website-build-skill 0.1.6 → 0.1.8

package/.claude-plugin/plugin.json

@@ -1,10 +1,33 @@
 {
   "name": "website-build-skill",
-  "version": "0.1.6",
-  "description": "A skill pack that teaches your AI current website-building expertise: research, design, code, accessibility, performance, search and security.",
+  "version": "0.1.8",
+  "description": "A skill pack that turns your AI into an expert website builder: current research, design, code, accessibility, speed, SEO and security, alone or as a team.",
   "author": {
     "name": "website-build-skill contributors"
   },
   "repository": "https://github.com/aunysillyme/website-build-skill",
-  "license": "MIT"
+  "license": "MIT",
+  "homepage": "https://github.com/aunysillyme/website-build-skill",
+  "keywords": [
+    "agent-skills",
+    "ai-skills",
+    "llm-skills",
+    "claude-skills",
+    "skill-pack",
+    "web-design",
+    "web-development",
+    "claude-code",
+    "codex",
+    "chatgpt",
+    "grok",
+    "antigravity",
+    "multi-agent",
+    "accessibility",
+    "web-performance",
+    "seo",
+    "aeo",
+    "design-systems",
+    "brand-design",
+    "research-workflow"
+  ]
 }

package/CHANGELOG.md

@@ -6,6 +6,23 @@ Version policy: [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html)
 
 ## [Unreleased]
 
+## [0.1.8] - 2026-09-26
+
+### Added
+
+- Web design review in the existing checks. BM05 now names common template tells (gradient heading text, side-stripe card borders, the generic purple-to-blue palette, nested cards, icon-tile stacks, bounce easing, decorative numbered labels, thin border with a wide soft shadow) and contextual landing-page layout defaults. A recorded brand decision overrides each default, and text expansion, zoom and reflow always win.
+- CQ06 checks design-token drift and repeated copy-paste shortcuts, and asks that findings be verified in source before they are reported. B08 replays the chosen layout defaults on the built page at the recorded mobile and desktop viewports.
+- Prompt 04 opens with a one-line design read (page type, audience, direction) and points to BM05.
+- `docs/PROVENANCE.md` credits the techniques to Impeccable (Apache-2.0) and Taste Skill (MIT). No upstream text was copied and no dependency was added.
+
+## [0.1.7] - 2026-09-25
+
+### Changed
+
+- Grok Bot has its own setup in the Grok adapter, written from xAI's Grok Bot documentation (read 2026-09-25) and the operator's own use: install the package into `/workspace`, save it as a private skill, and run TEAM as a six-Bot group with Reviewer outside Grok Bot, since every Bot runs on Grok. Grok Bot stays a documented setup with no trial receipt ([#15](https://github.com/aunysillyme/website-build-skill/issues/15)).
+- The shared manual fallback no longer names an instruction field or a seven-Bot group; it points to where each host keeps standing instructions and respects the host's group limit.
+- One description everywhere: `package.json`, the GitHub About box, npm and `.claude-plugin/plugin.json` now carry the same line, which matches the README lead and names the solo or team choice. The plugin manifest also gains the homepage and keywords.
+
 ## [0.1.6] - 2026-09-24
 
 ### Added

package/REPO_SETTINGS.md

@@ -7,9 +7,9 @@ trusting any row; a checklist is only as current as its last read.
 
 ## Description
 
-- [x] Repository description set to this one line, identical to package.json and npm. Read back 2026-09-23; it matches.
+- [x] Repository description set to this one line, identical to package.json, .claude-plugin/plugin.json and npm. Set 2026-09-25 in 0.1.7.
 
-Skills that make your AI an expert website builder: current research, design, accessibility, performance, SEO, security and code, for any LLM or agent.
+A skill pack that turns your AI into an expert website builder: current research, design, code, accessibility, speed, SEO and security, alone or as a team.
 
 ## Topics
 

package/adapters/grok.md

@@ -7,7 +7,7 @@ See [compatibility](../docs/COMPATIBILITY.md) for setup evidence and host trials
 
 - SOLO: paste the starter in [zero-install](zero-install.md), or give a file-capable session the complete canonical skill.
 - TEAM: install or attach all five [bundles](../docs/bundles/team.md), open the seven sessions yourself, then paste the setup request below in each session.
-- Native skill (Grok Build CLI): install with `--target grok`, which writes `.grok/skills/website-build-skill/`, then trust the project folder (accept the trust prompt, or run `grok --trust` there once). Grok Build offers project skills only in a trusted folder. Native loading was tested on Grok Build CLI 1.0.40 (macOS, SOLO, trusted folder, 2026-09-24; one run, limitations in the [receipt](../docs/evidence/host-trial-grok-build-2026-09-24.json)); `grok inspect --json` lists the skill with source `project` when it is available to you. Grok Bot (the Bots app) is awaiting its own trial. Current status: [compatibility](../docs/COMPATIBILITY.md).
+- Native skill (Grok Build CLI): install with `--target grok`, which writes `.grok/skills/website-build-skill/`, then trust the project folder (accept the trust prompt, or run `grok --trust` there once). Grok Build offers project skills only in a trusted folder. Native loading was tested on Grok Build CLI 1.0.40 (macOS, SOLO, trusted folder, 2026-09-24; one run, limitations in the [receipt](../docs/evidence/host-trial-grok-build-2026-09-24.json)); `grok inspect --json` lists the skill with source `project` when it is available to you. Grok Bot is a separate app with its own setup, below. Current status: [compatibility](../docs/COMPATIBILITY.md).
 - Independence: workers from one model family leave the independent release gate BLOCKED.
 - Reference: [Bot setup](https://docs.x.ai/grok-bot/bots), [collaboration](https://docs.x.ai/grok-bot/chat-and-collaboration), [skills](https://docs.x.ai/build/features/skills-plugins-marketplaces). Use these references when checking the installed controls.
 
@@ -15,6 +15,32 @@ See [compatibility](../docs/COMPATIBILITY.md) for setup evidence and host trials
 Give me the team (option 2). I open each session myself and carry the handoffs between them, with Researcher first. Use the attached team.md and the complete role body for this session. Return its setup acknowledgement with session reference, model family and tool limits. I collect seven acknowledgements through the manual setup below. Give my request to Researcher first; every other worker waits for the saved-library gate. Use a reviewer from a different model family for independent review.
 ```
 
+## Grok Bot
+
+Grok Bot is the Bots app (desktop, iPhone and Android). It keeps skills in its own private skill library, so `--target grok` does not reach it. This setup follows xAI's [Grok Bot documentation](https://docs.x.ai/grok-bot/overview), read 2026-09-25; no trial receipt exists yet, so treat each step as the documented route and confirm it on your account.
+
+**What the app gives you**
+
+- One private skill library shared by all your Bots. Type `/` in the composer to use a saved skill; if one is missing, open **Marketplace → Your plugins → Manage plugins and skills** and look under **Private skills**.
+- One shared cloud computer for all your Bots, with a browser, a command line and a `/workspace` folder every Bot can read. Keep `site-work/` there.
+- Bots with their own conversation and memory. A Bot's standing rules live in its profile **description**.
+- Group chats of two to six Bots, `@` mentions, and direct Bot-to-Bot handoffs. Handoffs posted to a group are text only, so a Bot sends an image directly to the Bot that must inspect it.
+- Up to six attachments per message, 25 MB per document.
+- Every Bot runs on Grok: there is no model picker (reported by the operator, 2026-09-25). A reviewer from a different model family therefore sits outside Grok Bot.
+
+**SOLO**
+
+1. Choose **New** (`Cmd/Ctrl+N`), then **Create new Bot**, and use **Edit Profile** to name it `Website Builder`.
+2. Ask it to install the package into `/workspace` and learn it as a skill: `Run npx website-build-skill@latest --solo --target portable --dir /workspace/website-build-skill --yes, read /workspace/website-build-skill/.website-build-skill/SKILL.md, and save it as a private skill called website-build-skill that reads the files beside it.` The Bot learns the skill and keeps it across conversations (reported by the operator, 2026-09-25).
+3. Type `/` and confirm `website-build-skill` is listed. If it is missing, attach the five [bundles](../docs/bundles/team.md) to your first message and ask the Bot to keep them in `/workspace/website-build-skill/`.
+4. Start the build with `/website-build-skill` and your site request.
+
+**TEAM**
+
+- Create six Bots in the order below (Researcher, Coordinator, Designer, Graphics, Builder, Optimizer). Save each role body from the [team bundle](../docs/bundles/team.md) to `/workspace/site-work/roles/<role>.md` and write in each description: `You are Website <Role>. Before every task, read /workspace/site-work/roles/<role>.md and follow it.`
+- Put those six in one group, Researcher first. A Bot keeps its memory, skills and context when it joins a group (reported by the operator, 2026-09-25). Six is the group limit, and it fits: the seventh role, Reviewer, needs a different model family, so it runs outside Grok Bot and you relay the final packet to it.
+- Follow the steps below for setup acknowledgements, the research gate and the handoff contract. Since every Bot reads `/workspace`, pass file paths in handoffs rather than reattaching files.
+
 ## Manual fallback
 
 TEAM: one command installs the seven workers' files; you open each session yourself and carry the handoffs between them. Researcher goes first. This manual relay is the TEAM workflow.
@@ -24,7 +50,7 @@ TEAM: one command installs the seven workers' files; you open each session yours
 - Get the complete `docs/bundles/team.md`, `method.md`, `prompts.md`, `playbooks.md`, and `checklists.md` from the same release. The team bundle contains the seven complete role bodies and this guide; the prompts bundle contains active prompts.
 - Get `skills/website-build-skill/archive/graphics-design-original.md` separately for Researcher's provenance reading. Keep its inactive header and do not execute its historical save instructions.
 - Choose the private project workspace where `site-work/` will live. Keep its research and brand files out of the public skill repository and deployment output.
-- Open your host's Bots area. Use **New** to create one Bot at a time; set its name and paste the entire named role body into its instruction field, then save. These are semantic field instructions; exact field labels in your account must be checked. If **New**, the instruction field or group controls are absent, use separate chats and relay the complete role packets manually rather than inventing an API.
+- Open your host's Bots or agents area and create one worker at a time. Give each the entire named role body wherever your host keeps standing instructions (in Grok Bot, a role file in `/workspace` that the description points to, as in [Grok Bot](grok.md#grok-bot)), then save. If your host has no such place, use separate chats and relay the complete role packets manually rather than inventing an API.
 - Give each Bot the method, prompt, playbook and checklist bundles as files or pasted text through controls your account actually provides. If a filename inside an instruction is inaccessible, attach or paste that file's contents with its label before work starts. Confirm file access separately for each Bot.
 - Request only a setup acknowledgement: name, received role, route, actual model family if known, tools, and inaccessible files. For all Bots except Researcher add: `Wait for the research gate; do not begin your role yet.` Pass each work gate using its own required evidence.
 
@@ -40,7 +66,7 @@ TEAM: one command installs the seven workers' files; you open each session yours
 
 **Connect the group and verify its routes**
 
-- If your account exposes group creation, create `Website Design` and add the seven saved Bots in the same order, Researcher first. Record the actual route for each. Verify one bounded setup message reaches the intended recipient using the host's documented addressing controls.
+- If your host offers group chats, create `Website Design` and add the saved workers in the same order, Researcher first, up to the host's group limit (six in Grok Bot, where Reviewer runs outside the group). Record the actual route for each. Verify one bounded setup message reaches the intended recipient using the host's documented addressing controls.
 - Use separate Bot chats and relay each handoff and its attachments manually, including when the account offers a group view. Keep distinct workers on separate routes; separate workers need separate routes, and labels inside one chat stay one worker. Ordinary single-chat work uses SOLO.
 - If group messages are text-only, attach mockups and assets directly to the receiving Bot. Image review needs the Bot to open the image itself; a text path alone gives it only the path, so confirm the receiving Bot can inspect the image directly.
 - Give Coordinator this complete contract after replacing each angle-bracket route with the real saved Bot/chat reference. Unresolved placeholders keep setup incomplete.

package/docs/COMPATIBILITY.md

@@ -32,7 +32,7 @@ when its receipt demonstrates loading, file access, tool permissions and the sel
 | Codex | [Skill and explicit router](../adapters/codex.md) | Shared destination, role configuration and actual model family | [Skills](https://learn.chatgpt.com/docs/build-skills) |
 | Hermes | [Skill and separate sessions](../adapters/hermes.md) | Trust, alias semantics, routes and inherited permissions | [Skills](https://hermes-agent.nousresearch.com/docs/user-guide/features/skills) |
 | Antigravity | [Explicit core pointer](../adapters/antigravity.md) | Schema, paths, quoted off, routing and denied writes | [Subagents](https://antigravity.google/docs/subagents) |
-| Grok Bot | [Bundles and manual roles](../adapters/grok.md) | Account controls, routes and image relay | [Bots](https://docs.x.ai/grok-bot/bots) |
+| Grok Bot | [Private skill and six-Bot group](../adapters/grok.md#grok-bot), from the xAI docs read 2026-09-25 | `/` lists the saved skill, role files in `/workspace`, group routes; Reviewer outside Grok Bot | [Bots](https://docs.x.ai/grok-bot/bots) |
 | Claude Desktop | [Bundle attachments](../adapters/claude-desktop.md) | Account upload controls and loaded resources | [Skills](https://support.claude.com/en/articles/12512180-use-skills-in-claude) |
 | ChatGPT Project/custom GPT | [Instructions and bundles](../adapters/chatgpt-project.md) | File access, tool availability and state reattachment | [Projects](https://help.openai.com/en/articles/10169521-projects-in-chatgpt) |
 | Generic file-reading agent | [Explicit core pointer](../adapters/agents-md.md) | Router read-back and preserved instructions | [Adapter](../adapters/agents-md.md) |

package/docs/PROVENANCE.md

@@ -13,6 +13,20 @@ Reported historical measurements are not repeated as package evidence.
 Original package work uses [MIT](../LICENSE). The conduct text retains its own attribution and license.
 No third-party site screenshots, fonts or brand kits are included.
 
+## Design review techniques
+
+Two techniques adapted (own wording, not copied text) into checklists/brand-and-mockups.md (BM05),
+checklists/code-quality.md (CQ06), checklists/build.md (B08) and prompts/04-three-mockups.md:
+
+- Design Read (recording page type, audience and intended visual direction before judging a design)
+  and contextual landing-page layout defaults: adapted from Taste Skill,
+  [github.com/Leonxlnx/taste-skill](https://github.com/Leonxlnx/taste-skill), commit
+  `ce26fc25c0e5e8cab638f883de62d9a86ee5e45b`, MIT licence.
+- A named template-tell check (signs of generic AI-template output) and separating measurable
+  findings from visual judgment with in-context verification: adapted from Impeccable,
+  [github.com/pbakaus/impeccable](https://github.com/pbakaus/impeccable), commit
+  `9d715cc4f5564a990ca8345abfdd5df6dc9b41c8`, Apache-2.0 licence.
+
 ## Reference ledger
 
 These links are research entrypoints, not evidence that this package was loaded in a client.

package/docs/bundles/checklists.md

@@ -160,7 +160,7 @@ Date rule: [ASK DATE, source evidence, and revalidation](../../skills/website-bu
 | BM02: provenance and conflicts | A screenshot estimate is called exact, an inference becomes approved, or conflicting accents are silently collapsed. | Inspect original approved assets and styles; record each value's source, method, confidence, role, and explicit conflict disposition in BRAND.md and tokens.json. |
 | BM03: computed brand contrast | Any contrast claim lacks a computed ratio or ignores a relevant composited state. | Apply accessibility.md AX01 to brand/contrast.md; require tool, actual colors, size/weight, criterion, raw ratio, and result for text/actions/focus. |
 | BM04: three visual directions | Fewer than three inspectable directions, recolored copies, or text wireframes presented as mockups. | Open one image file (PNG, JPEG, WebP or SVG) per direction and viewport (desktop and mobile), plus comparison.md. A static HTML preview is optional; text alone fails BM04. Compare hierarchy, density, type, composition, imagery, and useful interaction with the same representative content. |
-| BM05: stress and visual fit | Only a short desktop hero was inspected. | Review long headline, dense content, mobile layout, primary CTA, focus and reduced-motion intent; record screenshots and specific findings per direction. |
+| BM05: stress and visual fit | Only a short desktop hero was inspected. | Review long headline, dense content, mobile layout, primary CTA, focus and reduced-motion intent; record screenshots and specific findings per direction. Also check for template tells (gradient text on headings, a side-stripe accent border on cards, the generic purple-blue AI palette, cards nested in cards, icon-tile stacks, bounce/elastic easing, decorative numbered section labels, thin border plus wide soft shadow) and contextual landing-page layout defaults (desktop headline about two lines, short supporting copy, restrained nav height, no long run of identical section layouts, one CTA label per intent, grid cell count matching real content); record the chosen viewport and any approved brand-decision exception, and yield to text expansion, zoom and reflow. |
 | BM06: user selection before code | A guessed approval, unnamed choice, or website scaffolding/markup precedes a named selection. | Read the user's actual decision and selection.md, approved brand revision, and stage chronology. Three visuals and a selected revision are mandatory. |
 | BM07: assets and rights | Released assets lack exact intended-use rights, measured dimensions, or inspected crops/exports. | Read Graphics' authoritative rights ledger and immutable asset manifest; inspect dimensions, compression, safe zones, font embedding/subsetting notices, and alt intent. |
 | BM08: handoff ownership | Designer changes Graphics' rights ledger, or Builder receives unversioned inputs. | Compare ownership, source revisions, asset requests, selected-design receipt, and Coordinator acceptance. Preserve producer originals. |
@@ -213,7 +213,7 @@ Date rule: [ASK DATE, source evidence, and revalidation](../../skills/website-bu
 | B05: context-safe output | Quotes escape attributes, hostile text becomes markup, script terminators escape JSON, or unsafe URL schemes survive. | Render quotes, ampersands, angle brackets, a script terminator plus markup, and a javascript-scheme URL. Parse actual output; require inert text, valid script-safe JSON, and rejected unsafe actions. |
 | B06: state and clock parity | Page, badge, control, feed, and discovery state disagree or dates use an implicit timezone. | Test before/at/after boundaries with an explicit clock and timezone. Verify one shared state decision and a documented rebuild trigger or manual owner. |
 | B07: deterministic clean artifact | The build needs undocumented state, output changes without explained inputs, or generated output was hand edited. | Run the documented clean build, record tool/dependency versions and result, compare repeat output, and preserve artifact identity plus output allowlist. |
-| B08: integration and design fidelity | Integrated assets/discovery drift from approved revisions or selected mockup. | Read source handoffs and compare rendered mobile/desktop output; preserve producer files and identify copied revisions. |
+| B08: integration and design fidelity | Integrated assets/discovery drift from approved revisions or selected mockup. | Read source handoffs and compare rendered mobile/desktop output; preserve producer files and identify copied revisions. Replay the selected layout defaults (brand-and-mockups.md BM05) against the built page at the recorded mobile and desktop viewports, and log any mismatch or approved brand-decision exception. |
 | B09: critical journeys and states | The main action, validation, empty/error/loading/success state, or no-JavaScript content fails. | Exercise each applicable state on the exact candidate and retain route, environment, screenshots, and functional outcomes. Apply accessibility and performance/discovery gates. |
 | B10: truthful handoff | Unrun tests are called passed or output lacks reproduction commands. | Open build receipts, QA reports, limitations, artifact digest, next owners, and the audit packet. BLOCKED checks remain visible. |
 | B11: code quality | Any required code-quality check is FAIL or BLOCKED. | Apply [checklists/code-quality.md](../../skills/website-build-skill/checklists/code-quality.md) CQ01-CQ06 to the exact candidate and coding-standards.md revision; reopen the standards, command output, dependency/security evidence, and Builder's review receipt before handoff. |
@@ -258,7 +258,7 @@ Date rule: [ASK DATE, source evidence, and revalidation](../../skills/website-bu
 | CQ03: executed quality commands | Applicable tests, lint, format checks, or type-checks fail, are unrun, or lack recorded output. | Run the standards file's unit, integration, end-to-end, lint, format-check, and type-check commands on the candidate. Save commands, environment, exit codes, full output, and artifact identity; give inapplicable checks a scope-specific reason. |
 | CQ04: dependency hygiene | A dependency lacks a requirement, versions or lockfile permit unexplained drift, or advisory findings lack disposition. | Compare the dependency inventory with the policy; verify pinned versions, lockfile, reproducible install, and audit command output. Record applicable findings, remediation or evidenced disposition, owners, and recheck dates. |
 | CQ05: secure coding | Templates, scripts, URL handling, or secret boundaries violate the stack's secure-coding rules. | Inspect source and rendered output; run synthetic escaping, script-terminator, unsafe-URL, and invalid-input cases. Record results and a secret-boundary check without recording secret values. |
-| CQ06: review evidence | The candidate lacks a code-review receipt against its standards, or material findings remain unresolved. | Builder records inspected revision, organization/pattern checks, findings, and dispositions before handoff. Reviewer challenges this checklist against the same standards and candidate at Challenge; retain the independent receipt and confirmed-fix regressions for shipment. |
+| CQ06: review evidence | The candidate lacks a code-review receipt against its standards, or material findings remain unresolved. | Builder records inspected revision, organization/pattern checks, findings, and dispositions before handoff. Include design-token drift (hard-coded values bypassing tokens) and repeated copy-paste implementation shortcuts among the pattern checks, and verify each finding in source before recording it. Reviewer challenges this checklist against the same standards and candidate at Challenge; retain the independent receipt and confirmed-fix regressions for shipment. |
 
 ## Gate receipt
 

package/docs/bundles/prompts.md

@@ -463,6 +463,9 @@ Show me three visual mockups for this website before writing any website code.
 Use the approved brief, research, brand kit, and representative real content.
 If the brand kit is missing, first ask for my profile-picture and banner screenshots.
 
+DESIGN READ
+- Before judging the three directions, note the page type, the audience, and the intended visual direction. See checklists/brand-and-mockups.md BM05.
+
 RESEARCH INTO DESIGN
 - Inspect the researched award-winning work and browser possibilities.
 - Borrow principles, not another site's identity, assets, or exact composition.

package/docs/bundles/team.md

@@ -1688,7 +1688,7 @@ TEAM: one command installs the seven workers' files; you open each session yours
 - Get the complete `docs/bundles/team.md`, `method.md`, `prompts.md`, `playbooks.md`, and `checklists.md` from the same release. The team bundle contains the seven complete role bodies and this guide; the prompts bundle contains active prompts.
 - Get `skills/website-build-skill/archive/graphics-design-original.md` separately for Researcher's provenance reading. Keep its inactive header and do not execute its historical save instructions.
 - Choose the private project workspace where `site-work/` will live. Keep its research and brand files out of the public skill repository and deployment output.
-- Open your host's Bots area. Use **New** to create one Bot at a time; set its name and paste the entire named role body into its instruction field, then save. These are semantic field instructions; exact field labels in your account must be checked. If **New**, the instruction field or group controls are absent, use separate chats and relay the complete role packets manually rather than inventing an API.
+- Open your host's Bots or agents area and create one worker at a time. Give each the entire named role body wherever your host keeps standing instructions (in Grok Bot, a role file in `/workspace` that the description points to, as in [Grok Bot](../../adapters/grok.md#grok-bot)), then save. If your host has no such place, use separate chats and relay the complete role packets manually rather than inventing an API.
 - Give each Bot the method, prompt, playbook and checklist bundles as files or pasted text through controls your account actually provides. If a filename inside an instruction is inaccessible, attach or paste that file's contents with its label before work starts. Confirm file access separately for each Bot.
 - Request only a setup acknowledgement: name, received role, route, actual model family if known, tools, and inaccessible files. For all Bots except Researcher add: `Wait for the research gate; do not begin your role yet.` Pass each work gate using its own required evidence.
 
@@ -1704,7 +1704,7 @@ TEAM: one command installs the seven workers' files; you open each session yours
 
 **Connect the group and verify its routes**
 
-- If your account exposes group creation, create `Website Design` and add the seven saved Bots in the same order, Researcher first. Record the actual route for each. Verify one bounded setup message reaches the intended recipient using the host's documented addressing controls.
+- If your host offers group chats, create `Website Design` and add the saved workers in the same order, Researcher first, up to the host's group limit (six in Grok Bot, where Reviewer runs outside the group). Record the actual route for each. Verify one bounded setup message reaches the intended recipient using the host's documented addressing controls.
 - Use separate Bot chats and relay each handoff and its attachments manually, including when the account offers a group view. Keep distinct workers on separate routes; separate workers need separate routes, and labels inside one chat stay one worker. Ordinary single-chat work uses SOLO.
 - If group messages are text-only, attach mockups and assets directly to the receiving Bot. Image review needs the Bot to open the image itself; a text path alone gives it only the path, so confirm the receiving Bot can inspect the image directly.
 - Give Coordinator this complete contract after replacing each angle-bracket route with the real saved Bot/chat reference. Unresolved placeholders keep setup incomplete.

package/docs/evidence/content-review.json

@@ -10,9 +10,9 @@
       "disposition": "instructions-and-qualified-status-only"
     },
     "CHANGELOG.md": {
-      "sha256": "b3dc41e64c3a2d05c81ebbfec4ecc6e559db14b7381931e539a00bf24dc7ed21",
+      "sha256": "0982434d410179d8225d930c551f6874300f8827841c65c2ae8ea7981f6e76a7",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the added 0.1.1 framing note against the presentation copy changes; publication is a separate release action. Implementation-agent editorial review; independent review remains pending. Reviewed the copied-install checker ladder fix against the canonical instructions and regression test. Live host retrial remains pending release. Reviewed for the ROUND 1 audit: added Fixed/Added/Changed lines for the restored positive-and-accurate adapter, SKILL.md, designer.md, grok.md and validate.mjs fixes. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.3: reviewed the #13 description check and #14 Hermes path documentation entries against the implementation and regression tests; publication remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. Reviewed the #15 Fixed line for the symlinked-parent receipt path against src/install.mjs and installer tests 7e-7g, and the #15 Added line against the two receipts. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. 0.1.5 release heading moved the Unreleased lines under [0.1.5] - 2026-09-24 unchanged. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending."
+      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the added 0.1.1 framing note against the presentation copy changes; publication is a separate release action. Implementation-agent editorial review; independent review remains pending. Reviewed the copied-install checker ladder fix against the canonical instructions and regression test. Live host retrial remains pending release. Reviewed for the ROUND 1 audit: added Fixed/Added/Changed lines for the restored positive-and-accurate adapter, SKILL.md, designer.md, grok.md and validate.mjs fixes. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.3: reviewed the #13 description check and #14 Hermes path documentation entries against the implementation and regression tests; publication remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. Reviewed the #15 Fixed line for the symlinked-parent receipt path against src/install.mjs and installer tests 7e-7g, and the #15 Added line against the two receipts. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. 0.1.5 release heading moved the Unreleased lines under [0.1.5] - 2026-09-24 unchanged. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 0.1.7: Grok Bot setup and one-description entries reviewed against the diff. Claude editorial review. 0.1.8: reviewed the Added lines against the committed BM05, CQ06, B08, prompt 04 and PROVENANCE.md diff; every named tell, default and credit matches the checklist text. Claude editorial review; the change itself had an independent codex audit (CLEAN)."
     },
     "CLAUDE.md": {
       "sha256": "4bc19853ddcdea0b2b751f82fba1d7c2451d2ae42f173dba1da2f6035df6e464",
@@ -71,9 +71,9 @@
       "review": "0.1.3: reviewed the same-commit description update and explicit GitHub command against the task specification; no live repository setting was changed in this offline implementation pass. Implementation-agent editorial review; independent review remains pending. The command uses the exact repository URL to preserve the existing privacy allowance for public repository references."
     },
     "REPO_SETTINGS.md": {
-      "sha256": "f0a405e61c2361c9b746a867279dc2ca28a983a14899d14b249286c486e989de",
+      "sha256": "4460fa8f5379df2991fc11eb55ba7ae6319ca66acc5a2f8702b3b64b6847d967",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "Topic list changed to match the skill-pack framing and package.json keywords (20 topics). Reviewed by Claude against the check TOPICS rule. 0.1.3: matched the Description text to package.json and added the requested 2026-09-23 read-back row from the maintainer task bundle; GitHub and npm were not independently queried in this offline implementation pass. Implementation-agent editorial review; independent review remains pending."
+      "review": "Topic list changed to match the skill-pack framing and package.json keywords (20 topics). Reviewed by Claude against the check TOPICS rule. 0.1.3: matched the Description text to package.json and added the requested 2026-09-23 read-back row from the maintainer task bundle; GitHub and npm were not independently queried in this offline implementation pass. Implementation-agent editorial review; independent review remains pending. 0.1.7: description line replaced with the unified 155-character string also set in package.json and plugin.json. Claude editorial review."
     },
     "SECURITY.md": {
       "sha256": "9e0a9064cd020c23ae82f4c734ceab24bb9e4297073227a49ecc41414e33f8b7",
@@ -127,9 +127,9 @@
       "review": "Reviewed setup instructions, tool fallback gates and compatibility links against the previous adapter; research status and safety requirements preserved. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending."
     },
     "adapters/grok.md": {
-      "sha256": "1119d57dbbaafeca3b158fc58994eba867b34a2a2df446423cb131b6a720bdcc",
+      "sha256": "722ec03c83e8edc7cff0d2b9a6f3fc46f2e5c971a483f8a93fc799e7dae9414c",
       "disposition": "status-claims-bound-to-receipts",
-      "review": "Reviewed setup instructions, tool fallback gates and compatibility links against the previous adapter; research status and safety requirements preserved. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending.",
+      "review": "Reviewed setup instructions, tool fallback gates and compatibility links against the previous adapter; research status and safety requirements preserved. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 0.1.7: reviewed the new Grok Bot section against docs.x.ai/grok-bot pages read 2026-09-25 (bots, chat-and-collaboration, files-and-results, computer-and-apps, skills-routines-and-automations, faq) and two operator reports (no model picker; a Bot learns an installed skill and keeps memory, skills and context in a group). Portable install command and SKILL.md path confirmed by a local dry install. Grok Bot stays a documented setup with no receipt. The manual-fallback edits are host-neutral because the fallback is copied into team.md. Claude editorial review.",
       "claims": [
         {
           "text": "Native loading was tested on Grok Build CLI 1.0.40 (macOS, SOLO, trusted folder, 2026-09-24;",
@@ -148,7 +148,7 @@
       "review": "Reviewed setup instructions, tool fallback gates and compatibility links against the previous adapter; research status and safety requirements preserved. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending."
     },
     "docs/COMPATIBILITY.md": {
-      "sha256": "aaac6741324d456ac72618bd3d583c6211f0061958dd27daa6441997acf89425",
+      "sha256": "4f51a66171eb84590e7e919e2ffd23010e475fec9b48ce6b52ad73b918df15a9",
       "disposition": "status-claims-bound-to-receipts",
       "claims": [
         {
@@ -164,7 +164,7 @@
           "evidence": "docs/evidence/host-trial-grok-build-2026-09-24.json"
         }
       ],
-      "review": "Reviewed documented setup routes and required trial evidence; retained the existing revision-bound hosted-check claim and receipt. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. ROUND 1 (2026-09-24): added the receipts' one-run and operator-configuration limitations to the promoted wording, per the code-reviewer finding. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending."
+      "review": "Reviewed documented setup routes and required trial evidence; retained the existing revision-bound hosted-check claim and receipt. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending. 0.1.5 (#15): host-status wording promoted only for SOLO native loading on the exact client versions in the 2026-09-24 receipts; Claude (orchestrator, ran both trials) editorial review, independent review remains pending. ROUND 1 (2026-09-24): added the receipts' one-run and operator-configuration limitations to the promoted wording, per the code-reviewer finding. 0.1.6 (#15): Grok Build CLI 1.0.40 SOLO native-loading receipt added; wording promoted only for that client, in a trusted folder, one run; Grok Bot (Bots app) stays awaiting its trial. Claude (orchestrator, ran the trial) editorial review, independent review remains pending. 0.1.7: Grok Bot row stays under documented setups (no receipt), now pointing at the new Grok Bot section and naming what to verify. Claude editorial review."
     },
     "docs/EVALUATION.md": {
       "sha256": "cb34b13e24b906496d0f05ef20187695bd51defe75b25abb7df8d5ad2935c32d",
@@ -188,7 +188,7 @@
       "review": "0.1.4: reviewed the added coding-research description and fourteen-domain wording against the canonical prompts and checklists; package release remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending. Reviewed #16 manual-gate instructions against the explicit skips, packed consumer test and configured OS matrix; reviewed #17 TEAM wording against file-only installation and human session/handoff responsibilities. Implementation-agent editorial review only; host trials and independent review remain pending."
     },
     "docs/PROVENANCE.md": {
-      "sha256": "a4d8039968d64163c78997e15b1a9dc8cc5b1e7aa6995a0f07e789758b2e7cb4",
+      "sha256": "d7e464f6deaed305987e8720a64bf10ce8880f205a7bc17a0ad82840b8cccf8f",
       "disposition": "evidence-backed",
       "claims": [
         {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "website-build-skill",
-  "version": "0.1.6",
-  "description": "Skills that make your AI an expert website builder: current research, design, accessibility, performance, SEO, security and code, for any LLM or agent.",
+  "version": "0.1.8",
+  "description": "A skill pack that turns your AI into an expert website builder: current research, design, code, accessibility, speed, SEO and security, alone or as a team.",
   "type": "module",
   "license": "MIT",
   "bin": {

package/skills/website-build-skill/checklists/brand-and-mockups.md

@@ -24,7 +24,7 @@ Date rule: [ASK DATE, source evidence, and revalidation](../playbooks/research-a
 | BM02: provenance and conflicts | A screenshot estimate is called exact, an inference becomes approved, or conflicting accents are silently collapsed. | Inspect original approved assets and styles; record each value's source, method, confidence, role, and explicit conflict disposition in BRAND.md and tokens.json. |
 | BM03: computed brand contrast | Any contrast claim lacks a computed ratio or ignores a relevant composited state. | Apply accessibility.md AX01 to brand/contrast.md; require tool, actual colors, size/weight, criterion, raw ratio, and result for text/actions/focus. |
 | BM04: three visual directions | Fewer than three inspectable directions, recolored copies, or text wireframes presented as mockups. | Open one image file (PNG, JPEG, WebP or SVG) per direction and viewport (desktop and mobile), plus comparison.md. A static HTML preview is optional; text alone fails BM04. Compare hierarchy, density, type, composition, imagery, and useful interaction with the same representative content. |
-| BM05: stress and visual fit | Only a short desktop hero was inspected. | Review long headline, dense content, mobile layout, primary CTA, focus and reduced-motion intent; record screenshots and specific findings per direction. |
+| BM05: stress and visual fit | Only a short desktop hero was inspected. | Review long headline, dense content, mobile layout, primary CTA, focus and reduced-motion intent; record screenshots and specific findings per direction. Also check for template tells (gradient text on headings, a side-stripe accent border on cards, the generic purple-blue AI palette, cards nested in cards, icon-tile stacks, bounce/elastic easing, decorative numbered section labels, thin border plus wide soft shadow) and contextual landing-page layout defaults (desktop headline about two lines, short supporting copy, restrained nav height, no long run of identical section layouts, one CTA label per intent, grid cell count matching real content); record the chosen viewport and any approved brand-decision exception, and yield to text expansion, zoom and reflow. |
 | BM06: user selection before code | A guessed approval, unnamed choice, or website scaffolding/markup precedes a named selection. | Read the user's actual decision and selection.md, approved brand revision, and stage chronology. Three visuals and a selected revision are mandatory. |
 | BM07: assets and rights | Released assets lack exact intended-use rights, measured dimensions, or inspected crops/exports. | Read Graphics' authoritative rights ledger and immutable asset manifest; inspect dimensions, compression, safe zones, font embedding/subsetting notices, and alt intent. |
 | BM08: handoff ownership | Designer changes Graphics' rights ledger, or Builder receives unversioned inputs. | Compare ownership, source revisions, asset requests, selected-design receipt, and Coordinator acceptance. Preserve producer originals. |

package/skills/website-build-skill/checklists/build.md

@@ -27,7 +27,7 @@ Date rule: [ASK DATE, source evidence, and revalidation](../playbooks/research-a
 | B05: context-safe output | Quotes escape attributes, hostile text becomes markup, script terminators escape JSON, or unsafe URL schemes survive. | Render quotes, ampersands, angle brackets, a script terminator plus markup, and a javascript-scheme URL. Parse actual output; require inert text, valid script-safe JSON, and rejected unsafe actions. |
 | B06: state and clock parity | Page, badge, control, feed, and discovery state disagree or dates use an implicit timezone. | Test before/at/after boundaries with an explicit clock and timezone. Verify one shared state decision and a documented rebuild trigger or manual owner. |
 | B07: deterministic clean artifact | The build needs undocumented state, output changes without explained inputs, or generated output was hand edited. | Run the documented clean build, record tool/dependency versions and result, compare repeat output, and preserve artifact identity plus output allowlist. |
-| B08: integration and design fidelity | Integrated assets/discovery drift from approved revisions or selected mockup. | Read source handoffs and compare rendered mobile/desktop output; preserve producer files and identify copied revisions. |
+| B08: integration and design fidelity | Integrated assets/discovery drift from approved revisions or selected mockup. | Read source handoffs and compare rendered mobile/desktop output; preserve producer files and identify copied revisions. Replay the selected layout defaults (brand-and-mockups.md BM05) against the built page at the recorded mobile and desktop viewports, and log any mismatch or approved brand-decision exception. |
 | B09: critical journeys and states | The main action, validation, empty/error/loading/success state, or no-JavaScript content fails. | Exercise each applicable state on the exact candidate and retain route, environment, screenshots, and functional outcomes. Apply accessibility and performance/discovery gates. |
 | B10: truthful handoff | Unrun tests are called passed or output lacks reproduction commands. | Open build receipts, QA reports, limitations, artifact digest, next owners, and the audit packet. BLOCKED checks remain visible. |
 | B11: code quality | Any required code-quality check is FAIL or BLOCKED. | Apply [checklists/code-quality.md](code-quality.md) CQ01-CQ06 to the exact candidate and coding-standards.md revision; reopen the standards, command output, dependency/security evidence, and Builder's review receipt before handoff. |

package/skills/website-build-skill/checklists/code-quality.md

@@ -25,7 +25,7 @@ Date rule: [ASK DATE, source evidence, and revalidation](../playbooks/research-a
 | CQ03: executed quality commands | Applicable tests, lint, format checks, or type-checks fail, are unrun, or lack recorded output. | Run the standards file's unit, integration, end-to-end, lint, format-check, and type-check commands on the candidate. Save commands, environment, exit codes, full output, and artifact identity; give inapplicable checks a scope-specific reason. |
 | CQ04: dependency hygiene | A dependency lacks a requirement, versions or lockfile permit unexplained drift, or advisory findings lack disposition. | Compare the dependency inventory with the policy; verify pinned versions, lockfile, reproducible install, and audit command output. Record applicable findings, remediation or evidenced disposition, owners, and recheck dates. |
 | CQ05: secure coding | Templates, scripts, URL handling, or secret boundaries violate the stack's secure-coding rules. | Inspect source and rendered output; run synthetic escaping, script-terminator, unsafe-URL, and invalid-input cases. Record results and a secret-boundary check without recording secret values. |
-| CQ06: review evidence | The candidate lacks a code-review receipt against its standards, or material findings remain unresolved. | Builder records inspected revision, organization/pattern checks, findings, and dispositions before handoff. Reviewer challenges this checklist against the same standards and candidate at Challenge; retain the independent receipt and confirmed-fix regressions for shipment. |
+| CQ06: review evidence | The candidate lacks a code-review receipt against its standards, or material findings remain unresolved. | Builder records inspected revision, organization/pattern checks, findings, and dispositions before handoff. Include design-token drift (hard-coded values bypassing tokens) and repeated copy-paste implementation shortcuts among the pattern checks, and verify each finding in source before recording it. Reviewer challenges this checklist against the same standards and candidate at Challenge; retain the independent receipt and confirmed-fix regressions for shipment. |
 
 ## Gate receipt
 

package/skills/website-build-skill/manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "0.1.6",
+  "packageVersion": "0.1.8",
   "skillName": "website-build-skill",
   "pathBase": "All asset paths resolve from this manifest directory; runtime paths resolve in the authorized user project.",
   "assets": [
@@ -104,7 +104,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "dfb45d8862133df938da722c10295b7a48819da9ea40c9d94d3ef2908e6d948b"
+      "sha256": "9881d8c5ae027d57288f40b50621142b5dc66efd989796ee2b12a420d6dba953"
     },
     {
       "path": "prompts/05-stack-and-build.md",
@@ -542,7 +542,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "44e83577edf2fb1166f25c680d13bcf85245e347c89cf711b24578ce9abba5f5"
+      "sha256": "774d08f3093a3668d874074f9c5cc7435d089997a3c850afb6ae0553287bcc46"
     },
     {
       "path": "checklists/build.md",
@@ -557,7 +557,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "4492d1576d276f73dcab9be83e525acf690984bb058f2139c1c703967fe1eccf"
+      "sha256": "ccc6b3de61ae7ab4b2d052b970b956695a52fba4c3fd24750439da3a8df2b69f"
     },
     {
       "path": "checklists/code-quality.md",
@@ -572,7 +572,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "6a0346ef6678b0ed3c64ff04df93e466ae5acd8c26e34c802b78505091ae62c3"
+      "sha256": "c2d1aa467a5ab9d4b8846c4fdefbd3c8efbb2f342e05d5526e2059a4ddb4d926"
     },
     {
       "path": "checklists/accessibility.md",

package/skills/website-build-skill/prompts/04-three-mockups.md

@@ -7,6 +7,9 @@ Show me three visual mockups for this website before writing any website code.
 Use the approved brief, research, brand kit, and representative real content.
 If the brand kit is missing, first ask for my profile-picture and banner screenshots.
 
+DESIGN READ
+- Before judging the three directions, note the page type, the audience, and the intended visual direction. See checklists/brand-and-mockups.md BM05.
+
 RESEARCH INTO DESIGN
 - Inspect the researched award-winning work and browser possibilities.
 - Borrow principles, not another site's identity, assets, or exact composition.