kuker24 · kuker24 · Oct 4, 2026 · Oct 4, 2026 · Oct 4, 2026 · Oct 4, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.1.12 — 2026-10-04
+
+Wave 0.1.12 body-only ("skill-refresh"). Katalog tetap 65 (50 model + 15 manual). Tidak ada pertumbuhan allowlist (`vendor/skill-allowlist.txt` tidak berubah). Tidak ada penambahan atau pensiun skill. Exception 0.1.8 tetap spent.
+
+- `hyperframes`: Pembaruan ke upstream v0.8.119 (commit `3a0299e851ce`). Mengadaptasi kontrak render deklaratif berbasis data attributes (`data-composition-id`, `data-width`, `data-height`, `data-fps` pada elemen root dan `data-start`, `data-duration`, `data-track-index` pada elemen klip berkelas `.clip`). Memperbarui pipeline CLI resmi (`npx hyperframes render [dir] -o <path> -f <fps> -q <quality> [--format]`) dengan fallback CDP/FFmpeg. Menegaskan prasyarat Node.js ≥22 dan FFmpeg lokal (jika tidak lengkap -> `NOT_CONFIGURED`, dilarang melaporkan PASS palsu). Menolak instalasi skill luar (`npx skills add heygen-com/hyperframes` dan `npx hyperframes skills update` dilarang).
+- `awesome-opus5-5-videos`: Penambahan referensi first-party `POINTER_ONLY` di `skills/hyperframes/references/prompt-patterns.md` (snapshot `3d54892e2ae5b0e8d337171e6508bba4cec01ab8`, 2026-09-29). Menjelaskan translasi prompt viral satu baris menjadi brief HyperFrames berparameter deterministik tanpa menyalin prompt, dataset, atau media pihak ketiga. Menambahkan pointer di `rules/00-routing.md`.
+- Migrasi Matt Pocock cluster: Format nama domain glossary diperbarui dari konvensi lama `CONTEXT.md` / `CONTEXT-MAP.md` menjadi `GLOSSARY.md` / `GLOSSARY-MAP.md` mengikuti upstream v1.3. Berkas `skills/domain-modeling/CONTEXT-FORMAT.md` dipindahkan menjadi `GLOSSARY-FORMAT.md`. Seluruh referensi pada spesialis dan aturan (`domain-modeling`, `grill-with-docs`, `codebase-design`, `tdd`, `diagnosing-bugs`, `/improve-codebase-architecture`, `/why`, `00-routing.md`, `03-prose-discipline.md`) diselaraskan ke `GLOSSARY.md`. Fallback kompatibilitas backward dipertahankan di `domain-modeling` dan `grill-with-docs` agar repositori pengguna yang sudah memiliki `CONTEXT.md` tetap terbaca tanpa diubah secara sepihak. Menolak impor skill baru dari upstream (`implement-spec`, `pr`, `retro`).
+- Pembersihan referensi mati & bump minor: Menghapus referensi `game-asset-core` pada `visual-studio` dan `scroll-world`, digantikan status `NOT_APPLICABLE (out of catalog)` sesuai batas routing. `humanizer` diperbarui ke v3.1.0 (`225a6f39ac85`) dengan adaptasi pola 25 & 26 (menulis tentang dokumen itu sendiri dan menjelaskan ulang konteks yang sudah diketahui). `diagram-design` di-pin ke 2.6.51 (`f903933a534b`). Evaluasi upstream `impeccable` v4.5.0 ditunda (deferred) demi menjaga integritas batas catalog freeze dan arsitektur specialist.
+- Sumber dan pin diperbarui di `VERSION`, `vendor/sources.json`, `vendor/provenance.json`, `vendor/license-audit.json`, `docs/CATALOG-FREEZE.md`, `docs/source-wave.md`, dan `README.md`. Versi produk 0.1.12.
+- Release-prep & dokumentasi: Penyelarasan pin upstream Matt Pocock ke `d81f3a1` di seluruh dokumentasi dan third-party notices, pencatatan evaluasi `impeccable` v4.5.0 (deferred) di `docs/source-wave.md`, penambahan ringkasan "What's new (0.1.11 + 0.1.12)" pada `README.md`, verifikasi 25 closed intents, dan penegasan status catalog freeze 65/65 untuk rilis ganda v0.1.11 dan v0.1.12.
+
+## 0.1.11 — 2026-10-04
+
+Wave 0.1.11 body-only ("web_research" data-gathering). Katalog tetap 65 (50 model + 15 manual). Tidak ada pertumbuhan allowlist (`vendor/skill-allowlist.txt` tidak berubah). Tidak ada penambahan atau pensiun skill. Exception 0.1.8 tetap spent.
+
+- Closed intent bertambah 24 → 25: menambahkan `web_research` yang dipetakan ke spesialis `research` (pembaruan badan skill + referensi baru `skills/research/references/web-data.md`).
+- `research`: pembaruan deskripsi dan instruksi untuk pengumpulan data web dan media sosial secara read-only. Aturan sumber primer tetap berlaku: setiap klaim wajib merujuk ke sumber primer pemiliknya, output berupa data.
+- Ladder backend web data: `WebSearch`/`WebFetch` ringan → ekstraksi artikel Markdown via `crawl4ai` (jika aktif) → structured scraping via `scrapling` (jika aktif) → penangkapan background XHR/JSON via skrip sementara di `/tmp` → feed pengembang/API tanpa konfigurasi via CLI `agent-reach` (pointer host) → platform berotentikasi (kredensial milik pengguna, tidak menyimpan cookie/token) → alur sesi browser persisten via `browser-act`. Pengujian aplikasi UI lokal tetap menggunakan `playwright-qa`.
+- Batasan etika & keamanan scraping: bypass stealth dan anti-bot nonaktif secara default (hanya atas persetujuan eksplisit pengguna); patuhi `robots.txt` dan delay sopan; dilarang membobol paywall/login; dilarang mengekstrak cookie dari browser desktop pengguna (`--from-browser` dilarang); dilarang proxy rotasi penipuan.
+- Scrapling: dipromosikan menjadi MCP opsional `FOREIGN_ON_DEMAND` lokal stdio (`uvx --from scrapling[ai]==0.4.15 scrapling mcp`). Dikelola lewat CLI `opencode-he scrapling enable` dan `opencode-he scrapling disable`. Tidak divendor ke `lib/`. Mode `--http`, docker bind-all, dan binding `0.0.0.0` dilarang keras dan ditolak oleh `doctor`. Dilarang menjalankan `scrapling install` (karena memanggil `playwright install-deps` dengan sudo).
+- Agent-Reach: ditetapkan sebagai `POINTER_ONLY` CLI pada host di bawah `research` (`skills/research/references/web-data.md`). Ditolak sebagai MCP maupun skill. Dilarang menjalankan `agent-reach install --system` (karena memutasi paket sistem dan menyalin skill asing ke direktori konfigurasi).
+- Deteksi `doctor`: menambahkan pemeriksaan versi CLI `agent-reach` dan deteksi pembajakan router oleh direktori skill tak terkelola (`FOREIGN_SKILL_SHADOW` untuk `agent-reach` atau `scrapling-official` di `~/.config/opencode/skills/` tanpa `.opencode-highend.json`).
+- `whaleyxbt/patchright-enhanced`: ditolak secara tegas di seluruh dokumentasi karena risiko keamanan dan pemeliharaan fork tidak resmi.
+- Batasan spesialis tetangga dipertegas: `playwright-qa` dan `browser-act` menegaskan pengumpulan data web/sosial bukan tugas QA aplikasi dan diarahkan ke `research`.
+- Sumber dan pin diperbarui di `vendor/sources.json`, `vendor/provenance.json`, `vendor/license-audit.json`, `vendor/mcp-policy.json`, `vendor/mcp-wanted.json`, `THIRD_PARTY_NOTICES.md`, dan `docs/source-wave.md`. Versi produk 0.1.11.
+
 ## 0.1.10 — 2026-10-03
 
 Rilis ini menutup kerja yang sudah di `main` setelah tag `v0.1.9`. Katalog tetap 65 (50 model + 15 manual). Tidak ada pertumbuhan allowlist. Tidak ada penambahan atau pensiun skill.

diff --git a/README.md b/README.md
@@ -4,12 +4,12 @@ OpenCode 2 overlay: 65 frozen routed skills, thin `AGENTS.md`, `opencode-he`.
 
 Installer and runtime overlay for [OpenCode 2](https://opencode.ai/v2/docs/).
 
-Version **0.1.10**. The 65-skill catalog is strictly frozen.
+Version **0.1.12**. The 65-skill catalog is strictly frozen.
 
 ## What it is
 
 - 65 skills: 50 model-invoked, 15 manual slash commands (frozen; see [docs/CATALOG-FREEZE.md](docs/CATALOG-FREEZE.md))
-- A thin `AGENTS.md` router (lazy, one primary specialist, 24 closed intents)
+- A thin `AGENTS.md` router (lazy, one primary specialist, 25 closed intents)
 - Core MCP: Codebase Memory (dual CLI and MCP graph adapters), Context7, shadcn
 - 12 Universal Design Banks + Operator Banks (34,700+ items across Identity, Motion, Section, Atomic, and Oversight) with zero-token local search & Google Drive v3 bootstrap
 - Design Bank path resolution via `~/.config/opencode/highend/config/design-bank.json`
@@ -22,7 +22,7 @@ Version **0.1.10**. The 65-skill catalog is strictly frozen.
 - Emil motion doctrines live under `emil-design-eng` references (not extra skills)
 - Design Intelligence (lazy, inside Impeccable)
 - `opencode-he doctor`, `opencode-he cbm` status/index helpers, transactional install, uninstall, restore
-- Selected skills adapted from Matt Pocock (`9c9f36c`) and pstack `23e4138` (0.15.6) with OpenCode host isolation and verification-loop rigor
+- Selected skills adapted from Matt Pocock (`d81f3a1`) and pstack `23e4138` (0.15.6) with OpenCode host isolation and verification-loop rigor
 - Claude Code isolation: `OPENCODE_DISABLE_CLAUDE_CODE=1`
 
 ## What it is not
@@ -38,6 +38,18 @@ Version **0.1.10**. The 65-skill catalog is strictly frozen.
 - Not OpenCode 1.x (installer fails closed on 1.x)
 - Not claimed as macOS/Windows-tested (Linux x86_64 only for this release)
 
+## What's new (0.1.11 + 0.1.12)
+
+- **Web research intent & backend ladder (0.1.11)**: Added `web_research` closed intent (25 closed intents total) mapped to `research` with primary-source discipline and ethical data gathering (`references/web-data.md`).
+- **Scrapling optional MCP (0.1.11)**: Added `scrapling` as local stdio `FOREIGN_ON_DEMAND` MCP (`uvx --from scrapling[ai]==0.4.15 scrapling mcp`) with fail-closed safety (no `--http`, no `0.0.0.0`, no `scrapling install`).
+- **Agent-Reach host pointer (0.1.11)**: Documented `agent-reach` as pointer-only host CLI; doctor detects unmanaged skill shadowing.
+- **HyperFrames declarative render refresh (0.1.12)**: Upstream v0.8.119 (`3a0299e`) declarative data attributes (`data-composition-id`, `.clip` with `data-start`/`data-duration`), official CLI render pipeline, and Node ≥22 / local FFmpeg requirement.
+- **Code-driven animation prompt patterns (0.1.12)**: First-party `POINTER_ONLY` prompt patterns in `skills/hyperframes/references/prompt-patterns.md` (inspired by `awesome-opus5-5-videos` without vendoring third-party assets).
+- **Matt Pocock cluster GLOSSARY migration (0.1.12)**: Domain modeling conventions aligned to upstream v1.3 (`GLOSSARY.md` / `GLOSSARY-MAP.md` format) across all specialists and rules with backward compatibility for existing `CONTEXT.md` files; pin updated to `d81f3a1`.
+- **Humanizer v3.1.0 update (0.1.12)**: Upstream v3.1.0 (`225a6f3`) adding patterns 25 & 26 (meta-commentary and re-explaining known context).
+- **Catalog freeze strictly preserved**: Exactly 65 routed skills (50 model-invoked + 15 manual commands); zero additions or retirements.
+- **Core MCPs strictly preserved**: Codebase Memory (v0.11.0), Context7, and shadcn (`4.21.0`) remain the only core MCP servers.
+
 ## Quickstart
 
 ```bash
@@ -125,6 +137,7 @@ Default: repository evidence first. Then at most one specialist.
 | 9Router gateway (inference/image/video/TTS/STT/web) | `ninerouter` |
 | Deterministic HTML composition video | `hyperframes` (18s brag card via `references/brag.md`) |
 | Demo video aplikasi & narasi ID | `id-demo-video` (`/demo-video`) |
+| Web / social data gathering | `research` (backend ladder in `references/web-data.md`; Scrapling optional MCP; read-only; not QA) |
 | Browser | `playwright-qa` (isolated verification edge; evidence ledger) → `browser-act` → `chrome-devtools-axi` → `click-path-audit` |
 | Documents (PDF/DOCX/answer/extract/review) | `smartdoc` |
 | Consulting PPTX & 16:9 slide decks | `deck-design` |
@@ -137,7 +150,7 @@ Default: repository evidence first. Then at most one specialist.
 | TS Oxlint install | `install-anti-slop` (explicit only) |
 | Architecture bake-off | `/architect` (manual) |
 
-Warehouse: `api-design`, `contract-first`, `automation-audit-ops`, `code-tour`, `click-path-audit` (plus Wave 2 diagnostics). Wave 0.1.7 additions: `json-render` (generative UI from typed catalogs), `deck-design` (consulting-grade PPTX & 16:9 HTML slide decks), `pageindex` (vectorless tree-reasoning long document navigation). Wave 0.1.8 additions: `business-motion-film` (commercial launch films; retires `img2threejs`), `ninerouter` (multi-provider gateway stub; retires `prompt-optimizer`). Wave 0.1.9 body-only: merges `kaventro/motion-designer` into `business-motion-film` (product-film doctrine for real app UI; catalog strictly 65/65). Wave 0.1.10: `found-this-design` indexes Oversight Supply and the Design Bank bootstrap pin moves to DesignBank v3; pstack selected-skill provenance moves to `23e4138` (0.15.6) with host adaptation (`poteto-mode` rejected). Catalog stays 65.
+Warehouse: `api-design`, `contract-first`, `automation-audit-ops`, `code-tour`, `click-path-audit` (plus Wave 2 diagnostics). Wave 0.1.7 additions: `json-render` (generative UI from typed catalogs), `deck-design` (consulting-grade PPTX & 16:9 HTML slide decks), `pageindex` (vectorless tree-reasoning long document navigation). Wave 0.1.8 additions: `business-motion-film` (commercial launch films; retires `img2threejs`), `ninerouter` (multi-provider gateway stub; retires `prompt-optimizer`). Wave 0.1.9 body-only: merges `kaventro/motion-designer` into `business-motion-film` (product-film doctrine for real app UI; catalog strictly 65/65). Wave 0.1.10: `found-this-design` indexes Oversight Supply and the Design Bank bootstrap pin moves to DesignBank v3; pstack selected-skill provenance moves to `23e4138` (0.15.6) with host adaptation (`poteto-mode` rejected). Wave 0.1.11 body-only: adds `web_research` closed intent to `research` with `references/web-data.md`; Scrapling optional MCP; Agent-Reach pointer-only host tool; catalog strictly 65/65. Wave 0.1.12 body-only: `hyperframes` v0.8.119 refresh (declarative data attributes, CLI render); `awesome-opus5-5-videos` POINTER_ONLY prompt patterns; Matt cluster `GLOSSARY.md` migration; `humanizer` v3.1.0; catalog strictly 65/65.
 
 Examples: interactive product story told by scroll → `scroll-craft`. Unbroken camera through a miniature factory → `scroll-world`. Clean security dashboard → `impeccable`. Video, image generation, and Design V2 stay optional.
 
@@ -189,6 +202,7 @@ Optional:
 - `ui-skills` — `opencode-he ui-skills enable` registers UI Skills (`https://www.ui-skills.com/mcp`) as an optional remote MCP server. `FOREIGN_ON_DEMAND` for design-skill lookup only. Product UI remains Design Bank + Impeccable + Design V2 atoms + shadcn; `BANK_MISS` never generates from a random ui-skills document. `opencode-he ui-skills disable` removes only that server key. Absent is not a `doctor` failure; a malformed entry fails closed.
 - `markitdown` — `opencode-he markitdown enable` registers MarkItDown as a local stdio ingest converter (`uvx --from markitdown-mcp==0.1.8 markitdown-mcp`). `FOREIGN_ON_DEMAND`. Local trusted agents only; never `--http` / `0.0.0.0` / docker bind-all. Output is Markdown data; SmartDoc keeps contract/QA/render. `opencode-he markitdown disable` removes only that server key. Absent is not a `doctor` failure; a malformed entry fails closed.
 - `crawl4ai` — `opencode-he crawl4ai enable` registers Crawl4AI as an optional web content extraction remote MCP (`http://127.0.0.1:11235/mcp`; `--cloud` registers `https://api.crawl4ai.com/mcp` with `{env:CRAWL4AI_KEY}`). `FOREIGN_ON_DEMAND`. Docker users bind `127.0.0.1:11235`, never `0.0.0.0`. Web content extraction only; not an exploratory QA tool (`playwright-qa` remains default). `opencode-he crawl4ai disable` removes only that server key. Absent is not a `doctor` failure; a malformed entry (or `0.0.0.0`) fails closed.
+- `scrapling` — `opencode-he scrapling enable` registers Scrapling as an optional local stdio MCP (`uvx --from scrapling[ai]==0.4.15 scrapling mcp`). `FOREIGN_ON_DEMAND`. Structured web scraping and element extraction only; not an exploratory QA tool (`playwright-qa` remains default). Never run `scrapling install` (runs `playwright install-deps` with sudo). `opencode-he scrapling disable` removes only that server key. Absent is not a `doctor` failure; a malformed entry (or `--http` / `0.0.0.0` / docker bind) fails closed.
 - `jev-mcp` — TypeSafe Jev / `jkudish/jev-mcp` is intentionally SKIPPED as a required runtime MCP; core verification and done-gates operate offline without external server dependencies.
 - `pageindex` — PageIndex Cloud MCP is `FOREIGN_ON_DEMAND` and omitted from core servers; skill `pageindex` operates offline or uses local SDK with graceful `NOT_CONFIGURED` degradation.
 - `exa` — `FOREIGN_ON_DEMAND`; installer never adds, removes, or overwrites it
@@ -344,7 +358,7 @@ Officially tested:
 - OpenCode 2.x
 - Python 3, Node + npx, git, curl, tar
 
-Optional host tools: Chromium, `gh`, browser-act, serena, semgrep, osv-scanner, gitleaks.
+Optional host tools: Chromium, `gh`, browser-act, agent-reach, serena, semgrep, osv-scanner, gitleaks.
 
 ## Security model
 
@@ -357,4 +371,4 @@ See [docs/security.md](docs/security.md).
 
 ## Provenance & Licenses
 
-OpenCodeHighEnd is MIT-licensed for first-party installer, docs, overlays, and tests (see [LICENSE](LICENSE)). Selected skills are adapted from [mattpocock/skills](https://github.com/mattpocock/skills) (`9c9f36c`, MIT) and [cursor/plugins](https://github.com/cursor/plugins) `pstack/` pinned to `23e4138` (pstack 0.15.6, MIT) under OpenCode host conventions. Upstream vendored components and skills retain their original licenses as evidenced in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+OpenCodeHighEnd is MIT-licensed for first-party installer, docs, overlays, and tests (see [LICENSE](LICENSE)). Selected skills are adapted from [mattpocock/skills](https://github.com/mattpocock/skills) (`d81f3a1`, MIT) and [cursor/plugins](https://github.com/cursor/plugins) `pstack/` pinned to `23e4138` (pstack 0.15.6, MIT) under OpenCode host conventions. Upstream vendored components and skills retain their original licenses as evidenced in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).