feat(skills): add om-ux-design for detailed prototypes and review

[matgren]

🎯 Goal

Add om-ux-design for detailed screens and connected prototypes from a specification or selected backlog scope, using the repository's real design system and existing components. This is the renamed and improved prototype capability in this PR. The naming split agreed in #107 reserves om-mockup-prototype for neutral discovery experiments.

Subject issue: #104. Original rollout specification: #91. Detailed update specification: .ai/specs/2026-09-14-ux-design-skill.md.

📝 Changes

• Prefer an existing prototype runtime and real components; use portable HTML when appropriate. With no design system, clearly label the visual direction as a proposal.
• Map requirements to connected screens, relevant states and recovery paths; inspect the result in the browser and distinguish verification from human acceptance.
• Preserve prototype identity, comment anchors, review operations and deletion records when refreshing a design.
• Support current and legacy token formats, explicit source precedence, theme overrides and drift checks. Fix initialization, template escaping, path containment and comment/navigation defects.
• Register the renamed skill and its documentation, setup integration, spec handoff and UX review rules. Keep the discovery skill unchanged.

🧪 Verification

Implementation verification at 7e3a766: all six configured validation commands passed, including 38 helper and comment-engine regression tests. The earlier independent implementation review findings were fixed and cleared on re-review. Three local browser executions passed: an existing component runtime, a no-DS portable design, and a refresh with existing feedback. Full flows were inspected at 360px and 1280px. Feedback export/reload, resolve/reopen, deletion preservation and isolation between prototype IDs passed. Screenshots and disposable fixtures remain local.

Native date entry exposed an automation limitation: CLI fill left the field empty. The component-runtime trial seeded the date through DOM events and verified real arrow-key changes; the portable trial used individual date-segment key presses.

⛔ Merge gate

@matgren accepted the revised rollout condition: verify the import from pinned upstream source 9ea83205be7447867c042bbcfd3caaa9b4cadfb5, with complete mapping, accounted differences, retained evidence and fresh review. This is recorded in the #91 specification's Rollout section and comparison/evidence record.

• All 13 source files map to skills/om-ux-design/; four portable CSS files are byte-identical and all 124 token records retain their values. Workflow, template, helper and comment-engine changes are accounted for in the record.
• All six configured commands pass again for this documentation amendment, including 38 regression tests. The implementation is unchanged from 7e3a766; the three browser executions and upstream baseline are retained historical evidence, not newly repeated browser runs.
• Pending: @pkarw must confirm this revised condition and re-review the current head before blocked is removed, as requested by @matgren. Green tests and this amendment do not replace that review or authorize merging.

Once the revised condition is confirmed and the evidence accepted, open-mercato/open-mercato#5832 merging is no longer a prerequisite. This collection is the source going forward; the upstream PR and its consumption follow-up can proceed independently.

Tracking plan: .ai/runs/2026-09-02-import-om-mockup-prototype.md
Status: complete

[matgren]

🤖 om-auto-create-pr — label rationale

• ⛔ blocked — the import source is the upstream Phase 1 branch (feat(skills): decouple om-mockup-prototype from the application design system open-mercato#5832, ready and CI-green but awaiting required review). Per the spec's rollout gate this PR is mergeable only after that PR merges and the imported files are re-verified against the merged commit; the label comes off then.
• 🧪 skip-qa — markdown, docs, and two Node scripts exercised by direct verification runs recorded on this PR; no product UI or runtime code path changes.
• 🏷️ feature — adds a new capability to the collection: the interactive prototype skill and its docs.
• 🏷️ priority-medium — mirrors the driving spec's priority (docs(specs): interactive prototype skill, decoupled from any one design system #91); it unblocks the designer role's missing step but nothing downstream is waiting on a date.
• 🏷️ risk-low — additive change: one new skill directory, one roster line, documentation; no existing skill's behavior, no shared contract surface.

[matgren]

🤖 om-auto-create-pr — run summary

🎯 What this PR does

Executes Phase 2 — Add the skill here (spec steps 8–14) of .ai/specs/2026-08-26-interactive-prototype-skill.md (#91). It adds skills/om-mockup-prototype — clickable, commentable pre-implementation prototypes with the anchored-comment engine — to the collection, product-agnostic and lint-clean. Subject issue: #104.

⛔ Merge gate

Import source: commit 9ea8320 on feat/om-mockup-prototype-decouple of the upstream monorepo (its Phase 1 PR open-mercato/open-mercato#5832 is ready and CI-green, awaiting required review). Per the spec's rollout gate, this PR merges only after that PR lands and the imported files are re-diffed against the merged commit — if review changes them upstream, the re-import happens here before the blocked label comes off.

📝 What landed, step by step

• Step 8 — import + content gate. All 13 skill files imported; the lint's forbidden-pattern scan came back with three hits (the product name in the page template's sidebar brand and twice in SKILL.md) — fewer than the spec's six because the upstream decoupling already cleaned the stylesheet headers. All three removed; the dangling om-ds-mockup pointer replaced with the question-based routing rule decided by the design-system track owner on docs(specs): interactive prototype skill, decoupled from any one design system #91: this skill answers "does this flow make sense", a composer answers "is this screen faithful to the system".
• Step 9 — roster. om-mockup-prototype joined the ROSTER line; the roster-sync gate passes.
• Step 10 — standard references. agentic-setup.md (no tracker ops; repo-local override contract including the anatomy override; untrusted-requirements boundary), rules.md (canonical shared block + skill specifics: stable screen ids, comment-export contract, bounded localhost server, tokens-only styling), report-templates.md (the hand-off shape, naming the token source and anatomy source used).
• Step 11 — house structure. SKILL.md restructured into ## Arguments / ## Workflow (7 numbered steps) / ## Rules / ## Security boundaries, second person; description 424 chars, body 8,880 chars — inside both budgets. Script paths are install-location-neutral.
• Step 12 — default snapshot. references/ds-tokens.default.json provenance rewritten in product-agnostic terms, documented in the new references/ds-tokens.md (resolution order, field format, D2 rationale). Verified: in a bare git repo with no design system, initialization produces a prototype whose tokens.css header states Source: bundled default snapshot, rendering in both themes (light oklch(1 0 0) vs dark oklch(0.145 0 0) computed in Chromium).
• Step 13 — anatomy template + scaffolding (new behavior). The shipped references/screen-patterns.md is now a neutral template: the concrete shell/list/form/Kanban anatomy the bundled stylesheets implement, with the product-specific component-file attributions stripped and an explicit "this file is a template" contract. Initialization scaffolds it into a missing repo-local override (.ai/skills/om-mockup-prototype/references/screen-patterns.md), pre-filled with a design-contract section when .uxproof/ exists, and prints the anatomy source for the hand-off. Verified all three branches: no override → scaffolded; override present → used and respected; .uxproof/ present → pre-filled note included.
• Step 14 — docs. docs/skills/om-mockup-prototype.md; rows in the README interactive-skills table and the designer table; a row and a tip in docs/roles/designer.md; the index row in docs/skills/README.md; a dated DECISIONS.md entry framed as extending the UX layer from feat(skills): om-ux-shape, om-ux-setup, om-ux-review-pr — the UX judgment layer #57 (decoupled-at-source import, question-based boundary, anatomy-as-override); an Unreleased CHANGELOG.md entry.

🧪 Validation gate

bash scripts/lint.sh prints Lint OK. — frontmatter, budgets, packaging, reference resolution, roster sync, product-agnosticism, and tracker-abstraction gates all green.

🔍 Review

The in-run review pass covered correctness (the scaffolding's three branches exercised by real runs; generated init code imports and executes), scope (every changed line traces to spec steps 8–14; no other skill's content touched), security (no gh usage in the skill; localhost-only server rule; escaping preserved; requirements treated as untrusted data), and compatibility (additive only — one new directory, one roster line, docs). A standalone om-auto-review-pr 106 pass can run on demand.

⏭️ After upstream merges

1. Re-diff skills/om-mockup-prototype against the merged upstream commit; re-import if review changed anything.
2. Drop blocked, apply review, merge via the normal gate.
3. Phase 3 (upstream replaces its local copy with this installed skill plus a repo-local override) is an upstream follow-up tracked in the spec.

[matgren]

🤖 om-auto-create-pr — run summary

🎯 What this PR does

Executes Phase 2 — Add the skill here (spec steps 8–14) of .ai/specs/2026-08-26-interactive-prototype-skill.md (#91): imports om-mockup-prototype — clickable, commentable pre-implementation prototypes with an anchored-comment engine — from the upstream Phase 1 branch (open-mercato/open-mercato#5832, commit 9ea8320), product-agnostic and lint-clean. Subject issue: #104.

📝 Changes

• Step 8 — import + content gate. All forbidden-pattern hits removed (page-template brand block neutralized, description and boundary rewritten); the dangling om-ds-mockup pointer dropped; the question-based scope boundary decided on docs(specs): interactive prototype skill, decoupled from any one design system #91 adopted: this skill answers "does this flow make sense" — "is this screen faithful to the system" routes to a design-system composer where one exists.
• Step 9 — roster. om-setup-agent-pipeline/references/skill-coverage.md ROSTER updated; roster-sync gate passes.
• Step 10 — standard references. agentic-setup.md, rules.md (canonical shared block + skill specifics: stable ids, comment-export contract, bounded server, tokens-only styling), report-templates.md (the prototype hand-off shape) — tailored to the steps this skill performs; it does no tracker operations.
• Step 11 — SKILL.md restructured into ## Arguments / ## Workflow / ## Rules / ## Security boundaries, second person, 8,880 body chars (budget 20,000), description 419 chars (limit 500).
• Step 12 — token snapshot. references/ds-tokens.default.json ships with product-agnostic provenance; new references/ds-tokens.md documents resolution order, format, and provenance (spec decision D2).
• Step 13 — anatomy scaffolding (new behavior). references/screen-patterns.md is now a neutral template; initialization scaffolds it into a missing repo-local override (.ai/skills/om-mockup-prototype/references/screen-patterns.md), pre-filled from the om-ux-setup contract (.uxproof/) when present, and prints the anatomy source for the hand-off.
• Step 14 — docs. docs/skills/om-mockup-prototype.md, rows in docs/skills/README.md, the README interactive-skills and designer tables, a docs/roles/designer.md row and tip, a dated DECISIONS.md entry framed as extending the UX layer from feat(skills): om-ux-shape, om-ux-setup, om-ux-review-pr — the UX judgment layer #57, and a CHANGELOG.md Unreleased entry.

🧪 Verification

• bash scripts/lint.sh prints Lint OK (frontmatter, budgets, forbidden patterns, roster sync, reference resolution, tracker abstraction).
• Initialization in a bare git repository with no design system: prototype created, tokens.css header states Source: bundled default snapshot (references/ds-tokens.default.json), renders in both themes (light oklch(1 0 0) / dark oklch(0.145 0 0) body backgrounds via headless Chromium).
• Override scaffolding, all three branches: missing override → scaffolded from the template; existing override → used and named; missing override + .uxproof/ present → scaffolded pre-filled from the contract.
• --check on a fresh prototype reports tokens.css is current.

⛔ Merge gate

Blocked until open-mercato/open-mercato#5832 merges; then the imported files must be re-verified against the merged commit (recorded import source: 9ea8320). Phase 3 (the monorepo consuming this copy) is prepared as stacked PR open-mercato/open-mercato#5836.

🔍 Review

In-run review pass: correctness (equivalence of imported scripts with the verified Phase 1 versions; scaffolding no-op when the override path is the skill's own file, which is exactly the upstream Phase 3 layout), security (no shell interpolation, no network, localhost-only server, untrusted-content boundary stated), scope (every change traces to spec steps 8–14), contracts (no other skill's files touched beyond the roster line; no shared format changed).

[pkarw]

🤖 om-auto-review-pr started by @pkarw at 2026-09-04T09:12:42Z. Other auto-skills will skip this PR until the lock is released.

[pkarw]

Code Review: feat(skills): add om-mockup-prototype — interactive prototypes with anchored review comments

Summary

This is a useful additive skill, and the imported engine/scripts are syntactically valid, lint-clean, and not duplicated on main. The review cannot approve it yet: its declared upstream rollout prerequisite remains unmet, and the current implementation omits required test coverage and two concrete contract behaviors from the accepted spec.

Verdict

request changes — one external rollout blocker and three actionable major findings must be resolved before this can merge.

Validation Gate

Command	Status	Notes
bash scripts/lint.sh	PASS	Printed Lint OK. on PR head df9f488.

The PR checks lint and license/cla are also successful. Branch protection is not readable, so all reported checks were treated as required.

Findings

Blocker

1. The accepted rollout prerequisite has not landed. .ai/runs/2026-09-02-import-om-mockup-prototype.md:3 identifies open-mercato/open-mercato#5832 as the source and explicitly makes its merge plus a post-merge re-verification a prerequisite. That upstream PR is still open with REVIEW_REQUIRED, so the source cannot yet be verified against a merged commit. Keep this PR unmergeable; once #5832 lands, compare every imported file with its merged head and record the result (re-importing any reviewed changes).

Major

1. Executable behavior has no committed automated tests. The diff adds skills/om-mockup-prototype/scripts/init-mockup.mjs, skills/om-mockup-prototype/scripts/sync-tokens.mjs, and a 736-line browser engine, but no *.test.*, *.spec.*, or equivalent test file. The accepted spec requires the initialization/token and full comment-engine checklists. Import or adapt the upstream test suite and cover argument/path rejection, atomic cleanup, token source/drift, symlink containment, storage isolation, reply focus, pins, re-anchoring, tombstones, and export.

2. The implementation drops the accepted configurable path/token-source contract and hardcodes repository paths. skills/om-mockup-prototype/SKILL.md:8-35, scripts/init-mockup.mjs:21, and scripts/sync-tokens.mjs:11,31-37 hardcode .ai/prototypes and .ai/ds/ds-tokens.json; references/agentic-setup.md:8-11 says config is irrelevant. The accepted spec defines optional paths.prototypes and designTokens, while this repository requires working paths to come from .ai/agentic.config.json. Load and validate those fields with backward-compatible defaults, pass them consistently to both scripts and reporting, and add both optional fields/defaults to the setup schema and documentation.

3. A scaffold failure leaves a CLI run failed but permanently occupies the prototype slug. skills/om-mockup-prototype/scripts/init-mockup.mjs:145-149 renames the staged prototype into place before ensureAnatomyOverride() runs. If the override scaffold then fails (for example, an unwritable or invalid override path), the command exits 2 but leaves the prototype directory behind; the next run refuses to overwrite it. Coordinate or roll back the two initialization outputs so a failed command is safely retryable, and add a regression test for this failure path.

Breaking Changes

• No exported/public symbol removed or renamed without a deprecation path.
• No function signature changed in a breaking way.
• No required type or response field removed or narrowed.
• No HTTP route, event/message name, CLI flag, database schema, or existing config key changed.
• The new skill name and roster entry are additive.
• Merge rollout is not yet safe because the imported upstream source has not reached its required merged state.

Test Coverage

Not covered in this PR. Direct verification described in comments is useful evidence but does not replace committed regression tests for the new executable scripts and browser interaction engine. The upstream source already contains a substantial om-mockup-prototype.test.mjs; adapt it to this collection and ensure the repository can run it without relying on an undeclared package.

[pkarw]

🤖 om-auto-review-pr — label rationale

• ❌ changes-requested — all actionable code findings are fixed, but the accepted rollout still requires upstream PR feat(skills): decouple om-mockup-prototype from the application design system open-mercato#5832 to merge and be re-verified.
• 🏷️ feature — the PR adds the new om-mockup-prototype capability to the collection.
• 🧪 skip-qa — the static tooling is covered by automated contracts and a browser smoke pass; there is no application UI to route through manual QA.
• 🏷️ priority-medium — this remains an ordinary additive feature without an outage or release deadline.
• ⚠️ risk-low — the final diff is additive, isolated, regression-tested, and CI-green; the remaining block is release coordination rather than code risk.

[pkarw]

Thanks @matgren — review found actionable items, so I am handing this PR back to you for the next pass. I am continuing the autonomous fix-forward pass now; when the updates are pushed, re-request review from the latest head.

[pkarw]

Re-review: feat(skills): add om-mockup-prototype — interactive prototypes with anchored review comments

Summary

Autofix iteration 1 resolved all three actionable major findings, and the branch was then merged with the latest main to clear the newly surfaced conflicts. The implementation is now lint-clean, CI-green, regression-tested, and browser-smoke-verified; only the explicitly accepted upstream rollout prerequisite remains unresolved.

Verdict

request changes — the code findings are resolved, but the upstream source PR must merge and be re-verified before this PR can safely enter the merge queue.

Validation Gate

Command	Status	Notes
bash scripts/lint.sh	PASS	Printed Lint OK. on final head 456a652.

Additional verification also passed:

• node --test scripts/test-mockup-prototype.mjs — 9/9 tests passed.
• node scripts/test-browser-providers.mjs — provider contract passed.
• node scripts/test-tracker-providers.mjs — 42 operations and two split providers passed.
• node scripts/test-classify-runs.mjs — classifier contract passed.
• node scripts/test-close-keywords.mjs — keyword contract passed.
• GitHub checks lint and license/cla are successful.
• Real-browser smoke verification passed for light/dark switching, anchored comment creation, pin rendering, and persistence across reload.

Findings

Blocker

1. The rollout prerequisite is still open. .ai/runs/2026-09-02-import-om-mockup-prototype.md:3 requires open-mercato/open-mercato#5832 to merge and the imported files to be compared with its merged commit. That upstream PR remains open with REVIEW_REQUIRED. Once it merges, re-diff the imported assets/scripts against the merged head, carry forward any upstream review changes, rerun the gates, and re-request review here.

All three previous major findings are resolved by f9ca0a9: the optional designTokens and paths.prototypes contracts are implemented with contained-path validation and documented setup defaults; failed anatomy scaffolding now rolls back the new prototype so retry is safe; and the new dependency-free regression suite is wired into CI. Merge commit 456a652 resolves the base conflicts and preserves both branches' setup/decision changes.

Breaking Changes

• No exported/public symbol removed or renamed without a deprecation path.
• No function signature changed in a breaking way.
• No required type or response field removed or narrowed.
• No HTTP route, event/message name, CLI flag, database schema, or existing config key changed.
• The new config fields are optional and retain backward-compatible defaults.
• The new skill name, roster entry, test command, and CI step are additive.
• The rollout prerequisite is not complete until the upstream source is merged and re-verified.

Test Coverage

Covered for initialization, argument/path containment, token-source precedence, CSS-input safety, atomic cleanup, override scaffolding, symlink rejection, variable resolution, drift detection, and repository-root fallback. The unchanged browser engine matches upstream source commit 9ea8320 and received an additional local browser smoke pass; its full interaction checklist remains part of the upstream prerequisite verification after #5832 merges.

[pkarw]

🤖 om-auto-review-pr completed: CHANGES REQUESTED. Lock released after 1 autofix iteration; all actionable findings and base conflicts were fixed, and upstream PR #5832 is the only remaining blocker.

[pat-lewczuk]

🤖 Previous claim by @matgren appears stale (assignee handback from 2026-09-02; the om-auto-review-pr lock by @pkarw was explicitly released 2026-09-04, no activity in 5 days); taking over.

[pat-lewczuk]

🤖 Claiming this PR — starting om-auto-fix-pr run. Started: 2026-09-09T12:45:09Z.

[pat-lewczuk]

🤖 om-auto-review-pr taking over the chain lock — review + autofix pass under om-auto-fix-pr. Started: 2026-09-09T12:47:30Z.

[pat-lewczuk]

Code Review: feat(skills): add om-mockup-prototype — interactive prototypes with anchored review comments

Verdict

request changes — the code is ready; the release is not. Every actionable code finding from the earlier pass is fixed, the branch is now merged with the latest main, and the full validation gate is green on head 730a1d6. The single remaining blocker is the accepted rollout prerequisite: the upstream import source is still an open PR, so the imported files cannot yet be re-verified against a merged commit.

What this changes

Adds om-mockup-prototype to the collection: a skill that generates a self-contained, click-through HTML prototype from a requirements doc, with an anchored-comment engine reviewers use in the browser and export back into the repo as a committed comments.js. Two Node scripts back it — init-mockup.mjs (scaffold a prototype directory) and sync-tokens.mjs (generate tokens.css from a design-token snapshot, with drift checking). Nothing existing changes behavior; the roster, docs, and CI step are additive, and the two new optional config keys (designTokens, paths.prototypes) default to today's behavior.

Validation Gate

Command	Status	Notes
bash scripts/lint.sh	PASS	Lint OK. on head 730a1d6.
node scripts/test-browser-providers.mjs	PASS	Passed after the fix below; failed on the raw merge result — see Blocker-adjacent note.
node scripts/test-tracker-providers.mjs	PASS	42 operations, 2 split providers.
node scripts/test-classify-runs.mjs	NOT RUN locally	jq is unavailable in this reviewer's sandbox. Verified green in CI instead: the lint job on head 730a1d6 runs this exact command and the job succeeded.
node scripts/test-close-keywords.mjs	PASS	Contract OK.
node --test scripts/test-mockup-prototype.mjs	PASS	9/9. (Requires TMPDIR outside the repository — see nit 4.)

Required checks on head 730a1d6: lint success (run). main is unprotected, so all reported checks are treated as required.

Findings

Blocker

1. The rollout prerequisite is still unresolved (inherited from @pkarw's review, 2026-09-04) — .ai/runs/2026-09-02-import-om-mockup-prototype.md:3 and this PR's own body gate the merge on upstream open-mercato/open-mercato#5832. Re-checked at review time: that PR is still OPEN, mergedAt: null. Until it merges, the imported files under skills/om-mockup-prototype/ cannot be re-diffed against a merged commit, so any upstream review change would land here as drift. This is release coordination, not a code defect — nothing in this diff needs to change for it. Action: when #5832 merges, re-diff the imported assets and scripts against its merged head, carry forward any upstream changes, rerun the gate, and re-request review.

Not filed as a finding, but recorded: the base merge in 265f8e2 surfaced a real integration break that this pass fixed in 730a1d6. main grew validation.commands from one entry to five while this branch added node --test scripts/test-mockup-prototype.mjs to the lint workflow; the merge kept base's five-entry list, so test-browser-providers.mjs:124 ("repository validation.commands must mirror the lint workflow in order") failed. Resolved by taking the union both sides intended. Two textual conflicts (package.json scripts, the skill-coverage.md ROSTER) were likewise resolved as unions of om-discover and om-mockup-prototype.

Minor

2. renderTemplate corrupts output when the requirements path contains $ — skills/om-mockup-prototype/scripts/init-mockup.mjs:115. String.prototype.replaceAll interprets $&, $`, $' and $1 in the replacement string, and escapeHtml does not escape $. Verified: --requirements 'docs/a$&b.md' renders docs/a{{REQUIREMENTS}}b.md; x$`y splices the preceding template text into the file. Fix: pass a replacer function — content.replaceAll(\{{${placeholder}}}`, () => value)`.

3. ensureAnatomyOverride ignores the caller's repo root — skills/om-mockup-prototype/scripts/init-mockup.mjs:160. initializePrototypeWithAnatomy accepts options and threads options.prototypesRoot into initializePrototype, but calls (options.ensureAnatomyOverride || ensureAnatomyOverride)() with no arguments, so options.repoRoot never reaches it. A caller that scopes the prototype to a sandbox still gets .ai/skills/om-mockup-prototype/references/screen-patterns.md written to the real REPO_ROOT. The test suite only exercises this through a stub, so the gap is not covered. Fix: forward { repoRoot: options.repoRoot }.

4. exportMarkdown interpolates a screen id straight into a CSS selector — skills/om-mockup-prototype/references/assets/prototype.js:588, '#' + screenId + ' .screen-meta h2'. A screen value that is not a bare CSS identifier (leading digit, space, quote) makes querySelector throw SyntaxError and aborts the whole Markdown export. screen comes from operation payloads in comments.js, which normalizeOperations does not constrain. Fix: document.getElementById(screenId)?.querySelector('.screen-meta h2').

Nit

5. HTML escaping applied in a JavaScript string context — escapeHtml(slug) fills {{SLUG}} inside a single-quoted JS literal in references/assets/comments.js:10, and {{MODULE}}/{{REQUIREMENTS}} are HTML-escaped into references/assets/README.md, a Markdown file where & would render as &. Harmless today only because SLUG_PATTERN already forbids quotes — the escaping is the wrong function for two of the three sinks, not a live defect. Worth escaping per target format if these templates grow.

6. test-mockup-prototype.mjs depends on TMPDIR being outside the repository — the repository-root fallback case asserts resolveRepoRoot() returns the temp directory, which only holds when mkdtemp lands outside any git checkout. On a machine whose TMPDIR sits inside the repo the test fails with a confusing diff. Consider forcing os.tmpdir() explicitly.

Security

No new attack surface. The browser engine has no innerHTML, eval, new Function, document.write, fetch, or XMLHttpRequest — every reviewer-supplied string reaches the DOM through textContent or setAttribute, and export goes through a local Blob download with no network egress. Both Node scripts validate configured paths against the repository root, reject absolute paths, traversal, and symlink escapes (sync-tokens.mjs:50-72, init-mockup.mjs:99-110), and tokenDeclarations rejects token names that are not valid custom-property identifiers and values containing ;, {, }, or url( before they reach generated CSS.

Breaking Changes

• No exported symbol, HTTP route, event name, CLI flag, schema, or existing config key removed, renamed, or narrowed.
• designTokens and paths.prototypes are optional and fall back to current behavior.
• The new skill, roster entry, test command, and CI step are purely additive.

Test Coverage

Adequate for the two scripts: 9 cases covering argument rejection, HTML substitution, configured-path containment and defaults, token-source precedence, atomic/retry-safe initialization, override scaffolding idempotence, symlink and ambiguous-target rejection, bundled-variable auditing, drift detection, and the repo-root fallback. The browser engine is covered by manual smoke verification rather than automated tests, which matches the earlier pass's evidence; findings 2–4 are each currently uncovered and would be worth a case if they are fixed here rather than upstream.

[pat-lewczuk]

🤖 om-auto-fix-pr — 🏷️ label rationale

• ⛔ blocked — replaces changes-requested: there is no longer any code change for the author to make. Every actionable finding is fixed and the gate is green; what holds this PR is release coordination, namely upstream feat(skills): decouple om-mockup-prototype from the application design system open-mercato#5832 merging so the imported files can be re-diffed against a merged commit.
• 🏷️ feature — the PR adds a new capability to the collection, the om-mockup-prototype skill and its docs.
• 🧪 skip-qa — the change is markdown, docs, and two Node scripts covered by an automated suite in CI; the repository has no application UI to route through manual QA, and the prototype engine already carries a recorded browser smoke pass.
• 🏷️ priority-medium — unchanged: it mirrors the driving spec (docs(specs): interactive prototype skill, decoupled from any one design system #91) and unblocks the designer role's missing step, but nothing downstream is waiting on a date.
• 🏷️ risk-low — unchanged: the final diff is additive and isolated, the two new config keys are optional with backward-compatible defaults, and no existing skill's behavior changes.

[pat-lewczuk]

🤖 om-auto-fix-pr — run summary

Not merge-ready, and no code change is left to make. The branch is now merged with the latest main, conflict-free, and green; the only thing holding it is the accepted rollout gate — upstream open-mercato/open-mercato#5832 is still open, so the imported files cannot yet be re-diffed against a merged commit. Pipeline label moved from changes-requested to blocked to say that honestly.

What this run changed (265f8e2, 730a1d6): merged main and resolved two textual conflicts as unions (package.json scripts, the skill-coverage.md ROSTER — om-discover and om-mockup-prototype both belong). That merge also surfaced a real integration break: main grew validation.commands to five entries while this branch added the mockup test to the lint workflow, so test-browser-providers.mjs's "config must mirror the lint workflow" assertion failed. Fixed by taking the union both sides intended.

🧪 CI lint passes on head 730a1d6; locally every configured command passes except test-classify-runs.mjs, which needs jq (unavailable in this sandbox) and is verified green inside that same CI job. 📸 UI: n/a — no application UI, skip-qa set.

Four non-blocking findings (review) were deliberately not patched here and are tracked in #113 instead: they sit in files imported from #5832, and fixing them locally would create exactly the drift the re-diff gate exists to catch.

Next: when #5832 merges, re-diff the imported assets and scripts against its merged head, carry forward anything upstream changed, rerun the gate, and re-request review. Then om-approve-merge-pr 106.

[pat-lewczuk]

@matgren — nothing to change in the code: the review found no blocking defect, and this run merged main and fixed the one integration break the merge caused. The PR is parked on blocked until upstream open-mercato/open-mercato#5832 merges; the re-diff of the imported files is yours to run then. Deferred polish is tracked in #113.

🤖 om-auto-fix-pr completed: BLOCKED (upstream rollout prerequisite). Lock released.

[zielivia]

🤖 om-ux-design — rollout prerequisite proposal

@matgren, do you agree to replace this PR's requirement that open-mercato/open-mercato#5832 must merge first with a verified import from a pinned source commit?

The original condition supported the Phase 1 → Phase 2 extraction in #91. This PR now carries the detailed-design workflow agreed in #107 under om-ux-design, along with its own helper and review-engine fixes. It has no runtime dependency on the upstream checkout. The question is whether the original merge ordering still serves a coordination requirement we should preserve.

Proposed replacement gate for this PR:

1. Record upstream source 9ea83205be7447867c042bbcfd3caaa9b4cadfb5 and the file mapping to skills/om-ux-design/.
2. Account for all intentional differences. All 13 upstream skill files have counterparts; the four portable CSS files are byte-identical, and the bundled token values are unchanged apart from provenance metadata. Workflow, templates and helper/engine changes are covered by the detailed-update spec and tests.
3. Retain the verification evidence: all six configured commands and 38 regression tests pass on 7e3a766; the existing-runtime, no-DS and feedback-preserving refresh executions passed in the browser. The upstream baseline also passed its eight tests, including Chromium.
4. Obtain fresh review of the current feat(skills): add om-ux-design for detailed prototypes and review #106 head after updating the agreed condition in the specification and PR description.

The snapshot-validation defect found during the upstream review is already addressed here. A separate, tested two-file patch is available for your review on #5832, so that PR can be handled on its own merits.

Until we agree on the revised rollout condition, the blocked label and existing prerequisite remain in place.

[matgren]

Agreed: replace the "#5832 merges first" prerequisite with the verified import from the pinned commit, exactly as you list it (source commit, file mapping, accounted differences, retained evidence, fresh review). The original ordering served the Phase 1 → Phase 2 extraction; after the rename to om-ux-design and the workflow changes a re-diff against a merged upstream would no longer verify anything, and this collection is the source going forward.

Two things before the label moves: record the revised condition in the #91 rollout section and in this PR's description, so the decision lives with the spec and not in a comment thread; and @pkarw, since the gate came from your 4 Sept review, please confirm and take the re-review, then blocked comes off.

[zielivia]

🤖 om-ux-design — rollout prerequisite update

The condition accepted by @matgren is now recorded in the #91 specification's Rollout section, #91's rollout description, and this PR's merge gate. Documentation commit: 6a71dcff3cba68c59e8e2465292b7669192750b2.

The verification record maps all 13 files from upstream 9ea83205be7447867c042bbcfd3caaa9b4cadfb5, explains the intentional differences, and confirms four byte-identical CSS files plus 124 unchanged token records. All six configured commands passed locally, including 38 regression tests. No implementation changed; earlier browser/upstream results are explicitly retained as historical evidence.

@pkarw, please confirm the revised prerequisite and re-review the current head, as requested in @matgren's decision. blocked remains until that requirement is satisfied.