TueJon · TueJon · Aug 27, 2026 · Aug 27, 2026
diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -7,8 +7,8 @@
     {
       "name": "webmcpify",
       "source": "./",
-      "description": "Integrate WebMCP into any existing web app — inventory, integrate, verify, heal — without touching unrelated logic or UI.",
-      "version": "0.4.0"
+      "description": "WebMCP agent skill for curated core coverage or route-by-route parity — inventory an existing web app, integrate approved tools, then verify and heal them in a real browser.",
+      "version": "0.5.0"
     }
   ]
 }
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "webmcpify",
-  "description": "Make any web app agent-ready, verifiably: an end-to-end pipeline that inventories user actions into a reviewable tool manifest, integrates WebMCP tools, then verifies and heals them in a real browser — with zero unrelated changes.",
-  "version": "0.4.0",
+  "description": "WebMCP agent skill for curated core coverage or route-by-route parity — inventory an existing web app, integrate approved tools, then verify and heal them in a real browser.",
+  "version": "0.5.0",
   "author": {
     "name": "Jonas Tüchler"
   }

diff --git a/.cursor-plugin/plugin.json b/.cursor-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "webmcpify",
-  "description": "Make any web app agent-ready, verifiably: an end-to-end pipeline that inventories user actions into a reviewable tool manifest, integrates WebMCP tools, then verifies and heals them in a real browser — with zero unrelated changes.",
-  "version": "0.4.0",
+  "description": "WebMCP agent skill for curated core coverage or route-by-route parity — inventory an existing web app, integrate approved tools, then verify and heal them in a real browser.",
+  "version": "0.5.0",
   "author": {
     "name": "Jonas Tüchler"
   }

diff --git a/AGENTS.md b/AGENTS.md
@@ -11,9 +11,12 @@ Quick facts:
   (loop) → VERIFY (loop) → HEAL (loop) → AUDIT + report. Invocation modes
   (`inventory` / `integrate` / `verify` / `status` / `full`) run subsets — see
   SKILL.md §Invocation modes.
-- All state persists in `.webmcpify/manifest.json` (Manifest v2) in the target
+- All state persists in `.webmcpify/manifest.json` (Manifest v4) in the target
   repo — resume from it if it exists. Terminal tool statuses: `verified`,
   `skipped`, `rejected`.
+- Coverage is explicit: `curated` produces a reviewed route→tool map; `parity`
+  produces a per-route interactive-element census. Neither mode may infer coverage
+  from a raw tool count.
 - `skills/webmcpify/templates/` contains everything you vendor into target
   projects (runtime TS + JS, ambient types, Playwright spec) — the skill directory
   is self-contained; nothing outside it is needed at run time.

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,17 @@ reconstruct them from git history.
 
 ## [Unreleased]
 
+- Added an explicit `curated | parity` coverage choice, policy-backed inventory
+  verdicts, and a required route→tool coverage map (an element census for parity).
+- Made secure context, verification origin, backend origins and CORS assumptions
+  DETECT gates instead of late verification surprises.
+- Guarded imperative tools against bare `null`/`undefined` results and documented
+  deferred route changes after a structured result.
+- Classified failures before retry counting, reset counters after contract changes,
+  and made skips state the impossibility class and evidence.
+- Hardened headed-Chrome verification around environment-provided origins and
+  dedicated profiles, and added dated ChatGPT Site tools guidance.
+
 ## [0.4.0] — 2026-08-17
 
 - Migrated persistent runs to Manifest v3 with explicit auth fixtures, client vs.

diff --git a/README.md b/README.md
@@ -4,7 +4,8 @@
 
 🌐 **[webmcpify.at](https://webmcpify.at)** — the site itself is webmcpified: open it with a WebMCP-enabled agent and call its tools.
 
-webmcpify is an agent skill that integrates [WebMCP](https://webmachinelearning.github.io/webmcp/)
+webmcpify is a WebMCP agent skill for **curated core coverage or route-by-route
+parity**. It integrates [WebMCP](https://webmachinelearning.github.io/webmcp/)
 (`document.modelContext` — a proposed web standard incubated in the W3C Web Machine
 Learning Community Group, currently in Chrome origin trial) into an **existing**
 web application — from a static landing page to a large multi-tenant SaaS — end to end:
@@ -14,11 +15,12 @@ DETECT ─▶ INVENTORY ─▶ [you approve the tool manifest] ─▶ INTEGRATE
              loop                                            loop        loop     loop
 ```
 
-Your coding agent investigates the codebase, proposes a **tool manifest** (every
-user action worth exposing, with names, schemas, examples, and a read-only/mutating
-classification), and after your approval integrates the tools, **exercises each one
-in a real browser**, and heals failures — escalating honestly what it can't fix —
-while keeping unrelated logic and UI untouched.
+Your coding agent investigates the codebase, asks whether you want a curated set of
+high-value actions or an auditable per-route interaction census, then proposes a
+**tool manifest** with names, schemas, examples, coverage reasons, and a read-only/
+mutating classification. After your approval it integrates the tools, **exercises
+each one in a real browser**, and heals failures—while keeping unrelated logic and
+UI untouched.
 
 ## See native Chrome verification
 
@@ -76,6 +78,7 @@ Open your agent in the target repo and pick your scope:
 /webmcpify integrate      # integrate the approved manifest
 /webmcpify verify         # verify + heal what's integrated
 /webmcpify status         # where are we? what's next?
+/webmcpify full parity    # census every interactive element on every authenticated route
 ```
 
 (or in plain words: *"webmcpify this app"*, *"map what tools this app could expose"*)
@@ -95,8 +98,13 @@ Every phase is a **loop over persistent state**, not a one-shot pass:
   deep-reads one area per iteration — a 500-file SaaS is processed area by area,
   never in one context-busting sweep. Sub-agent fan-out writes per-area shard
   files; a single coordinator merges them (no write races).
-- **Tool budgets** keep SaaS toolsets usable: priority waves, an overlap rule
+- **Coverage is explicit:** `curated` produces a reviewed route→tool map for core
+  actions; `parity` produces a per-route element census where every interaction is
+  mapped to a tool or a written reason. A tool count alone is never called 100%.
+- **Tool budgets** keep curated SaaS toolsets usable: priority waves, an overlap rule
   (no two tools matching the same request), and role/tenant coverage tracking.
+  Parity uses route-scoped registration and reports client-capacity gaps instead of
+  claiming an unmeasured universal per-page limit.
 - **Integrate** works in small batches (one area or ≤5 tools), each independently
   built and typechecked — committed per batch only if you opted in.
 - **Verify/Heal** iterate per tool with attempt caps and honest escalation
@@ -108,13 +116,17 @@ Every phase is a **loop over persistent state**, not a one-shot pass:
 - **Unrelated logic and UI stay untouched** — every diff hunk traces to a manifest
   entry; a final audit against the recorded baseline commit enforces it, and files
   that were already dirty when the run started are never modified or reverted.
-- **Read-only first** — mutating tools require your explicit per-tool approval;
-  destructive/payment actions are never exposed.
+- **Read-only first** — server mutations require your explicit per-tool approval.
+  Auth, signup, billing, payment and credential-returning tools stay excluded;
+  irreversible delete actions can only open the app's existing confirmation UI.
 - **Server stays the trust boundary** — tools only call code paths your UI already
   uses; no new endpoints, no bypasses.
 - **Spec-shaped, zero dependencies** — a small MIT runtime is vendored into your
   repo (no npm dependency), everything feature-detected: your app is
   **behaviorally unchanged** in browsers without WebMCP.
+- **No ambiguous imperative results** — the runtime guards accidental bare
+  `null`/`undefined`, and route-changing tools return a structured result before
+  deferring navigation and route-scope disposal.
 - **Exercised, not assumed** — every tool is enumerated and executed in real
   Chrome, asserting on both the tool result and the resulting UI state, from
   examples recorded in the manifest. That includes mutating declarative forms,
@@ -149,6 +161,9 @@ enumeration/execution surface, and treats Google's live
 source of current best practices at integration time.
 
 Release-by-release spec adaptations are recorded in the [changelog](CHANGELOG.md).
+ChatGPT's separate, model/account-gated client surface is documented as
+[Site tools](skills/webmcpify/references/client.md), with dated availability facts
+and a troubleshooting order.
 
 ## Related projects
 

diff --git a/gemini-extension.json b/gemini-extension.json
@@ -1,7 +1,7 @@
 {
   "name": "webmcpify",
-  "description": "Integrate WebMCP into any existing web app — inventory, integrate, verify, heal — without touching unrelated logic or UI.",
-  "version": "0.4.0",
+  "description": "WebMCP agent skill for curated core coverage or route-by-route parity — inventory an existing web app, integrate approved tools, then verify and heal them in a real browser.",
+  "version": "0.5.0",
   "author": {
     "name": "Jonas Tüchler"
   }

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,10 +1,10 @@
 {
   "name": "webmcpify",
   "displayName": "webmcpify",
-  "description": "WebMCP agent skill — make any web app agent-ready, verifiably: inventory, integrate, verify in a real browser, heal.",
+  "description": "WebMCP agent skill for curated core coverage or route-by-route parity — inventory an existing web app, integrate approved tools, then verify and heal them in a real browser.",
   "type": "module",
   "license": "MIT",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "publisher": "TueJon",
   "repository": {
     "url": "https://github.com/TueJon/webmcpify"

diff --git a/release/v0.5.0-directory-update.md b/release/v0.5.0-directory-update.md
@@ -0,0 +1,37 @@
+# webmcpify v0.5.0 — directory update draft
+
+Status: copy and refresh plan only. Do not submit, post, publish, buy placement or
+change ads without a separate approval.
+
+## Short directory copy
+
+webmcpify is an open-source WebMCP agent skill for existing web apps. Choose curated
+core coverage or route-by-route parity; it inventories a reviewable tool manifest,
+integrates only approved tools through the app's existing UI paths, and verifies and
+heals them in real headed Chrome. v0.5.0 adds secure-origin/CORS gates,
+policy-backed coverage evidence, structured results for route-changing tools and
+failure-aware retries.
+
+Canonical source:
+<https://github.com/TueJon/webmcpify/tree/main/skills/webmcpify>
+
+## Refresh after v0.5.0 is actually published
+
+- **GitHub:** publish the prepared release notes and verify the repository About/
+  README description carries `curated | parity`.
+- **skills.sh and SkillsMP:** expect source-driven refresh; verify the displayed
+  version/description after their next crawl because skills.sh previously served a
+  stale cached revision. Do not create duplicates.
+- **Awesome Skills:** request a recrawl/correction of the live canonical listing;
+  its provider copy called the project an “Antigravity agent skill”.
+- **mcpservers.org:** correct the live listing from “MCP Server” to “WebMCP agent
+  skill” and replace its description with the copy above.
+- **MCP.Directory:** the accepted review had no live listing as of 2026-07-23.
+  Re-check exact-name URLs; do not resubmit while the existing review is pending.
+- **agentskills.in / agentskill.sh / agenticskills.io:** re-check provider issue/
+  queue health before any retry; prior submissions failed on provider-side 500,
+  GitHub API 403, storage quota or an unconfigured review queue.
+- **OpenAgentSkill:** re-check the live star threshold before submitting.
+
+The weekly public-reach automation remains the measurement owner; do not add a
+second reach checker.
diff --git a/release/v0.5.0.md b/release/v0.5.0.md
@@ -0,0 +1,37 @@
+# webmcpify v0.5.0 — draft release notes
+
+Status: prepared, not published. Re-check the dated client claims and run the
+release checklist before creating a GitHub release or directory update.
+
+webmcpify now asks for a coverage target up front:
+
+- `curated` maps a reviewed set of high-value actions and records why other
+  interaction classes were deferred.
+- `parity` inventories every interactive element on every authenticated route and
+  maps each one to a WebMCP tool or a written reason. The route census—not a tool
+  count—is the audit evidence.
+
+The rest of the pipeline is stricter where real integrations failed:
+
+- DETECT refuses to inventory on an insecure verification origin and records
+  backend-origin/CORS assumptions before tool work begins.
+- Inventory verdicts carry the policy that produced them; widening a gate reopens
+  affected areas automatically.
+- Identity, tenancy/billing, credentials and destructive-delete gates use separate
+  vocabulary, so creating ordinary product objects is no longer mistaken for
+  account creation.
+- Imperative tools cannot return bare `null`/`undefined`; route-changing tools
+  return a structured result before deferring navigation and disposal.
+- HEAL classifies failures before counting independent retries and resets the
+  counter after an approved contract revision.
+- The verification template requires a secure env-provided origin, a dedicated
+  Chrome profile and a real headed browser environment.
+
+The skill also documents ChatGPT's **Site tools** surface separately from Chrome
+developer verification. Availability details are dated 2026-08-27 and link to the
+official OpenAI documentation because model/workspace support can change.
+
+Compatibility note: no public source or measured client run establishes a universal
+safe tool count per page. Parity is an auditable coverage target, not a promise that
+every client will accept an arbitrarily large route toolset; client-capacity gaps are
+reported honestly.
diff --git a/skill.json b/skill.json
@@ -1,7 +1,7 @@
 {
   "name": "webmcpify",
-  "version": "0.4.0",
-  "description": "WebMCP agent skill — make any web app agent-ready, verifiably: inventory, integrate, verify in a real browser, heal.",
+  "version": "0.5.0",
+  "description": "WebMCP agent skill for curated core coverage or route-by-route parity — inventory an existing web app, integrate approved tools, then verify and heal them in a real browser.",
   "license": "MIT",
   "author": {
     "name": "Jonas Tüchler",
@@ -23,7 +23,7 @@
     {
       "id": "webmcpify",
       "path": "skills/webmcpify/SKILL.md",
-      "description": "End-to-end WebMCP integration pipeline: propose a tool manifest, integrate, verify every tool in a real browser, heal failures — zero unrelated changes."
+      "description": "Choose curated core coverage or route-by-route parity, inventory an existing web app, integrate approved WebMCP tools, then verify and heal them in a real browser."
     }
   ],
   "agents": ["claude-code", "codex", "cursor", "opencode", "copilot", "gemini-cli"],