webmcpify v0.5.0

webmcpify v0.5.0

webmcpify now asks for a coverage target up front:

• curated maps a reviewed set of high-value actions and records why other
  interaction classes were deferred.
• parity inventories every interactive element on every authenticated route and
  maps each one to a WebMCP tool or a written reason. The route census—not a tool
  count—is the audit evidence.

The rest of the pipeline is stricter where real integrations failed:

• DETECT refuses to inventory on an insecure verification origin and records
  backend-origin/CORS assumptions before tool work begins.
• Inventory verdicts carry the policy that produced them; widening a gate reopens
  affected areas automatically.
• Identity, tenancy/billing, credentials and destructive-delete gates use separate
  vocabulary, so creating ordinary product objects is no longer mistaken for
  account creation.
• Imperative tools cannot return bare null/undefined; route-changing tools
  return a structured result before deferring navigation and disposal.
• HEAL classifies failures before counting independent retries and resets the
  counter after an approved contract revision.
• The verification template requires a secure env-provided origin, a dedicated
  Chrome profile and a real headed browser environment.
• A temporary, agent-launched WebMCP Workbench now compares approved manifest
  tools with live registrations, builds schema-driven examples, and labels every
  result as Native or Simulated. Simulated evidence never counts as verification.
• The current CG draft's consequentialHint is carried through inventory,
  ambient types, integration guidance and verification. It signals significant
  real-world or non-reversible effects without replacing application-enforced
  authorization, confirmation, idempotency or replay protection. Chrome's current
  documentation includes the hint, but the local Chrome 150 proof accepted it at
  registration and still omitted it from getTools(); native propagation is not
  claimed until the target browser actually returns the field.
• Native Chrome's stringified I/O and spec-shaped object stubs now use an explicit
  adapter mode, avoiding heuristic retries that could execute a mutation twice.

The skill also documents ChatGPT's Site tools surface separately from Chrome
developer verification. Availability details are dated 2026-08-31 and link to the
official OpenAI documentation because model/workspace support can change. ChatGPT's
built-in browser currently discovers top-level imperative tools, not declarative
forms or iframe registrations; that client subset is separate from Chrome's broader
WebMCP implementation.

Compatibility note: no public source or measured client run establishes a universal
safe tool count per page. Parity is an auditable coverage target, not a promise that
every client will accept an arbitrarily large route toolset; client-capacity gaps are
reported honestly.

Thanks to @arnabwithab for the native/stub I/O
compatibility work in #13.