A design council, an artifact library, and a viewer per template

Added

- Quality modes — a design council around the build. The composer gains
a Quality chip with three modes: Fast (build → automatic checks →
done), Reviewed (one independent critic on the frozen evidence, plus
up to one repair pass) and Council (Visual, UX, Copy and Rights
critics review the same frozen capture in parallel, then a bounded
repair pass). The default lives in Settings → General; the chip sets a
per-project override.
- Only the builder ever writes the project. Critics run as separate
agent runs inside disposable review workspaces, over evidence the host
freezes first: the requirements contract, the capture manifest, the
gate results, an asset-provenance walk and a content extract — every
claim a critic makes cites a path inside that bundle.
- The host merges findings, it doesn't summarize prose: a repair turn
carries at most three prioritized, evidence-backed problems, and a
visual finding only closes after a fresh capture and a targeted
re-review — a green automatic check can't quietly close it.
- A council card in the chat tracks the pipeline stage by stage
(requirements freeze → build → checks → capture → reviews → merge →
repair → verdict) and lands each domain's verdict as a record, not a
score. Material conflicts come back as a decision card, and the final
state is honest — reviewed, partial, needs decision or failed, never
an invented pass.
- Critic seats prefer a different runtime than the builder — a second
opinion from the same model isn't one — and a seat with no ready
runtime is skipped and reported rather than silently re-seated. The
custom profile pins each discipline to a specific agent:model.
- Critics are extra runs under your own CLIs and accounts, so they cost
plan usage — that's why Fast stays the default. An interrupted council
resumes or closes as partial after a restart.
- Artifacts — a library of everything the studio has shipped. A new
top-level screen (the top bar, or "View all artifacts" on Home) browses
the deliverables across every project: search, type and availability
filters, sort, paged rows with lazy thumbnails, and a detail view with
the artifact's revisions and exports.
- Favorites, collections and archive are metadata-only — archive hides a
row, "remove from library" forgets the registration, and neither
touches a byte on disk.
- A project whose folder moved stays listed with its last-known
records — missing is not deleted — and a Locate action re-points the
project at the folder you found.
- Deleting a project now goes through a real trash: the folder moves
under app-data trash and restores with its identity intact.
- Social Media design type. "Announce the autumn sale — feed post,
story and link card" produces one campaign composed per placement: six
archetypes (announcement, offer, quote, tip, event, carousel — a
carousel is a sequence of placements at one feed size, not its own
type), a social.json campaign model at the project root, and a
versioned placement-size catalog the project pins.
- gate --type social shoots each placement at its own declared canvas
and checks the set: model↔render agreement, safe areas, one hook and
font stack across placements, no two different-ratio placements
sharing identical geometry — the scaled-copy tell — and grounding:
factual roles (offer, date, attribution, legal) must cite a claim in
design-evidence/claims.json or be omitted, never invented. Suggested
alt text lands in design-check/social/alt-text.md.
- Exports pin to each placement's exact canvas — PNG at 1×/2×, JPEG, and
a ZIP of the authored files. The board is a host page, never an
export.
- Every template renders in its own viewer. The result panel honors
the viewer each template declares instead of one generic stage:
- Slides get a deck — thumbnail strip, slide counter, prev/next, and
f plus arrow keys while presenting.
- Documents and research get a paged view — A4/Letter stage, page
break guides and a page count — which engages itself when the design
plan names print or PDF.
- Mobile, wireframe and mockup get artboards — the live board plus a
labeled strip of sibling screens to switch between.
- Animations get a player — playhead, speed and loop riding the
artifact's seek contract; the controls disable rather than lie when
the artifact can't be driven.
- Emails get client-check chrome — 600px and 375px widths, a dark
color-scheme preview and a no-images toggle: the same conditions the
gate checks.
- An artifact missing the viewer's hooks just renders the plain stage.
- Characters that move — the craft contract for 3D. A design plan can
now name an authored character: the agent declares a craft document
(pack, subject, seed, semantic poses against scene targets, contact
intervals) and the kit's versioned craft bundle compiles it — joints,
IK, contacts, life layers — into a deterministic performance.
- Evaluation is a pure function of time: seeking frame 400 then frame 3
gives the pose frame 3 always had, and blink streams derive from the
seed so adding a second character never reshuffles the first's.
- craft-check.mjs measures the evaluated result — pivots, limits,
contacts, loop seams — and anything the contract can't honestly
deliver comes back as a typed diagnostic, never a silent
approximation.
- Preview a turn's before-state. The history list's Preview button
materializes what the project looked like before a turn into a
read-only served overlay — the workspace is never touched, and restore
stays the only path that writes.
- Offline preview. A shield toggle in the result toolbar serves the
artifact under a content-security policy that blocks network access —
for designs that should provably not phone home. It applies to the
host-served preview only, never an external dev server, and flipping it
restarts the server so the policy actually changes.

Improved

- Much smaller downloads and project folders. The design kit no longer
ships its examples' run evidence — design-check/, .1design/,
proof/ and shots/ output — or each 3D example's duplicate vendored
three.js: roughly 250 MB of the kit tree, most of the 1.1.0 installer,
previously copied into every project folder. A README marks each dropped
vendor copy so the example still explains itself.
- Every screen is held to an accessibility gate. Scrolling panes take
keyboard focus, and inputs, filters, sliders and color wells carry
labels — the studio's own chrome is now audited with the same checks the
kit runs on artifacts, at both themes and both window sizes.
- The macOS installer window has a face. The DMG gets a proper
background and icon layout instead of the stock empty window.
- Sharper infographic guidance. The kit's infographic curriculum was
rewritten around deciding the kind first, one sentence of message, the
"hide the text" cover test, and drawing the thing instead of naming it —
the agent's brief-quality bar, not just the checker's.

Fixed

- Mobile prototypes rendered without their token styling. The starter
runtime mapped color.inkSecondary to --color-inksecondary while the
generated tokens.css emits --color-ink-secondary, so every
token-referenced color, radius and type size silently fell back to
defaults. Rows marked fill-width also only stretched vertically, so
label/value rows squeezed together instead of growing along the row.

Removed

- The "Critic round" toggle. Settings → General's on/off switch is
superseded by Default quality — a stored "on" reads as Reviewed.

Privacy

- The offline preview makes "nothing leaves" testable. Flipping the
shield serves the artifact with network access blocked at the CSP
level — no telemetry endpoint, font CDN or stray fetch can fire
inside it.
- Council runs stay inside the local-first contract. Critics are your
own installed CLIs under your own accounts; their evidence freezes under
the project's .1design/review/ (added to the managed .gitignore
block) and the asset manifest records provenance facts on disk. Nothing
is proxied through StoicSoft.
- The artifact library is metadata-only. Archive, collections,
favorites and "remove from library" write index records, never your
files; trash moves a project folder into app-data trash on your own
disk and restores it whole.