website-editing-783de4 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited website-editing-783de4 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Conventions for the SvelteKit static site at WebSite/site/ that deploys to tinyassets.io. These are project-level website rules — they apply equally to every provider (Codex, Cursor, Aider, Claude Code, Cowork), but the detailed rules live here so AGENTS.md can stay lean. When in doubt, add website conventions to this skill and keep provider-specific files as pointers or harness notes.
http://localhost:5173/, hard-pinned. Jonathan double-clicks WebSite/preview.bat once per boot; from then on every edit you make to WebSite/site/src/** hot-reloads automatically.ship.ps1, fast-forward to main, the GitHub Actions deploy, and the playwright verify against the live URL. cat > "/full/path/to/file" << 'FILE_EOF'
... full file content ...
FILE_EOFVerify with wc -l + tail. Other providers (Codex, Cursor, Claude Code on Windows) don't have this issue.
Once preview.bat is up and Jonathan has the tab open at localhost:5173/:
Jonathan: "the hero subline is too long"
Agent: [edits Hero.svelte]
Jonathan: [tab updates by itself] ← HMR, no F5 needed
Jonathan: "yeah that's better"You do not rebuild or redeploy to show a change. Vite's HMR pushes the patch over a websocket. Every browser tab open to localhost:5173/ (Jonathan's, your playwright tab, anyone else's) receives the same update simultaneously — multi-agent / multi-tab sync is free.
If F5 is ever needed, that's a signal HMR misfired — investigate, don't normalize the workaround. The intended state is "edit a file, tab updates, no input from the user."
The site's home (ChatDemo) and /loop show real conversations Jonathan had with the Workflow MCP connector via claude.ai. The principle: when claiming transparency, the captured material has to BE the captured material — not a summary, not a paraphrase, not curated highlights.
Required when capturing a real conversation for the site:
get_page_text to extract the rendered conversation. Don't reword. Don't shorten. Don't "tighten the prose."get_page_text after every expansion to make sure you've got it all.Anti-pattern: writing "Loading tools — Goals — Wiki Knowledge Base × 3" and calling it a thought trace. That's a summary of tool calls, not the actual text. The actual text has Claude's reasoning between each tool call. Capture all of it.
<=1000px. If you add nav items, they go in TopNav.svelte's items array — both the desktop nav and the mobile drawer auto-render./status, /account, /goals, /catalog): keep them honest. /wiki is the canonical community wiki and public-work lens. /goals and /catalog are compatibility redirects only; do not advertise /goals in primary nav, CTAs, sitemap, or graph affordances.mailto: (the alliance form does this). Real fields with name= attributes; onsubmit actually does something.<button> and <a> over clickable <div>s.<button>, keep its children phrasing-only (span, strong, small, etc.); headings, paragraphs, and divs can be parsed outside the button and make only part of the card clickable. If the card needs block content, use an <a> for navigation or put a real button/link inside the card with a clearly bounded hit target, then verify by clicking the title/body text in Playwright.Refresh MCP and Refresh GitHub. Page-specific variants like Probe MCP, Refresh goals, or Refresh branches make the same command feel like different controls.MCP source / GitHub source cells should be static proof readouts unless they open the actual raw source in a clearly different context. Do not link a source readout to another page that repeats the same source readout./graph and highlights the current lens, rather than a static CTA tile./graph should not show project objects as visual orphans just because an explicit cross-reference has not been extracted yet. Add truthful relationship layers from live source structure first: bug tracker hub for BUG pages, goal/universe/wiki-draft hubs for MCP collections, GitHub branch hub for branch refs, and tag hubs for shared real tags. Keep explicit references visually stronger than collection/tag edges, and rename residual counts to "loose ends" or "isolated" so the page distinguishes missing specific routing from fake disconnection.ran - Intake Router; avoid prefixes like Last event: when they crowd out the actual event. Never put raw prompt/output JSON in the rail. For historical/no-active-run stages, preserve recency in the tile with Last ran <timestamp> and put See recent events as the bottom cue instead of replacing the timestamp with a generic status - see recent events line.WebSite/site/ is SvelteKit + adapter-static. `src/routes/+layout.ts` has `export const prerender = true;` — this is required; without it the static adapter outputs only assets, no HTML.svelte.config.js prerender.entries lists every route. Add new routes here.WebSite/site/static/. Reference via absolute /foo.png./mcp-live → tinyassets.io/mcp (see vite.config.js). In prod, the cloudflare worker handles /mcp directly.WebSite/ship.ps1 from Windows PowerShell. It clones a fresh main to $env:TEMP\wf-ship, fetches the bundle Cowork prepared, pushes the branch. Then fast-forward main. Watch the GitHub Actions deploy-site workflow. Run the playwright verify in WebSite/DEPLOY.md against the live URL.Before declaring a website edit "done":
cd WebSite/site && npm run build — must end with ✔ done and produce build/<route>.html for every route.errs: 0, warns: 0, key elements present (H1, expected text, expected counts).{}, [], undefined, numeric epoch timestamps, stuck disabled buttons, or a green source label with no populated rows. For /loop, click Refresh MCP and Refresh GitHub; verify the visible showcase is operationally current. A stale terminal MCP run must not pass as "working" or "current patch run" just because it has readable text. If MCP has no active/current loop run, the page must say that plainly and either show the GitHub community-loop monitor as the live source or show an explicit empty-state reason.+layout.ts, prerender entries): rebuild from scratch (rm -rf build first) — stale .svelte-kit/ artifacts can mask real failures.This skill is itself subject to the auto-iterate ratchet pattern. If a website-related failure recurs:
| Recurrence | Ratchet |
|---|---|
| 1st | Fix in place. Note it in the relevant doc. |
| 2nd | Add the rule to this SKILL.md and the relevant subsystem doc (PREVIEW.md / DEPLOY.md / HOOKS_FUSE_QUIRKS.md). |
| 3rd | Build a runnable check in scripts/ that catches the failure pattern. |
| 4th | Wire as a PostToolUse hook in .claude/hooks/ for Claude Code; runnable from any provider. |
| Next | Pre-commit / CI gate. |
Concrete examples that have already ratcheted:
WebSite/HOOKS_FUSE_QUIRKS.md.scripts/check_cross_provider_drift.py → .claude/hooks/cross_provider_drift_guard.py PostToolUse. Ladder: AGENTS.md § Where new conventions live.build/ had only static assets; root cause was missing prerender = true in +layout.ts. The "verification before shipping" rule above (assert build/<route>.html exists) prevents recurrence./loop refresh verification passed on button/source/no console errors while the actual event stream rendered {} details and raw epoch timestamps. The live-data control rule above prevents declaring success until the populated records are readable./loop 1-6 stage buttons stretched to the full event-stream height, creating tall vertical strips where sparse text sat far from the visible top. The workflow-rail verification above requires bounding-box checks on desktop and mobile./loop 1-6 stage buttons updated selection state but the page appeared unchanged to users. The workflow-rail verification above now requires clicking every stage and asserting a visible content change./loop rendered a readable Apr 29 failed bootstrap run and was incorrectly declared fixed. The live-data rule above now requires freshness/operational checks: historical terminal runs are source evidence, not the current showcase.| File | What it is |
|---|---|
WebSite/preview.bat | Hidden + persistent + idempotent dev launcher |
WebSite/preview-stop.bat | Kill the background vite server |
WebSite/PREVIEW.md | Full preview-loop reference |
WebSite/ship.ps1 | Push the prepared bundle to GitHub |
WebSite/website-ship.bundle | Generated by Cowork; one push away from live |
WebSite/DEPLOY.md | Deploy-day playbook + Claude Code verify prompt |
WebSite/HOOKS_FUSE_QUIRKS.md | Why heredoc, not Edit/Write, on Cowork's FUSE |
WebSite/site/src/routes/ | All page routes |
WebSite/site/src/lib/components/ | Shared components |
WebSite/site/src/lib/content/*.json | Content (mcp-snapshot, patterns, legal-info, …) |
WebSite/site/src/routes/+layout.ts | Sets prerender = true — DO NOT delete |
WebSite/site/svelte.config.js | adapter-static, prerender entries |
WebSite/site/vite.config.js | Dev proxy for /mcp-live, HMR overlay |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.