kuker24 · kuker24 · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+- Upgraded `codebase-memory-mcp` pin to v0.11.0 with SHA-256 verified portable tarball download, and added automatic `--format json` argument propagation in `lib/cbm.py` for reliable JSON extraction across project listing and status commands.
+- Bumped `shadcn` CLI MCP pin to `4.21.0` across `vendor/mcp-wanted.json`, `vendor/mcp-policy.json`, `lib/install.py`, `rules/00-routing.md`, and doctor tests.
+- Refreshed `impeccable` craft floor mechanics in `skills/impeccable/reference/craft-floor.md` from upstream `skill-v4.3.1` / main (tracking caps at -0.04em, single elevation declarations via border or shadow, banning amateur sketch imitation in SVG while preserving geometric linework, subject-world textures, and truth-grounded claims).
+- Created `skills/impeccable/reference/email.md` synthesizing email design intelligence and bulletproof rendering (CosmoBlk, email-pro-max, email-skills, agent-skills): 6 committed archetypes (Editorial, Bold-mono, Minimal-lux, Founder letter, Punk/Character, Lookbook), strict presentation tables (or React Email/MJML framework components), inline CSS, 6-digit hex colors, bulletproof table-cell CTA buttons, preheader anti-spill ZWNJ padding, dark mode resilience, and <100KB deliverability constraints.
+- Wired email design routing into `skills/impeccable/SKILL.md`, `skills/impeccable/reference/routing.md`, and `skills/impeccable/reference/ui-hub.md` to guarantee web component libraries are never mistakenly installed into email templates.
+- Consolidated Emil Kowalski motion doctrines into `skills/emil-design-eng/references/`: created `motion.md` (decision framework, compositor-only properties, production recipes, exit choreography), `apple-principles.md` (WWDC 2018 fluid interfaces, physics-based springs, velocity handoff, momentum projection, materials, SF Pro optical sizing), and `native-motion.md` (eliminating mobile web browser tells, 100dvh, safe area insets, touch-action, overscroll containment, and Expo / React Native Reanimated 3 worklets). Maintained zero new skill names, preserving catalog freeze at 62.
+- Refreshed upstream pins in `vendor/sources.json` for `pbakaus/impeccable` (tag `skill-v4.3.1` `cd12f8660e2d` / verified main `e0881d2de397`), `emilkowalski/skills` (`85e8e2363b71`), `microsoft/markitdown` (v0.1.8 `b8f79c57`, PIN_ONLY), and `kunchenguid/axi` (`85a8723276ca`, PIN_ONLY).
+- Updated `docs/source-wave.md`, `docs/mcp.md`, `README.md`, and `THIRD_PARTY_NOTICES.md` with complete attribution and license notices for merged doctrines.
+- Recorded `CODEBASE_MEMORY_BINARY_CHECKSUM_FAILED` in `docs/troubleshooting.md` (delete download cache and `components/codebase-memory`, then reinstall; v0.11 index rebuilds once). Vendored `vendor/licenses/IMPECCABLE-APACHE2.txt` and `vendor/licenses/EMILKOWALSKI-MIT.txt` so `licenseFile` pins are not empty pointers. `scroll-world` and `browser-act` stay **UPDATE** (not body-refreshed in this wave). markitdown `uvx` invocation stays unpinned (`PIN_ONLY` follow-up).
+
 ## 0.1.3 — 2026-09-23
 
 - Codified the 20-member closed intent classification set in `rules/00-routing.md`, `docs/routing.md`, and `templates/AGENTS.md` (`repo_understand | bug | security | perf | ui_direction | ui_implement | motion | scroll_2d | scroll_3d | img3d | docs | ingest_md | prose | academic | browser_qa | architecture | warehouse | ops_data | video_html | demo_id`).

diff --git a/README.md b/README.md
@@ -154,7 +154,7 @@ Native OpenCode 2 shape (`mcp.servers`, every entry has `type`, `disabled` not V
       },
       "shadcn": {
         "type": "local",
-        "command": ["npx", "-y", "shadcn@4.18.0", "mcp"],
+        "command": ["npx", "-y", "shadcn@4.21.0", "mcp"],
         "disabled": false
       }
     }
@@ -166,7 +166,7 @@ Core (installed):
 
 - `codebase-memory-mcp` — downloaded, SHA-256 verified, Linux x86_64. If the binary will not run, doctor reports `DEGRADED`, never fake `CONNECTED`.
 - `context7` — `https://mcp.context7.com/mcp` (no secret stored)
-- `shadcn` — `npx -y shadcn@4.18.0 mcp`
+- `shadcn` — `npx -y shadcn@4.21.0 mcp`
 
 Optional:
 

diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
@@ -27,6 +27,8 @@ Machine-readable copy: `vendor/license-audit.json`.
 | `academic` | Original first-party text. Conceptual pipeline (research→write→review→revise) independently implemented. No source copied from Imbad0202/academic-research-skills (CC-BY-NC-4.0). | MIT © 2026 OpenCodeHighEnd contributors | follow MIT |
 | `hyperframes` | [heygen-com/hyperframes](https://github.com/heygen-com/hyperframes); skill `NOTICE.md` | Apache-2.0 | follow Apache-2.0 |
 | `diagram-design` | [cathrynlavery/diagram-design](https://github.com/cathrynlavery/diagram-design); skill `NOTICE.md` | MIT © 2024-2026 Cathryn Lavery contributors | follow MIT |
+| Email design doctrine | Merged from [CosmoBlk/email-design](https://github.com/CosmoBlk/email-design) (MIT © 2026 CosmoBlk), [jayesh-bansal/email-pro-max](https://github.com/jayesh-bansal/email-pro-max) (MIT © 2026 Jayesh Bansal), [chunkydotdev/email-skills](https://github.com/chunkydotdev/email-skills) (MIT © 2026 chunkydotdev), and [Olshansk/agent-skills](https://github.com/Olshansk/agent-skills) (MIT © 2026 Olshansk) into `skills/impeccable/reference/email.md` | MIT | follow MIT |
+| Emil Kowalski motion doctrines | Merged from [emilkowalski/skills](https://github.com/emilkowalski/skills) (`85e8e2363b71`) into `skills/emil-design-eng/references/` (`motion.md`, `apple-principles.md`, `native-motion.md`, `interface-feel.md`). Text: `vendor/licenses/EMILKOWALSKI-MIT.txt` | MIT © 2026 Emil Kowalski | follow MIT |
 | Warehouse Batch 2a (`agent-architecture-audit`, `cost-aware-llm-pipeline`, `eval-harness`, `prompt-optimizer`, `skill-stocktake`) | Adapted from [affaan-m/ECC](https://github.com/affaan-m/ECC); respective skill `NOTICE.md` files | MIT © 2024-2026 affaan-m and ECC contributors | follow MIT |
 | Warehouse Batch 3a (`api-design`, `automation-audit-ops`, `click-path-audit`, `code-tour`, `contract-first`) | Adapted from [affaan-m/ECC](https://github.com/affaan-m/ECC); respective skill `NOTICE.md` files | MIT © 2024-2026 affaan-m and ECC contributors | follow MIT |
 | Design bank media | User-provided public bootstrap artifact or existing local bank | **not cleared** | not in git; normal install does not download it |

diff --git a/docs/mcp.md b/docs/mcp.md
@@ -6,9 +6,9 @@ Owned:
 
 | Name | Type | Pin |
 | --- | --- | --- |
-| codebase-memory-mcp | local stdio | 0.9.0 SHA-256 verified |
+| codebase-memory-mcp | local stdio | 0.11.0 SHA-256 verified |
 | context7 | remote HTTP | https://mcp.context7.com/mcp |
-| shadcn | local stdio | `npx -y shadcn@4.18.0 mcp` |
+| shadcn | local stdio | `npx -y shadcn@4.21.0 mcp` |
 
 Optional:
 

diff --git a/docs/source-wave.md b/docs/source-wave.md
@@ -7,13 +7,13 @@ Recorded per Phase 0 contract.
 |---|---|---|:---:|---|---|
 | [miqdadbadjuber/anti-slop](https://github.com/miqdadbadjuber/anti-slop) | `743735248fbaefd76bb56619615687dfa8b3bc1e` (v3.2.9) | UI/copy filter (38 rules R-01–R-38), 3 tiers (Hard Gate, Purpose-Gate, Quality Locks), Delivery Gate checklist, Liveliness dials, during/after usage modes. MIT. | **MERGE** | `skills/impeccable` (taste-guard + direction), `skills/humanizer`, `rules/03-prose-discipline.md` | Filter, not a style guide. Do not vendor as 65th skill (`antislop` or `antislop-ui`). Distinct from Oxlint. |
 | [dmmulroy/anti-slop](https://github.com/dmmulroy/anti-slop) | `e8c4880471b23ab7f216fba7b27d173a6ef07d4c` (v0.1.2) | TypeScript/JavaScript Oxlint static linter ruleset. MIT. | **DONE** | `skills/install-anti-slop` | Already vendored and pinned. Strictly for static code linting on opt-in TS/JS projects. |
-| [microsoft/markitdown](https://github.com/microsoft/markitdown) | `945314a45ddbe02935f2fd287b797dc0ba4a01e4` (v0.1.7 tag `63714e4`) | File to Markdown converter (Office/PDF/HTML/CSV/XLSX/PPTX/EPUB/ZIP). MIT. | **UPDATE** | `skills/markitdown` | Update pin and CLI invocation surface. Output is data-only. SmartDoc keeps contract/QA/render. MCP remains FOREIGN_ON_DEMAND. |
+| [microsoft/markitdown](https://github.com/microsoft/markitdown) | `b8f79c57ebc0044be41323d89b2a45d3fda8460e` (v0.1.8) | File to Markdown converter (Office/PDF/HTML/CSV/XLSX/PPTX/EPUB/ZIP). MIT. | **PIN_ONLY** | `skills/markitdown` | Pinned to v0.1.8 (commit `b8f79c57`). CLI invocation unchanged; output remains data-only. SmartDoc keeps contract/QA/render. MCP remains FOREIGN_ON_DEMAND. |
 | [affaan-m/ECC](https://github.com/affaan-m/ECC) | `dd6ee538aee0f548d4a6b520118f875431fd749e` | External agent control plane (68 agents, 292 skills, hooks, learning runtime). | **REJECT** | None (`FOREIGN_ON_DEMAND`) | Do not vendor harness control plane or 292 skills. No installer mutator. Doctor does not fail when absent. Individual warehouse ports remain first-party MIT. |
 | [Leonxlnx/taste-skill](https://github.com/Leonxlnx/taste-skill) | `e79ca9ec7e071eb3a3b623c4fb752e853fc3ed58` (`ccbc156` base) | Design taste dials (VARIANCE, MOTION, DENSITY), quality rules, GSAP/Tailwind references. MIT. | **MERGE** | `skills/impeccable/reference/taste/direction.md`, `taste-guard.md` | Dials already integrated into Impeccable surface brief. Fenced after Design Bank or DESIGN.md direction exists. Never a frontend-design twin. |
 | [ashemag/human-atlas](https://github.com/ashemag/human-atlas) | `1c38bf35c254a891200d3cedecfd57abebe83d8d` | 3D human anatomy application (Three.js/R3F + BodyParts3D dataset). CC BY-SA 4.0 / CC BY 4.0 data. | **REJECT** | None (catalog reject) | Standalone 3D application, not an agent writing or coding skill. Do not vendor heavy anatomy meshes or CC BY-4.0 data into OCBF overlay. |
 | [oso95/scroll-world](https://github.com/oso95/scroll-world) | `71cc36d3bb150248ae36a2c552f9cbf88802a79c` | Continuous camera fly-through landing, vanilla-JS scrub engine, seam QA. MIT. | **UPDATE** | `skills/scroll-world` | Update camera style choices and composition seam QA. Retain boundary: scroll-craft = 2D timeline; scroll-world = 3D camera flight. Do not vendor paid video backends (degrade to NOT_CONFIGURED). |
 | [VoltAgent/awesome-design-md](https://github.com/VoltAgent/awesome-design-md) | `8147538b4226ae41e2487a9179e3bcc1f68e8554` | Curated repository of brand DESIGN.md files and design token guidelines. | **REJECT** (vendor) / **FOREIGN** (reference) | Mention in `skills/found-this-design` | Human-chosen reference corpus only. Do not clone brand files into overlay. Direction stays Design Bank + project DESIGN.md. |
-| [kunchenguid/axi](https://github.com/kunchenguid/axi) | `fb752160dea2eb421b082dee77fc1d5bc152639c` | Agent eXperience Interface (AXI) — 10 CLI principles; official `gh-axi`, `chrome-devtools-axi`. MIT. | **UPDATE** | `skills/gh-axi`, `skills/chrome-devtools-axi` | Refresh command surfaces and principles from upstream. Do not introduce a generic "axi" skill. Maintain 4-door browser hierarchy. |
+| [kunchenguid/axi](https://github.com/kunchenguid/axi) | `85a8723276ca` | Agent eXperience Interface (AXI) — 10 CLI principles; official `gh-axi`, `chrome-devtools-axi`. MIT. | **PIN_ONLY** | `skills/gh-axi`, `skills/chrome-devtools-axi` | Pinned commit `85a8723276ca`. Command surfaces and 4-door browser hierarchy unchanged. Do not introduce a generic "axi" skill. |
 | [browser-act/skills](https://github.com/browser-act/skills) | `11c057b03f92101642cadc9f840564574120d184` | BrowserAct CLI agent skills (2.0.2 stub, multi-account, stealth, session isolation). MIT. | **UPDATE** | `skills/browser-act` | Document three modes: `chrome` (profile reuse), `stealth-fresh`, `stealth-fixed`. Ban `chrome-direct`. Playwright-qa remains primary default QA adapter. |
 | [cursor/plugins](https://github.com/cursor/plugins) | `e31650eea443aaea1e84cc15d88c13f40080b275` (`60c641e` base) | Cursor ecosystem: pstack, SaaS connectors (Gmail, HubSpot, Salesforce), continual-learning, ralph-loop, orchestrate. | **DONE** (pstack) / **REJECT** (SaaS & autopilot) | Existing specialists | pstack principles already absorbed in routing and engineering principles. Reject foreign SaaS connectors and autopilot loops (`ralph-loop`, `orchestrate`, `continual-learning`). |
 | [jakubkrehel/make-interfaces-feel-better](https://ui-skills.com) | ui-skills upstream | Interface tactile feel: typography stability, hit targets, concentric border radii, layered shadows. MIT. | **MERGE** | `skills/emil-design-eng/references/interface-feel.md` | Concrete checklists for tactile feel merged directly into `emil-design-eng`. Zero catalog bloat; no new skill folder. |
@@ -28,9 +28,17 @@ Recorded per Phase 0 contract.
 | [PaulRBerg/agent-skills](https://github.com/PaulRBerg/agent-skills) | upstream ref | Agent coding skills and engineering conventions. | **CHERRY-PICK** | `rules/00-routing.md`, `skills/codebase-design/` | Cherry-pick module interface and seam principles. Do not vendor catalog; `frontend-design` must not become a skill. |
 | [confident-ai/deepteam](https://github.com/confident-ai/deepteam) | `latest` / Apache-2.0 | LLM red-teaming and OWASP LLM Top 10 evaluation framework. | **OPTIONAL_POINTER** | `skills/full-audit-keamanan/SKILL.md`, `skills/eval-harness/SKILL.md` | Documented as external maintainer-side red-team framework pointer. Zero overlay dependencies, non-vendored. |
 | [Panniantong/Agent-Reach](https://github.com/Panniantong/Agent-Reach) | upstream ref | Headless browser reaching and web crawling agent tool. | **REJECT** / **FOREIGN** | None (`docs/mcp.md`) | Reject as core MCP or skill. Not exploratory QA eyes; carries ToS/cookie risk; Exa is already designated FOREIGN_ON_DEMAND. |
-| [emilkowalski/emil-design-eng](https://github.com/emilkowalski) | animations.dev | Design engineering, interaction feel, and spring physics. | **UPDATE** | `skills/emil-design-eng/` | Update references and interaction doctrines. |
+| [emilkowalski/emil-design-eng](https://github.com/emilkowalski) | animations.dev | Design engineering, interaction feel, and spring physics. | **MERGE** | `skills/emil-design-eng/references/` | Body landed (`motion.md`, `apple-principles.md`, `native-motion.md`, `interface-feel.md`). Not an open UPDATE. Zero new skill names. |
 | [emilkowalski/apple-design](https://github.com/emilkowalski) + [wshobson/interaction-design](https://github.com/wshobson/interaction-design) | upstream refs | Apple-grade tactile motion, velocity inheritance, interruptible springs. | **MERGE** | `skills/emil-design-eng/references/interface-feel.md` | Merge interruptible springs, velocity inheritance, and tactile press feedback. Never an Apple-clone skill. |
 | [mengto/beautiful-shadows](https://github.com/mengto) + [pbakaus/adapt](https://github.com/pbakaus) + [superfuture/design-review](https://github.com/superfuture) | upstream refs | Multi-layer ambient shadows, adaptive container queries, and design review checklists. | **MERGE** | `skills/emil-design-eng/references/interface-feel.md`, `skills/impeccable/reference/audit.md` | Merged bounded checklist items (≤15 bullets total). No new skill. |
-| [shadcn-ui/shadcn](https://github.com/shadcn-ui/ui) | upstream ref | Shadcn component registry and CLI MCP. | **SKIP** | `mcp.servers.shadcn` | Core MCP already owned and pinned (`shadcn@4.18.0`). Skip raw skill text to prevent duplicate routing. |
+| [shadcn-ui/shadcn](https://github.com/shadcn-ui/ui) | upstream ref | Shadcn component registry and CLI MCP. | **SKIP** | `mcp.servers.shadcn` | Core MCP already owned and pinned (`shadcn@4.21.0`). Skip raw skill text to prevent duplicate routing. |
 | [anthropics/frontend-design](https://github.com/anthropics) | upstream ref | Frontend design principles and anti-generic aesthetic filters. | **MERGE** | `skills/impeccable/reference/taste-guard.md` | Merged anti-generic rules (≤25 bullets: no cream #F4F1EA kit, no terracotta cards, token system before markup). NEVER add as skill; NEVER implement product UI from it when Design Bank misses. |
 | [ui-skills.com](https://www.ui-skills.com) | remote MCP | Curated design-skill reference server. | **FOREIGN_ON_DEMAND** | `docs/mcp.md` | Lookup-only remote MCP (`list_skills`, `get_skill`). Product UI remains Design Bank + Impeccable + Design V2 atoms + shadcn; BANK_MISS never generates from ui-skills document. |
+| [pbakaus/impeccable](https://github.com/pbakaus/impeccable) | tag `skill-v4.3.1` (`cd12f8660e2d`), main `e0881d2de397` | Impeccable design skill suite. Apache-2.0. | **UPDATE** | `skills/impeccable` | Refreshed craft floor mechanics (`reference/craft-floor.md`) from upstream tag/main; merged anti-slop email reference (`reference/email.md`). Preserved Design Bank overlay gates. |
+| [CosmoBlk/email-design](https://github.com/CosmoBlk/email-design) + [jayesh-bansal/email-pro-max](https://github.com/jayesh-bansal/email-pro-max) + [chunkydotdev/email-skills](https://github.com/chunkydotdev/email-skills) + [Olshansk/agent-skills](https://github.com/Olshansk/agent-skills) | upstream refs (`c56bfe0`, `6a28b31`, `dca18fc`, `d43745c`) | Anti-slop email design, 6 archetypes, and bulletproof multi-client HTML email rendering. MIT. | **MERGE** | `skills/impeccable/reference/email.md` | Merged into single reference under Impeccable; strict tables, inline CSS, 6-digit hex, bulletproof CTA, preheader anti-spill padding, framework exemption for React Email/MJML. No new skill. |
+| [emilkowalski/skills](https://github.com/emilkowalski/skills) | `85e8e2363b71` | Animation recipes, WWDC fluid interface design, mobile web polish, and Expo motion. MIT. | **MERGE** | `skills/emil-design-eng/references/` | Merged `motion.md`, `apple-principles.md`, and `native-motion.md` into references. Zero new skill names, exact catalog freeze maintained. |
+| [DeusData/codebase-memory-mcp](https://github.com/DeusData/codebase-memory-mcp) | `v0.11.0` | Codebase indexing and symbol memory MCP server. | **UPDATE** | `vendor/sources.json`, `lib/install.py`, `lib/cbm.py` | Bumped binary pin to 0.11.0 with SHA-256 verified portable tarball and inner binary, plus `--format json` for `list_projects` / `index_status`. |
+| [heygen-com/hyperframes](https://github.com/heygen-com/hyperframes) | `ed75203cb6aa` (v0.8.64) | Deterministic HTML/CSS video composition. Apache-2.0. | **PIN_ONLY** | `skills/hyperframes` | Pinned commit `ed75203cb6aa` in `vendor/sources.json`. Skill body unchanged. |
+| [cathrynlavery/diagram-design](https://github.com/cathrynlavery/diagram-design) | `dc1ace47b99a` (v2.6.33) | Editorial HTML/SVG diagram design. MIT. | **PIN_ONLY** | `skills/diagram-design` | Pinned commit `dc1ace47b99a` in `vendor/sources.json`. Skill body unchanged. |
+| [blader/humanizer](https://github.com/blader/humanizer) | `3.0.0` | AI prose humanizing and slop removal. MIT. | **PIN_ONLY** | `skills/humanizer` | Pinned v3.0.0 in `vendor/sources.json`. Skill body unchanged. |
+| [semgrep / gitleaks / osv-scanner](https://github.com) | `semgrep` 1.177.0, `gitleaks` 8.30.1, `osv-scanner` 2.6.0 | Host security scanners. | **PIN_ONLY** | `skills/full-audit-keamanan` | Host scanner version pins recorded in `vendor/sources.json`. |
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
@@ -6,7 +6,9 @@
 
 `V1_PLUGIN_LEFTOVER` / `failed to load plugin` — OpenCode 2 rejects legacy V1 plugins (such as `impeccable-live-poll.ts` from OCBF) in `~/.config/opencode/plugins/`. Re-run `./install.sh` to quarantine known legacy plugins to `~/.local/share/opencode-highend/quarantine/plugins/`, or move them manually.
 
-`CODEBASE_MEMORY_CHECKSUM_FAILED` — delete `~/.local/share/opencode-highend/cache/downloads/` and retry. Do not ignore a mismatch.
+`CODEBASE_MEMORY_CHECKSUM_FAILED` — archive hash mismatch. Delete `~/.local/share/opencode-highend/cache/downloads/` and retry. Do not ignore a mismatch.
+
+`CODEBASE_MEMORY_BINARY_CHECKSUM_FAILED` — archive hash matched, extracted `codebase-memory-mcp` did not. Delete `~/.local/share/opencode-highend/cache/downloads/` and `~/.local/share/opencode-highend/components/codebase-memory`, then re-run `./install.sh`. A 0.9.0 → 0.11.0 upgrade rebuilds the index once. Do not ignore a mismatch.
 
 `DESIGN_BANK_INVALID` — bootstrap requires parseable 21st, Aura, Refero, and Motionsites catalogs (the 4 foundational bootstrap catalogs; `found-this-design` indexes up to 12 banks once present). Fix the configured target or choose a new empty `--target`.