website-build-skill 0.1.12 → 0.1.14

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "website-build-skill",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "A skill pack that turns your AI into an expert website builder: current research, design, code, accessibility, speed, SEO and security, alone or as a team.",
   "author": {
     "name": "website-build-skill contributors"

package/CHANGELOG.md

@@ -6,6 +6,25 @@ Version policy: [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html)
 
 ## [Unreleased]
 
+## [0.1.14] - 2026-10-01
+
+### Changed
+
+- Terminal demo re-recorded from the published 0.1.13 package.
+
+## [0.1.13] - 2026-10-01
+
+### Added
+
+- README hero trailer: a short tour of what your AI learns, the 14 research domains and the 12 stages, ending on the install command.
+
+### Changed
+
+- Terminal demo moved to the installer guide and labeled as a recording from version 0.1.1.
+- GIFs excluded from the npm package; documentation uses absolute raw image URLs.
+- The package check requires the GIF exclusion after the docs entry.
+- The privacy and voice scan reads a GIF by path only, so compressed bytes cannot match as prose.
+
 ## [0.1.12] - 2026-10-01
 
 ### Added
@@ -184,6 +203,8 @@ Version policy: [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html)
 - Generated native workers for the seven-role team, gated on schema and permission tests.
 - Clean-client trials, behavioral evaluations and fresh-tarball trials on Linux and Windows.
 
-[Unreleased]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.12...HEAD
+[Unreleased]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.14...HEAD
+[0.1.14]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.13...v0.1.14
+[0.1.13]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.12...v0.1.13
 [0.1.12]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.11...v0.1.12
 [0.1.11]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.10...v0.1.11

package/README.md

@@ -17,6 +17,8 @@ Run the npm installer in your project folder. It asks how you want to work, whic
 npx website-build-skill
 ```
 
+![A short tour of what your AI learns, the 14 research domains and the 12 stages, ending on the install command on the closing card](https://raw.githubusercontent.com/aunysillyme/website-build-skill/main/docs/trailer.gif)
+
 It copies the skill pack into your host's folder, checks the saved files and writes a receipt.
 Open your AI and ask it to read the installed `SKILL.md`.
 Use `--dry-run` to preview paths. The [installer guide](docs/INSTALLER.md) covers all flags, receipts and exit codes.
@@ -44,8 +46,6 @@ Get them from [the public bundle folder](https://github.com/aunysillyme/website-
 or [the main archive](https://github.com/aunysillyme/website-build-skill/archive/refs/heads/main.zip).
 Ask your AI to name the files it read before starting.
 
-![Installer demo: preview the files, install the Codex skill and inspect the receipt](https://raw.githubusercontent.com/aunysillyme/website-build-skill/main/docs/demo.gif)
-
 ## What your AI learns
 
 | Area | What your AI learns | Files |

package/RELEASING.md

@@ -99,6 +99,7 @@ Release completion requires:
 
 - Bin: `npm view website-build-skill@<version> bin --json --prefer-online` equals `node -p "JSON.stringify(require('./package.json').bin)"`.
 - Demo image: `curl -sI -o /dev/null -w '%{http_code} %{content_type}\n' https://raw.githubusercontent.com/aunysillyme/website-build-skill/main/docs/demo.gif` prints `200 image/gif`.
+- Hero trailer: `curl -sI -o /dev/null -w '%{http_code} %{content_type}\n' https://raw.githubusercontent.com/aunysillyme/website-build-skill/main/docs/trailer.gif` prints `200 image/gif`. The README hero resolves only once `docs/trailer.gif` is on main, so push main and wait for it to be green before tagging.
 
 Host discovery and activation are still not proven by any of that.
 Record downloaded bytes, commands, versions, date, actual results and any gaps as sanitized evidence.

package/docs/INSTALLER.md

@@ -32,6 +32,10 @@ npx website-build-skill --solo --target codex --dir . --scope project --yes
 npx website-build-skill --team --target antigravity --dir . --scope project --yes
 ```
 
+This recorded install uses the published 0.1.13 package (SOLO, Codex target), ending on the receipt read-back of 57 files.
+
+![Installer demo: preview the files, install the Codex skill and inspect the receipt](https://raw.githubusercontent.com/aunysillyme/website-build-skill/main/docs/demo.gif)
+
 For unreleased changes, use `npx github:aunysillyme/website-build-skill` with the same flags.
 Append `#<reviewed-commit-sha>` to the repository reference for a reproducible install.
 

package/docs/evidence/content-review.json

@@ -25,9 +25,9 @@
       "review": "0.1.5 (#15): status line narrowed to the two SOLO loading receipts; other hosts, TEAM, account tools and independent review stay UNVERIFIED. Claude editorial review. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 0.1.11: the three accuracy lines moved unchanged from CLAUDE.md; the method and contributor instructions stay in one source. Implementation-agent editorial review; independent review remains pending."
     },
     "CHANGELOG.md": {
-      "sha256": "0067dcf28db58951f60e68b4c91c7522289f69dc741e7252c9ed6a12078c2d11",
+      "sha256": "effb91c28ac5865778c2ed95f425c0eb2f4a823b7117591fed3eb77fd4510054",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the added 0.1.1 framing note against the presentation copy changes; publication is a separate release action. Implementation-agent editorial review; independent review remains pending. Reviewed the copied-install checker ladder fix against the canonical instructions and regression test. Live host retrial remains pending release. Reviewed for the ROUND 1 audit: added Fixed/Added/Changed lines for the restored positive-and-accurate adapter, SKILL.md, designer.md, grok.md and validate.mjs fixes. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.3: reviewed the #13 description check and #14 Hermes path documentation entries against the implementation and regression tests; publication remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. Reviewed the #15 Fixed line for the symlinked-parent receipt path against src/install.mjs and installer tests 7e-7g, and the #15 Added line against the two receipts. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. 0.1.5 release heading moved the Unreleased lines under [0.1.5] - 2026-09-24 unchanged. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 0.1.7: Grok Bot setup and one-description entries reviewed against the diff. Claude editorial review. 0.1.8: reviewed the Added lines against the committed BM05, CQ06, B08, prompt 04 and PROVENANCE.md diff; every named tell, default and credit matches the checklist text. Claude editorial review; the change itself had an independent codex audit (CLEAN). 0.1.9: reviewed the Fixed line against the src/bundle.mjs describe() diff, the regenerated llms.txt lines 19 and 21 and test/llms-labels.test.mjs. Claude editorial review; the change had an independent codex audit (CLEAN). 0.1.10: reviewed the Added and Changed lines against scripts/build.mjs --rehash, its tests and the CONTRIBUTING/RELEASING diff; the claims match (code-reviewer audit CLEAN). 0.1.11: reviewed the entry against the instruction import and accuracy-note move; the compare link joins v0.1.10 and v0.1.11. Implementation-agent editorial review; publication remains a separate maintainer action. 0.1.12: reviewed Keep a Changelog 2.0.0 reference, empty Unreleased section, 0.1.12 Added/Changed/Removed entries and compare link against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending."
+      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the added 0.1.1 framing note against the presentation copy changes; publication is a separate release action. Implementation-agent editorial review; independent review remains pending. Reviewed the copied-install checker ladder fix against the canonical instructions and regression test. Live host retrial remains pending release. Reviewed for the ROUND 1 audit: added Fixed/Added/Changed lines for the restored positive-and-accurate adapter, SKILL.md, designer.md, grok.md and validate.mjs fixes. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.3: reviewed the #13 description check and #14 Hermes path documentation entries against the implementation and regression tests; publication remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. Reviewed the #15 Fixed line for the symlinked-parent receipt path against src/install.mjs and installer tests 7e-7g, and the #15 Added line against the two receipts. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. 0.1.5 release heading moved the Unreleased lines under [0.1.5] - 2026-09-24 unchanged. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 0.1.7: Grok Bot setup and one-description entries reviewed against the diff. Claude editorial review. 0.1.8: reviewed the Added lines against the committed BM05, CQ06, B08, prompt 04 and PROVENANCE.md diff; every named tell, default and credit matches the checklist text. Claude editorial review; the change itself had an independent codex audit (CLEAN). 0.1.9: reviewed the Fixed line against the src/bundle.mjs describe() diff, the regenerated llms.txt lines 19 and 21 and test/llms-labels.test.mjs. Claude editorial review; the change had an independent codex audit (CLEAN). 0.1.10: reviewed the Added and Changed lines against scripts/build.mjs --rehash, its tests and the CONTRIBUTING/RELEASING diff; the claims match (code-reviewer audit CLEAN). 0.1.11: reviewed the entry against the instruction import and accuracy-note move; the compare link joins v0.1.10 and v0.1.11. Implementation-agent editorial review; publication remains a separate maintainer action. 0.1.12: reviewed Keep a Changelog 2.0.0 reference, empty Unreleased section, 0.1.12 Added/Changed/Removed entries and compare link against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending. 0.1.13 hero trailer: reviewed against the approved v2a render. 0.1.13 audit round 1 fixes, non-author: alt text, trailer check and tag-order note, and the package-check and GIF-scan gate lines reviewed against src/validate.mjs and test/content.test.mjs. Claude editorial review.. 0.1.14 demo re-record: reviewed against the new recording's final frame"
     },
     "CLAUDE.md": {
       "sha256": "09976587703de7dff40a2fd5074d655f31072c33ea76ffd4ecc58fad87e1ea7c",
@@ -48,9 +48,9 @@
       "disposition": "instructions-and-qualified-status-only"
     },
     "README.md": {
-      "sha256": "13f77e6fbb5786d72481f77e0a344af669d775776623e465f22e01246afc3614",
+      "sha256": "4a9fe7f0ec6cfefa79d6449eff1cb94354364acb81355ef42ee71f6bdc40ce42",
       "disposition": "status-claims-bound-to-receipts",
-      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the requested skill-pack framing and each learning-table sentence against its linked canonical instructions; preserved the twelve stages, starter, setup card and sibling links. Demo URL awaits the separately recorded artifact. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. ROUND 1 (2026-09-24): added the receipts' one-run and operator-configuration limitations to the promoted wording, per the code-reviewer finding. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 2026-09-28: the \"Part of a set\" model-orchestrator row now carries that package's 1.0.0 description, verified identical to `npm view model-orchestrator description`; no claim about this package changed. Claude editorial review. 0.1.12: reviewed Gemini host label, unchanged sibling section relocation, receipt-based Uninstall section and FAQ link, and the seven-link Read next index against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending.",
+      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the requested skill-pack framing and each learning-table sentence against its linked canonical instructions; preserved the twelve stages, starter, setup card and sibling links. Demo URL awaits the separately recorded artifact. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. ROUND 1 (2026-09-24): added the receipts' one-run and operator-configuration limitations to the promoted wording, per the code-reviewer finding. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 2026-09-28: the \"Part of a set\" model-orchestrator row now carries that package's 1.0.0 description, verified identical to `npm view model-orchestrator description`; no claim about this package changed. Claude editorial review. 0.1.12: reviewed Gemini host label, unchanged sibling section relocation, receipt-based Uninstall section and FAQ link, and the seven-link Read next index against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending. 0.1.13 hero trailer: reviewed against the approved v2a render. 0.1.13 audit round 1 fixes, non-author: alt text, trailer check and tag-order note, and the package-check and GIF-scan gate lines reviewed against src/validate.mjs and test/content.test.mjs. Claude editorial review.",
       "claims": [
         {
           "text": "Native loading is tested",
@@ -67,9 +67,9 @@
       ]
     },
     "RELEASING.md": {
-      "sha256": "499b59bdcbf4861df6d1c649efd8f4dd99c2d2e61a2e8cf35bde3c0693c309f7",
+      "sha256": "0d0227d18f93758650614afa43a213af78574623c63825150732281b000812c5",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "0.1.3: reviewed the same-commit description update and explicit GitHub command against the task specification; no live repository setting was changed in this offline implementation pass. Implementation-agent editorial review; independent review remains pending. The command uses the exact repository URL to preserve the existing privacy allowance for public repository references. 0.1.9: step 6 now names both package-lock.json version fields, matching vault 05_how_we_build_repos 6.2; the lock had stayed at 0.1.6 through 0.1.8. Claude editorial review against scripts/check.mjs version comparison. Reviewed step 2 and the Writes section against scripts/build.mjs --rehash; plain build still writes only bundles and llms.txt. Claude editorial review; code audited separately by another model family. 0.1.12: reviewed 57-file install count supplied by the maintainer audit, present-tense failure modes, one installer write statement, GitHub release step, registry lag and README/description/provenance/funding completion checks against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending."
+      "review": "0.1.3: reviewed the same-commit description update and explicit GitHub command against the task specification; no live repository setting was changed in this offline implementation pass. Implementation-agent editorial review; independent review remains pending. The command uses the exact repository URL to preserve the existing privacy allowance for public repository references. 0.1.9: step 6 now names both package-lock.json version fields, matching vault 05_how_we_build_repos 6.2; the lock had stayed at 0.1.6 through 0.1.8. Claude editorial review against scripts/check.mjs version comparison. Reviewed step 2 and the Writes section against scripts/build.mjs --rehash; plain build still writes only bundles and llms.txt. Claude editorial review; code audited separately by another model family. 0.1.12: reviewed 57-file install count supplied by the maintainer audit, present-tense failure modes, one installer write statement, GitHub release step, registry lag and README/description/provenance/funding completion checks against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending.. 0.1.13 audit round 1 fixes, non-author: alt text, trailer check and tag-order note, and the package-check and GIF-scan gate lines reviewed against src/validate.mjs and test/content.test.mjs. Claude editorial review."
     },
     "REPO_SETTINGS.md": {
       "sha256": "ccace33e8ec71e10616729888406098136a1b60ee626da8a68856a50af0b3e97",
@@ -180,9 +180,9 @@
       "review": "Reviewed the exact two-sibling allowlist against production privacy rules and rejection regressions. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending."
     },
     "docs/INSTALLER.md": {
-      "sha256": "91a116f1a6b243ae4d2f2e13f2f531528fca44686a79f90a173288e5b31ed853",
+      "sha256": "9aeb2ccf0e13e1e815344d080685012a33a8b4d62f3f77f1abc5bb722103813a",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "Reviewed npm commands and loading instructions against the CLI contract and existing installer tests; flags and exit policy preserved. Implementation-agent editorial review; independent review remains pending. 0.1.3: reviewed the installed skill folder resolution root, exit 3 and Path escapes destination root message against src/install.mjs and the installer regression. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending."
+      "review": "Reviewed npm commands and loading instructions against the CLI contract and existing installer tests; flags and exit policy preserved. Implementation-agent editorial review; independent review remains pending. 0.1.3: reviewed the installed skill folder resolution root, exit 3 and Path escapes destination root message against src/install.mjs and the installer regression. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending. 0.1.13 hero trailer: reviewed against the approved v2a render. 0.1.14 demo re-record: reviewed against the new recording's final frame"
     },
     "docs/METHOD.md": {
       "sha256": "3b45db282de20f327c903e86f6d7da9440b5913907dfb75cadedf5e6b7210f95",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "website-build-skill",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "A skill pack that turns your AI into an expert website builder: current research, design, code, accessibility, speed, SEO and security, alone or as a team.",
   "type": "module",
   "license": "MIT",
@@ -47,6 +47,7 @@
     "skills/",
     "adapters/",
     "docs/",
+    "!docs/*.gif",
     "README.md",
     "LICENSE",
     "CHANGELOG.md",

package/skills/website-build-skill/manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "0.1.12",
+  "packageVersion": "0.1.14",
   "skillName": "website-build-skill",
   "pathBase": "All asset paths resolve from this manifest directory; runtime paths resolve in the authorized user project.",
   "assets": [

package/src/validate.mjs

@@ -243,7 +243,9 @@ export function check(root, options = {}) {
   } catch { published = false; }
   const protect = (name, fn) => { try { fn(); } catch (e) { issues.push(`${name}:${e.message}`); } };
   for (const name of names) {
-    const text = read(root, name);
+    // A GIF is compressed bytes, not prose: a text scan matches random byte runs (an em dash
+    // sequence, an at-sign). Its path is still checked; only the content scan is skipped.
+    const text = /\.gif$/i.test(name) ? '' : read(root, name);
     issues.push(...privacyIssues(name, text, options));
     if (name.endsWith('.md') || name === 'llms.txt') issues.push(...linkIssues(root, name, text));
     if (name.endsWith('.md')) issues.push(...installClaimIssues(name, text, published));
@@ -333,12 +335,17 @@ export function check(root, options = {}) {
     if (binEntry !== 'bin/website-build-skill.mjs') issues.push('PACKAGE_HONESTY:bin must name the real entry point');
     else if (/UNAVAILABLE/.test(read(root, binEntry))) issues.push('PACKAGE_HONESTY:bin is still the unavailable sentinel');
     // A published tarball that omits any of these installs nothing on a stranger's machine.
-    // A negation can empty one of them while the entry it negates is still listed, so the
-    // list is compared on its effective entries, and `src` and `src/` are the same entry.
+    // A negation can empty one of them while the entry it negates is still listed. Only
+    // the GIF exclusion is allowed: documentation serves those images by raw URL.
+    // `src` and `src/` are the same entry.
     const published = (p.files ?? []).map(entry => String(entry).replace(/\/+$/, ''));
-    if (published.some(entry => entry.startsWith('!'))) issues.push('PACKAGE_FILES:a negated entry can empty a published path');
+    if (published.some(entry => entry.startsWith('!') && entry !== '!docs/*.gif')) issues.push('PACKAGE_FILES:a negated entry can empty a published path');
     for (const needed of ['bin', 'src', 'skills', 'docs', 'README.md', 'LICENSE'])
       if (!published.includes(needed)) issues.push(`PACKAGE_FILES:${needed} is not published`);
+    // npm applies the list in order, so an exclusion placed before the entry it trims
+    // removes nothing and both GIFs still ship.
+    if (published.includes('!docs/*.gif') && published.indexOf('!docs/*.gif') < published.indexOf('docs'))
+      issues.push('PACKAGE_FILES:!docs/*.gif must come after the docs entry or it excludes nothing');
     const floor = p.engines?.node?.match(/(\d+)/)?.[1];
     const checks = JSON.parse(read(root, '.github/workflows/check.yml')).jobs?.checks;
     const matrix = checks?.strategy?.matrix?.node;