kuker24 · kuker24 · Oct 4, 2026 · Oct 4, 2026 · Oct 4, 2026 · Oct 4, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.13 — 2026-10-04
+
+Wave 0.1.13 upstream sync across 6 discrete scopes (A–F). Katalog tetap 65 (50 model + 15 manual). Closed intents tetap 25. Tidak ada penambahan atau pensiun skill (`vendor/skill-allowlist.txt` dan `vendor/skill-policy.json` tidak berubah).
+
+- **Scope A (Pins & MCP)**: Pembaruan pin MCP `shadcn@4.21.1`, `@reticlehq/server@3.5.0`, `markitdown-mcp==0.0.1a7` dengan `markitdown[all]==0.1.8`, dan standardisasi `crawl4ai` endpoint ke `/mcp/sse` (URL lama `/mcp` memicu peringatan `CRAWL4AI_LEGACY_URL`). Menambahkan deteksi shadow `context7-mcp` pada doctor.
+- **Scope B (Skill Refresh)**: Memperbarui `playwright-qa` dengan opsi emulasi perangkat (`open --device`), resize viewport (`resize`), perintah sesi media (`set-color-scheme`, `set-reduced-motion`), dan batas keamanan WebMCP (`webmcp-list`, `webmcp-call`). Menambahkan mode `update` pada `install-anti-slop` (`manage.mjs`) untuk memperbarui aset vendored sambil menjaga preferensi profil. Menyelaraskan handoff browser dual-door pada `scroll-craft`.
+- **Scope C (Doctrines)**: Mengadaptasi doktrin adversarial UI stress testing `break-ui` (Emil Kowalski) ke `skills/impeccable/reference/break-ui.md` dengan alur 6 fase, dev toggle, dan failure signatures. Mengadaptasi hierarki penegakan invarian 5 level `pstack /correct` ke `manual-skills/reflect/references/correct.md`. Memperbarui `business-motion-film` (product-film mode) dengan scored review 7 dimensi, tinjauan layar ponsel 360 px, dan rata-rata subframe motion blur. Memperbarui `manual-skills/architect` dengan lensa kontributor agent (asumsi perbaikan lokal harus aman global).
+- **Scope D (Tata Kelola & Inventaris)**: Pembaruan catatan disposisi upstream di `docs/source-wave.md` dan `docs/warehouse-inventory.md` untuk sinkronisasi wave 0.1.13. Batas lisensi GPL-3.0-or-later repository `oraios/serena` (`6707cd9b7efbaea1435fb7bfd7ff20d4b5916983`) ditegaskan tetap sebagai pointer eksternal (`POINTER_ONLY`/`OPTIONAL_ABSENT`).
+- **Scope E (Atribusi & Notices)**: Sinkronisasi atribusi upstream pada `THIRD_PARTY_NOTICES.md`, `vendor/sources.json`, `vendor/license-audit.json`, dan berkas `NOTICE.md` terkait (`skills/business-motion-film/NOTICE.md`, `skills/install-anti-slop/NOTICE.md`, `skills/playwright-qa/NOTICE.md`, `skills/scroll-craft/NOTICE.md`). Bukti lisensi pstack diperbarui ke `e43c7ee` (0.15.9). Label Matt Pocock distandardisasi menjadi `v1.3.0 (d81f3a1; tag 984a2c0 = version bump)`. Full SHA hyperframes (`6037d228441e`) dan ninerouter (`a99cf57239ff`) diverifikasi penuh.
+- **Scope F (Rilis)**: Bump versi produk ke 0.1.13 (`VERSION`, `vendor/sources.json`, `vendor/provenance.json`, `vendor/license-audit.json`, `docs/CATALOG-FREEZE.md`, `README.md`). Menjalankan seluruh test suite secara komprehensif.
+- Design Bank: pensiunkan fallback #4 GitHub release artifact (kuker24/GrokBestFriend 404); prioritas bootstrap kini: local bank -> operator URL/SHA -> Google Drive ZIP pin.
+
 ## 0.1.12 — 2026-10-04
 
 Wave 0.1.12 body-only ("skill-refresh"). Katalog tetap 65 (50 model + 15 manual). Tidak ada pertumbuhan allowlist (`vendor/skill-allowlist.txt` tidak berubah). Tidak ada penambahan atau pensiun skill. Exception 0.1.8 tetap spent.

diff --git a/README.md b/README.md
@@ -4,7 +4,7 @@ OpenCode 2 overlay: 65 frozen routed skills, thin `AGENTS.md`, `opencode-he`.
 
 Installer and runtime overlay for [OpenCode 2](https://opencode.ai/v2/docs/).
 
-Version **0.1.12**. The 65-skill catalog is strictly frozen.
+Version **0.1.13**. The 65-skill catalog is strictly frozen.
 
 ## What it is
 
@@ -17,12 +17,12 @@ Version **0.1.12**. The 65-skill catalog is strictly frozen.
 - Evidence-blocked done-gate (`FACT:` / `JUDGMENT:`) via verification rules + `/decision-log`
 - UI polish checklists merged into `emil-design-eng` + practical a11y & React smell checklist in `impeccable` (`react-doctor` as on-demand `OPTIONAL_TOOL`)
 - Generative UI from typed schemas via `json-render`, consulting slide factories via `deck-design`, vectorless tree-reasoning long-doc nav via `pageindex`, commercial launch films & real app UI product-film mode via `business-motion-film`, gateway routing via `ninerouter`
-- Core MCP pins: Codebase Memory **0.11.0** (tarball and inner-binary SHA-256) and `shadcn@4.21.0`
+- Core MCP pins: Codebase Memory **0.11.0** (tarball and inner-binary SHA-256) and `shadcn@4.21.1`
 - Email design is an Impeccable reference, not a new skill (raw HTML uses tables; React Email / MJML may use framework components)
 - Emil motion doctrines live under `emil-design-eng` references (not extra skills)
 - Design Intelligence (lazy, inside Impeccable)
 - `opencode-he doctor`, `opencode-he cbm` status/index helpers, transactional install, uninstall, restore
-- Selected skills adapted from Matt Pocock (`d81f3a1`) and pstack `23e4138` (0.15.6) with OpenCode host isolation and verification-loop rigor
+- Selected skills adapted from Matt Pocock (`v1.3.0 (d81f3a1; tag 984a2c0 = version bump)`) and pstack `e43c7ee` (0.15.9; `/correct` at `9511e60`) with OpenCode host isolation and verification-loop rigor
 - Claude Code isolation: `OPENCODE_DISABLE_CLAUDE_CODE=1`
 
 ## What it is not
@@ -31,13 +31,21 @@ Version **0.1.12**. The 65-skill catalog is strictly frozen.
 - Not your provider keys, models, or auth state
 - Not a Design Bank media repository
 - Not a multi-agent swarm (explicit, artifact-gated specialist graph)
-- Not adopting foreign autopilot loops, swarms, or Cursor model rules: pstack selected skills are pinned to `23e4138` with OpenCode host adaptation; `poteto-mode`, `/how`, and `~/.cursor/rules/pstack-models.mdc` are rejected
+- Not adopting foreign autopilot loops, swarms, or Cursor model rules: pstack selected skills are pinned to `e43c7ee` (0.15.9) with OpenCode host adaptation; `poteto-mode`, `/how`, and `~/.cursor/rules/pstack-models.mdc` are rejected
 - Not vendoring external red-team playbooks like `deepteam` (optional external pointer only)
 - Not vendoring monolithic apps (`genoffice`, `monocode`, `openmuse`), external graph databases (`graphiti`, `cognee`), or Jev compose APIs
 - Not adding extra core MCP servers (core remains strictly Codebase Memory, Context7, and shadcn)
 - Not OpenCode 1.x (installer fails closed on 1.x)
 - Not claimed as macOS/Windows-tested (Linux x86_64 only for this release)
 
+## What's new in 0.1.13
+
+- **Upstream Pins & MCP Modernization**: Core MCP `shadcn` bumped to `4.21.1`; `@reticlehq/server` pinned to `3.5.0`; `markitdown-mcp` pinned to `0.0.1a7` with `markitdown[all]==0.1.8`; `crawl4ai` standardized to `/mcp/sse` endpoint; `context7-mcp` shadow detection added to doctor.
+- **Skill Refresh**: `playwright-qa` refreshed with device emulation, viewport resize, and media feature session commands (`set-color-scheme`, `set-reduced-motion`) plus explicit WebMCP security boundaries; `install-anti-slop` gained `update` mode; `scroll-craft` aligned to dual-door browser handoffs.
+- **Doctrines Adopted**: Adversarial UI stress-testing doctrine (`break-ui` by Emil Kowalski) integrated into `skills/impeccable/reference/break-ui.md`; pstack `/correct` invariant enforcement hierarchy (5-level mechanical elimination) integrated into `manual-skills/reflect/references/correct.md`; `business-motion-film` product-film mode upgraded with 7-dimension scored review gate, 360 px phone-size review, and motion blur subframe averaging; `architect` updated with agent contributor mental model and 4 new design red flags (Split ownership, Two ways to do one task, Importable internals, Hand-synced list).
+- **Governance & Notices**: `docs/source-wave.md`, `docs/warehouse-inventory.md`, and `THIRD_PARTY_NOTICES.md` fully synchronized; Serena GPL-3.0-or-later boundary preserved as external pointer only (`POINTER_ONLY` / `OPTIONAL_ABSENT`).
+- **Catalog Freeze Strictly Maintained**: Exactly 65 skills (50 model-invoked + 15 manual) and exactly 25 closed intents; zero allowlist growth.
+
 ## What's new (0.1.11 + 0.1.12)
 
 - **Web research intent & backend ladder (0.1.11)**: Added `web_research` closed intent (25 closed intents total) mapped to `research` with primary-source discipline and ethical data gathering (`references/web-data.md`).
@@ -255,7 +263,6 @@ OPENCODE_DESIGN_BANK_URL=... OPENCODE_DESIGN_BANK_SHA256=... opencode-he design
 Download sources (SHA-256 fail-closed; URL without SHA is refused):
 
 1. **Default Drive pin** in `lib/design_v2/bootstrap_sources.json` (`OpenCodeHighEnd-DesignBank-v3.zip`, SHA-256 `91d90b4ef9e1af9a44b222171ecb8becac521cfc0814117bdcdc08a54e86df53`). Google Drive is contacted only during bootstrap.
-2. **Fallback GitHub artifact** in `vendor/sources.json` (`GrokBestFriend` `Design-bank.tgz`, sha256 `9866f5a8…`). Used when the Drive pin is unavailable.
 
 Operator override: `OPENCODE_DESIGN_BANK_URL` + `OPENCODE_DESIGN_BANK_SHA256`. Drive view links (`/file/d/ID/view`) resolve to `uc?export=download`. A valid local bank (at `OPENCODE_DESIGN_BANK` or `~/Design`) is used as-is — no download.
 
@@ -371,4 +378,4 @@ See [docs/security.md](docs/security.md).
 
 ## Provenance & Licenses
 
-OpenCodeHighEnd is MIT-licensed for first-party installer, docs, overlays, and tests (see [LICENSE](LICENSE)). Selected skills are adapted from [mattpocock/skills](https://github.com/mattpocock/skills) (`d81f3a1`, MIT) and [cursor/plugins](https://github.com/cursor/plugins) `pstack/` pinned to `23e4138` (pstack 0.15.6, MIT) under OpenCode host conventions. Upstream vendored components and skills retain their original licenses as evidenced in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+OpenCodeHighEnd is MIT-licensed for first-party installer, docs, overlays, and tests (see [LICENSE](LICENSE)). Selected skills are adapted from [mattpocock/skills](https://github.com/mattpocock/skills) (`d81f3a1`, MIT) and [cursor/plugins](https://github.com/cursor/plugins) `pstack/` pinned to `e43c7ee` (pstack 0.15.9, MIT) under OpenCode host conventions. Upstream vendored components and skills retain their original licenses as evidenced in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
@@ -6,7 +6,7 @@ First-party installer, docs, overlays, and tests are MIT (see `LICENSE`).
 
 This product vendors OpenCode-adapted skills and Design Intelligence runtime, originally snapshotted through GrokBestFriend 1.3.1 and ClaudeBestFriend 1.4.2-claude.1 (`05e6fdc`).
 
-Selected skills also come from [mattpocock/skills](https://github.com/mattpocock/skills) (`d81f3a1`, MIT © 2026 Matt Pocock) and [cursor/plugins](https://github.com/cursor/plugins) `pstack/` (`23e4138`, MIT © 2026 Lauren Tan). Full plugins are not installed.
+Selected skills also come from [mattpocock/skills](https://github.com/mattpocock/skills) (v1.3.0 (d81f3a1; tag 984a2c0 = version bump), MIT © 2026 Matt Pocock) and [cursor/plugins](https://github.com/cursor/plugins) `pstack/` (`e43c7ee`, pstack 0.15.9, MIT © 2026 Lauren Tan). Full plugins are not installed.
 
 Licenses below are taken from vendored frontmatter or an obvious upstream statement. If a skill has no license in tree, this file says so. **That is not a grant.**
 
@@ -17,25 +17,25 @@ Machine-readable copy: `vendor/license-audit.json`.
 | `adhd` | vendored frontmatter | MIT | follow MIT |
 | `impeccable` | vendored frontmatter | Apache-2.0 | follow Apache-2.0 |
 | Matt Pocock selected skills (`diagnosing-bugs`, `domain-modeling`, `codebase-design`, `writing-for-agents`, `research`, `prototype`, `improve-codebase-architecture`, `wizard`, `grill-with-docs`, `to-spec`, `to-tickets`, `tdd`, `matt-code-review` ← `code-review`) | mattpocock/skills `d81f3a1` MIT LICENSE — `vendor/licenses/MATT-POCOCK-MIT.txt` | MIT | follow MIT |
-| Pstack selected skills (`blast-radius`, `unslop`, `create-verification-skill`, `maintain-verification-skill`, `technical-writing`, `arena`, `interrogate`, `architect`, `decision-log`, `why`, `reflect`, `figure-it-out`) | cursor/plugins pstack `23e4138` | MIT — `vendor/licenses/PSTACK-MIT.txt` | follow MIT |
+| Pstack selected skills (`blast-radius`, `unslop`, `create-verification-skill`, `maintain-verification-skill`, `technical-writing`, `arena`, `interrogate`, `architect`, `decision-log`, `why`, `reflect`, `figure-it-out`) | cursor/plugins pstack `e43c7ee` (0.15.9; `/correct` at `9511e60` merged into `manual-skills/reflect/references/correct.md`) | MIT — `vendor/licenses/PSTACK-MIT.txt` | follow MIT |
 | Snapshot skills (`browser-act`, `chrome-devtools-axi`, `emil-design-eng`, `found-this-design`, `full-audit-keamanan`, `full-performance-audit`, `gh-axi`, `scroll-world`, `visual-studio`) | GrokBestFriend 1.3.1 snapshot + `vendor/licenses/GROKBESTFRIEND-MIT.txt`; skill wrappers MIT. Separate CLIs follow their own packages. | MIT | follow MIT |
 | `scroll-world` | [oso95/scroll-world](https://github.com/oso95/scroll-world) `71cc36d` + GrokBestFriend snapshot; seam QA calibration note merged | MIT © 2026 cyw | follow MIT |
-| `scroll-craft` | [nateherkai/scroll-craft](https://github.com/nateherkai/scroll-craft) `0b81622` — `vendor/licenses/NATEHERK-SCROLL-CRAFT-MIT.txt`; skill `NOTICE.md` | MIT © 2026 Nate Herk | follow MIT |
-| `playwright-qa` | [microsoft/playwright-cli](https://github.com/microsoft/playwright-cli) `655530f` — `vendor/licenses/MICROSOFT-PLAYWRIGHT-CLI-APACHE2.txt`; skill `NOTICE.md` | Apache-2.0 © Microsoft Corporation | follow Apache-2.0 |
+| `scroll-craft` | [nateherkai/scroll-craft](https://github.com/nateherkai/scroll-craft) `75d81f7` — `vendor/licenses/NATEHERK-SCROLL-CRAFT-MIT.txt`; skill `NOTICE.md` | MIT © 2026 Nate Herk | follow MIT |
+| `playwright-qa` | [microsoft/playwright-cli](https://github.com/microsoft/playwright-cli) `b85c7a7` — `vendor/licenses/MICROSOFT-PLAYWRIGHT-CLI-APACHE2.txt`; skill `NOTICE.md` | Apache-2.0 © Microsoft Corporation | follow Apache-2.0 |
 | `taste-guard` | [Leonxlnx/taste-skill](https://github.com/Leonxlnx/taste-skill) `ccbc156` — `vendor/licenses/LEONXLNX-TASTE-MIT.txt`; integrated in Impeccable | MIT © 2026 Leonxlnx | follow MIT |
-| `install-anti-slop` | [dmmulroy/anti-slop](https://github.com/dmmulroy/anti-slop) `e8c4880` — `vendor/licenses/DMMULROY-ANTI-SLOP-MIT.txt`; skill `NOTICE.md` | MIT © 2026 Dillon Mulroy | follow MIT |
+| `install-anti-slop` | [dmmulroy/anti-slop](https://github.com/dmmulroy/anti-slop) `e8c4880` — `vendor/licenses/DMMULROY-ANTI-SLOP-MIT.txt`; skill `NOTICE.md` (updated with `update` mode) | MIT © 2026 Dillon Mulroy | follow MIT |
 | `humanizer` | [blader/humanizer](https://github.com/blader/humanizer) 3.1.0 (`225a6f3`); skill `NOTICE.md` | MIT © 2024-2026 blader contributors | follow MIT |
 | `academic` | Original first-party text. Conceptual pipeline (research→write→review→revise) independently implemented. No source copied from Imbad0202/academic-research-skills (CC-BY-NC-4.0). | MIT © 2026 OpenCodeHighEnd contributors | follow MIT |
-| `hyperframes` | [heygen-com/hyperframes](https://github.com/heygen-com/hyperframes) v0.8.119 (`3a0299e`); skill `NOTICE.md` | Apache-2.0 | follow Apache-2.0 |
+| `hyperframes` | [heygen-com/hyperframes](https://github.com/heygen-com/hyperframes) v0.8.119 (`3a0299e`), refreshed in 0.1.13 to v0.8.122 (`6037d22`); skill `NOTICE.md` | Apache-2.0 | follow Apache-2.0 |
 | `json-render` | [vercel-labs/json-render](https://github.com/vercel-labs/json-render) `c2600d73`; skill `NOTICE.md`. npm packages not vendored. | Apache-2.0 © 2025 Vercel Inc. | follow Apache-2.0 |
 | `deck-design` | [carnot-tech/consulting-pptx-skill](https://github.com/carnot-tech/consulting-pptx-skill) `f50edac`; skill `NOTICE.md`. 62-type packs not vendored. | MIT © carnot-tech contributors | follow MIT |
-| `pageindex` | [VectifyAI/PageIndex](https://github.com/VectifyAI/PageIndex) `037a7dba`; skill `NOTICE.md`. SDK/Cloud not vendored. | MIT © 2026 PageIndex AI / VectifyAI | follow MIT |
+| `pageindex` | [VectifyAI/PageIndex](https://github.com/VectifyAI/PageIndex) `6d23caf4` (v0.2.21); skill `NOTICE.md`. SDK/Cloud not vendored. | MIT © 2026 PageIndex AI / VectifyAI | follow MIT |
 | `diagram-design` | [cathrynlavery/diagram-design](https://github.com/cathrynlavery/diagram-design); skill `NOTICE.md` | MIT © 2024-2026 Cathryn Lavery contributors | follow MIT |
 | Email design doctrine | Merged from [CosmoBlk/email-design](https://github.com/CosmoBlk/email-design) (MIT © 2026 CosmoBlk), [jayesh-bansal/email-pro-max](https://github.com/jayesh-bansal/email-pro-max) (MIT © 2026 Jayesh Bansal), [chunkydotdev/email-skills](https://github.com/chunkydotdev/email-skills) (MIT © 2026 chunkydotdev), and [Olshansk/agent-skills](https://github.com/Olshansk/agent-skills) (MIT © 2026 Olshansk) into `skills/impeccable/reference/email.md` | MIT | follow MIT |
-| Emil Kowalski motion doctrines | Merged from [emilkowalski/skills](https://github.com/emilkowalski/skills) (`85e8e2363b71`) into `skills/emil-design-eng/references/` (`motion.md`, `apple-principles.md`, `native-motion.md`, `interface-feel.md`). Text: `vendor/licenses/EMILKOWALSKI-MIT.txt` | MIT © 2026 Emil Kowalski | follow MIT |
+| Emil Kowalski motion & design doctrines | Merged from [emilkowalski/skills](https://github.com/emilkowalski/skills) (`e8a175de22ae`) into `skills/emil-design-eng/references/` (`motion.md`, `apple-principles.md`, `native-motion.md`, `interface-feel.md`) and `skills/impeccable/reference/break-ui.md` (adversarial UI stress testing). Text: `vendor/licenses/EMILKOWALSKI-MIT.txt` | MIT © 2026 Emil Kowalski | follow MIT |
 | Warehouse Batch 2a (`agent-architecture-audit`, `cost-aware-llm-pipeline`, `eval-harness`, `skill-stocktake`) | Adapted from [affaan-m/ECC](https://github.com/affaan-m/ECC); respective skill `NOTICE.md` files (prompt-optimizer retired in 0.1.8) | MIT © 2024-2026 affaan-m and ECC contributors | follow MIT |
-| `business-motion-film` | [echris6/motion-video-kit](https://github.com/echris6/motion-video-kit) `255562b` — `vendor/licenses/ECHRIS6-MOTION-VIDEO-KIT-MIT.txt`; [kaventro/motion-designer](https://github.com/kaventro/motion-designer) `0cf0ba9` (product-film mode) — `vendor/licenses/KAVENTRO-MOTION-DESIGNER-MIT.txt`; skill `NOTICE.md` | MIT © 2026 echris6; MIT © 2026 kaventro | follow MIT |
-| `ninerouter` | [decolua/9router](https://github.com/decolua/9router) `f01fb90`; skill `NOTICE.md`. First-party gateway stub; skills on-demand. | MIT © 2026 decolua | follow MIT |
+| `business-motion-film` | [echris6/motion-video-kit](https://github.com/echris6/motion-video-kit) `255562b` — `vendor/licenses/ECHRIS6-MOTION-VIDEO-KIT-MIT.txt`; [kaventro/motion-designer](https://github.com/kaventro/motion-designer) `7d0b8bb` (v1.2.0, product-film mode with phone review, motion blur, and scored review) — `vendor/licenses/KAVENTRO-MOTION-DESIGNER-MIT.txt`; skill `NOTICE.md` | MIT © 2026 echris6; MIT © 2026 kaventro | follow MIT |
+| `ninerouter` | [decolua/9router](https://github.com/decolua/9router) `a99cf57` (v0.5.95; `f01fb90` base); skill `NOTICE.md`. First-party gateway stub; skills on-demand. | MIT © 2026 decolua | follow MIT |
 | Warehouse Batch 3a (`api-design`, `automation-audit-ops`, `click-path-audit`, `code-tour`, `contract-first`) | Adapted from [affaan-m/ECC](https://github.com/affaan-m/ECC); respective skill `NOTICE.md` files | MIT © 2024-2026 affaan-m and ECC contributors | follow MIT |
 | Design bank media | User-provided public bootstrap artifact or existing local bank | **not cleared** | not in git; normal install does not download it |
 | Codebase Memory, serena, browser-act CLI, Scrapling, Agent-Reach CLI, semgrep, gitleaks, osv-scanner | `vendor/sources.json` | upstream; not vendored | follow upstream |

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-0.1.12
+0.1.13