Candidate checked on Linux x64 with Node 22.23.2 and project-local Sharp 0.35.4. The checkout lockfile was installed with npm ci --ignore-scripts. No shared tool cache or explicit Sharp locator was required for the assembled tests or packaged CLI.
The initial npm test executed 38 individual tests: 38 passed, zero failed, zero skipped. Coverage includes detached record revisions, protected chosen context, explicit reopening, stale revisions, malformed JSON references, absent/errored capability probes, refused SVG inputs, output collisions, source preservation and actual raster pixels for clipping, transforms and a hole. CLI tests exercise an npm-style binary symlink from another directory. The skill authoring validator also passed; it establishes metadata structure only.
An npm pack --ignore-scripts archive was installed in a separate local consumer. Its installed binary validated the packaged synthetic record, probed its own local renderer and exported the packaged SVG to a separate PNG from the consumer directory. Actual named module exports were inspected. The archive contained the skill, references, helpers and synthetic examples, with no private work receipts or dependency tree. The repository lockfile pins checkout dependencies; a consumer installing the archive resolves dependencies under its own lockfile.
An independent code review found that malformed reference objects could throw during validation. The fix rejects invalid IDs before reference bookkeeping, with regression coverage across all reference arrays. Integration review also covered packaging and CLI execution. The CLI entrypoint was corrected to recognize npm binary symlinks.
Seven independent manual workflow exercises covered explicit magazine-cover exploration, implicit bookshelf exploration, a single editable invitation, contradictory feedback with a preserved composition, reuse with missing agreed inputs, and unrelated arithmetic and correctness-only code requests. A real invitation SVG was rendered and its PNG inspected. An unsupported letter-spacing attribute was refused on the first attempt; that failure was retained, the study simplified and the retry inspected. These exercises assess instructions and observable outputs, not automatic client routing or human acceptance.
Fresh local CLI sessions subsequently demonstrated direct and implicit installed-skill selection, with two unrelated requests avoiding activation. An installed-client synthetic revision preserved earlier records and sources. These bounded observations do not establish universal routing, desktop propagation or owner acceptance. Only the stated Linux/Node/Sharp environment was qualified. Host fonts affect rasterized text. The SVG recognizer supports a conservative subset, not arbitrary SVG or an untrusted-input sandbox. No font build pipeline, production print qualification, engineering acceptance, deployment or release was performed. User inspection and scoped choices remain necessary for design acceptance.
The next qualification step is desktop discovery and a real scoped brief with user review. Preserve accepted choices and source artifacts during that evaluation.
The renderer-directory change adds three assembled tests, bringing npm test to 41 passing tests with zero skips. Explicit empty directories remain absent even with a renderer available in an ancestor checkout. Incompatible modules and broken native/transitive dependencies report errored status with setup help; discovery does not install or write files. Existing export refusal tests still verify that unsupported SVG is rejected before module resolution.
A fresh npm-installed consumer omitted optional dependencies. A separate user-owned directory installed Sharp 0.35.4 using the setup guide's npm command. The installed binary was run from another directory, with spaces in both consumer and renderer paths. npm run test:installed-renderer passed one end-to-end test covering setup guidance, missing/incompatible dependencies, record use without rendering, actual capability/render output, SHA-256 source/output identity, exact source preservation and output overwrite refusal. The installed package did not contain its own Sharp; its explicit renderer boundary supplied it. An independently inspected 320 by 240 PNG was also retained. The test does not install dependencies or access the network itself.
To reproduce that opt-in test, prepare a fresh npm consumer from an npm pack --ignore-scripts archive with --omit=optional --ignore-scripts, and prepare a separate renderer directory using the setup guide. Then run from the source checkout:
INGENIUM_TEST_CONSUMER_DIR="/your/fresh-consumer" \
INGENIUM_TEST_RENDERER_DIR="/your/owned-renderer" \
npm run test:installed-rendererThe consumer must contain node_modules/@ajhcs/ingenium and its npm binary link. Use new owned directories for fixture setup. No existing native client cache was mutated for this test; the earlier installed-client evidence remains a preserved snapshot of its earlier candidate. This change is verified in a fresh installed package, not as a desktop refresh.
The assembled foundation suite ran 79 individual tests: 79 passed, zero failed, zero skipped on Node22.23.2/Linux x64. It covers pure layout construction, shared record/guides, boundaries/conflicts/cycles, explicit optical exceptions, unrounded contrast thresholds, strict finite JSON evidence, scoped exceptions, stable identities/deltas, missing/incompatible browser capability, actual browser states/journeys and file/CLI integration. Tests include exact4.5 and just-below4.5 inputs; status never follows a rounded display value.
Real browser runs reused an existing compatible Playwright1.57.0, @axe-core/playwright4.11.1, axe-core4.11.1 and Chromium143.0.7499.4 installation. Chromium's sandbox remained enabled. Existing rootless runtime libraries and a temporary directory on the admitted workspace were supplied process-locally. No browser/runtime download, security change or new external dependency installation was required. The default suite explicitly skips the two opt-in real-browser tests when their adapter/executable inputs are absent; the reported79-test qualification supplied both and skipped none. The core remains useful without browser dependencies.
An original owned fixture was rendered at1280×900 and320×720 CSS viewports, under an English text-spacing override and in an open-dialog state. It exercises a source-derived SVG grid, native versus transformed bounds, font readiness, state-specific axe outcomes and named keyboard focus return. The deliberate broken variant reported10 failure outcomes and8 review outcomes, including unnamed controls, font failure and overflow/clipping candidates. The corrected variant reported no failure, error, review-needed or not-run outcomes in its authored scope. Counts are per scoped outcome, not distinct WCAG criteria or a completeness score. The clean, narrow/text-spacing, dialog, guide and relevant failure-crop images were visually inspected.
Independent reviewers reproduced layout partial-guide/resource failures, malformed arrays/null constraints, exception-scope leakage, accessor identity drift, hidden exception changes, browser state assertions lost from status, malformed-profile rejection and ignored options. Fixes received regression coverage and exact-reproducer re-review. Unsupported zoom now errors; clip paths/masks/filters remain review candidates; profile annotations do not infer acceptance. Consumer forward-testing also exercised construction, invalid constraints, optical review, deltas, missing adapter and overwrite refusal.
A fresh npm-installed consumer omitted optional dependencies and scripts. Its packaged generator and binary executed outside the checkout with the explicit external adapter and protected browser. Source exports and installed helper bytes were checked against the candidate; it retained full reports and actual images. This is real installed-package/CLI evidence, not refreshed desktop skill discovery or a new LLM client-routing qualification.
The review runner keeps one prepared browser/context/page across authored profiles and states. Full raw results, screenshots and reports stay in evidence files; stable fingerprints drive compact introduced/resolved/updated summaries and at most8 optional target crops. In one retained broken-to-fixed fixture run the summary was12,345 bytes, the report232,068 bytes and raw JSON607,962 bytes. These are artifact sizes for that run, not a token/cost/performance benchmark. Exact byte sizes change with evidence paths and outcomes.
Remaining limits: automated checks are not accessibility certification; geometry candidates do not prove painted visibility or loss of meaning/functionality; font readiness does not establish exact glyph provenance; authored viewport sizes are not browser zoom or print qualification. No all-device, all-WCAG, engineering-adequacy, originality, taste or owner-acceptance claim follows. Intentional scrolling/overlap and scoped exceptions remain visible for review. No font/vector pipeline, asset resolver or award-reference study is implemented in this slice.
This slice is offline-qualified only, with live provider qualification blocked/not-run. One bounded metadata attempt each to Iconify search/collection and Fontsource filtered fonts/detail returned HTTP403. No retry, alternate host/route, proxy, credential or permission change followed. Provider versus intermediary cause is unknown. Official primary API documentation informed the adapters; no live asset, collection license or font license was verified by the installed client. Fontsource file preview/fetch explicitly remains unavailable until a file/license/version binding is qualified. shadcn remains a documentation-only metadata extension; no registry code executes.
The assembled Node22 suite ran101 individual tests:101 passed, zero failures or skips, with existing parser and browser inputs explicitly selected. The22 offline asset tests cover default network refusal, malformed metadata, missing/unsafe license, explicit selection, timeout/403/429 without retry, declared/streamed oversize input, MIME, unsafe URLs and raw redirects, strict parsed XML/namespace/element/attribute/path bounds, optional parser absence, provenance, cache capacity/integrity, symlink refusal and overwrite protection. The full suite retains the prior foundation's actual protected-browser checks on owned fixtures; these are not live-provider tests.
Independent read-only reviewers found and reproduced cache fixture evidence relabeled as network, preview source identifying metadata instead of the asset, malformed exported size bounds, nonfinite/path grammar input, inherited limit keys and encoded redirect normalization. Remediation preserves acquisition mode and cache-hit identity, separate asset/metadata sources, explicit hard bounds and raw-location validation before URL normalization. Exact original reproducers were re-reviewed. These are bounded correctness reviews, not an exhaustive security certification.
A fresh npm-packed consumer was installed offline with scripts and optional dependencies omitted. It ran the packaged original synthetic asset example using an explicitly selected existing saxes6.0.0 parser, generated separate original/safe SVG and provenance, and rendered the packaged HTML in the existing sandbox-enabled Chromium. The actual output was inspected and exact artifacts retained privately. This establishes offline installation/selection/cache/render behavior; no upstream asset or provider response is substituted by those fixtures. The example's MIT icon is original project work, with attribution recorded. Text uses system fonts; no font was fetched, constructed, installed or converted. No new external package/runtime was installed; manifests, lock and root dependency tree remain unchanged.
External XML uses an optional strict real parser plus a narrow static-icon allowlist. Unsupported SVG is refused, not stripped. Original source remains untrusted; only the separately serialized derived file is offered for rendering. Cache hashes detect byte corruption under the documented one-owner model; they do not establish publisher authenticity or resist a malicious same-authority writer. WOFF2 admission is container-only, unused by the current provider fetch path. Counts, byte sizes and fixture render inspection imply neither accessibility certification nor artistic quality. Parent inspection accepted the earlier foundation PNGs as technical fixture evidence only; generic fixture blocks/labels are not a final user-facing design standard. All predecessor artifacts and limits remain preserved.
This optional slice uses an isolated CPython3.12 environment and a hash-locked Linux x86_64 wheel closure: ufoLib2 0.19.1, ufo2ft3.9.1, FontTools4.67.0, skia-pathops0.9.2, picosvg0.23.0 and uharfbuzz0.56.3 (HarfBuzz14.6.0). Official source/docs/licenses and actual wheel metadata/notices were inspected. Direct tools, transitive dependencies and bootstrap pip are recorded separately; no global tool/font install, account, security configuration or Node dependency change. Fontmake is deferred for this one-master static face. The platform lock intentionally does not claim cross-platform wheel qualification.
Ingenium Grid Proof Regular has48 glyphs and45 encoded characters: uppercase ASCII, digits, limited punctuation, lowercase f/i and combining acute qualified on A. Original patterns/features generate editable UFO3 with metrics, kerning groups, anchors, ligature and an unencoded composite; TTF, standalone features, license, shaping reports and HTML proof remain separate. Round-trip source compilation reproduced identical TTF bytes. Actual HarfBuzz shaping of the delivered TTF verifies kern80-unit change, f+i substitution and zero-advance mark placement at offsets−310/740 with features on/off. Full FontTools table decompile, cmap and metric checks passed. OTS/Fontspector and standalone hb-shape/hb-view were absent: their validation is not-run. No font sanitation, hinting, production spacing, language breadth or typography quality certification follows.
The assembled Node suite ran106 tests, all passing without skips, with existing browser/parser and the optional Python explicitly selected. A separate16-test Python suite passed, including cmap/glyph/line/advance metrics, malformed/cyclic components, feature/anchor/group refusals, deterministic round-trip compilation, actual binary shaping, holes/winding, near-coincident edges, boolean operations and vector input limits. Independent reviewers reproduced changed-metric acceptance, missing-composite/proof mismatch, symlink-ancestor admission, fixed-viewBox clipping and silently dropped malformed trailing path commands. Fixes and exact original reproducers were independently re-reviewed; no remaining blocker in their bounded scope.
A fresh npm-installed consumer used the packaged Python helpers and original editable sources with the isolated tools. Its compiled TTF matched the qualified source build. The typed proof embeds the exact binary; Chromium CDP reported only the expected custom IngeniumGridProof-Regular for16/24/48/96px and complete-charset proof nodes. Exact embedded/compiled hashes, glyph counts and actual rendered PNGs were retained. This tests actual selected-font usage beyond font readiness. System-font explanatory labels are outside those proof nodes. The font and vector PNGs were inspected as technical specimens; parent acceptance and worked-design quality are separate.
The vector fixture preserves original sources and separate normalized/boolean derivatives. picosvg normalizes tested transforms, rectangular clipping and strokes; PathOps tests explicit evenodd/nonzero holes, union/intersection/difference, near-coincident edges, input nonmutation and actual/empty export bounds. Secure parsed input rejects unsupported masks/filters/resources/structures; drop_unsupported remains false. Initial pixel equality failed and that receipt remains preserved. Independent pixel/geometry analysis localized116 changed pixels/274 channels entirely to the four rounded stroke corners at800×560. Quadratic round-join approximation had sampled radial deviation≈0.05px at4×; antialias coverage/low-alpha RGB quantization explains the raster residual (max channel20, mean absolute0.000435). Hole/interior/straight/clip pixels were unchanged. The passing regression requires every changed pixel inside the qualified corner-edge rings plus empirical residual guards. This is not pixel identity or an all-input/all-size equivalence bound.
Limits remain explicit: bounded owned demonstration font compilation and narrow untrusted static-vector admission, not arbitrary-font sanitation, a general SVG interpreter/editor or protection from malicious same-authority writers. Native subprocess budgets are practical bounds. No provider403 was retried; the separate read-only diagnostic found insufficient retained headers/body/route evidence to attribute denials. Fontsource file fetch remains unavailable. Four worked design examples remain deferred; these capability proofs do not replace them. No merge, release, deployment or administration occurred.
An opt-in memory-only request observation ring was qualified with6 new offline tests plus22 existing asset tests:28 passed, zero skips with the existing parser. Tests cover default-off/inert behavior, synthetic secret exclusion, stable fingerprints independent of raw bodies/header values/queries, manual/unsafe redirect decisions, request exceptions and timeouts, copy isolation/caps and unchanged request options. No provider endpoint was requested. Independent review scope and results are retained with local receipts. This improves evidence for future already-authorized requests; historical403 cause remains undetermined and live asset qualification blocked.
The parent inspected the original font/vector PNGs and accepted them as technical proofs only. Grid-font16px readability is limited; there is no production typography acceptance. This boundary does not convert the specimens into worked design examples. Four worked examples remain the next design acceptance goal and were not started by this diagnostic follow-up.
The separate local-package library route qualified actual Fontsource Inter5.3.0 and Space Mono5.3.0, Iconify Lucide1.2.145, and explicit pure Iconify utils3.1.7 conversion. Registry acquisition retained exact metadata/tarballs/SHA512 receipts and executed no package scripts. Actual Inter browser CDP identified custom Inter-Regular glyphs; actual sun original/color-stroke derivative rendered. Historical provider API403s remain unaltered; recovered original evidence establishes executed HTTP refusals, not their issuing-layer cause. No denied endpoint was retried.
Four exact selected Radix3.0.0 scales, six original geometric constructors, selected Fluent Emoji Flat1.2.6 illustration/Hero Patterns tile preparation and three native Bulma1.0.4-styled wrappers were exercised through actual source exports and local renders. Independent reviews inspected source bytes, notices, previews, modifications and refusal/preservation paths. Findings about inherited shape IDs, integrity validation order, UI search and selected-control preservation were fixed and rechecked. Full relevant Node22 suite:152 tests passed,0 failures,0 skips with all explicit optional parser/browser/Python/UI inputs. Separate acquisition-helper Python suite:4 passed. Four CLI regressions include actual local pinned UI data and customized selection round trips. These observations do not prove installed desktop routing, source legal sufficiency, artistic acceptance or product-wide accessibility.
Real-source limits remain explicit: Lucide's full ISC/Feather MIT notice is an upstream snapshot with unknown artwork release binding; Fluent's pinned Microsoft MIT notice does not identify the unknown artwork release; Hero's official site declares CC BY4.0 while its repository has no notice. The external full CC legalcode request returned HTTP403 and was not retried or obtained. Source/rights/package/tool identities remain separate. Full-design/template libraries are excluded.