
+
+For every rung that runs, save the command, exit code and output. PASS still needs exit 0 from a mechanical rung, or a recorded manual equivalent for rung 4. Acted-on UNVERIFIED claims still keep research acceptance BLOCKED.
+
+Independent AD09 runs
 before ship with live re-fetches of the required acted-on source sample.
 The library exists on disk, every domain this project touches has a substantive
 file and checklist, and every claim that will be acted on carries an opened source