website-build-skill 0.1.14 → 0.1.15

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "website-build-skill",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "A skill pack that turns your AI into an expert website builder: current research, design, code, accessibility, speed, SEO and security, alone or as a team.",
   "author": {
     "name": "website-build-skill contributors"

package/CHANGELOG.md

@@ -6,6 +6,12 @@ Version policy: [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html)
 
 ## [Unreleased]
 
+## [0.1.15] - 2026-10-02
+
+### Changed
+
+- LICENSE names Auny LLC as copyright holder; outside contributions now require the CLA in CLA.md.
+
 ## [0.1.14] - 2026-10-01
 
 ### Changed
@@ -203,7 +209,8 @@ Version policy: [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html)
 - Generated native workers for the seven-role team, gated on schema and permission tests.
 - Clean-client trials, behavioral evaluations and fresh-tarball trials on Linux and Windows.
 
-[Unreleased]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.14...HEAD
+[Unreleased]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.15...HEAD
+[0.1.15]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.14...v0.1.15
 [0.1.14]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.13...v0.1.14
 [0.1.13]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.12...v0.1.13
 [0.1.12]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.11...v0.1.12

package/CLA.md

@@ -0,0 +1,37 @@
+# Contributor License Agreement
+
+This agreement lets Auny LLC accept your contribution and keep the project's licensing options open, while you keep the copyright in what you wrote. It is adapted from the Apache Software Foundation's Individual Contributor License Agreement v2.2.
+
+To agree, tick the Contributor License Agreement box in your pull request description. The box is the record of your agreement for that pull request and every later change you push to it.
+
+## 1. Definitions
+
+- **"You"** means the person or legal entity submitting a Contribution.
+- **"Contribution"** means any original work of authorship, including any changes or additions to existing work, that You intentionally submit to Auny LLC for inclusion in this project, through a pull request, an issue, a comment or any other channel Auny LLC uses to discuss or manage the project.
+- **"Auny LLC"** means Auny LLC, a New York limited liability company, the owner and maintainer of this project.
+
+## 2. Copyright license
+
+You grant Auny LLC, and recipients of software distributed by Auny LLC, a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense and distribute Your Contributions and such derivative works, under any license terms, including open source and commercial terms.
+
+## 3. Patent license
+
+You grant Auny LLC, and recipients of software distributed by Auny LLC, a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable patent license to make, have made, use, offer to sell, sell, import and otherwise transfer the work, where the license applies only to patent claims licensable by You that are necessarily infringed by Your Contribution alone or by its combination with the work to which it was submitted. If any entity starts patent litigation alleging that Your Contribution, or the work it was submitted to, infringes a patent, the patent licenses granted to that entity under this agreement for that Contribution or work end on the date the litigation is filed.
+
+## 4. Your rights
+
+You keep the copyright in Your Contributions. Apart from the licenses granted above, You reserve all rights, and You may use Your Contributions for any other purpose.
+
+## 5. Your promises
+
+- You are legally entitled to grant these licenses. If your employer has rights to intellectual property you create, You have permission to make the Contribution on its behalf, or your employer has waived those rights.
+- Each Contribution is Your original creation. When it includes third-party material, You identify that material and its license in the pull request.
+- You will tell Auny LLC if any of these promises stops being accurate.
+
+## 6. No warranty
+
+You provide Your Contributions "as is", without warranties or conditions of any kind, including warranties of title, non-infringement, merchantability or fitness for a particular purpose. You are not expected to provide support for Your Contributions.
+
+## 7. Trademarks
+
+This agreement grants no rights in the names, logos or trademarks of Auny LLC, including "Auny", "AunySillyMe" and the project's name.

package/CONTRIBUTING.md

@@ -44,6 +44,12 @@ For a new check, demonstrate a failing fixture and a valid control. See [evaluat
 The Markdown gate checks file targets, reference links, images, HTML links and heading anchors.
 External URLs require a separate live review; offline success does not prove availability.
 
+## Contributor License Agreement
+
+Outside contributors tick the Contributor License Agreement box in the PR description.
+You keep the copyright in what you wrote and grant Auny LLC the licenses in [CLA.md](CLA.md).
+The `cla` check passes once the box is ticked.
+
 ## Review and handoff
 
 Describe the problem, resulting behavior, exact checks and any remaining limits in the PR.

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Auny
+Copyright (c) 2026 Auny LLC and contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/docs/evidence/content-review.json

@@ -2,8 +2,9 @@
   "policy": "Editorial review scope, not test evidence. New or changed prose requires renewed human/code-owner review; generator must not update this ledger.",
   "files": {
     ".github/pull_request_template.md": {
-      "sha256": "debf5cbb40e292fb82280abf6f61809813cdc1df3bbfd9d9bd275bbec8c5ed34",
-      "disposition": "instructions-and-qualified-status-only"
+      "sha256": "8f05835d1701f3b3086fc094a40c80498aab9971862563c3f3b95ed36c510a02",
+      "disposition": "instructions-and-qualified-status-only",
+      "review": "CLA change: reviewed the exact agreement box against the authorized task bundle and workflow matcher. Implementation-agent editorial review; independent review remains pending."
     },
     "AGENTS.md": {
       "sha256": "0a73523dc04b2fac0fb8a4cedc00bc3e903885054b02519c46e4369e9db47be5",
@@ -25,9 +26,9 @@
       "review": "0.1.5 (#15): status line narrowed to the two SOLO loading receipts; other hosts, TEAM, account tools and independent review stay UNVERIFIED. Claude editorial review. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 0.1.11: the three accuracy lines moved unchanged from CLAUDE.md; the method and contributor instructions stay in one source. Implementation-agent editorial review; independent review remains pending."
     },
     "CHANGELOG.md": {
-      "sha256": "effb91c28ac5865778c2ed95f425c0eb2f4a823b7117591fed3eb77fd4510054",
+      "sha256": "950f5704904e186f5712f1dd94d1f5ea1f52a5faea53b717e83a60f5c041505b",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the added 0.1.1 framing note against the presentation copy changes; publication is a separate release action. Implementation-agent editorial review; independent review remains pending. Reviewed the copied-install checker ladder fix against the canonical instructions and regression test. Live host retrial remains pending release. Reviewed for the ROUND 1 audit: added Fixed/Added/Changed lines for the restored positive-and-accurate adapter, SKILL.md, designer.md, grok.md and validate.mjs fixes. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.3: reviewed the #13 description check and #14 Hermes path documentation entries against the implementation and regression tests; publication remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. Reviewed the #15 Fixed line for the symlinked-parent receipt path against src/install.mjs and installer tests 7e-7g, and the #15 Added line against the two receipts. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. 0.1.5 release heading moved the Unreleased lines under [0.1.5] - 2026-09-24 unchanged. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 0.1.7: Grok Bot setup and one-description entries reviewed against the diff. Claude editorial review. 0.1.8: reviewed the Added lines against the committed BM05, CQ06, B08, prompt 04 and PROVENANCE.md diff; every named tell, default and credit matches the checklist text. Claude editorial review; the change itself had an independent codex audit (CLEAN). 0.1.9: reviewed the Fixed line against the src/bundle.mjs describe() diff, the regenerated llms.txt lines 19 and 21 and test/llms-labels.test.mjs. Claude editorial review; the change had an independent codex audit (CLEAN). 0.1.10: reviewed the Added and Changed lines against scripts/build.mjs --rehash, its tests and the CONTRIBUTING/RELEASING diff; the claims match (code-reviewer audit CLEAN). 0.1.11: reviewed the entry against the instruction import and accuracy-note move; the compare link joins v0.1.10 and v0.1.11. Implementation-agent editorial review; publication remains a separate maintainer action. 0.1.12: reviewed Keep a Changelog 2.0.0 reference, empty Unreleased section, 0.1.12 Added/Changed/Removed entries and compare link against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending. 0.1.13 hero trailer: reviewed against the approved v2a render. 0.1.13 audit round 1 fixes, non-author: alt text, trailer check and tag-order note, and the package-check and GIF-scan gate lines reviewed against src/validate.mjs and test/content.test.mjs. Claude editorial review.. 0.1.14 demo re-record: reviewed against the new recording's final frame"
+      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the added 0.1.1 framing note against the presentation copy changes; publication is a separate release action. Implementation-agent editorial review; independent review remains pending. Reviewed the copied-install checker ladder fix against the canonical instructions and regression test. Live host retrial remains pending release. Reviewed for the ROUND 1 audit: added Fixed/Added/Changed lines for the restored positive-and-accurate adapter, SKILL.md, designer.md, grok.md and validate.mjs fixes. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.3: reviewed the #13 description check and #14 Hermes path documentation entries against the implementation and regression tests; publication remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. Reviewed the #15 Fixed line for the symlinked-parent receipt path against src/install.mjs and installer tests 7e-7g, and the #15 Added line against the two receipts. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. 0.1.5 release heading moved the Unreleased lines under [0.1.5] - 2026-09-24 unchanged. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 0.1.7: Grok Bot setup and one-description entries reviewed against the diff. Claude editorial review. 0.1.8: reviewed the Added lines against the committed BM05, CQ06, B08, prompt 04 and PROVENANCE.md diff; every named tell, default and credit matches the checklist text. Claude editorial review; the change itself had an independent codex audit (CLEAN). 0.1.9: reviewed the Fixed line against the src/bundle.mjs describe() diff, the regenerated llms.txt lines 19 and 21 and test/llms-labels.test.mjs. Claude editorial review; the change had an independent codex audit (CLEAN). 0.1.10: reviewed the Added and Changed lines against scripts/build.mjs --rehash, its tests and the CONTRIBUTING/RELEASING diff; the claims match (code-reviewer audit CLEAN). 0.1.11: reviewed the entry against the instruction import and accuracy-note move; the compare link joins v0.1.10 and v0.1.11. Implementation-agent editorial review; publication remains a separate maintainer action. 0.1.12: reviewed Keep a Changelog 2.0.0 reference, empty Unreleased section, 0.1.12 Added/Changed/Removed entries and compare link against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending. 0.1.13 hero trailer: reviewed against the approved v2a render. 0.1.13 audit round 1 fixes, non-author: alt text, trailer check and tag-order note, and the package-check and GIF-scan gate lines reviewed against src/validate.mjs and test/content.test.mjs. Claude editorial review.. 0.1.14 demo re-record: reviewed against the new recording's final frame. 0.1.15 release heading for the merged LICENSE/CLA change"
     },
     "CLAUDE.md": {
       "sha256": "09976587703de7dff40a2fd5074d655f31072c33ea76ffd4ecc58fad87e1ea7c",
@@ -39,9 +40,9 @@
       "disposition": "instructions-and-qualified-status-only"
     },
     "CONTRIBUTING.md": {
-      "sha256": "ff672ae1445219685445fa0a8438325c4047418f9d0ae0a17b08ee3e54988b49",
+      "sha256": "8b8e10fe19934c760c044f13fe9e04af815cb6c65612d23033fca23ce9f2b261",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. Reviewed the Digests line and the build note against scripts/build.mjs --rehash: named assets only, manifest and archive refused, write only on change; the review-the-diff step is kept. Claude editorial review; code audited separately by another model family."
+      "review": "Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. Reviewed the Digests line and the build note against scripts/build.mjs --rehash: named assets only, manifest and archive refused, write only on change; the review-the-diff step is kept. Claude editorial review; code audited separately by another model family. CLA change: reviewed the three sentences against the approved agreement and event-only workflow: contributors retain copyright, grant the agreement licenses and tick the PR box. Implementation-agent editorial review; independent review remains pending."
     },
     "MAINTAINERS.md": {
       "sha256": "8632008661d5ad3d60300ea2028715217c298d24d3d66af7224c52b6e0e24552",
@@ -332,6 +333,11 @@
       "disposition": "instructions-and-qualified-status-only",
       "sha256": "71e20110a1b1cb0e50a0797d0940ec9e4bf3232022d7fe3769a43ec011b5f39f",
       "review": "Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending."
+    },
+    "CLA.md": {
+      "disposition": "instructions-and-qualified-status-only",
+      "sha256": "4f2d353a83c183797c26d3531c52ead6888916d879fdffbc23e94d18fab68006",
+      "review": "Approved legal text supplied by the orchestrator, kept byte-identical. Reviewed its package inclusion and privacy allowances against the authorized task bundle; no legal wording edited. Implementation-agent integration review; independent review remains pending."
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "website-build-skill",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "A skill pack that turns your AI into an expert website builder: current research, design, code, accessibility, speed, SEO and security, alone or as a team.",
   "type": "module",
   "license": "MIT",
@@ -50,6 +50,7 @@
     "!docs/*.gif",
     "README.md",
     "LICENSE",
+    "CLA.md",
     "CHANGELOG.md",
     "SECURITY.md",
     "llms.txt",

package/skills/website-build-skill/manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "0.1.14",
+  "packageVersion": "0.1.15",
   "skillName": "website-build-skill",
   "pathBase": "All asset paths resolve from this manifest directory; runtime paths resolve in the authorized user project.",
   "assets": [

package/src/validate.mjs

@@ -7,6 +7,13 @@ const headings = ['IDENTITY', 'WHAT YOU OWN', 'BOUNDARIES', 'WHAT YOU NEED TO KN
 const owner = ['au', 'ny', 'sillyme'].join('');
 const funding = ['https://github.com', 'sponsors', owner].join('/');
 const personal = ['au', 'ny'].join('');
+const publicName = personal[0].toUpperCase() + personal.slice(1);
+const company = `${publicName} LLC`;
+const legalLines = {
+  LICENSE: `Copyright (c) 2026 ${company} and contributors`,
+  'CONTRIBUTING.md': `You keep the copyright in what you wrote and grant ${company} the licenses in [CLA.md](CLA.md).`,
+  'CHANGELOG.md': `- LICENSE names ${company} as copyright holder; outside contributions now require the CLA in CLA.md.`,
+};
 const product = ['Claude', 'Code'].join(' ');
 const forbidden = [personal, product, ['Vau','lts'].join(''), ['A','UN-'].join(''), ['linear','.app'].join(''), ['/','Users','/'].join(''), ['@','gmail'].join(''), ['site','builder','skill'].join('-')];
 export const privacyPattern = new RegExp(forbidden.map(s => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|'), 'i');
@@ -18,7 +25,11 @@ export function privacyIssues(name, text, options = {}) {
   if (privacyPattern.test(name)) issues.push(`PRIVACY_NAME:${name}`);
   for (const [i, original] of text.split('\n').entries()) {
     let line = original;
-    if (name === 'LICENSE' && line === `Copyright (c) 2026 ${personal[0].toUpperCase()}${personal.slice(1)}`) continue;
+    // Legal notices allow only the approved full line in its named file.
+    if (line === legalLines[name]) continue;
+    // The agreement alone may name the company and its two exact trademarks.
+    // Boundaries keep longer names and private suffixes subject to the privacy gate.
+    if (name === 'CLA.md') line = line.replace(new RegExp(`(?<![\\w-])(?:${company}|${publicName}SillyMe|${publicName}(?! LLC|SillyMe))(?![\\w-])`, 'g'), 'LEGAL_NAME');
     // Resolved policy. Two public identifiers are required by the repository and are exempt:
     // the owning account on the exact CODEOWNERS line, and the supported host's product name.
     // Everything else the pattern names stays forbidden, including the same account string