website-build-skill 0.1.2 → 0.1.4

package/skills/website-build-skill/examples/fictional-studio-handoff.md

@@ -58,6 +58,7 @@ framing_reset: "Treat draft direction names as questions to explore, not approve
 - Hosting: compare preview, HTTPS, form endpoint, response headers and rollback behavior.
 - Measurement: identify receiving-property proof for a successful inquiry.
 - Legal: verify exact font, image and intended-use rights; keep uncertain questions visible.
+- Coding: research current language support, tests, linting and secure code; refine the rules for the exact stack after Choose.
 
 ## Unresolved claims included in the packet
 
@@ -81,7 +82,7 @@ Optional memory status: pending proposal only; there is no durable-save claim.
 ## Complete the research-to-design transition
 
 After a capable Researcher establishes date provenance and opens current sources,
-it saves all grouped files, all thirteen checklists, claim ledgers, learning and staleness.
+it saves all grouped files, all fourteen checklists, claim ledgers, learning and staleness.
 It reads them back, applies AD01 through AD08 and R01 through R06, and issues a new revision.
 Coordinator reopens those artifacts before recording acceptance.
 Only then does scope-to-designer carry the approved brief, accepted library revision,

package/skills/website-build-skill/manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "0.1.2",
+  "packageVersion": "0.1.4",
   "skillName": "website-build-skill",
   "pathBase": "All asset paths resolve from this manifest directory; runtime paths resolve in the authorized user project.",
   "assets": [
@@ -17,7 +17,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "14083527283bb68e11a073776e48aa758514e934064ec24e0f83d131549eec76"
+      "sha256": "ed1c909f9946de0fa7a43364c84efc837b6644c0dc8334b81ddfaf031db156e1"
     },
     {
       "path": "manifest.json",
@@ -45,7 +45,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "f9be73afb8f0e7746f2e24db5131270ab6cbf7cf3e7636473b51962a679bdfe3"
+      "sha256": "d5ed2a92d5bd7071895658ebbf4d7d696aeddb3735aa8d9153d0405c517f7b9c"
     },
     {
       "path": "prompts/01-website-deep-research.md",
@@ -60,7 +60,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "3577554da4ddf2be09783e72a45fc84d39d79673b414408eee7a16c57efdb7c4"
+      "sha256": "6289264065a504551c0f6d20f7cfecc6a916880df8d91f1b4f5b04684c481cab"
     },
     {
       "path": "archive/graphics-design-original.md",
@@ -119,7 +119,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "4a7b4120f37922eee98db9160cdab13f104f422d58c2f8e235ad8697f8079efa"
+      "sha256": "7b49af1c5286281b58aa37fa3ff0215750cc4ca3efc97ff550992c616cd3cbf8"
     },
     {
       "path": "prompts/06-site-audit.md",
@@ -225,7 +225,22 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "e6e7cad7d31ee51879a82f14b82ef7d0a171c67ab1763140a69e2b63e5d0c93f"
+      "sha256": "58a53b49b1da1039195d0ecaa24dff296668d9c4c4a52545d40836ddf8d6d388"
+    },
+    {
+      "path": "prompts/13-coding-research.md",
+      "version": "0.1.4",
+      "kind": "prompt",
+      "active": true,
+      "bundles": [
+        "prompts"
+      ],
+      "distributions": [
+        "npm",
+        "skill-zip",
+        "native-skill"
+      ],
+      "sha256": "d1de4c7ed85b4109a35b60d5d2aedd2db5178ed6d198cbdca0c31250cf469ed4"
     },
     {
       "path": "roles/researcher.md",
@@ -240,7 +255,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "245b0ee036e2c73619bab2c3b7585cf7b1cc7c5f9b7364dcd48a613ff2d1be78"
+      "sha256": "741a5200fbef577c8e8da4dec7eb4d738cca9ead11928260ca610a67bdb98106"
     },
     {
       "path": "roles/coordinator.md",
@@ -255,7 +270,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "1049ee3d1d85976ed943d767d89814d9d83463707591c3bd0268a8be02f7fdca"
+      "sha256": "0bddf3b4477c224fe0dfb75b8370e213e51f939871fd973e4ff0ff88cba3b822"
     },
     {
       "path": "roles/designer.md",
@@ -300,7 +315,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "7f7e957e65e2cff0d73baf6fd4dff5eb9468d451dbde792ddf4d5c143c6909b1"
+      "sha256": "c02abff4b072d9a95eec7e2303c27bd6908f59b3c895cac5f1ea52ebb403c4be"
     },
     {
       "path": "roles/optimizer.md",
@@ -330,7 +345,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "85e8355c2b7996ec1304024db3760ff489f3fdfbc1f962e9d54649b647eae599"
+      "sha256": "8d77a3f3db3eb127ae931e1b92ed8cc30da3f5bd095b0af84d76acd15430c66b"
     },
     {
       "path": "playbooks/choose-stack.md",
@@ -482,7 +497,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "9ff5f322e6f80b8bf9d1daa39e9416933fa7c6b911c27a0b1a134e2714ba434b"
+      "sha256": "dbac7440d87a85d1f8970b10938d91baa7203b5a596f1f902dfe347b5baecaad"
     },
     {
       "path": "playbooks/deploy-and-operate.md",
@@ -512,7 +527,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "2bfc2be84723071e21dbcaa0eb607d5f08ef944b0eecc712f1ea16f95118c2a8"
+      "sha256": "ce3ea09b3aea6c1e1ad046bfc32c11c5502f3a206349f149b51925ae7ff4bde1"
     },
     {
       "path": "checklists/brand-and-mockups.md",
@@ -542,7 +557,22 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "bf41f87f56761f15a3528a27ba56052ddfcc50a68a45766d84b61fddbba8e0d1"
+      "sha256": "4492d1576d276f73dcab9be83e525acf690984bb058f2139c1c703967fe1eccf"
+    },
+    {
+      "path": "checklists/code-quality.md",
+      "version": "0.1.4",
+      "kind": "checklist",
+      "active": true,
+      "bundles": [
+        "checklists"
+      ],
+      "distributions": [
+        "npm",
+        "skill-zip",
+        "native-skill"
+      ],
+      "sha256": "6a0346ef6678b0ed3c64ff04df93e466ae5acd8c26e34c802b78505091ae62c3"
     },
     {
       "path": "checklists/accessibility.md",
@@ -602,7 +632,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "16e71886e51957db9e4c18758fcb5de7ba1d85ab930a199ce77e3ce9b6a08902"
+      "sha256": "24e633228248eccb69fb4aa5c6a4afd6481ddcbe72f3ac095cc10d53e4367dba"
     },
     {
       "path": "references/stacks/static-html.md",
@@ -722,7 +752,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "9bb043eb71a2f9f1c8b293efa91bb1b5b844db91456571cab01e6e2f6bd60f9f"
+      "sha256": "2b3476d038ee0b067ea38006bcad6819ab219b5751de92f911820abe53ab501f"
     },
     {
       "path": "templates/handoff.yaml",
@@ -813,7 +843,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "d1caaa1ecb36de1fa19439d30f18dd68f29ca512e3c9c7252804367ad128c8d3"
+      "sha256": "190e80ee0e8447923e71120ebb24e656168db1311f72da5049a27ac7a4229963"
     },
     {
       "path": "examples/audit-cases.md",
@@ -1004,6 +1034,7 @@
       "assets": [
         "roles/builder.md",
         "prompts/05-stack-and-build.md",
+        "prompts/13-coding-research.md",
         "playbooks/choose-stack.md",
         "playbooks/data-and-templates.md",
         "playbooks/image-pipeline.md",
@@ -1012,7 +1043,8 @@
         "references/stacks/static-html.md",
         "references/stacks/scripted-static.md",
         "references/stacks/framework.md",
-        "checklists/build.md"
+        "checklists/build.md",
+        "checklists/code-quality.md"
       ],
       "requires": [
         "research",
@@ -1029,10 +1061,18 @@
         "B07",
         "B08",
         "B09",
-        "B10"
+        "B10",
+        "B11",
+        "CQ01",
+        "CQ02",
+        "CQ03",
+        "CQ04",
+        "CQ05",
+        "CQ06"
       ],
       "runtimeOutputs": [
         "site-work/stack.md",
+        "site-work/coding-standards.md",
         "site-work/build/",
         "site-work/qa/build/",
         "authorized implementation_root"
@@ -1135,7 +1175,8 @@
         "prompts/10-adversarial-pre-ship.md",
         "templates/audit-brief.md",
         "checklists/research.md",
-        "checklists/ship.md"
+        "checklists/ship.md",
+        "checklists/code-quality.md"
       ],
       "requires": [
         "experience",
@@ -1147,7 +1188,13 @@
         "AD09",
         "SH01",
         "SH02",
-        "SH03"
+        "SH03",
+        "CQ01",
+        "CQ02",
+        "CQ03",
+        "CQ04",
+        "CQ05",
+        "CQ06"
       ],
       "runtimeOutputs": [
         "Returned read-only findings/research/handoff; Coordinator captures site-work/review/"
@@ -1215,7 +1262,8 @@
       "prompts/09-security-headers.md",
       "prompts/10-adversarial-pre-ship.md",
       "prompts/11-ship-and-verify.md",
-      "prompts/12-web-design-team.md"
+      "prompts/12-web-design-team.md",
+      "prompts/13-coding-research.md"
     ],
     "playbooks": [
       "playbooks/choose-stack.md",
@@ -1237,6 +1285,7 @@
       "checklists/research.md",
       "checklists/brand-and-mockups.md",
       "checklists/build.md",
+      "checklists/code-quality.md",
       "checklists/accessibility.md",
       "checklists/performance-seo.md",
       "checklists/security.md",
@@ -1274,6 +1323,7 @@
         "prompts/10-adversarial-pre-ship.md",
         "prompts/11-ship-and-verify.md",
         "prompts/12-web-design-team.md",
+        "prompts/13-coding-research.md",
         "roles/researcher.md",
         "roles/coordinator.md",
         "roles/designer.md",
@@ -1295,6 +1345,7 @@
         "checklists/research.md",
         "checklists/brand-and-mockups.md",
         "checklists/build.md",
+        "checklists/code-quality.md",
         "checklists/accessibility.md",
         "checklists/performance-seo.md",
         "checklists/security.md",
@@ -1335,6 +1386,7 @@
         "prompts/10-adversarial-pre-ship.md",
         "prompts/11-ship-and-verify.md",
         "prompts/12-web-design-team.md",
+        "prompts/13-coding-research.md",
         "roles/researcher.md",
         "roles/coordinator.md",
         "roles/designer.md",
@@ -1356,6 +1408,7 @@
         "checklists/research.md",
         "checklists/brand-and-mockups.md",
         "checklists/build.md",
+        "checklists/code-quality.md",
         "checklists/accessibility.md",
         "checklists/performance-seo.md",
         "checklists/security.md",
@@ -1396,6 +1449,7 @@
         "prompts/10-adversarial-pre-ship.md",
         "prompts/11-ship-and-verify.md",
         "prompts/12-web-design-team.md",
+        "prompts/13-coding-research.md",
         "roles/researcher.md",
         "roles/coordinator.md",
         "roles/designer.md",
@@ -1417,6 +1471,7 @@
         "checklists/research.md",
         "checklists/brand-and-mockups.md",
         "checklists/build.md",
+        "checklists/code-quality.md",
         "checklists/accessibility.md",
         "checklists/performance-seo.md",
         "checklists/security.md",

package/skills/website-build-skill/playbooks/research-and-memory.md

@@ -97,6 +97,7 @@ same-calendar-day currency. A decision explicitly requiring that proof stays BLO
 | 11. Hosting, deploy and DNS | Same-day check for platform capabilities, plan prices/restrictions, header syntax and deploy configuration; 90 days for DNS fundamentals. | Commercial limits and deployment contracts change quickly; name-resolution principles change slowly. Recheck the actual target before release. |
 | 12. Measurement | 30 days for setup and interpretation guidance; same-day check for selected event APIs, consent settings and receiving-property behavior. | Statistical caveats persist; vendor interfaces and active configuration do not. Changed instrumentation or property triggers verification. |
 | 13. Legal, kept light | Same-day check for exact font/stock/AI tool licenses and intended-use rights; 30 days for background guidance. | Rights attach to a particular asset, version and tier; a previously allowed use is not evidence for a new use. Changed terms or jurisdiction triggers review. |
+| 14. Languages and coding practice | Same-day check for selected language, runtime and framework versions, Baseline status of features in use, and security advisories; 30 days for testing, linting and tooling guidance; 365 days for fundamentals such as semantic HTML and structural escaping. | Language support, framework idioms and advisories can change during a build; stable semantics and escaping principles need less repetition. A selected-version, browser-target or security change triggers an earlier recheck. |
 
 - Versioned standards: identify the authoritative current release as of ASK DATE and at each scheduled refresh; record release/version, target level, source and applicability. An old but still-current standard is not stale merely because its publication is old. A new relevant release triggers review before reuse even inside a nominal window.
 - Staleness artifact: generate this full table into `staleness.md`, add all applicable claims, original accesses, last revalidations, window/expiry, trigger, reason, owner and dependent receipts. Name the earliest-expiring applicable domain (all ties), its window, and concrete recheck date with the ASK DATE-relative expression. Same-day domains are due before use that day. Do not average domain windows or let a slow domain hide a fast subclaim.
@@ -251,7 +252,7 @@ site-work/
     library/                              Researcher-owned canonical library.
       README.md                           Dated index, headline findings, role reading map.
       scope.md                            ASK DATE, ladder rung/raw evidence, workspace root, request, tools, applicability.
-      coverage.md                         Thirteen domains, files, checklist and source coverage.
+      coverage.md                         Fourteen domains, files, checklist and source coverage.
       01-codebases-and-stacks.md           Domains 1 and 2; code reads and current stacks.
       02-design-and-experience.md          Domains 3 and 5; design and UI/UX.
       03-graphics-and-rights.md            Domains 4 and 13; graphics and light legal.
@@ -259,6 +260,7 @@ site-work/
       05-search-and-answers.md             Domains 8 and 9; SEO and AEO.
       06-security-and-delivery.md          Domains 10 and 11; threats, hosts, deploy, DNS.
       07-measurement-and-operations.md     Domain 12; analytics and operational follow-through.
+      08-languages-and-code.md             Domain 14; language support, coding practice and verification.
       sources.md                          Claim IDs, opened URLs, source/access dates, scope.
       receipts/
         <CLAIM-ID>.md                     Per-claim page fetch fields and verbatim supporting excerpt.
@@ -268,7 +270,7 @@ site-work/
       how-to-read-a-brand-kit.md           Evidence into checkable design decisions.
       website-qa-checklist.md              Cross-domain blocker-first index of applied checks.
       surprises.md                        Short findings and implications for the user.
-      staleness.md                        Thirteen freshness windows relative to ASK DATE, earliest expiry, reuse decisions.
+      staleness.md                        Fourteen freshness windows relative to ASK DATE, earliest expiry, reuse decisions.
       learning.md                         Opened evidence, learned rules, applied checklist IDs.
       recipes.md                          Commands that actually ran, with tool version and what they produced.
       memory-proposal.md                  Durable rules and location, not a completed save.
@@ -287,6 +289,7 @@ site-work/
         11-hosting.md                     Preview, DNS, HTTPS, rollback, plan restrictions.
         12-measurement.md                 Receiving-property proof and interpretation limits.
         13-legal.md                       Font, stock, AI imagery, trademark evidence.
+        14-code.md                        Supported features, tests, tooling, dependencies and secure code.
     coordinator/                          Coordinator top-ups, flags, learning and QA receipts.
     designer/                             Designer top-ups, flags, learning and QA receipts.
     graphics/                             Graphics top-ups, flags, learning and QA receipts.
@@ -299,7 +302,7 @@ site-work/
   MEMORY.md                               Coordinator's consolidated durable-memory proposal.
 ```
 
-- Coverage: map all thirteen domains to grouped files, source claims, checks, and downstream owners.
+- Coverage: map all fourteen domains to grouped files, source claims, checks, and downstream owners.
 - Exclusions: survey every domain; justify any project-specific NOT APPLICABLE check.
 - Checklists: each domain check names criterion, method, expected evidence, claim IDs, owner, status, and exclusion reason.
 - Blockers: website-qa-checklist.md collects unresolved critical checks before quality scoring.

package/skills/website-build-skill/prompts/00-start.md

@@ -94,6 +94,10 @@ NEXT
 - Without web search, say so, write the query plan and unresolved-claim ledger, and
   stop at the research gate; do not present unresearched output as researched.
 - Then extract the brand and show three visual mockups before writing website code.
+- Builder follows prompts/05-stack-and-build.md and runs
+  [prompts/13-coding-research.md](13-coding-research.md) after Choose, before Build.
+  Learn site-work/coding-standards.md before coding and apply
+  [checklists/code-quality.md](../checklists/code-quality.md) during Build and Challenge.
 - Finish with the current stage, its evidence, and the next concrete action.
 
 EVIDENCE

package/skills/website-build-skill/prompts/01-website-deep-research.md

@@ -29,7 +29,7 @@ STANDARDS
 - Research outputs are Markdown. All paths below are relative to
   site-work/research/library/ in the user's agreed project, never this skill package.
 
-RESEARCH THESE 13 AREAS
+RESEARCH THESE 14 AREAS
 1. Reference codebases and real implementations.
    Questions: open real repositories and read the entrypoints, routes, templates,
    data models, build scripts, tests, and deploy configuration. Which patterns recur
@@ -147,10 +147,26 @@ RESEARCH THESE 13 AREAS
     determinations to the owner or qualified adviser. Do not claim legal clearance.
     Artifact: 03-graphics-and-rights.md, domain 13 rights ledger requirements and
     unresolved questions; checklists/13-legal.md with evidence and escalation paths.
+14. Languages and coding practice.
+    Questions: as of the ASK DATE, which current HTML semantics and elements fit
+    this project? Which CSS layout features, container queries, cascade layers, and
+    nesting patterns fit its browser targets, and what is each feature's Baseline
+    status? Which JavaScript and TypeScript language features, module format, and
+    build or bundling defaults suit the selected versions? What idioms, deprecated
+    APIs, and upgrade notes apply to the chosen framework version? Research unit,
+    integration, and end-to-end testing; linting, formatting, and type-checking;
+    lockfiles, version pinning, dependency audits, and minimal dependencies; secure
+    template and script escaping, URL validation, and keeping inline secrets out
+    of code; and code organization and review. Use primary sources: MDN, web.dev
+    Baseline status, WHATWG and W3C specifications, TC39 finished proposals,
+    TypeScript release notes, and official runtime, tooling, and selected-framework
+    documentation and changelogs. Verify support separately from proposal status.
+    Artifact: 08-languages-and-code.md, domain 14 dated language/support matrix and
+    coding guidance; checklists/14-code.md with version, quality, and secure-code checks.
 
 SAVE THE RESULTS - two places, both required:
 A. Markdown files in site-work/research/library/:
-   - Write the seven grouped domain files named above, with all thirteen sections.
+   - Write the eight grouped domain files named above, with all fourteen sections.
      Survey every domain; mark genuinely inapplicable project checks with reasons.
      Extend these domains for databases, auth, payments, content workflows,
      internationalization, testing, privacy, or operations when the brief needs them.
@@ -171,7 +187,7 @@ A. Markdown files in site-work/research/library/:
      evidence needed to settle it, and current disposition. Never average claims.
    - query-plan.md and unresolved-claims.md: searches, unanswered questions, missing
      sources/tools, affected decisions, and a named next verification action.
-   - checklists/01-codebases.md through checklists/13-legal.md: exact filenames
+   - checklists/01-codebases.md through checklists/14-code.md: exact filenames
      named above. One checklist per domain, with criterion, method, expected evidence,
      source claim IDs, assigned downstream owner, PASS/FAIL/BLOCKED/NOT APPLICABLE,
      and a reason for exclusions. These are applied checks, not remembered prose.
@@ -180,7 +196,7 @@ A. Markdown files in site-work/research/library/:
      concrete type, color, spacing, imagery, and motion decisions out.
    - surprises.md: a short user-facing summary of the most surprising findings,
      each linked to a claim ID and its practical consequence for this site.
-   - staleness.md: the canonical thirteen-domain freshness table from
+   - staleness.md: the canonical fourteen-domain freshness table from
      playbooks/research-and-memory.md, then claim/domain, ASK DATE, window, original
      access, last revalidation, next-check date, reason, owner and dependent receipts.
      Identify the earliest-expiring domain, its window, and its ASK DATE-relative due date.

package/skills/website-build-skill/prompts/05-stack-and-build.md

@@ -16,6 +16,12 @@ CHOOSE
 - Record alternatives, dependencies, host constraints, and the next-page editing path
   in site-work/stack.md. Verify current APIs before writing against them.
 
+LEARN CODING PRACTICE
+- Run [prompts/13-coding-research.md](13-coding-research.md) for the exact selected
+  stack and versions after CHOOSE and before IMPLEMENT.
+- Read back site-work/coding-standards.md and record the rules learned before writing
+  code. Current sourced standards are required; unresolved research blocks coding.
+
 IMPLEMENT
 - Keep content, shared rendering, assets, and generated output separate.
 - Make the next page a data change wherever pages share a structure.
@@ -35,6 +41,8 @@ VERIFY
 - Exercise empty IDs, quotes, ampersands, script-terminator text, long copy,
   missing optional assets, and date boundaries using synthetic records.
 - Check the selected design at mobile and desktop sizes and preserve the evidence.
+- Apply [checklists/code-quality.md](../checklists/code-quality.md) against
+  site-work/coding-standards.md and record command output and code-review evidence.
 - Do not deploy. Continue through experience, discovery, headers, and audit gates.
 
 HANDOFF

package/skills/website-build-skill/prompts/12-web-design-team.md

@@ -36,7 +36,7 @@ SET UP
 RESEARCHER
 - Own site-work/research/library/ and handoffs/researcher/; own both research resources.
 - Run prompts/01-website-deep-research.md, with the inactive graphics original as
-  provenance. Complete all thirteen domains and their checklists current as of the ASK DATE.
+  provenance. Complete all fourteen domains and their checklists current as of the ASK DATE.
 - Save the library before any other role works. Gate: the library exists on disk,
   every domain this project touches has a substantive file and checklist, and every
   acted-on claim has an opened source URL, a publication/update date or explicit unknown, and an access date on or after the ASK DATE. UNVERIFIED cannot pass a claim.
@@ -67,7 +67,9 @@ GRAPHICS
 
 BUILDER
 - After mockup selection, learn codebase/stack, accessibility/performance and
-  security/delivery research; top up chosen APIs, headers, and measurement rules.
+  security/delivery and language/coding research; top up chosen APIs, headers, and measurement rules.
+- After Choose and before Build, run prompts/13-coding-research.md and read
+  site-work/coding-standards.md; apply checklists/code-quality.md to the implementation.
 - Own stack choice, implementation, performance, headers, build evidence and release.
 - Integrate Graphics and Optimizer outputs without editing their original sources.
 - Prepare the immutable candidate/audit brief; reproduce findings and test fixes.
@@ -83,6 +85,7 @@ REVIEWER
 - Last before ship, use a different model family or return INTERNAL, gate BLOCKED.
 - Learn the relevant library and top up current attack, accessibility and scanner facts.
 - Review the fixed candidate read-only; return findings and research without edits.
+- Check code against site-work/coding-standards.md and checklists/code-quality.md.
 - Return reproducible evidence or an explicit scoped no-findings result.
 - Apply checklists/ship.md ASK DATE checks to library and top-ups; reject undated,
   stale-access and stamped-but-unrevalidated claims as findings.

package/skills/website-build-skill/prompts/13-coding-research.md

@@ -0,0 +1,83 @@
+ASK DATE prerequisite: follow playbooks/research-and-memory.md#ask-date-rule.
+Researcher establishes it before intake or research; later roles read scope.md.
+Never ask the user for the date or infer it from model knowledge. Apply the
+same source, two-date, freshness, reuse, and blocked-gate rules to this stage.
+
+Research how to code this project's selected stack before writing website code.
+Run as Builder after CHOOSE in [prompts/05-stack-and-build.md](05-stack-and-build.md)
+and before IMPLEMENT. Require accepted research, a named mockup selection, and
+site-work/stack.md with the selected stack and exact versions.
+
+LEARN
+- Read site-work/research/library/README.md, scope.md, coverage.md, sources.md,
+  staleness.md, 08-languages-and-code.md, and checklists/14-code.md.
+- Read the approved brief, browser targets, host constraints, and stack.md.
+  Top up the chosen path and its unresolved questions against the saved library.
+- Return stale or wrong library claims to Researcher with claim IDs and evidence;
+  resume affected decisions after a corrected library receipt.
+
+RESEARCH
+- Open primary sources as of the ASK DATE: MDN, web.dev Baseline status, WHATWG
+  and W3C specifications, TC39 finished proposals, TypeScript release notes, and
+  the selected runtime, framework, package manager, and tools' official docs,
+  changelogs, upgrade guides, and security advisories.
+- Verify the exact selected language targets, runtime and framework versions,
+  supported combinations, module format, and build or bundling defaults. For
+  living standards, record the dated specification and browser targets; for an
+  absent runtime, compiler, or framework, record NOT APPLICABLE with a reason.
+- Research current HTML semantics and elements; CSS layout, container queries,
+  cascade layers, and nesting; and JavaScript/TypeScript features for this stack.
+  Record each proposed feature's Baseline or target browser/runtime support and
+  the fallback or exclusion when support misses the project's targets. For
+  compiler-only features, mark Baseline NOT APPLICABLE and cite compiler support.
+  Verify implementation support separately from a proposal being finished.
+- Identify the selected framework version's idioms, deprecated APIs, replacement
+  patterns, and upgrade notes. Map organization rules to this project's routes,
+  components, data, rendering, tests, and generated output.
+- Select unit, integration, and end-to-end checks for the actual failure modes.
+  Verify lint, format, and type-check tools and commands for the pinned versions.
+  Give any inapplicable test level or tool a project-specific reason.
+- Define dependency hygiene: justify each dependency, pin direct versions and
+  toolchain versions, preserve the lockfile, use reproducible install commands,
+  audit advisories, and record findings, owners, and update/recheck decisions.
+- Research secure template and script handling for the actual stack: structural
+  escaping by output context, script-safe serialization, URL scheme validation,
+  input validation, and secrets supplied through the server-side environment.
+  Keep secrets out of inline scripts, client bundles, source, and recorded output.
+- For every dated claim, save the opened URL, publication/update date or unknown,
+  actual access date, and supporting evidence under site-work/research/builder/.
+  Record fetched-page receipts when opening sources using templates/evidence.md.
+  Keep disagreements and unresolved claims explicit. Apply the canonical freshness
+  windows and later-day rechecks before using a claim.
+
+SAVE AND INGEST
+Write site-work/coding-standards.md, opening with "Research as of <ASK DATE>".
+Include these sections:
+1. Pinned language, runtime, framework, and tooling versions or dated targets,
+   with source URLs, source dates, access dates, and relevant claim IDs.
+2. Features to use, each with Baseline or target support status and any fallback.
+3. Deprecated APIs and patterns to avoid, with their supported replacements.
+4. Project commands for unit, integration, and end-to-end tests, linting,
+   formatting, and type-checking, including working directory and prerequisites.
+   Label commands PLANNED until executed; link actual command output after Build.
+5. Dependency policy, lockfile and pinning rules, install/audit commands, advisory
+   handling, and the reason each dependency is needed.
+6. Secure-coding rules for this stack, with concrete adverse cases to verify.
+7. Code organization rules and a short code-review checklist tied to these choices.
+
+Reopen the standards file and record its revision, learned rules, and applied
+claim/check IDs in site-work/research/builder/learning.md before implementation.
+Use [checklists/code-quality.md](../checklists/code-quality.md) during Build and
+include its receipts and the standards file in the Reviewer packet. Revalidate
+affected standards when selected versions, requirements, or source freshness change.
+
+BLOCKED RESEARCH
+If search or source access is unavailable, follow playbooks/research-and-memory.md:
+return a query plan and unresolved-claim ledger for the selected stack, keep research
+BLOCKED, and stop before implementation. Training memory or a previous library
+does not pass current research. If file writing is unavailable, return named file
+bodies for saving and read-back before the standards gate can pass.
+
+EVIDENCE
+Never report a measured, saved, installed, or deployed result without evidence.
+Apply the stage route and named checks in manifest.json before handing off.

package/skills/website-build-skill/roles/builder.md

@@ -4,7 +4,7 @@ You are Website Builder, accountable for implementation, performance, headers, a
 
 ## WHAT YOU OWN
 
-Write site-work/stack.md, build/, qa/build/, qa/site-audit.md,
+Write site-work/stack.md, coding-standards.md, build/, qa/build/, qa/site-audit.md,
 qa/accessibility.md, qa/contrast.md, qa/security-headers.md, audit/, release/,
 research/builder/, and handoffs/builder/. Own the authorized implementation_root
 recorded in site-work/ownership.yaml and its SITE_OPERATIONS.md. Only you materialize
@@ -31,18 +31,22 @@ disagreements.md, unresolved-claims.md, and staleness.md in that same directory.
 Verify the research gate and current revision before doing your job. Then read
 site-work/research/library/01-codebases-and-stacks.md,
 04-accessibility-and-performance.md, 06-security-and-delivery.md,
-07-measurement-and-operations.md, and 05-search-and-answers.md for integration.
+07-measurement-and-operations.md, 08-languages-and-code.md, and
+05-search-and-answers.md for integration.
 Apply library checklists/01-codebases.md, 02-stacks.md, 05-ui-ux.md,
-06-accessibility.md, 07-performance.md, 10-security.md, and 11-hosting.md.
+06-accessibility.md, 07-performance.md, 10-security.md, 11-hosting.md, and 14-code.md.
 Learn the smallest-stack decision from playbooks/choose-stack.md and
 references/stacks/static-html.md, scripted-static.md, and framework.md.
 Read site-work/research/library/recipes.md for build and asset commands already proven here,
 and append the ones you get working.
 Read playbooks/data-and-templates.md, image-pipeline.md, self-hosted-fonts.md,
 embed-facades.md, security-headers.md, performance-budgets.md, accessibility.md,
-and deploy-and-operate.md. Read checklists/build.md, accessibility.md, security.md,
-ship.md; prompts/05-stack-and-build.md, 09-security-headers.md,
-10-adversarial-pre-ship.md, 11-ship-and-verify.md; templates/audit-brief.md.
+and deploy-and-operate.md. Read checklists/build.md, code-quality.md,
+accessibility.md, security.md, ship.md; prompts/05-stack-and-build.md, 09-security-headers.md,
+10-adversarial-pre-ship.md, 11-ship-and-verify.md, 13-coding-research.md;
+templates/audit-brief.md. After choosing the stack, run prompts/13-coding-research.md,
+then read and ingest site-work/coding-standards.md before writing code. Record the
+standards revision and learned rules in research/builder/learning.md.
 Record the checklist IDs and research decisions used before coding.
 
 ## WHAT YOU MUST RESEARCH
@@ -95,7 +99,8 @@ For release, require release-to-builder with authority and final gate receipts.
 
 ## YOUR OUTPUTS
 
-Produce stack.md with alternatives and requirement mapping; source and generated
+Produce stack.md with alternatives and requirement mapping; coding-standards.md
+with current selected-stack rules and source evidence; source and generated
 artifact at implementation_root; reproducible build/tests, QA evidence, response
 headers, audit/AUDIT_BRIEF.md with ROUND 1 dispositions, release receipt/rollback
 identity, and SITE_OPERATIONS.md. Name what watches the site, including nothing.
@@ -106,8 +111,9 @@ learned rules, source IDs, and applied checks. A proposal is not a completed sav
 
 ## YOUR GATE
 
-Before coding, require selected mockup plus current sourced research. Validate
-fallible data, context-specific escaping, script terminators, URL schemes, empty IDs,
+Before coding, require selected mockup, current sourced research, and saved/read-back
+coding-standards.md. Apply checklists/code-quality.md to the candidate before handoff.
+Validate fallible data, context-specific escaping, script terminators, URL schemes, empty IDs,
 and shared state. Prove the next repeated page is a data change. Run relevant
 accessibility, performance, discovery and header checks on rendered output.
 Use the current library's standards and the declared package defaults separately.

package/skills/website-build-skill/roles/coordinator.md

@@ -33,12 +33,13 @@ Verify the research gate and current revision before doing your job. Then read
 site-work/research/library/01-codebases-and-stacks.md,
 02-design-and-experience.md, 03-graphics-and-rights.md,
 04-accessibility-and-performance.md, 05-search-and-answers.md,
-06-security-and-delivery.md, and 07-measurement-and-operations.md in that directory.
+06-security-and-delivery.md, 07-measurement-and-operations.md, and
+08-languages-and-code.md in that directory.
 Learn stage acceptance from SKILL.md, prompts/00-start.md,
 prompts/12-web-design-team.md, playbooks/research-and-memory.md,
 playbooks/deploy-and-operate.md, checklists/research.md, checklists/ship.md,
 templates/brief.md, templates/status.md, and templates/handoff.yaml.
-Open all thirteen library checklists and assign an accountable downstream owner.
+Open all fourteen library checklists and assign an accountable downstream owner.
 Record learned rules and applied checklist evidence in your learning receipts.
 
 ## WHAT YOU MUST RESEARCH