The first live run produced a faithful carburetor plate, then drew the
region in SVG and left the plate on disk. Before diffing, the hero gate
now walks the artifact (or a bounded source tree) for every plate's file
name or a data URI named for it.
AI-assisted (Claude).
Co-Authored-By: Claude <noreply@anthropic.com>
The first live run forced past the plates gate with 'single-file HTML
delivery requires embedded CSS/SVG'. That is not a reason the comp's
authority moves for; the script now refuses a --force whose reason does
not quote the user, and new-work.md says a single-file deliverable inlines
the plate as a data URI. Texture plates are judged on palette and grain,
not size or structure, since they tile.
AI-assisted (Claude).
Co-Authored-By: Claude <noreply@anthropic.com>
new-work.md section 6 becomes the spec / plates / hero / sections / motion /
responsive phase list, each closed by build-phase.mjs advance; the
reproduction and hero-checkpoint prose that asked the model to compare
from memory is gone. visualize.md's inventory, medium gate, and produce
sections collapse into the spec and plate mechanism. The finish reviewer
takes the state file and comp-diff reports as inputs and starts its
fidelity matrix from the measured verdicts. docs/COMP-FIDELITY.md records
the design.
AI-assisted (Claude).
Co-Authored-By: Claude <noreply@anthropic.com>
generate-image.mjs --plate produces one raster region of the measured spec
from the comp crop, scores it against the crop, and refuses under --min.
The asset producer's job becomes producing the spec's plates. Detector
gains organic-clip-path (many-vertex polygon / curved path() clips) and
buried-raster (raster under a near-opaque wash or at near-zero opacity),
wired into both engines with fixtures.
AI-assisted (Claude).
Co-Authored-By: Claude <noreply@anthropic.com>
Dependency-free PNG codec, perceptual metrics (structure / color / detail /
bands), side-by-side + heatmap + per-region crops, a measured spec from the
approved comp (grid overlay, sampled palette, plate list), and a phase state
machine whose spec / plates / hero gates run the diff instead of asking the
model to remember the image.
AI-assisted (Claude).
Co-Authored-By: Claude <noreply@anthropic.com>
Main's #469 tests POSTed /heartbeat and /answer without ?key=, which the
gate now rejects, so those daemons looked dead. The e2e heartbeat counter
also has to match pathname rather than a suffix, now that the URL carries
the key.
Written with AI assistance under maintainer direction.
Co-authored-by: Cursor <cursoragent@cursor.com>
Bugbot caught that the exact-match allowlists 403 every request on --port 80
because browsers drop the default-port suffix; other ports stay strict.
Written with AI assistance under maintainer direction.
Co-authored-by: Cursor <cursoragent@cursor.com>
An unauthenticated POST /build-path wrote the flip event that makes --wait
instruct the agent to generate comps: same class as the /answer hole in #555.
Written with AI assistance under maintainer direction.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unauthenticated POST /answer copied steer into the agent ANSWER line. The handler now requires the detached session key and rejects foreign Origin and Host.
Written with AI assistance under maintainer direction.
Co-authored-by: Cursor <cursoragent@cursor.com>
page.authenticate is page-wide, so a cross-origin redirect that then 401s would receive the original credentials. Attach Authorization only to requests for the scan origin.
Written with AI assistance (Cursor); reviewed by maintainer.
Co-authored-by: Cursor <cursoragent@cursor.com>
Strip basic-auth credentials from scan-target URLs before goto and finding output, and pass them to page.authenticate instead.
Written with AI assistance (Cursor); reviewed by maintainer.
Co-authored-by: Cursor <cursoragent@cursor.com>
ignore-value stored exact values for rules that cannot extract one, so the entries never matched. Refuse them and point at "*" --file.
AI assistance: implemented with Cursor Grok 4.6.
Co-authored-by: Cursor <cursoragent@cursor.com>
Dot-segment hrefs like /../outside.css could leave the project, and a process-wide warning set hid missing-sheet notices on later detectHtml calls.
AI assistance: implemented with Cursor Grok 4.6.
Co-authored-by: Cursor <cursoragent@cursor.com>
Root-relative hrefs like /static/app.css were treated as OS-absolute and silently dropped, hiding contrast findings.
AI assistance: implemented with Cursor Grok 4.6.
Co-authored-by: Cursor <cursoragent@cursor.com>
packages/* now includes nested package.json dirs under a matched
workspace package, and Impeccable projectRoots govern a path even when
package-manager workspaces exclude it.
Written with AI assistance (Cursor); reviewed by maintainer.
Co-authored-by: Cursor <cursoragent@cursor.com>
process.exit after a queued write truncated boot output on a backpressured pipe. Await the write callback, then close the fetch dispatcher.
AI assistance: implemented with Cursor Grok 4.6.
Co-authored-by: Cursor <cursoragent@cursor.com>
findDesignRoot continued past every workspace package.json to any
workspace-declaring ancestor. It now matches the boundary against that
ancestor's globs (including negations and globstars), so excluded and
stray packages do not inherit, while included workspaces still do.
Written with AI assistance (Cursor); reviewed by maintainer.
Co-authored-by: Cursor <cursoragent@cursor.com>
On Windows/Node 24, a live undici keep-alive from the update-check fetch aborted libuv during teardown after valid stdout. Destroy the dispatcher first, matching concept-seed.
AI assistance: implemented with Cursor Grok 4.6.
Co-authored-by: Cursor <cursoragent@cursor.com>
Update the grouped Bun dependencies while holding ai at 7.0.69 to avoid the automatic tool-execution behavior regression introduced in 7.0.70.
Prepared and validated with AI assistance.
Point installer readers to the harness-specific approval and verification steps on impeccable.style.\n\nAI-assisted: Codex prepared and verified this documentation update under direct maintainer instruction.
Keep Codex as its own Stop harness (decision/block) while taking main's Grok envelope detection and Stop cache sync.
Co-authored-by: Cursor <cursoragent@cursor.com>
The hook_event_name mapping (and its pre_tool_use entry) had no reader:
hook.mjs routes on the raw stdin via isStopEvent, and nothing downstream
keys on the normalized event name. The trailing-slash strip duplicated
the path.resolve every consumer already does. Pin the one commit-2
behavior that had no test: a Stop detector failure must leave the
remembered set alone.
Prepared with AI assistance.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A clean Stop never replaced remembered keys, so a finding that was fixed and then reintroduced stayed silent. Remember the live scan, including empty, and persist that write.
Prepared with AI assistance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Grok was classified as GitHub Copilot, so the design hook skipped every
edit with no-file-path and never ran Stop. Normalize toolInput/sessionId
and treat Stop additionalContext as the Grok product.
Prepared with AI assistance.
Co-authored-by: Cursor <cursoragent@cursor.com>
github-actions[bot]
dependabot[bot]andGitHub