website-build-skill 0.1.19 → 0.1.20

package/skills/website-build-skill/checklists/ship.md

@@ -20,16 +20,16 @@ Date rule: [ASK DATE, source evidence, and revalidation](../playbooks/research-a
 
 | Check | Reject condition | Method and required evidence |
 | --- | --- | --- |
-| SH01: independent family and read-only review | Review is INTERNAL, self-review, same-family, unspecified-family, or Reviewer changed the candidate. | Compare actual Builder and Reviewer family evidence, fixed inspected identity, tool constraints and unchanged candidate bytes. Different model names or roles do not prove different families. Independent gate is NOT MET and shipment BLOCKED for internal review. |
-| SH02: independent ASK DATE rejection | Any acted-on library claim or top-up lacks source/access evidence, predates ASK DATE, has a false source date, expired window, or fresh stamp over unrevalidated content. | Reviewer applies research.md AD09, repeating AD01 through AD08 against scope, actual claim IDs, openings, original-access/revalidation history, all fourteen windows and later-day checks. Return read-only findings with locations and evidence. |
-| SH03: reproduced dispositions | A review allegation is treated as confirmed without reproduction, a material issue is unresolved, or a confirmed fix lacks regression evidence. | Read original findings and ROUND 1 dispositions. Require before-fix failure and after-fix pass for confirmed fixes, explicit inconclusive/not-reproduced results, and post-fix affected-check results. One independent round; harness verifies corrections. |
-| SH04: final artifact continuity | Promoted bytes differ from the reviewed/fixed candidate without an explained, checked change. | Compare reviewed predecessor, bounded fix diff, final harness artifact digest, upload manifest, and preview identity. No moving-branch rebuild substitutes for checked bytes. |
-| SH05: prerequisite gates and approvals | Research, rights, brand selection, build, accessibility, performance/discovery, security, or required review evidence remains incomplete. | Reopen every applicable receipt and artifact. Researcher corrects library claims; owning roles correct top-ups; Coordinator accepts verified revisions without editing producer evidence. |
-| SH06: concrete release authority | Target, account, project, domain, action, operator, or rollback authority falls outside recorded authorization. | Read the user's existing scope and exact prepared release plan. If missing, request authorization only after the candidate is concrete and reviewable. No implied purchases, account creation, unrelated DNS or key rotation. |
-| SH07: public payload and recovery | Private work files or secrets enter deployment, or rollback/safe recovery lacks an identified target and procedure. | Inspect the final allowlist and exact artifact. Name known-working recovery identity, operator, commands, limits and verification; initial releases need an explicit safe recovery plan. |
-| SH08: live routes and journey | Deployment command success substitutes for actual HTTPS, route, asset, error, or primary-action checks. | After authorized promotion, record public URLs, deployment identity/time, GET responses, mobile/desktop browser results, production CSP and complete primary journey. Critical failure triggers the authorized recovery procedure and verification. |
-| SH09: live discovery and honest measurement | Canonical/schema/sitemap/llms data drift, or social caches, field results or analytics receipt are asserted without evidence. | Inspect live origin responses and discovery parity. Keep actual third-party cache/property/field observations separate; name UNVERIFIED follow-ups and measurement owner. |
-| SH10: complete operations and handoff | SITE_OPERATIONS.md cannot guide a cold reader or omits what watches the site and who handles failure. | Read the one document end to end: purpose, trigger, invocation chain, dependencies, reads, writes, closed loop, failure modes, manual run/verify/recovery, source of truth. Verify tested commands; mark untested procedures UNVERIFIED. |
+| SH01: independent family and read-only review<br>Prevents self-review or a changed candidate from being called independent review. | Review is INTERNAL, self-review, same-family, unspecified-family, or Reviewer changed the candidate. | Compare actual Builder and Reviewer family evidence, fixed inspected identity, tool constraints and unchanged candidate bytes. Different model names or roles do not prove different families. Independent gate is NOT MET and shipment BLOCKED for internal review. |
+| SH02: independent ASK DATE rejection<br>Prevents stale or unsupported research from being accepted for release. | Any acted-on library claim or top-up lacks source/access evidence, predates ASK DATE, has a false source date, expired window, or fresh stamp over unrevalidated content. | Reviewer applies research.md AD09, repeating AD01 through AD08 against scope, actual claim IDs, openings, original-access/revalidation history, all fourteen windows and later-day checks. Return read-only findings with locations and evidence. |
+| SH03: reproduced dispositions<br>Prevents untested allegations and unproven fixes from deciding release readiness. | A review allegation is treated as confirmed without reproduction, a material issue is unresolved, or a confirmed fix lacks regression evidence. | Read original findings and ROUND 1 dispositions. Require before-fix failure and after-fix pass for confirmed fixes, explicit inconclusive/not-reproduced results, and post-fix affected-check results. One independent round; harness verifies corrections. |
+| SH04: final artifact continuity<br>Prevents releasing different files from the ones that were reviewed and checked. | Promoted bytes differ from the reviewed/fixed candidate without an explained, checked change. | Compare reviewed predecessor, bounded fix diff, final harness artifact digest, upload manifest, and preview identity. No moving-branch rebuild substitutes for checked bytes. |
+| SH05: prerequisite gates and approvals<br>Prevents release while required checks and approvals are incomplete. | Research, rights, brand selection, build, accessibility, performance/discovery, security, or required review evidence remains incomplete. | Reopen every applicable receipt and artifact. Researcher corrects library claims; owning roles correct top-ups; Coordinator accepts verified revisions without editing producer evidence. |
+| SH06: concrete release authority<br>Prevents release actions from exceeding the user's permission. | Target, account, project, domain, action, operator, or rollback authority falls outside recorded authorization. | Read the user's existing scope and exact prepared release plan. If missing, request authorization only after the candidate is concrete and reviewable. No implied purchases, account creation, unrelated DNS or key rotation. |
+| SH07: public payload and recovery<br>Prevents private-file exposure and a release with no usable recovery plan. | Private work files or secrets enter deployment, or rollback/safe recovery lacks an identified target and procedure. | Inspect the final allowlist and exact artifact. Name known-working recovery identity, operator, commands, limits and verification; initial releases need an explicit safe recovery plan. |
+| SH08: live routes and journey<br>Prevents a successful deploy command from hiding a broken live site. | Deployment command success substitutes for actual HTTPS, route, asset, error, or primary-action checks. | After authorized promotion, record public URLs, deployment identity/time, GET responses, mobile/desktop browser results, production CSP and complete primary journey. Critical failure triggers the authorized recovery procedure and verification. |
+| SH09: live discovery and honest measurement<br>Prevents live search details and measurement claims from outrunning their proof. | Canonical/schema/sitemap/llms data drift, or social caches, field results or analytics receipt are asserted without evidence. | Inspect live origin responses and discovery parity. Keep actual third-party cache/property/field observations separate; name UNVERIFIED follow-ups and measurement owner. |
+| SH10: complete operations and handoff<br>Prevents a handoff that leaves the next operator unable to check or recover the site. | SITE_OPERATIONS.md cannot guide a cold reader or omits what watches the site and who handles failure. | Read the one document end to end: purpose, trigger, invocation chain, dependencies, reads, writes, closed loop, failure modes, manual run/verify/recovery, source of truth. Verify tested commands; mark untested procedures UNVERIFIED. |
 
 ## Apply the two release phases
 

package/skills/website-build-skill/examples/audit-cases.md

@@ -1,4 +1,4 @@
-# Synthetic audit cases
+# Invented examples: synthetic audit cases
 
 Date rule: [ASK DATE and evidence discipline](../playbooks/research-and-memory.md#ask-date-rule).
 Everything in this example is invented. It is not a real organization, person, project,

package/skills/website-build-skill/examples/crumb-and-co-real-run.md

@@ -0,0 +1,73 @@
+# Crumb & Co: real demo run, 2026-10-18
+
+One run, one host (Claude Code), one model (Claude Sonnet 5.5), SOLO. Demo business with placeholder content, not deployed. The business name was given; menu, prices, hours, address and the order URL are invented placeholders. This is a real execution record, not user approval or evidence for a new engagement.
+
+## Request
+
+> Build a one-page website for Crumb & Co, a neighbourhood bakery. White background, warm and simple. It needs the menu with prices, opening hours, the address with a map link, and a button to order ahead. Static site, no framework.
+
+## Active time
+
+24 min 48 s of active time, research to proof, one run. Install took 43 s separately. Stage intervals include thinking and tool waits; writing the report and run log afterward is excluded. These are observations of this demo, not a forecast or a completed release.
+
+| Stage | Active interval | Seconds |
+| --- | --- | --- |
+| Install (separate) | 0 min 43 s | 43 |
+| Research | 7 min 35 s | 455 |
+| Learn | 0 min 32 s | 32 |
+| Ingest | 0 min 44 s | 44 |
+| Scope | 0 min 45 s | 45 |
+| Match | 1 min 07 s | 67 |
+| Mock | 2 min 47 s | 167 |
+| Choose | 0 min 25 s | 25 |
+| Build | 3 min 46 s | 226 |
+| Prove | 7 min 07 s | 427 |
+
+## Chosen direction
+
+Three real mockups: A Menu First, B Info Strip and C Display Band, each at 1440 and 390 px. The operator chose B Info Strip under the trial's explicit instruction, so BM06 is PASS with exception. Hours, address and the primary action sat near the top; the white background and simple menu fit the request.
+
+The task-weighted rubric preferred B (4.55) to A (4.4). The operator proposed those weights; Awwwards' published weights preferred A (4.3) to B (4.2). The choice depends on that judgment, and a user who values design above task-finding could choose A. The build shortened the headline, used semantic hours markup, fixed menu wrapping and added the demo notice.
+
+Treat the first mockup as a draft: say what feels off and ask again.
+
+## Recorded gate results
+
+Gate results are those of package 0.1.19. The current BM04 also requires screenshot sheets and 4x crops of each mockup, which this run did not produce.
+
+The original report's stage results follow with generic tool names. Paths in code spans refer to the source run, not packaged assets.
+
+| Stage | Gate result | Why |
+| --- | --- | --- |
+| Research | PASS (AD01 to AD08), AD09 BLOCKED | `check-library` exit 0, 23 OPENED, 0 UNVERIFIED (`site-work/handoffs/researcher/check-library-run.txt`). AD09 needs a different-family reviewer; none was available. Nine research gaps listed in `unresolved-claims.md` (U-01 to U-09), none relied on |
+| Learn | PASS | library reopened; `research/library/learning.md` |
+| Ingest | PASS | learning receipts for designer, graphics, builder, optimizer under `site-work/research/<role>/learning.md` |
+| Scope | PASS (SOLO acceptance) | `site-work/brief.md`, `capabilities.md`, `status.md`, `ownership.yaml`; the same model held Researcher and Coordinator, so acceptance is not independent |
+| Match | PASS, brand INFERRED | no brand kit and no screenshots exist; only "white background" is an approved rule. 11 contrast pairs computed with a calculator tool (`site-work/brand/contrast.md`) |
+| Mock | PASS (BM04), PASS with limits (BM05) | three directions at 390 and 1440, every PNG opened and inspected; two layout defects in my own first renders found and fixed |
+| Choose | PASS with exception (BM06) | the skill says the user names the direction and silence is not a selection. The dispatcher told me to pick, so the operator chose B (Info Strip), recorded as an operator choice. B beats A by 0.15 on a rubric I reweighted (4.55 vs 4.4); with Awwwards' own weights A beats B (4.3 vs 4.2). That ordering depends on a judgment call, and `mockups/selection.md` says so |
+| Build | PASS with limits | `node site-work/qa/check.mjs` exit 0: 38 of 38 checks, 14 of 14 adverse mutants caught. B09 PARTIAL: the order link target is verified, the click is not exercised (placeholder destination) |
+| Prove | PASS with limits | AX01 contrast PASS; AX05 reflow and 48px targets PASS (scrollWidth equals innerWidth at 320, 390, 768, 1440); AX03 PARTIAL (focus ring checked by a forced-style render, no Tab run); AX07 BLOCKED (no screen reader); PS01 BLOCKED (no Lighthouse), PS02 UNVERIFIED (nothing live); page weight 7692 bytes raw, 2647 gzip |
+| Protect | NOT RUN as a stage | not in the requested list. Local CSP evidence only (`site-work/qa/security-headers.md`): page renders byte-identical under the enforced policy, 0 CSP console lines, positive control caught 3 |
+| Challenge | NOT RUN | needs a different-family reviewer; SH01 NOT MET |
+| Ship | NOT RUN | stopped by instruction; `SITE_OPERATIONS.md` and the SH08 to SH10 checks are MISSING |
+
+## Recorded gaps
+
+The original report's failed, skipped or missing items follow with generic tool names.
+
+- MISSING: `SITE_OPERATIONS.md`, independent review receipts (`site-work/review/`), live checks SH08 to SH10 (Ship not run).
+- MISSING by decision: `sitemap.xml`, `robots.txt`, `404.html`, canonical link, share image, `agents.json`, `ai-instructions.json` (no domain, no host, no owner policy, optional; listed in `site-work/optimization/route-map.json`).
+- Not run, tool or access missing: Lighthouse, screen reader, keyboard Tab run, 200 percent text zoom, W3C HTML validator, Rich Results Test, securityheaders.com, click on the order link.
+- Memory save: unsupported, nothing saved (`research/library/memory-receipt.md`).
+- Research attempts that failed: a search tool (account out of credits), WebSearch for NN/g restaurant guidance (no NN/g result), `nngroup.com/articles/pdf-usability/` (HTTP 404), an Awwwards bakery page (script-rendered, navigation text only). Logged in `query-plan.md`. Award-winning bakery design was therefore not studied (U-01).
+- Deviation: I appended gap U-09 to the Researcher-owned `unresolved-claims.md` while acting as Designer; the skill says a downstream role flags the Researcher instead of editing the library. Same model held both roles, so it is recorded here, not hidden.
+- First draft schema.org fetches returned compressed bytes; discarded and refetched with `--compressed` before any receipt was written.
+
+Installer activation remained UNVERIFIED. Brand colours and mockup selection were the operator's choices. Protect was not run as a stage; local CSP evidence alone did not complete it. Independent review and release remain unmet.
+
+## Open the real artifacts
+
+For a new run, follow the checker ladder in [prompts/00-start.md](../prompts/00-start.md). When the installed checker is not on PATH, use `npx -y website-build-skill@<packageVersion> check-library <root>/site-work`, reading `<packageVersion>` from the installed `manifest.json`; this instruction does not change the recorded run's results.
+
+See the [Crumb & Co showcase](https://github.com/aunysillyme/website-build-skill/tree/v0.1.20/docs/showcase/crumb-and-co) for the copied HTML, CSS, mockups, built-page PNGs, 4x crops, selection, research sources and full RESULT. The [showcase index](https://github.com/aunysillyme/website-build-skill/blob/v0.1.20/docs/showcase/README.md) links the original run log and evidence receipt. The showcase is repository-only and excluded from the npm package; if offline, request copies. Only the source list is included, not its fetch receipts or the entire research library.

package/skills/website-build-skill/examples/fictional-studio-brief.md

@@ -1,4 +1,4 @@
-# Fictional Studio: paper workshop website
+# Invented example: Fictional Studio paper workshop website
 
 Date rule: [ASK DATE and evidence discipline](../playbooks/research-and-memory.md#ask-date-rule).
 Everything in this example is invented. It is not a real organization, person, project,

package/skills/website-build-skill/examples/fictional-studio-handoff.md

@@ -1,4 +1,4 @@
-# Fictional Studio: research-to-design handoff walkthrough
+# Invented example: Fictional Studio research-to-design handoff walkthrough
 
 Date rule: [ASK DATE and evidence discipline](../playbooks/research-and-memory.md#ask-date-rule).
 Everything in this example is invented. It is not a real organization, person, project,

package/skills/website-build-skill/manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "0.1.19",
+  "packageVersion": "0.1.20",
   "skillName": "website-build-skill",
   "pathBase": "All asset paths resolve from this manifest directory; runtime paths resolve in the authorized user project.",
   "assets": [
@@ -17,7 +17,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "dc34d8b3344678c3ca86c3ad45212bafb8296b2c1537ef6e5da9f0cb37959860"
+      "sha256": "3676b02f74f003a3653feffb566d7508793481a5da14c0b967df868783880360"
     },
     {
       "path": "manifest.json",
@@ -104,7 +104,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "9881d8c5ae027d57288f40b50621142b5dc66efd989796ee2b12a420d6dba953"
+      "sha256": "8516e975a0c2ab8ddcfeadeed1db5a4754ab42113fc16bfdfc0c636d3721363e"
     },
     {
       "path": "prompts/05-stack-and-build.md",
@@ -527,7 +527,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "ce3ea09b3aea6c1e1ad046bfc32c11c5502f3a206349f149b51925ae7ff4bde1"
+      "sha256": "658900aceac1ddb254559b346431fa449f30308ca606d0a49c3dbb6ffad1131c"
     },
     {
       "path": "checklists/brand-and-mockups.md",
@@ -542,7 +542,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "774d08f3093a3668d874074f9c5cc7435d089997a3c850afb6ae0553287bcc46"
+      "sha256": "40da57f19ec61a57f468e81ff2a8e68468d0f8b99d66be160f35f879ca50d2c7"
     },
     {
       "path": "checklists/build.md",
@@ -557,7 +557,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "ccc6b3de61ae7ab4b2d052b970b956695a52fba4c3fd24750439da3a8df2b69f"
+      "sha256": "bfe0975267a4340a7434fc437c68067b3104c6db4be7a90823da4cdd4c83b693"
     },
     {
       "path": "checklists/code-quality.md",
@@ -572,7 +572,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "c2d1aa467a5ab9d4b8846c4fdefbd3c8efbb2f342e05d5526e2059a4ddb4d926"
+      "sha256": "2779b6c6d09bd433b874805e1a60d6b145dff17cb1597d35cc3a19ccd633d5b2"
     },
     {
       "path": "checklists/accessibility.md",
@@ -587,7 +587,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "5833f446b6a4b5b039bb24dc5a6df98bf73275f5acb1b2557fb7d4eb37acfba2"
+      "sha256": "52e980fc853f1f29b1b7f03534654063050bf3a5adf85a00e989f0fa97b4188f"
     },
     {
       "path": "checklists/performance-seo.md",
@@ -602,7 +602,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "d9e30af6eba3e644ca2c056431b375f7c1d7965e55b872ac794cbb30d3d00fc5"
+      "sha256": "a66621ba98162f0a2d5148109e5fe5714687d88c2ceacfc8216ce732b430c0fe"
     },
     {
       "path": "checklists/security.md",
@@ -617,7 +617,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "a9d92b9a647744d4217354a804d333fb3cb5d1e736df78f08d9dfe7fc91b4623"
+      "sha256": "c6c3f386a93e0a15018ae2669cb774319f7f86bf2b225cd036311e52c2360485"
     },
     {
       "path": "checklists/ship.md",
@@ -632,7 +632,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "24e633228248eccb69fb4aa5c6a4afd6481ddcbe72f3ac095cc10d53e4367dba"
+      "sha256": "dbf53ff1c796449cf74e0c685d8c753e66767bb9151cfd1b3eecb52b3d5bbc45"
     },
     {
       "path": "references/stacks/static-html.md",
@@ -815,6 +815,21 @@
       ],
       "sha256": "ba8fd139f7a7c28433cd27fad9fb5adabe49c79789cc1c8abe78cb1258e8d2af"
     },
+    {
+      "path": "examples/crumb-and-co-real-run.md",
+      "version": "0.1.0",
+      "kind": "example",
+      "active": true,
+      "bundles": [
+        "method"
+      ],
+      "distributions": [
+        "npm",
+        "skill-zip",
+        "native-skill"
+      ],
+      "sha256": "c5c2b7b24183c7948707bc7013d55d26bcf7aa7c7c593eea7edebe68317f1c06"
+    },
     {
       "path": "examples/fictional-studio-brief.md",
       "version": "0.1.0",
@@ -828,7 +843,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "1b5375d4624823c426cce086fc2247c6645f5049d18a1890e42e967f3ab1ce94"
+      "sha256": "258d97cd799446e932a249924c7ce682831727dd348b4db0427eab74308c4707"
     },
     {
       "path": "examples/fictional-studio-handoff.md",
@@ -843,7 +858,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "190e80ee0e8447923e71120ebb24e656168db1311f72da5049a27ac7a4229963"
+      "sha256": "b7ec17f13b0d5e68ca722d4b84fe99f68d1fc7a7bd31479587470c172b52a0d9"
     },
     {
       "path": "examples/audit-cases.md",
@@ -858,7 +873,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "02eb34cf2ce394533d4627677541a4ae4093157673b2ce628a1fb1a8163c9016"
+      "sha256": "3cbb5f4de23c4b9e16c9bb0ee39e8202807e3a51d9a3b67e661aa11ecd84a71d"
     }
   ],
   "entryRole": "researcher",
@@ -1247,6 +1262,7 @@
       "templates/audit-brief.md",
       "templates/site-operations.md",
       "templates/status.md",
+      "examples/crumb-and-co-real-run.md",
       "examples/fictional-studio-brief.md",
       "examples/fictional-studio-handoff.md",
       "examples/audit-cases.md"
@@ -1363,6 +1379,7 @@
         "templates/audit-brief.md",
         "templates/site-operations.md",
         "templates/status.md",
+        "examples/crumb-and-co-real-run.md",
         "examples/fictional-studio-brief.md",
         "examples/fictional-studio-handoff.md",
         "examples/audit-cases.md"
@@ -1426,6 +1443,7 @@
         "templates/audit-brief.md",
         "templates/site-operations.md",
         "templates/status.md",
+        "examples/crumb-and-co-real-run.md",
         "examples/fictional-studio-brief.md",
         "examples/fictional-studio-handoff.md",
         "examples/audit-cases.md"
@@ -1489,6 +1507,7 @@
         "templates/audit-brief.md",
         "templates/site-operations.md",
         "templates/status.md",
+        "examples/crumb-and-co-real-run.md",
         "examples/fictional-studio-brief.md",
         "examples/fictional-studio-handoff.md",
         "examples/audit-cases.md"

package/skills/website-build-skill/prompts/04-three-mockups.md

@@ -4,6 +4,7 @@ Never ask the user for the date or infer it from model knowledge. Apply the
 same source, two-date, freshness, reuse, and blocked-gate rules to this stage.
 
 Show me three visual mockups for this website before writing any website code.
+Treat the first mockup as a draft: say what feels off and ask again.
 Use the approved brief, research, brand kit, and representative real content.
 If the brand kit is missing, first ask for my profile-picture and banner screenshots.
 
@@ -29,11 +30,20 @@ QUALITY
 - Present one image file (PNG, JPEG, WebP or SVG) per direction and viewport,
   with an optional static HTML preview. Text descriptions alone are not mockups.
   Preview markup is a mockup artifact, not application markup or scaffolding.
+- Require a screenshot sheet for each direction: browser captures at 390 px and
+  1440 px viewport widths, plus 4x crops of the header and one content junction
+  from each viewport. Label the direction, viewport and cropped regions.
+- Open and inspect every image, including every crop and the assembled sheet,
+  before asking for a choice. Record the image paths, inspection and any defects
+  in site-work/mockups/comparison.md; repair and reinspect changed images.
+- If no browser is available, record that in comparison.md and the stage handoff.
+  Keep the mockups unproven and the visual gate BLOCKED until browser captures
+  and image inspection are available; record any missed first-hour target.
 - If you cannot produce or view visual files, return a designer handoff and mark
   this stage incomplete. Do not claim three visual mockups from three paragraphs.
 
 SAVE
-- site-work/mockups/: the visual files and a comparison.md with tradeoffs.
+- site-work/mockups/: the visual files, screenshot sheets and a comparison.md with tradeoffs and image inspection evidence.
 - Write my selected direction and requested revisions to site-work/mockups/selection.md.
 - Hand that decision to the coordinator, the sole writer of site-work/status.md.
 

package/src/validate.mjs

@@ -317,16 +317,18 @@ export function check(root, options = {}) {
     else if (/UNAVAILABLE/.test(read(root, binEntry))) issues.push('PACKAGE_HONESTY:bin is still the unavailable sentinel');
     // A published tarball that omits any of these installs nothing on a stranger's machine.
     // A negation can empty one of them while the entry it negates is still listed. Only
-    // the GIF exclusion is allowed: documentation serves those images by raw URL.
+    // GIFs and the repository-only showcase may be excluded; docs link to their public URLs.
     // `src` and `src/` are the same entry.
     const published = (p.files ?? []).map(entry => String(entry).replace(/\/+$/, ''));
-    if (published.some(entry => entry.startsWith('!') && entry !== '!docs/*.gif')) issues.push('PACKAGE_FILES:a negated entry can empty a published path');
+    const exclusions = ['!docs/*.gif', '!docs/showcase/**'];
+    if (published.some(entry => entry.startsWith('!') && !exclusions.includes(entry))) issues.push('PACKAGE_FILES:a negated entry can empty a published path');
     for (const needed of ['bin', 'src', 'skills', 'docs', 'README.md', 'LICENSE'])
       if (!published.includes(needed)) issues.push(`PACKAGE_FILES:${needed} is not published`);
     // npm applies the list in order, so an exclusion placed before the entry it trims
-    // removes nothing and both GIFs still ship.
-    if (published.includes('!docs/*.gif') && published.indexOf('!docs/*.gif') < published.indexOf('docs'))
-      issues.push('PACKAGE_FILES:!docs/*.gif must come after the docs entry or it excludes nothing');
+    // removes nothing and the excluded files still ship.
+    for (const exclusion of exclusions)
+      if (published.includes(exclusion) && published.indexOf(exclusion) < published.indexOf('docs'))
+        issues.push(`PACKAGE_FILES:${exclusion} must come after the docs entry or it excludes nothing`);
     const floor = p.engines?.node?.match(/(\d+)/)?.[1];
     const checks = JSON.parse(read(root, '.github/workflows/check.yml')).jobs?.checks;
     const matrix = checks?.strategy?.matrix?.node;