website-build-skill 0.1.17 → 0.1.19

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "website-build-skill",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "A skill pack that turns your AI into an expert website builder: current research, design, code, accessibility, speed, SEO and security, alone or as a team.",
   "author": {
     "name": "website-build-skill contributors"

package/CHANGELOG.md

@@ -6,6 +6,20 @@ Version policy: [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html)
 
 ## [Unreleased]
 
+## [0.1.19] - 2026-10-10
+
+### Fixed
+
+- README common questions are now headings, so each question has its own anchor.
+- npm homepage now points at the product site.
+- The privacy check now allows the owner's public name and domains; vault paths, ticket ids, local paths and email addresses stay blocked.
+
+## [0.1.18] - 2026-10-07
+
+### Fixed
+
+- Installed SKILL.md links to this release's compatibility evidence and explains network retrieval, the offline copy fallback and the recorded trial required to verify host activation (#20).
+
 ## [0.1.17] - 2026-10-06
 
 ### Fixed
@@ -226,7 +240,9 @@ Version policy: [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html)
 - Generated native workers for the seven-role team, gated on schema and permission tests.
 - Clean-client trials, behavioral evaluations and fresh-tarball trials on Linux and Windows.
 
-[Unreleased]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.17...HEAD
+[Unreleased]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.19...HEAD
+[0.1.19]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.18...v0.1.19
+[0.1.18]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.17...v0.1.18
 [0.1.17]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.16...v0.1.17
 [0.1.16]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.15...v0.1.16
 [0.1.15]: https://github.com/aunysillyme/website-build-skill/compare/v0.1.14...v0.1.15

package/README.md

@@ -178,15 +178,25 @@ The [installer contract](docs/INSTALLER.md) defines preflight checks, exit codes
 
 ## Common questions
 
-**How do I teach Claude Code or Codex to build better websites?** Run `npx website-build-skill`, pick your host and let it copy the skill pack into your host's folder, then ask your AI to read the installed `SKILL.md`. It learns current practice in research, design, code, accessibility, performance, search and security before it touches your site.
+### How do I teach Claude Code or Codex to build better websites?
 
-**Which AI tools does it work with?** Any AI that can read files works with the SOLO method, including Claude, ChatGPT, Grok, Cursor and Copilot. TEAM installs the seven workers' files for Claude Code, Codex, Hermes, Gemini (via Antigravity CLI) and Grok Bot in one command; you open each session yourself and carry the handoffs between them, with Researcher first; see [Choose your host](#choose-your-host) for each setup guide.
+Run `npx website-build-skill`, pick your host and let it copy the skill pack into your host's folder, then ask your AI to read the installed `SKILL.md`. It learns current practice in research, design, code, accessibility, performance, search and security before it touches your site.
 
-**What does my AI research before it builds?** It researches fourteen domains current to the day of your request, from design and accessibility to performance, security, stack and search, and saves a library with source URLs and access dates so later pages can refresh stale claims. See [What your AI learns](#what-your-ai-learns) for the full list.
+### Which AI tools does it work with?
 
-**Can one AI run it, or does it need a team?** Either. SOLO has one AI learn the whole method and do every job itself with nothing else to install; TEAM installs the seven workers' files in one command; you open each session yourself and carry the handoffs between them. Researcher goes first. Pick SOLO if you are not sure; moving to TEAM later keeps everything you have already done.
+Any AI that can read files works with the SOLO method, including Claude, ChatGPT, Grok, Cursor and Copilot. TEAM installs the seven workers' files for Claude Code, Codex, Hermes, Gemini (via Antigravity CLI) and Grok Bot in one command; you open each session yourself and carry the handoffs between them, with Researcher first; see [Choose your host](#choose-your-host) for each setup guide.
 
-**How do I remove it?** Follow [Uninstall](#uninstall), using the target and directory from your install. It removes only files the installer wrote that still match its receipt. See the [installer guide](docs/INSTALLER.md) for flags and exit codes.
+### What does my AI research before it builds?
+
+It researches fourteen domains current to the day of your request, from design and accessibility to performance, security, stack and search, and saves a library with source URLs and access dates so later pages can refresh stale claims. See [What your AI learns](#what-your-ai-learns) for the full list.
+
+### Can one AI run it, or does it need a team?
+
+Either. SOLO has one AI learn the whole method and do every job itself with nothing else to install; TEAM installs the seven workers' files in one command; you open each session yourself and carry the handoffs between them. Researcher goes first. Pick SOLO if you are not sure; moving to TEAM later keeps everything you have already done.
+
+### How do I remove it?
+
+Follow [Uninstall](#uninstall), using the target and directory from your install. It removes only files the installer wrote that still match its receipt. See the [installer guide](docs/INSTALLER.md) for flags and exit codes.
 
 ## Uninstall
 

package/RELEASING.md

@@ -77,8 +77,10 @@ that permission at the top level, in any other job, and in any other workflow.
 ## The closed loop
 
 Local success requires exit 0 from both the read-only check and the test runner, with no unexpected skips.
-The privacy gate passes on the published tree. Its public-identifier exemptions are narrow and
-documented in `docs/EVALUATION.md`; the tests run against the same policy, not a separate one.
+The privacy gate allows the owner's public name, handles, domains, repository links and profile URLs.
+Private storage paths, ticket identifiers, internal issue links, local machine paths, email addresses
+and the retired package name stay blocked. Product names pass as prose; local product paths fail.
+The tests run against the same policy in `src/validate.mjs`.
 Inspect the full output and changed file list. A generated file existing is not enough; its bytes must match regeneration.
 Hosted success requires the exact source revision's run to pass on every runtime in the matrix.
 Release completion requires:

package/docs/EVALUATION.md

@@ -50,7 +50,7 @@ A change to the ledger itself requires code-owner review. No content checker can
 ## Privacy scope
 
 The gate scans every public file, including hidden community metadata, fixtures and generated bundles.
-It rejects personal paths, private identifiers, personal names and email addresses without echoing their values.
+It rejects personal paths, private identifiers, private names and email addresses without echoing their values. The owner's public name, domains and profile handles are brand, not private data, and pass.
 Every exemption is narrow, exact and implemented once in `privacyIssues` (`src/validate.mjs`).
 The privacy tests run against that same function.
 

package/docs/bundles/method.md

@@ -148,7 +148,10 @@ Complete the mockup gate with inspected images and mark code tested after execut
 A saved-file claim requires a successful write and read-back; memory needs its own receipt.
 Hand deployment to an authorized operator when deploy access is unavailable.
 Check the chosen host's loading, installation, team creation, permissions and integrations
-with a recorded trial. See the repository's docs/COMPATIBILITY.md for host evidence.
+with a recorded trial. Read [host evidence](https://github.com/aunysillyme/website-build-skill/blob/v0.1.19/docs/COMPATIBILITY.md)
+for this release. Network access is required to retrieve this document, which is not
+copied into the installed skill. If offline, ask for a copy of that release's document and linked receipts.
+Keep host activation, TEAM and integrations UNVERIFIED until checked in a recorded trial.
 After installation, open the role sessions and provide a different model family for
 independent review. Enforce permissions through the host's own controls.
 Role text guides behaviour; real permissions come from the host's own settings and

package/docs/evidence/content-review.json

@@ -26,9 +26,9 @@
       "review": "0.1.5 (#15): status line narrowed to the two SOLO loading receipts; other hosts, TEAM, account tools and independent review stay UNVERIFIED. Claude editorial review. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 0.1.11: the three accuracy lines moved unchanged from CLAUDE.md; the method and contributor instructions stay in one source. Implementation-agent editorial review; independent review remains pending."
     },
     "CHANGELOG.md": {
-      "sha256": "cf5fc170656cac70a49d17f3a5babd9c78ce4fe1164f2d0f7fe98adf87688ee2",
+      "sha256": "a9ff0ad1050d7e36ce37dd2b89e5c9ae593a11b51d5d5d11fdc51bd0ac4058d7",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the added 0.1.1 framing note against the presentation copy changes; publication is a separate release action. Implementation-agent editorial review; independent review remains pending. Reviewed the copied-install checker ladder fix against the canonical instructions and regression test. Live host retrial remains pending release. Reviewed for the ROUND 1 audit: added Fixed/Added/Changed lines for the restored positive-and-accurate adapter, SKILL.md, designer.md, grok.md and validate.mjs fixes. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.3: reviewed the #13 description check and #14 Hermes path documentation entries against the implementation and regression tests; publication remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. Reviewed the #15 Fixed line for the symlinked-parent receipt path against src/install.mjs and installer tests 7e-7g, and the #15 Added line against the two receipts. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. 0.1.5 release heading moved the Unreleased lines under [0.1.5] - 2026-09-24 unchanged. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 0.1.7: Grok Bot setup and one-description entries reviewed against the diff. Claude editorial review. 0.1.8: reviewed the Added lines against the committed BM05, CQ06, B08, prompt 04 and PROVENANCE.md diff; every named tell, default and credit matches the checklist text. Claude editorial review; the change itself had an independent codex audit (CLEAN). 0.1.9: reviewed the Fixed line against the src/bundle.mjs describe() diff, the regenerated llms.txt lines 19 and 21 and test/llms-labels.test.mjs. Claude editorial review; the change had an independent codex audit (CLEAN). 0.1.10: reviewed the Added and Changed lines against scripts/build.mjs --rehash, its tests and the CONTRIBUTING/RELEASING diff; the claims match (code-reviewer audit CLEAN). 0.1.11: reviewed the entry against the instruction import and accuracy-note move; the compare link joins v0.1.10 and v0.1.11. Implementation-agent editorial review; publication remains a separate maintainer action. 0.1.12: reviewed Keep a Changelog 2.0.0 reference, empty Unreleased section, 0.1.12 Added/Changed/Removed entries and compare link against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending. 0.1.13 hero trailer: reviewed against the approved v2a render. 0.1.13 audit round 1 fixes, non-author: alt text, trailer check and tag-order note, and the package-check and GIF-scan gate lines reviewed against src/validate.mjs and test/content.test.mjs. Claude editorial review.. 0.1.14 demo re-record: reviewed against the new recording's final frame. 0.1.15 release heading for the merged LICENSE/CLA change. 0.1.16: reviewed the two Added lines against the canonical handshake section, PS11 row, manifest discovery route and content tests. Implementation-agent editorial review; independent review and publication remain pending. 0.1.17: reviewed the Fixed and Added entries against the Contribution definition and README diff; release date is 2026-10-06 and the compare link joins v0.1.16 and v0.1.17. Implementation-agent editorial review; independent review and publication remain pending."
+      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the added 0.1.1 framing note against the presentation copy changes; publication is a separate release action. Implementation-agent editorial review; independent review remains pending. Reviewed the copied-install checker ladder fix against the canonical instructions and regression test. Live host retrial remains pending release. Reviewed for the ROUND 1 audit: added Fixed/Added/Changed lines for the restored positive-and-accurate adapter, SKILL.md, designer.md, grok.md and validate.mjs fixes. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.3: reviewed the #13 description check and #14 Hermes path documentation entries against the implementation and regression tests; publication remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. Reviewed the #15 Fixed line for the symlinked-parent receipt path against src/install.mjs and installer tests 7e-7g, and the #15 Added line against the two receipts. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. 0.1.5 release heading moved the Unreleased lines under [0.1.5] - 2026-09-24 unchanged. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 0.1.7: Grok Bot setup and one-description entries reviewed against the diff. Claude editorial review. 0.1.8: reviewed the Added lines against the committed BM05, CQ06, B08, prompt 04 and PROVENANCE.md diff; every named tell, default and credit matches the checklist text. Claude editorial review; the change itself had an independent codex audit (CLEAN). 0.1.9: reviewed the Fixed line against the src/bundle.mjs describe() diff, the regenerated llms.txt lines 19 and 21 and test/llms-labels.test.mjs. Claude editorial review; the change had an independent codex audit (CLEAN). 0.1.10: reviewed the Added and Changed lines against scripts/build.mjs --rehash, its tests and the CONTRIBUTING/RELEASING diff; the claims match (code-reviewer audit CLEAN). 0.1.11: reviewed the entry against the instruction import and accuracy-note move; the compare link joins v0.1.10 and v0.1.11. Implementation-agent editorial review; publication remains a separate maintainer action. 0.1.12: reviewed Keep a Changelog 2.0.0 reference, empty Unreleased section, 0.1.12 Added/Changed/Removed entries and compare link against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending. 0.1.13 hero trailer: reviewed against the approved v2a render. 0.1.13 audit round 1 fixes, non-author: alt text, trailer check and tag-order note, and the package-check and GIF-scan gate lines reviewed against src/validate.mjs and test/content.test.mjs. Claude editorial review.. 0.1.14 demo re-record: reviewed against the new recording's final frame. 0.1.15 release heading for the merged LICENSE/CLA change. 0.1.16: reviewed the two Added lines against the canonical handshake section, PS11 row, manifest discovery route and content tests. Implementation-agent editorial review; independent review and publication remain pending. 0.1.17: reviewed the Fixed and Added entries against the Contribution definition and README diff; release date is 2026-10-06 and the compare link joins v0.1.16 and v0.1.17. Implementation-agent editorial review; independent review and publication remain pending. 0.1.18 (#20): reviewed the release-bound compatibility link, explicit network retrieval, offline document/receipt fallback and recorded-trial UNVERIFIED instruction against installed asset membership and docs/COMPATIBILITY.md. Implementation-agent editorial review; independent audit recorded separately. 0.1.19: reviewed the two Fixed entries against the five README heading conversions and package homepage change; the release date is 2026-10-10 and the compare link joins v0.1.18 and v0.1.19. Implementation-agent editorial review; independent review and publication remain pending. 0.1.19 public brand policy: reviewed the added Fixed entry against src/validate.mjs and the brand/private-data regressions in test/privacy.test.mjs. Implementation-agent editorial review; independent review and publication remain pending."
     },
     "CLAUDE.md": {
       "sha256": "09976587703de7dff40a2fd5074d655f31072c33ea76ffd4ecc58fad87e1ea7c",
@@ -49,9 +49,9 @@
       "disposition": "instructions-and-qualified-status-only"
     },
     "README.md": {
-      "sha256": "756168b9ab891f3a1efd24eec285451d0376e9a928af71b57ae530a669861b89",
+      "sha256": "fbc7711054e6dd89499e7d6480fcf88d305a96f624574f6f1217a9251084ddaf",
       "disposition": "status-claims-bound-to-receipts",
-      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the requested skill-pack framing and each learning-table sentence against its linked canonical instructions; preserved the twelve stages, starter, setup card and sibling links. Demo URL awaits the separately recorded artifact. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. ROUND 1 (2026-09-24): added the receipts' one-run and operator-configuration limitations to the promoted wording, per the code-reviewer finding. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 2026-09-28: the \"Part of a set\" model-orchestrator row now carries that package's 1.0.0 description, verified identical to `npm view model-orchestrator description`; no claim about this package changed. Claude editorial review. 0.1.12: reviewed Gemini host label, unchanged sibling section relocation, receipt-based Uninstall section and FAQ link, and the seven-link Read next index against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending. 0.1.13 hero trailer: reviewed against the approved v2a render. 0.1.13 audit round 1 fixes, non-author: alt text, trailer check and tag-order note, and the package-check and GIF-scan gate lines reviewed against src/validate.mjs and test/content.test.mjs. Claude editorial review. 0.1.17: reviewed the added Contributing line against the exact authorized wording and the existing pull request agreement checkbox. Implementation-agent editorial review; independent review remains pending.",
+      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the requested skill-pack framing and each learning-table sentence against its linked canonical instructions; preserved the twelve stages, starter, setup card and sibling links. Demo URL awaits the separately recorded artifact. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. ROUND 1 (2026-09-24): added the receipts' one-run and operator-configuration limitations to the promoted wording, per the code-reviewer finding. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 2026-09-28: the \"Part of a set\" model-orchestrator row now carries that package's 1.0.0 description, verified identical to `npm view model-orchestrator description`; no claim about this package changed. Claude editorial review. 0.1.12: reviewed Gemini host label, unchanged sibling section relocation, receipt-based Uninstall section and FAQ link, and the seven-link Read next index against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending. 0.1.13 hero trailer: reviewed against the approved v2a render. 0.1.13 audit round 1 fixes, non-author: alt text, trailer check and tag-order note, and the package-check and GIF-scan gate lines reviewed against src/validate.mjs and test/content.test.mjs. Claude editorial review. 0.1.17: reviewed the added Contributing line against the exact authorized wording and the existing pull request agreement checkbox. Implementation-agent editorial review; independent review remains pending. 0.1.19: reviewed the five Common questions heading conversions against the prior README; question wording and answer text are unchanged, each question gains a heading anchor, and existing README links pass the local link check. Implementation-agent editorial review; independent review remains pending.",
       "claims": [
         {
           "text": "Native loading is tested",
@@ -68,9 +68,9 @@
       ]
     },
     "RELEASING.md": {
-      "sha256": "0d0227d18f93758650614afa43a213af78574623c63825150732281b000812c5",
+      "sha256": "e759858ff332e193534a9684a1de91e1838ef765cb6b514c17139e2faf3dbf61",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "0.1.3: reviewed the same-commit description update and explicit GitHub command against the task specification; no live repository setting was changed in this offline implementation pass. Implementation-agent editorial review; independent review remains pending. The command uses the exact repository URL to preserve the existing privacy allowance for public repository references. 0.1.9: step 6 now names both package-lock.json version fields, matching vault 05_how_we_build_repos 6.2; the lock had stayed at 0.1.6 through 0.1.8. Claude editorial review against scripts/check.mjs version comparison. Reviewed step 2 and the Writes section against scripts/build.mjs --rehash; plain build still writes only bundles and llms.txt. Claude editorial review; code audited separately by another model family. 0.1.12: reviewed 57-file install count supplied by the maintainer audit, present-tense failure modes, one installer write statement, GitHub release step, registry lag and README/description/provenance/funding completion checks against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending.. 0.1.13 audit round 1 fixes, non-author: alt text, trailer check and tag-order note, and the package-check and GIF-scan gate lines reviewed against src/validate.mjs and test/content.test.mjs. Claude editorial review."
+      "review": "0.1.3: reviewed the same-commit description update and explicit GitHub command against the task specification; no live repository setting was changed in this offline implementation pass. Implementation-agent editorial review; independent review remains pending. The command uses the exact repository URL to preserve the existing privacy allowance for public repository references. 0.1.9: step 6 now names both package-lock.json version fields, matching vault 05_how_we_build_repos 6.2; the lock had stayed at 0.1.6 through 0.1.8. Claude editorial review against scripts/check.mjs version comparison. Reviewed step 2 and the Writes section against scripts/build.mjs --rehash; plain build still writes only bundles and llms.txt. Claude editorial review; code audited separately by another model family. 0.1.12: reviewed 57-file install count supplied by the maintainer audit, present-tense failure modes, one installer write statement, GitHub release step, registry lag and README/description/provenance/funding completion checks against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending. 0.1.12 canon audit round 1: reviewed against canon audit round 1. Claude (non-author fixer) editorial review; independent review remains pending.. 0.1.13 audit round 1 fixes, non-author: alt text, trailer check and tag-order note, and the package-check and GIF-scan gate lines reviewed against src/validate.mjs and test/content.test.mjs. Claude editorial review. 0.1.19 public brand policy: reviewed the closed-loop description against src/validate.mjs and test/privacy.test.mjs. Public names, handles, domains, repository links and profiles are allowed; private traces and email addresses remain blocked. Implementation-agent editorial review; independent review remains pending."
     },
     "REPO_SETTINGS.md": {
       "sha256": "ccace33e8ec71e10616729888406098136a1b60ee626da8a68856a50af0b3e97",
@@ -170,7 +170,7 @@
       "review": "Reviewed documented setup routes and required trial evidence; retained the existing revision-bound hosted-check claim and receipt. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. ROUND 1 (2026-09-24): added the receipts' one-run and operator-configuration limitations to the promoted wording, per the code-reviewer finding. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 0.1.7: Grok Bot row stays under documented setups (no receipt), now pointing at the new Grok Bot section and naming what to verify. Claude editorial review. 0.1.12: reviewed Gemini host label with adapter paths and activation status preserved against the supplied repository canon audit. Implementation-agent editorial review; independent review remains pending."
     },
     "docs/EVALUATION.md": {
-      "sha256": "fab5e3b0fbff0febbf8384ca99e29f96a5c8fbf455bea67398c4da5dff5ad8ec",
+      "sha256": "dd44d7a4b448ee0734487c400712c842e15d22e3187aa961913c75d4e9eb3ad2",
       "disposition": "evidence-backed",
       "claims": [
         {
@@ -245,9 +245,9 @@
       "review": "0.1.4: reviewed generated content against the canonical manifest, fourteen-domain coverage, coding-research prompt, code-quality gate and team ownership roster; generated copies carry the source instructions. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending."
     },
     "skills/website-build-skill/SKILL.md": {
-      "sha256": "71cb5b229d68ae1b91a11d4168c6093a88d0c0f7da2dbcab0c933cb6a333c81b",
+      "sha256": "470457589c6422b34b92ece395b0853ea5b3c8d2bdf169cd705ca0c7f5faf7b6",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "0.1.4: reviewed against the coding-research task specification for fourteen-domain coverage, selected-stack standards before implementation, freshness, evidence and role ownership; no current language version or feature status is asserted. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending."
+      "review": "0.1.4: reviewed against the coding-research task specification for fourteen-domain coverage, selected-stack standards before implementation, freshness, evidence and role ownership; no current language version or feature status is asserted. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. 0.1.18 (#20): reviewed the release-bound compatibility link, explicit network retrieval, offline document/receipt fallback and recorded-trial UNVERIFIED instruction against installed asset membership and docs/COMPATIBILITY.md. Implementation-agent editorial review; independent audit recorded separately."
     },
     "skills/website-build-skill/checklists/build.md": {
       "sha256": "4492d1576d276f73dcab9be83e525acf690984bb058f2139c1c703967fe1eccf",

package/docs/evidence/issue-20-compatibility-reference.json

@@ -0,0 +1,32 @@
+{
+  "issue": "https://github.com/aunysillyme/website-build-skill/issues/20",
+  "date": "2026-10-07",
+  "environment": {
+    "platform": "macOS arm64",
+    "node": "v22.22.3"
+  },
+  "artifact": {
+    "packageVersion": "0.1.18",
+    "source": "skills/website-build-skill/SKILL.md",
+    "sha256": "470457589c6422b34b92ece395b0853ea5b3c8d2bdf169cd705ca0c7f5faf7b6"
+  },
+  "checks": [
+    {
+      "command": "node --test test/packed-artifact.test.mjs",
+      "phase": "before the source fix",
+      "result": "FAIL: solo: compatibility evidence must be linked to the installed release"
+    },
+    {
+      "command": "node scripts/build.mjs --rehash SKILL.md && node scripts/check.mjs",
+      "phase": "after the source fix and release metadata update",
+      "result": "PASS"
+    },
+    {
+      "command": "node --test test/*.test.mjs",
+      "phase": "after the source fix and release metadata update",
+      "result": "187 passed, 0 failed, 2 existing live-host checks skipped",
+      "coverage": "Actual npm tarball installed offline as a consumer; fresh SOLO and TEAM entrypoints carry the release-bound compatibility URL, network requirement, offline document/receipt fallback and recorded-trial UNVERIFIED instruction. Receipt digests and uninstall checks pass."
+    }
+  ],
+  "limits": "No live host activation, TEAM session operation or integration trial was performed. Public availability of the v0.1.18 evidence URL is checked after tag publication."
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "website-build-skill",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "A skill pack that turns your AI into an expert website builder: current research, design, code, accessibility, speed, SEO and security, alone or as a team.",
   "type": "module",
   "license": "MIT",
@@ -63,7 +63,7 @@
     "RELEASING.md",
     "REPO_SETTINGS.md"
   ],
-  "homepage": "https://github.com/aunysillyme/website-build-skill",
+  "homepage": "https://website-build-skill.aunysillyme.dev/",
   "bugs": {
     "url": "https://github.com/aunysillyme/website-build-skill/issues"
   },

package/skills/website-build-skill/SKILL.md

@@ -119,7 +119,10 @@ Complete the mockup gate with inspected images and mark code tested after execut
 A saved-file claim requires a successful write and read-back; memory needs its own receipt.
 Hand deployment to an authorized operator when deploy access is unavailable.
 Check the chosen host's loading, installation, team creation, permissions and integrations
-with a recorded trial. See the repository's docs/COMPATIBILITY.md for host evidence.
+with a recorded trial. Read [host evidence](https://github.com/aunysillyme/website-build-skill/blob/v0.1.19/docs/COMPATIBILITY.md)
+for this release. Network access is required to retrieve this document, which is not
+copied into the installed skill. If offline, ask for a copy of that release's document and linked receipts.
+Keep host activation, TEAM and integrations UNVERIFIED until checked in a recorded trial.
 After installation, open the role sessions and provide a different model family for
 independent review. Enforce permissions through the host's own controls.
 Role text guides behaviour; real permissions come from the host's own settings and

package/skills/website-build-skill/manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "0.1.17",
+  "packageVersion": "0.1.19",
   "skillName": "website-build-skill",
   "pathBase": "All asset paths resolve from this manifest directory; runtime paths resolve in the authorized user project.",
   "assets": [
@@ -17,7 +17,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "71cb5b229d68ae1b91a11d4168c6093a88d0c0f7da2dbcab0c933cb6a333c81b"
+      "sha256": "dc34d8b3344678c3ca86c3ad45212bafb8296b2c1537ef6e5da9f0cb37959860"
     },
     {
       "path": "manifest.json",

package/src/validate.mjs

@@ -4,10 +4,7 @@ import { CORE, ARCHIVE, ARCHIVE_SHA, digest, files, read, manifest, generated, o
 
 const roles = ['researcher', 'coordinator', 'designer', 'graphics', 'builder', 'optimizer', 'reviewer'];
 const headings = ['IDENTITY', 'WHAT YOU OWN', 'BOUNDARIES', 'WHAT YOU NEED TO KNOW BEFORE YOU START', 'WHAT YOU MUST LEARN', 'WHAT YOU MUST RESEARCH', 'YOUR TOOLS', 'YOUR INPUTS', 'YOUR OUTPUTS', 'YOUR GATE', 'YOUR HANDOFF', 'HOW YOU FAIL'];
-const owner = ['au', 'ny', 'sillyme'].join('');
-const funding = ['https://github.com', 'sponsors', owner].join('/');
-const personal = ['au', 'ny'].join('');
-const publicName = personal[0].toUpperCase() + personal.slice(1);
+const publicName = ['Au', 'ny'].join('');
 const company = `${publicName} LLC`;
 const legalLines = {
   LICENSE: `Copyright (c) 2026 ${company} and contributors`,
@@ -15,7 +12,8 @@ const legalLines = {
   'CHANGELOG.md': `- LICENSE names ${company} as copyright holder; outside contributions now require the CLA in CLA.md.`,
 };
 const product = ['Claude', 'Code'].join(' ');
-const forbidden = [personal, product, ['Vau','lts'].join(''), ['A','UN-'].join(''), ['linear','.app'].join(''), ['/','Users','/'].join(''), ['@','gmail'].join(''), ['site','builder','skill'].join('-')];
+// Public brand is allowed; private-stack traces stay blocked.
+const forbidden = [product, ['Vau','lts'].join(''), ['A','UN-'].join(''), ['linear','.app'].join(''), ['/','Users','/'].join(''), ['@','gmail'].join(''), ['site','builder','skill'].join('-')];
 export const privacyPattern = new RegExp(forbidden.map(s => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|'), 'i');
 
 export function privacyIssues(name, text, options = {}) {
@@ -27,14 +25,6 @@ export function privacyIssues(name, text, options = {}) {
     let line = original;
     // Legal notices allow only the approved full line in its named file.
     if (line === legalLines[name]) continue;
-    // The agreement alone may name the company and its two exact trademarks.
-    // Boundaries keep longer names and private suffixes subject to the privacy gate.
-    if (name === 'CLA.md') line = line.replace(new RegExp(`(?<![\\w-])(?:${company}|${publicName}SillyMe|${publicName}(?! LLC|SillyMe))(?![\\w-])`, 'g'), 'LEGAL_NAME');
-    // Resolved policy. Two public identifiers are required by the repository and are exempt:
-    // the owning account on the exact CODEOWNERS line, and the supported host's product name.
-    // Everything else the pattern names stays forbidden, including the same account string
-    // anywhere other than that line or a repository URL.
-    if (name === '.github/CODEOWNERS' && line === `* @${owner}`) continue;
     // The product name is exempt as a name, never as a path segment. Exempting it outright
     // would let a local working directory through, so path-shaped uses are caught first.
     // Normalise the spellings a path can take before testing: an escaped space, surrounding
@@ -43,26 +33,6 @@ export function privacyIssues(name, text, options = {}) {
     const productPath = new RegExp(`(?:~|\\$HOME|%USERPROFILE%|[A-Za-z]:)?[\\\\/]${product}(?=[\\\\/ ]|$)`, 'i');
     if (productPath.test(normalised)) { issues.push(`PRIVACY:${name}:${i + 1}`); continue; }
     line = line.replaceAll(product, 'PUBLIC_PRODUCT');
-    // Only the exact public funding URL is exempt; other Sponsors URLs fail closed.
-    // Sentence punctuation after the exact URL (. , ; : ] > *) is trimmed before the compare.
-    line = line.replace(/https:\/\/github\.com\/sponsors\/[^\s)"'`]+/g, url => {
-      if (url.replace(/[.,;:\]>*]+$/, '') === funding) return 'PUBLIC_FUNDING';
-      issues.push(`PRIVACY:${name}:${i + 1}`);
-      return url;
-    });
-    // Only exact repository URL namespaces, never the whole line around a URL. npm's
-    // `github:owner/repo` shorthand is the same repository reference in the form a package
-    // manager takes, so it is exempt in exactly that spelling and no other.
-    line = line.replace(new RegExp(`https://(?:github\\.com|raw\\.githubusercontent\\.com)/${owner}/website-build-skill(?=[/\\s)"'.\\x60]|$)`, 'g'), 'REPOSITORY');
-    line = line.replace(new RegExp(`github:${owner}/website-build-skill(?=[\\s)"'.\\x60]|$)`, 'g'), 'REPOSITORY');
-    // Related public tools share this owner, but the allowance ends at each exact
-    // repository name. A third repository or a longer name still fails closed.
-    const siblings = '(?:agent-personalizer|model-orchestrator)';
-    // Aligned with the self-repo lookahead above by adding the same sentence-ending period,
-    // but only when nothing word-shaped follows it: a bare trailing "." closes a sentence,
-    // while ".private" is a different, unexempted name and must still fail closed.
-    line = line.replace(new RegExp(`https://(?:github\\.com|raw\\.githubusercontent\\.com)/${owner}/${siblings}(?=[/#?\\s)"'\\x60]|\\.(?!\\w)|$)`, 'g'), 'REPOSITORY');
-    line = line.replace(new RegExp(`github:${owner}/${siblings}(?=[\\s)"'\\x60]|\\.(?!\\w)|$)`, 'g'), 'REPOSITORY');
     if (privacyPattern.test(line) || /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i.test(line)) issues.push(`PRIVACY:${name}:${i + 1}`);
     if (line.includes(String.fromCharCode(0x2014))) issues.push(`VOICE:${name}:${i + 1}`);
   }