Changelog

Second audit-followup batch (docs/audit-2026-06-11.md, Track C). slice.json.version is now the declared version SSOT: audit:slices errors if slice.contract.ts or slice.manifest.json disagree. Reconciled the existing drift — 12 contracts (notion-shell was 19 minors stale at 0.5.0 vs 0.24.0; all migrations-empty so the bump is safe) and 4 manifests — so the snapshot/migration system (which prefers contract.version) and the install tag stop mislabelling. The hand-curated catalog (lib/content/slices.ts) carries a display-only version that nobody bumps; rather than wedge commits behind ~34 hand-edits, a warn-only report-slices-drift.mjs now surfaces it at validate:all tail (34 entries drifted, 1 catalog-only). Durable fix is to generate the catalog version from slice.json — tracked, not yet done.

First batch of fixes from the 2026-06-11 full-surface audit (docs/audit-2026-06-11.md). The live assistant SSE route now sends X-Accel-Buffering: no, so per-delta streaming no longer collapses into a single end-of-turn flush behind the Dokploy/Traefik proxy. CopyButton gained aria-pressed + a state-aware aria-label and now surfaces a toast on clipboard failure instead of swallowing it silently. The catalog search placeholder is English ("Search…" not "Cari…"), and the ⌘K hint is hidden on mobile where it can't fire. A new CONTRIBUTING.md documents the three-surface sync, slice-authoring flow, validation tiers, and git hooks. pre-commit now gates skills SSOT drift (sync-skills --check) so the site can't advertise a skill the CLI doesn't ship.

The variant selector on every slice's Live tab (and in the Bundle Builder) is now a compact shadcn Tabs strip instead of a hand-rolled button group — one identical control across all 48 preview slices, with keyboard navigation from radix for free. Also fixes a real knob bug: axes that only feed a widget's INITIAL state did nothing on change, because the widget re-rendered without remounting. First seen on convex-auth — its defaultPasswordMode knob flips the password block's starting tab, but PasswordBlock keeps the mode in useState, so toggling signin/signup was a no-op. LazyWidget now keys the widget on the variant selection: every knob change remounts, so every declared axis takes effect on every slice.

A slice is NOT an agent — it exports a COLLECTION of function-calling tools, and ONE shared agent aggregates collections across slices. The shared kit (@/shared/agentic) ships the registry (namespaced tool aggregation + anthropicTools()), the single agent loop (runAgentLoop), a global host with mount-time self-registration (useAgentTools — remount-safe ctx rebinding), schema builders, and composable custom instructions (registry.systemPrompt() = BASE_AGENT_SYSTEM + each collection's guidance). rr holds NO model key anywhere: per slice it ships exactly (1) a custom instruction and (2) a function list; consumers bring their own key + transport — docs/agentic-byok-binding.md is the complete copy-paste binding. Safety seam: tools flag dangerous:true, runAgentLoop's confirm event runs BEFORE execution (decline = the model gets a denied tool_result), agent.md marks each one ⚠ destructive, and requirePerm() offers RBAC defense-in-depth. Coverage: 10 OS apps, 9 admin collections, 20 data/ui collections, landing-sections as the page-builder (list/add/update/remove over its LandingStore), and thin configure tools on the presentational slices — 47 total, each documented under "Tools (agentic surface)" + "Agent guidance" in its agent.md.

Closes every item deferred as riskier/design-level from the 2026-06-09 audit sweep. The site's Dockerfile is now a multi-stage standalone build (output gated behind NEXT_OUTPUT_STANDALONE=1 so local next start keeps working; outputFileTracingIncludes covers every runtime fs walk — without it the standalone image silently serves empty slice Code tabs). Site-wide CSP lands (frame-ancestors 'self'; object-src 'none'; base-uri 'self'; admin surfaces get frame-ancestors 'none'). The super-admin gate now requires a VERIFIED email on top of address equality — an unverified password sign-up of the admin address no longer owns the deployment (escape hatch env for dev). The Anonymous auth provider left the default copy-source (it made every requireUser gate satisfiable in one click). KaTeX (~280kB) lazy-loads at all four former static-import sites with a raw-TeX fallback that upgrades in place (markdown 0.3.1, notion 1.1.1, notion-shell 0.23.x). And the DateField primitive the hard rules referenced finally exists (Popover + Calendar), replacing the last input type=date.

Backfilled entry for the big upstream sync (landed 2026-06-10 alongside the agentic waves). appshell 1.4.0 rebuilds the Android (Material-You) shell — wallpaper clock, pull-down Control Center, Spotlight pill — and bundles a single-pane Dashboard shell; browser 1.1.0 gains a Chrome-style multitab strip + screencast hook; os-terminal puts a PTY surface behind an injectable configurePty seam with a LIVE/MOCK banner; file-explorer 1.2.0, assistant 1.1.0, reel-editor 1.1.0 (container-first compact mode), image-editor 2.1.0, app-store 1.1.0, media-viewer 1.1.0, system-monitor 1.1.0, image-picker 0.2.0 (debounced Unsplash search + CSS-escaped url() values), code-editor 1.1.0 all sync responsive/touch upgrades from upstream. New lifts: media-studio 1.0.0 (standalone canvas studio on a configureMediaStudio seam), quicklinks 1.0.0 (injectable QuicklinksStore), shell-settings 1.0.0 (settings-app UI primitives over an AppearanceAdapter).

New motion-kit slice (0.1.0): zero-dependency scroll-motion layer (IntersectionObserver + CSS) plus embla Carousel and radix Accordion. Ships Reveal (fade-up/fade/fade-left/fade-right/zoom), Stagger (incremental per-child reveal for grids), CountUp (rAF count-to-value, locale-aware), Marquee (infinite logo strip, hover-pause), useInView hook, Carousel*, Accordion*. All reveal/keyframe motion gated behind prefers-reduced-motion. Consumers append globals-motion.css to app/globals.css. Lifted from the _templates fleet where 8 standalone website templates already ship a byte-identical copy (motion pass 2026-06-10); this rr slice is now the SSOT for future scaffolds. carousel.tsx split into carousel.tsx + carousel-context.tsx to stay under the 200-LOC gate. Pairs with landing-sections (its kind renderers consume these primitives).

First REAL consumption of the payment base — and it found real bugs. New storefront-checkout slice (0.1.0): guest cart (CartProvider + localStorage), CartWidget header sheet with qty steppers, CheckoutSummary — props-driven R3, host re-prices server-side (client subtotal is display-only). doku-payment 0.2.0: paymentOrders.userId now optional with guest buyer contact, create actions key-guarded ({ok:false,notice} when DOKU creds unset — fresh clones never crash), status query guest-readable via unguessable orderId, DokuDirectForm's raw <select> replaced with themed shadcn Select (same white-dropdown class bug onboarding-wizard fixed) and supports server-generated orderIds. Fixed broken _generated paths that proved the base was never consumed: internal.features.payment.mutations.* → .mutation.* (file is mutation.ts) in doku/midtrans actions + webhook handlers, api.features.payment.queries.* → .query.*. Payment feature README rewritten to match the ACTUAL shared-table schema (the namespace-split tables it described were never applied). End-to-end host wiring (catalog → cart → server-priced placeOrder → DOKU Direct instructions → webhook) shipped live on wirausaha-os as the reference implementation.

configureAgentStream is now wired to a real Anthropic backend. New /api/agent-stream SSE proxy runs one model turn per call; the client-side runAgentLoop dispatches each tool_use against the live tool registry (tools bind to real React state, so they execute in the browser). createSseAgentStream + an AgentBridge mounted across /preview flip the assistant from the typing-demo to driving the 10 registered OS-app tool collections for real. Key-guarded (ANTHROPIC_API_KEY) + per-IP rate limited; falls back to the demo when unconfigured.

Hardening W5, closing the report's core critique: structural gates were strong but nothing verified behavior — the U7 dead-toggle shipped without a single failing test. New targeted suites (+22 tests, 425 total): nav-parts interaction tests click the actual Collapsible triggers (toggle works, collapsed-by-default, and the group/* class sits on the data-state carrier — the exact U7 chevron regression); recently-updated-badge asserts the card variant renders NO anchor (the W2 nested-<a> regression) and that deep links are page-aware; validate-changelog gets fixture-driven unit tests (future date, dup id, wrong epoch unit) via a new optional dir arg; and an offline CLI e2e spawns `rr info blog-section` to pin the U3 alias fall-through ('superseded by landing-sections'). Coverage measurement exists for the first time: vitest --coverage via @vitest/coverage-v8, baseline 35% statements / 38% lines — a number to move, not a gate (yet).