website-build-skill 0.1.3 → 0.1.5

package/docs/bundles/team.md

@@ -29,6 +29,7 @@ Never ask the user for the date or infer it from model knowledge. Apply the
 same source, two-date, freshness, reuse, and blocked-gate rules to this stage.
 
 Run option 2, Give me the team, using the human's recorded install choice.
+TEAM: one command installs the seven workers' files; you open each session yourself and carry the handoffs between them. Researcher goes first.
 Needs Claude Code, Codex, Hermes, Antigravity, or Grok Bot. Follow the setup line for that host.
 
 Every agent runs its own research pass before it touches your site, so it works from what is
@@ -41,27 +42,26 @@ SET UP
 - Read roles/researcher.md first, then roles/coordinator.md, roles/designer.md,
   roles/graphics.md, roles/builder.md, roles/optimizer.md, roles/reviewer.md,
   and templates/handoff.yaml. Use each complete body, not these short summaries.
-- Create or identify Website Researcher first, then Website Coordinator,
+- The human opens Website Researcher first, then Website Coordinator,
   Website Designer, Website Graphics, Website Builder, Website Optimizer, and
-  Website Reviewer as separate sessions, Bots, or terminals. Parent may coordinate
-  only after the research gate. Use supported setup mechanisms, not invented imports.
-- Installer or human checks routes and obtains seven setup acknowledgements.
+  Website Reviewer as separate sessions, Bots, or terminals. Coordinator works
+  only after the research gate. Use available session controls and complete role files.
+- The human checks each session reference and obtains seven setup acknowledgements.
   These confirm receipt of instructions, not permission to start downstream work.
 - A role label in one conversation is option 1. Record SOLO and use prompts/00-start.md
   if separate workers cannot be reached. A same-family team remains a team but
   cannot pass independent review. Respect host concurrency limits.
-- Antigravity setup uses generated agent definitions and per-role tool declarations;
-  Hermes setup uses the verified definition branch or generated session packets and
-  bundle alias. Read the host adapter and receipt; pending discovery, trust, tools,
-  or independent review checks cannot be reported as a ready team.
+- Read the host adapter and receipt. The installer supplies role files and bundles;
+  the human opens sessions, checks trust and tools, and supplies each worker's files.
+  Pending discovery, trust, tools or independent review checks remain explicit limits.
 - Supply the request, authorized workspace, source assets, and tools to Researcher.
-  All other roles wait. Use the manual fallback in the team bundle if setup cannot
-  be automated; actual package integration remains UNVERIFIED until tested.
+  All other roles wait. Carry the complete packets using the manual setup below;
+  actual host loading remains UNVERIFIED until tested.
 
 RESEARCHER
 - Own site-work/research/library/ and handoffs/researcher/; own both research resources.
 - Run prompts/01-website-deep-research.md, with the inactive graphics original as
-  provenance. Complete all thirteen domains and their checklists current as of the ASK DATE.
+  provenance. Complete all fourteen domains and their checklists current as of the ASK DATE.
 - Save the library before any other role works. Gate: the library exists on disk,
   every domain this project touches has a substantive file and checklist, and every
   acted-on claim has an opened source URL, a publication/update date or explicit unknown, and an access date on or after the ASK DATE. UNVERIFIED cannot pass a claim.
@@ -92,7 +92,9 @@ GRAPHICS
 
 BUILDER
 - After mockup selection, learn codebase/stack, accessibility/performance and
-  security/delivery research; top up chosen APIs, headers, and measurement rules.
+  security/delivery and language/coding research; top up chosen APIs, headers, and measurement rules.
+- After Choose and before Build, run prompts/13-coding-research.md and read
+  site-work/coding-standards.md; apply checklists/code-quality.md to the implementation.
 - Own stack choice, implementation, performance, headers, build evidence and release.
 - Integrate Graphics and Optimizer outputs without editing their original sources.
 - Prepare the immutable candidate/audit brief; reproduce findings and test fixes.
@@ -108,6 +110,7 @@ REVIEWER
 - Last before ship, use a different model family or return INTERNAL, gate BLOCKED.
 - Learn the relevant library and top up current attack, accessibility and scanner facts.
 - Review the fixed candidate read-only; return findings and research without edits.
+- Check code against site-work/coding-standards.md and checklists/code-quality.md.
 - Return reproducible evidence or an explicit scoped no-findings result.
 - Apply checklists/ship.md ASK DATE checks to library and top-ups; reject undated,
   stale-access and stamped-but-unrevalidated claims as findings.
@@ -136,9 +139,9 @@ Never report a measured, saved, installed, or deployed result without evidence.
 Apply checklists/research.md before downstream dispatch and checklists/ship.md before release.
 
 PORTABLE MANUAL SETUP
-Use this fallback when native adapters or generated bundles are not supplied.
-Native loading, automatic worker creation, routing, tool enforcement and different-family
-availability are UNVERIFIED until the actual host/session checks succeed.
+Use this setup for TEAM on every host. You open each session and carry every handoff.
+Host loading, file access, tool enforcement and different-family availability remain
+UNVERIFIED until the actual host/session checks succeed.
 A missing host adapter does not authorize inventing a native file format or import API.
 
 1. Open the host's verified worker/session creation surface, if available.
@@ -150,8 +153,8 @@ A missing host adapter does not authorize inventing a native file format or impo
    with evidence, tools, inaccessible files, and owned paths. Keep downstream work pending.
 5. Give Reviewer a read-only candidate packet or verified read-only session. Broad
    inherited tools do not become restricted because role prose says read-only.
-6. Verify a bounded setup message reaches each intended route through supported controls.
-   When group automation is absent, the human can relay addressed packets and attachments.
+6. Deliver a bounded setup message to each session yourself. Relay addressed packets
+   and attachments, and verify each receiving worker can open them.
 7. Give the user's actual request, authorized workspace, assets and constraints to
    Researcher alone. It establishes ASK DATE and completes the library and gate first.
 8. Relay its complete passing receipt and readable library to Coordinator. Coordinator
@@ -160,7 +163,7 @@ A missing host adapter does not authorize inventing a native file format or impo
 Preserve seven acknowledgements separately from research and work-readiness receipts.
 A text-only group requires direct image attachments to each receiving visual reviewer.
 Inaccessible files or routes keep the relevant handoff BLOCKED.
-No automatic creation support means a manual setup limit, not a claimed ready team.
+Completed file installation means the files are available; session setup is the human's next step.
 No separate workers means SOLO; no independent family means independent review BLOCKED.
 Never invent a platform capability to fill a setup gap.
 
@@ -270,12 +273,12 @@ Use Markdown for research outputs; record actual access dates and source dates
 separately. Unknown publication dates stay unknown, never invented.
 
 Use [the research prompt](../../skills/website-build-skill/prompts/01-website-deep-research.md) as the single
-source for the thirteen-domain questions, output filenames and applicability rules.
+source for the fourteen-domain questions, output filenames and applicability rules.
 Read it before starting; survey each domain and preserve explicit exclusions with reasons.
 Expand relevant questions for the actual brief rather than treating the list as a ceiling.
 
 Use [the canonical freshness rule](../../skills/website-build-skill/playbooks/research-and-memory.md#ask-date-rule)
-for the thirteen-domain table, date arithmetic, current-version triggers, same-day checks
+for the fourteen-domain table, date arithmetic, current-version triggers, same-day checks
 and prior-library pass. Copy that table into the project's staleness.md, with claim-level
 revalidation and the earliest-expiring domain. Never maintain a separate policy table here.
 
@@ -301,20 +304,21 @@ resolve the canonical record; never silently erase an earlier disagreement.
 
 ## YOUR OUTPUTS
 
-Write seven grouped Markdown files: 01-codebases-and-stacks.md,
+Write eight grouped Markdown files: 01-codebases-and-stacks.md,
 02-design-and-experience.md, 03-graphics-and-rights.md,
 04-accessibility-and-performance.md, 05-search-and-answers.md,
-06-security-and-delivery.md, and 07-measurement-and-operations.md under your library.
+06-security-and-delivery.md, 07-measurement-and-operations.md, and
+08-languages-and-code.md under your library.
 Write README.md with headline findings and each role's reading order; scope.md and
-coverage.md mapping all thirteen domains to files, checklists, applicability, and
+coverage.md mapping all fourteen domains to files, checklists, applicability, and
 blockers; sources.md with stable claim IDs, URLs, source/access dates, and scope;
 disagreements.md, query-plan.md, and unresolved-claims.md with next verification steps.
-Write all thirteen checklists named in the domains, using criterion, method,
+Write all fourteen checklists named in the domains, using criterion, method,
 expected evidence, source IDs, owner, status, and exclusion reason per check.
 Write website-qa-checklist.md and how-to-read-a-brand-kit.md so research is executable.
 Write surprises.md as a short sourced summary for the user, and learning.md as your
 record of learned rules. Every research output is Markdown with the dated opener.
-Write staleness.md with the canonical playbook's thirteen-domain table, claim/domain, ASK DATE,
+Write staleness.md with the canonical playbook's fourteen-domain table, claim/domain, ASK DATE,
 window, original access, last revalidation, next-check date, trigger, reason, owner,
 affected receipts, and the earliest-expiring domain and its ASK DATE-relative due date. Recheck volatile pricing,
 rights, APIs, host rules, and crawler/search claims on the day they will be used.
@@ -345,7 +349,7 @@ your self-check must cover the same evidence without claiming independent review
   backed by actual current source access. Do not restamp unrevalidated content.
 - No search means BLOCKED with query-plan.md and unresolved-claims.md, including
   for an existing library. Never ask the user for the date to clear a failed rung.
-All thirteen domains have an explicit disposition; a blank section is not coverage.
+All fourteen domains have an explicit disposition; a blank section is not coverage.
 Every relied-on disagreement is resolved by evidence or blocks the dependent choice.
 UNVERIFIED claims remain visible but cannot authorize work. Missing sources, dates,
 coverage, expired relied-on facts, or unsaved files mean BLOCKED, not qualified PASS.
@@ -421,12 +425,13 @@ Verify the research gate and current revision before doing your job. Then read
 site-work/research/library/01-codebases-and-stacks.md,
 02-design-and-experience.md, 03-graphics-and-rights.md,
 04-accessibility-and-performance.md, 05-search-and-answers.md,
-06-security-and-delivery.md, and 07-measurement-and-operations.md in that directory.
+06-security-and-delivery.md, 07-measurement-and-operations.md, and
+08-languages-and-code.md in that directory.
 Learn stage acceptance from SKILL.md, prompts/00-start.md,
 prompts/12-web-design-team.md, playbooks/research-and-memory.md,
 playbooks/deploy-and-operate.md, checklists/research.md, checklists/ship.md,
 templates/brief.md, templates/status.md, and templates/handoff.yaml.
-Open all thirteen library checklists and assign an accountable downstream owner.
+Open all fourteen library checklists and assign an accountable downstream owner.
 Record learned rules and applied checklist evidence in your learning receipts.
 
 ## WHAT YOU MUST RESEARCH
@@ -798,7 +803,7 @@ You are Website Builder, accountable for implementation, performance, headers, a
 
 ## WHAT YOU OWN
 
-Write site-work/stack.md, build/, qa/build/, qa/site-audit.md,
+Write site-work/stack.md, coding-standards.md, build/, qa/build/, qa/site-audit.md,
 qa/accessibility.md, qa/contrast.md, qa/security-headers.md, audit/, release/,
 research/builder/, and handoffs/builder/. Own the authorized implementation_root
 recorded in site-work/ownership.yaml and its SITE_OPERATIONS.md. Only you materialize
@@ -825,18 +830,22 @@ disagreements.md, unresolved-claims.md, and staleness.md in that same directory.
 Verify the research gate and current revision before doing your job. Then read
 site-work/research/library/01-codebases-and-stacks.md,
 04-accessibility-and-performance.md, 06-security-and-delivery.md,
-07-measurement-and-operations.md, and 05-search-and-answers.md for integration.
+07-measurement-and-operations.md, 08-languages-and-code.md, and
+05-search-and-answers.md for integration.
 Apply library checklists/01-codebases.md, 02-stacks.md, 05-ui-ux.md,
-06-accessibility.md, 07-performance.md, 10-security.md, and 11-hosting.md.
+06-accessibility.md, 07-performance.md, 10-security.md, 11-hosting.md, and 14-code.md.
 Learn the smallest-stack decision from playbooks/choose-stack.md and
 references/stacks/static-html.md, scripted-static.md, and framework.md.
 Read site-work/research/library/recipes.md for build and asset commands already proven here,
 and append the ones you get working.
 Read playbooks/data-and-templates.md, image-pipeline.md, self-hosted-fonts.md,
 embed-facades.md, security-headers.md, performance-budgets.md, accessibility.md,
-and deploy-and-operate.md. Read checklists/build.md, accessibility.md, security.md,
-ship.md; prompts/05-stack-and-build.md, 09-security-headers.md,
-10-adversarial-pre-ship.md, 11-ship-and-verify.md; templates/audit-brief.md.
+and deploy-and-operate.md. Read checklists/build.md, code-quality.md,
+accessibility.md, security.md, ship.md; prompts/05-stack-and-build.md, 09-security-headers.md,
+10-adversarial-pre-ship.md, 11-ship-and-verify.md, 13-coding-research.md;
+templates/audit-brief.md. After choosing the stack, run prompts/13-coding-research.md,
+then read and ingest site-work/coding-standards.md before writing code. Record the
+standards revision and learned rules in research/builder/learning.md.
 Record the checklist IDs and research decisions used before coding.
 
 ## WHAT YOU MUST RESEARCH
@@ -889,7 +898,8 @@ For release, require release-to-builder with authority and final gate receipts.
 
 ## YOUR OUTPUTS
 
-Produce stack.md with alternatives and requirement mapping; source and generated
+Produce stack.md with alternatives and requirement mapping; coding-standards.md
+with current selected-stack rules and source evidence; source and generated
 artifact at implementation_root; reproducible build/tests, QA evidence, response
 headers, audit/AUDIT_BRIEF.md with ROUND 1 dispositions, release receipt/rollback
 identity, and SITE_OPERATIONS.md. Name what watches the site, including nothing.
@@ -900,8 +910,9 @@ learned rules, source IDs, and applied checks. A proposal is not a completed sav
 
 ## YOUR GATE
 
-Before coding, require selected mockup plus current sourced research. Validate
-fallible data, context-specific escaping, script terminators, URL schemes, empty IDs,
+Before coding, require selected mockup, current sourced research, and saved/read-back
+coding-standards.md. Apply checklists/code-quality.md to the candidate before handoff.
+Validate fallible data, context-specific escaping, script terminators, URL schemes, empty IDs,
 and shared state. Prove the next repeated page is a data change. Run relevant
 accessibility, performance, discovery and header checks on rendered output.
 Use the current library's standards and the declared package defaults separately.
@@ -1109,12 +1120,14 @@ disagreements.md, unresolved-claims.md, and staleness.md in that same directory.
 Verify the research gate and current revision before doing your job. Then read
 site-work/research/library/01-codebases-and-stacks.md,
 04-accessibility-and-performance.md, 05-search-and-answers.md,
-06-security-and-delivery.md, and 03-graphics-and-rights.md for rights checks.
+06-security-and-delivery.md, 08-languages-and-code.md, and
+03-graphics-and-rights.md for rights checks. Read site-work/coding-standards.md.
 Read all applicable library checklists, especially 06-accessibility.md,
-10-security.md and 13-legal.md. Read prompts/10-adversarial-pre-ship.md,
+10-security.md, 13-legal.md, and 14-code.md. Read prompts/10-adversarial-pre-ship.md,
 playbooks/data-and-templates.md, playbooks/security-headers.md,
-playbooks/accessibility.md, checklists/build.md, checklists/accessibility.md,
-checklists/security.md, checklists/ship.md, and templates/audit-brief.md.
+playbooks/accessibility.md, checklists/build.md, checklists/code-quality.md,
+checklists/accessibility.md, checklists/security.md, checklists/ship.md,
+and templates/audit-brief.md.
 Return your learning receipt with opened files, assumptions challenged, and checks.
 
 ## WHAT YOU MUST RESEARCH
@@ -1185,6 +1198,9 @@ Old dates may appear only as explicit history alongside current validated access
 Treat a confident undated claim as a finding, not a detail. Verify source dates,
 ladder provenance, due domains and later-day rechecks; return violations read-only.
 Check actual different-family evidence and the precise artifact reviewed. Challenge
+the code against checklists/code-quality.md and site-work/coding-standards.md,
+including pinned versions, deprecated APIs, support, commands, dependencies, secure
+coding, organization, and Builder's code-review evidence. Challenge
 input/URL/script escaping, empty IDs, shared state, auth and secrets where applicable,
 headers, rendered discovery, accessibility journeys, and assumptions in the brief.
 Return enough evidence for Builder to reproduce each asserted defect; otherwise
@@ -1353,6 +1369,7 @@ same-calendar-day currency. A decision explicitly requiring that proof stays BLO
 | 11. Hosting, deploy and DNS | Same-day check for platform capabilities, plan prices/restrictions, header syntax and deploy configuration; 90 days for DNS fundamentals. | Commercial limits and deployment contracts change quickly; name-resolution principles change slowly. Recheck the actual target before release. |
 | 12. Measurement | 30 days for setup and interpretation guidance; same-day check for selected event APIs, consent settings and receiving-property behavior. | Statistical caveats persist; vendor interfaces and active configuration do not. Changed instrumentation or property triggers verification. |
 | 13. Legal, kept light | Same-day check for exact font/stock/AI tool licenses and intended-use rights; 30 days for background guidance. | Rights attach to a particular asset, version and tier; a previously allowed use is not evidence for a new use. Changed terms or jurisdiction triggers review. |
+| 14. Languages and coding practice | Same-day check for selected language, runtime and framework versions, Baseline status of features in use, and security advisories; 30 days for testing, linting and tooling guidance; 365 days for fundamentals such as semantic HTML and structural escaping. | Language support, framework idioms and advisories can change during a build; stable semantics and escaping principles need less repetition. A selected-version, browser-target or security change triggers an earlier recheck. |
 
 - Versioned standards: identify the authoritative current release as of ASK DATE and at each scheduled refresh; record release/version, target level, source and applicability. An old but still-current standard is not stale merely because its publication is old. A new relevant release triggers review before reuse even inside a nominal window.
 - Staleness artifact: generate this full table into `staleness.md`, add all applicable claims, original accesses, last revalidations, window/expiry, trigger, reason, owner and dependent receipts. Name the earliest-expiring applicable domain (all ties), its window, and concrete recheck date with the ASK DATE-relative expression. Same-day domains are due before use that day. Do not average domain windows or let a slow domain hide a fast subclaim.
@@ -1507,7 +1524,7 @@ site-work/
     library/                              Researcher-owned canonical library.
       README.md                           Dated index, headline findings, role reading map.
       scope.md                            ASK DATE, ladder rung/raw evidence, workspace root, request, tools, applicability.
-      coverage.md                         Thirteen domains, files, checklist and source coverage.
+      coverage.md                         Fourteen domains, files, checklist and source coverage.
       01-codebases-and-stacks.md           Domains 1 and 2; code reads and current stacks.
       02-design-and-experience.md          Domains 3 and 5; design and UI/UX.
       03-graphics-and-rights.md            Domains 4 and 13; graphics and light legal.
@@ -1515,6 +1532,7 @@ site-work/
       05-search-and-answers.md             Domains 8 and 9; SEO and AEO.
       06-security-and-delivery.md          Domains 10 and 11; threats, hosts, deploy, DNS.
       07-measurement-and-operations.md     Domain 12; analytics and operational follow-through.
+      08-languages-and-code.md             Domain 14; language support, coding practice and verification.
       sources.md                          Claim IDs, opened URLs, source/access dates, scope.
       receipts/
         <CLAIM-ID>.md                     Per-claim page fetch fields and verbatim supporting excerpt.
@@ -1524,7 +1542,7 @@ site-work/
       how-to-read-a-brand-kit.md           Evidence into checkable design decisions.
       website-qa-checklist.md              Cross-domain blocker-first index of applied checks.
       surprises.md                        Short findings and implications for the user.
-      staleness.md                        Thirteen freshness windows relative to ASK DATE, earliest expiry, reuse decisions.
+      staleness.md                        Fourteen freshness windows relative to ASK DATE, earliest expiry, reuse decisions.
       learning.md                         Opened evidence, learned rules, applied checklist IDs.
       recipes.md                          Commands that actually ran, with tool version and what they produced.
       memory-proposal.md                  Durable rules and location, not a completed save.
@@ -1543,6 +1561,7 @@ site-work/
         11-hosting.md                     Preview, DNS, HTTPS, rollback, plan restrictions.
         12-measurement.md                 Receiving-property proof and interpretation limits.
         13-legal.md                       Font, stock, AI imagery, trademark evidence.
+        14-code.md                        Supported features, tests, tooling, dependencies and secure code.
     coordinator/                          Coordinator top-ups, flags, learning and QA receipts.
     designer/                             Designer top-ups, flags, learning and QA receipts.
     graphics/                             Graphics top-ups, flags, learning and QA receipts.
@@ -1555,7 +1574,7 @@ site-work/
   MEMORY.md                               Coordinator's consolidated durable-memory proposal.
 ```
 
-- Coverage: map all thirteen domains to grouped files, source claims, checks, and downstream owners.
+- Coverage: map all fourteen domains to grouped files, source claims, checks, and downstream owners.
 - Exclusions: survey every domain; justify any project-specific NOT APPLICABLE check.
 - Checklists: each domain check names criterion, method, expected evidence, claim IDs, owner, status, and exclusion reason.
 - Blockers: website-qa-checklist.md collects unresolved critical checks before quality scoring.
@@ -1662,6 +1681,8 @@ Never report a measured, saved, installed, or deployed result without evidence.
 
 ## Manual fallback
 
+TEAM: one command installs the seven workers' files; you open each session yourself and carry the handoffs between them. Researcher goes first. This manual relay is the TEAM workflow.
+
 **Prepare the files and workspace**
 
 - Get the complete `docs/bundles/team.md`, `method.md`, `prompts.md`, `playbooks.md`, and `checklists.md` from the same release. The team bundle contains the seven complete role bodies and this guide; the prompts bundle contains active prompts.
@@ -1684,7 +1705,7 @@ Never report a measured, saved, installed, or deployed result without evidence.
 **Connect the group and verify its routes**
 
 - If your account exposes group creation, create `Website Design` and add the seven saved Bots in the same order, Researcher first. Record the actual route for each. Verify one bounded setup message reaches the intended recipient using the host's documented addressing controls.
-- If group routing or automated handoff is unavailable, use separate Bot chats and relay each handoff and its attachments manually. Keep distinct workers on separate routes; separate workers need separate routes, and labels inside one chat stay one worker. Ordinary single-chat work uses SOLO.
+- Use separate Bot chats and relay each handoff and its attachments manually, including when the account offers a group view. Keep distinct workers on separate routes; separate workers need separate routes, and labels inside one chat stay one worker. Ordinary single-chat work uses SOLO.
 - If group messages are text-only, attach mockups and assets directly to the receiving Bot. Image review needs the Bot to open the image itself; a text path alone gives it only the path, so confirm the receiving Bot can inspect the image directly.
 - Give Coordinator this complete contract after replacing each angle-bracket route with the real saved Bot/chat reference. Unresolved placeholders keep setup incomplete.
 
@@ -1716,7 +1737,7 @@ with Builder's route/content inputs. Send the fixed final candidate to Reviewer
 only after pre-review gates pass. Different-family review remains mandatory.
 Read every returned artifact. Preserve Reviewer returns unchanged. Use every field
 in templates/handoff.yaml and record gate acceptance only in site-work/status.md.
-If routing fails, return the complete addressed packet for me to relay manually.
+Return every complete addressed packet for me to relay manually.
 ```
 
 **Trigger the first work handoff**
@@ -1728,7 +1749,7 @@ Begin user-request-to-researcher. You are the first working agent.
 My site request: <paste the actual audience, main action, pages, and known constraints>
 My authorized project workspace: <chosen workspace>
 Supplied materials: <attach any existing brief, brand materials, or source links>
-Use your full role and prompts/01-website-deep-research.md to cover all thirteen
+Use your full role and prompts/01-website-deep-research.md to cover all fourteen
 research domains current as of the ASK DATE. Ask for only missing inputs needed to research.
 Write the grouped library, README headlines, per-domain checklists, source/date and
 disagreement ledgers, surprises, memory proposal/receipt, and staleness schedule.
@@ -1737,11 +1758,11 @@ leave the research gate BLOCKED. If you cannot save files, return named file bod
 for me to save and reattach; wait for read-back before passing the disk gate.
 Pass only when the saved library covers every touched domain and every claim we
 will act on has an opened source URL, a publication/update date or explicit unknown, and an access date on or after the ASK DATE. Read back the actual saved files before confirming persistence.
-Then send research-to-coordinator to <actual Coordinator route> using all handoff
-fields and readable artifacts. No other role starts before this research gate.
+Then return research-to-coordinator addressed to <actual Coordinator route> for me
+to relay, using all handoff fields and readable artifacts. No other role starts before this research gate.
 ```
 
-- First receipt: Researcher supplies `site-work/handoffs/researcher/research-<revision>.yaml` and its library. If automatic delivery fails, copy the whole receipt and attach the library to Coordinator yourself.
+- First receipt: Researcher supplies `site-work/handoffs/researcher/research-<revision>.yaml` and its library. Copy the whole receipt and attach the library to Coordinator yourself.
 - First acceptance: Coordinator opens the files, checks coverage and source dates, and writes PASS or BLOCKED in `site-work/status.md`. Only PASS releases downstream scope handoffs.
 - First design: Designer and Graphics read their named library files, return learning/top-up receipts, and apply their domain checklists. They open the evidence behind the research summary before starting.
 - Persistence: preserve the files and receipts, and reattach the current revision in each new session. Carry state in the saved files, since a Bot may not remember a group chat. A durable-memory proposal remains pending until an actual supported save is read back.
@@ -1750,6 +1771,8 @@ fields and readable artifacts. No other role starts before this research gate.
 ## Artifact ownership roster
 
 ```yaml
+# TEAM: one command installs the seven workers' files; you open each session yourself and carry the handoffs between them. Researcher goes first.
+# This roster records ownership and handoff fields for the human to relay.
 schema_version: 1
 team: website-design-team
 coordinator: coordinator
@@ -1779,7 +1802,7 @@ roles:
     owns: [graphics, research/graphics, handoffs/graphics]
   builder:
     instructions: roles/builder.md
-    owns: [stack.md, build, qa/build, qa/site-audit.md, qa/accessibility.md, qa/contrast.md, qa/security-headers.md, audit, release, research/builder, handoffs/builder]
+    owns: [stack.md, coding-standards.md, build, qa/build, qa/site-audit.md, qa/accessibility.md, qa/contrast.md, qa/security-headers.md, audit, release, research/builder, handoffs/builder]
     external_owns: [implementation_root, implementation_root/SITE_OPERATIONS.md]
   optimizer:
     instructions: roles/optimizer.md

package/docs/evaluation/host-gate.md

@@ -0,0 +1,129 @@
+# Manual host gate
+
+Status: NOT RUN. This document defines the work behind the explicit live-host skips.
+Live host behaviour is verified by receipts, not by `npm test`. The suite reports these
+items as skipped until a contributor supplies the required observations.
+
+## Automated distribution boundary
+
+Run from the package checkout:
+
+```sh
+node --test test/packed-artifact.test.mjs
+npm run check
+npm test
+```
+
+The packed-artifact test packs this revision, installs the tarball into a temporary
+consumer's `node_modules`, resolves the installed bin there, and runs SOLO and TEAM
+against empty destinations. It checks file trees, bytes, receipts and uninstall.
+The repository check workflow schedules it on `ubuntu-latest`, `macos-latest` and
+`windows-latest`. A configured matrix is a check to run; its results require CI evidence.
+The stable Repository checks job requires every matrix entry to succeed.
+
+Host discovery, upload controls, model behaviour and session permissions need the manual
+checks below. The repository currently builds bundles and an npm tarball; it has no ZIP
+production step. GitHub source archives and manually prepared skill ZIPs use the ZIP gate.
+
+## Hosts and operating systems
+
+Run each applicable item on the exact host, client version and OS whose compatibility
+claim you intend to make. Use Linux, macOS and Windows for any claim covering all three;
+keep unavailable host/OS combinations UNVERIFIED with a reason. A browser trial also
+records browser version and account controls available during that trial.
+
+| Host | Setup and loading instructions | Modes to observe |
+| --- | --- | --- |
+| Claude Code | [Adapter](../../adapters/claude-code.md) | SOLO and separately TEAM |
+| Codex | [Adapter](../../adapters/codex.md) | SOLO and separately TEAM |
+| Hermes | [Adapter](../../adapters/hermes.md), including explicit alias and trust checks | SOLO and separately TEAM |
+| Antigravity | [Adapter](../../adapters/antigravity.md) | SOLO and separately TEAM |
+| Grok Bot | [Adapter](../../adapters/grok.md), including attachment and manual relay controls | SOLO and separately TEAM |
+| Claude Desktop | [Adapter](../../adapters/claude-desktop.md), including skill ZIP upload where exposed | SOLO; record any separate-session TEAM trial separately |
+| ChatGPT Project | [Adapter](../../adapters/chatgpt-project.md) | SOLO; record any separate-session TEAM trial separately |
+| Custom GPT | [Adapter](../../adapters/custom-gpt.md) | SOLO; record any separate-session TEAM trial separately |
+| Generic file-reading agent | [Adapter](../../adapters/agents-md.md); name the actual client | SOLO; record any separate-session TEAM trial separately |
+
+TEAM installs seven workers' files in one command; you open each session yourself and
+carry the handoffs between them. Researcher goes first. Retain all seven setup
+acknowledgements separately from the research receipt and later work receipts.
+
+## Skipped item: live AD01-AD09 behaviour
+
+Test title: `Live AD01-AD09 behavior: ladder evidence, clock override, no-search blockage, stale claims, derived floors and multi-day expiry`.
+
+1. Use a fresh synthetic project on each claimed host/OS above. Follow the
+   [host trial](host-trial.md) to install, explicitly load the skill and record tool access.
+2. Run every case in `test/fixtures/ask-date-cases.md` from the matching source checkout
+   (test fixtures are checkout-only files).
+   Follow [AD01-AD09](../../skills/website-build-skill/checklists/research.md) and the
+   [ASK DATE rule](../../skills/website-build-skill/playbooks/research-and-memory.md#ask-date-rule)
+   for the expected boundary, including the independent AD09 review.
+3. Record the supplied input, actual tool evidence and observed response for each case.
+   Retain date ladder failures, conflicting clock evidence, absent search, stale claims,
+   derived floors and multi-day expiry observations. A fixture's expected answer is a
+   criterion, not an observation. Identify simulated tools separately from live tools;
+   a simulation cannot establish the live capability it replaces.
+4. Save scope, library, source receipts, gate output and transcript excerpts. Mark each
+   AD check PASS, FAIL, BLOCKED or NOT APPLICABLE with its evidence and reason. A missing
+   different-family Reviewer leaves AD09 BLOCKED.
+
+## Skipped item: per-host npm and ZIP distribution
+
+Test title: `Planned distribution: fresh npm tarball and ZIP installation on each claimed operating system and host`.
+The npm file-install portion is automated above; this skip covers actual host loading
+from that installation and ZIP extraction/upload on the host/OS combinations claimed.
+
+1. From the revision being evaluated, run `npm pack --json --ignore-scripts --pack-destination <existing-temp-directory>`.
+   Save the JSON report and the tarball digest. In a separate empty consumer, run
+   `npm init -y`, then `npm install --ignore-scripts --no-audit --no-fund <absolute-tarball-path>`.
+2. Run the consumer's installed bin, substituting the adapter target and a fresh absolute
+   trial directory. Repeat with `--team` in another empty trial directory:
+
+   ```sh
+   node node_modules/website-build-skill/bin/website-build-skill.mjs --solo --target codex --dir <trial-directory> --yes
+   ```
+
+   Compare receipt paths and hashes with the disk. Open the actual host in the trial
+   directory and follow its loading check. Record explicit file reads separately from
+   native discovery. Verify accessible assets, preserved existing instructions and
+   error/conflict behaviour in separate synthetic fixtures.
+3. For a GitHub source ZIP, download the archive for that exact commit, record its URL
+   and digest, extract it into an empty directory and follow the adapter's manual copy
+   or bundle-attachment steps. Verify manifest hashes and loaded resources.
+4. For a skill-upload ZIP, create an archive containing one complete
+   `website-build-skill/` directory from `skills/website-build-skill/`, with manifest and
+   relative assets. Record the packaging command/tool version, layout and digest.
+   Upload using the actual account controls described by the adapter and confirm each
+   loaded resource. Record absent upload controls as BLOCKED for that route. Source
+   archives and skill-upload ZIPs are distinct artifacts and need separate results.
+5. Save installer output, receipt, installed file/digest inventory, exact invocation,
+   host transcript and observed limits. Use the [full trial](host-trial.md) separately
+   before making a website-outcome claim.
+
+## Receipt and acceptance
+
+Copy [receipt-template.json](receipt-template.json) into the private trial workspace.
+Fill its fields from observations, including:
+
+- Identity: trial ID, package commit, artifact filename and SHA-256, host/client version,
+  OS/version, runtime and actual model family, mode, invocation and start/end times.
+- Commands: exact commands, working-directory roles, exit codes and relevant output.
+- Boundaries: each skipped item and AD check attempted, expected and observed behaviour,
+  status, and links to transcript excerpts, installed receipts and supporting files.
+- Negative trials: missing tools, conflicts and other failures actually exercised.
+- Review: candidate digest, actual reviewer family, findings and reproduced dispositions.
+- Limits: untested host/OS/mode combinations and unavailable controls; reproduction steps.
+
+Add artifact metadata to `artifacts` and per-case observations to `boundaries`; preserve
+unknown values as null. Sanitize private paths, account identifiers and credentials.
+Save the receipt as `docs/evidence/host-gate-<trial-id>.json` and its supporting artifacts
+under `docs/evidence/host-gate-<trial-id>/`. A reviewer reopens those artifacts before
+accepting the result. Keep failed and blocked receipts alongside successful ones.
+
+Each skipped item advances to either a real executable test for the behaviour it can
+assert, or a linked, reviewed receipt for the exact host/OS/mode observed. A receipt may
+be linked beside a retained skip for combinations still awaiting trials. A skipped test
+is never converted to a pass by editing its label, removing `skip`, or adding an empty
+passing body. `npm test` alone establishes no live-host result. Promote compatibility
+only for the observed scope under the [host-trial evidence rules](host-trial.md#publish-evidence-and-promote-narrowly).

package/docs/evaluation/host-trial.md

@@ -2,6 +2,8 @@
 
 Status: NOT RUN. This protocol is an acceptance test, not evidence of host support.
 A passing repository test suite or a copied skill folder cannot promote this status.
+Use the [manual host gate](host-gate.md) for the suite's live-host skips, per-OS loading
+checks, ZIP trials and required receipts.
 
 ## Scope and authority
 
@@ -14,7 +16,8 @@ Use a local preview. Production release and live-host checks remain BLOCKED.
 The operator supplies the visual selection and a separate model family for review.
 If either is unavailable, record the exact boundary reached; do not manufacture a PASS.
 The first useful milestone is one complete SOLO local-preview trial on one named host.
-TEAM requires a separate trial with seven observed routes and cannot inherit that result.
+TEAM requires a separate trial with seven sessions the human opens and handoffs they
+carry, with Researcher first; it cannot inherit the SOLO result.
 
 ## Prepare and invoke