docs: frontend team delivers correct work; the offline judge cannot run npm

Mission 01a0cbc7 on the new clawmates-frontend-scratch repo: accessible Tabs,
10/10 tests and tsc clean when re-run locally from the delivered branch, but
failed both iterations because the judge's copy excludes node_modules and
clawmates_core has no route to the registry. Blocks every npm team. Also fixes
the stale continuous_research row and adds self_audit to the recipe table.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

docs/TEMPLATE-MATURITY.md

@@ -13,7 +13,8 @@ mission built from it has completed and something checked the result.
 | `security_hardening` | 3 (scan → research → coding) | 1 scenario | +`rust_sdlc` | Exercised |
 | `benchmark` | 1 | 1 scenario | `rust_sdlc` | Exercised |
 | `refactor` | 1 | 1 scenario | `rust_sdlc` | Exercised |
-| `continuous_research` | 2 (analysis → script) | **none** | `continuous_research` | Runs live, unguarded |
+| `continuous_research` | 2 (analysis → script) | 1 scenario (`continuous-research`: digest on main, episode rendered, triage fields, saturation spread) | `continuous_research` | **Proven** — end to end incl. audio |
+| `self_audit` | 1 (research) | none (3 live runs, 2026-09-22) | `continuous_improvement` | Exercised — diagnosed a planted cause |
 
 `research_and_code` is the workhorse: every delivery, gate, judge, memory and
 triage scenario is built on it, so it is re-proven on every harness run.
@@ -58,7 +59,7 @@ holding (it was 55 of 85 dangling once).
 | `topic_research` | lead_researcher evidence_checker report_writer | research_web_readonly | 4 | **yes** — measured |
 | `continuous_research` | paper_reader signal_ranker script_writer | research_readonly | 11 | **yes** — live runs |
 | `backend` | api_designer db_engineer coder tester committer | coding_readwrite | 20 | **yes** — first run 2026-09-22 |
-| `frontend` | designer coder tester committer | coding_readwrite | 12 | no |
+| `frontend` | designer coder tester committer | coding_readwrite | 12 | **work verified by hand; judge cannot run npm** |
 | `mobile` | designer coder tester committer | coding_readwrite | 11 | no |
 | `gpu` | arch_analyst kernel_author bench_engineer coder committer | coding_readwrite | 13 | no |
 | `threejs` | scene_designer coder shader_author perf_engineer committer | coding_readwrite | 13 | no |
@@ -221,6 +222,35 @@ blocked on a target, not on the template. The remaining four —
 `codebase_research`, `papers_research`, `continuous_improvement`, `backend` —
 could be exercised against repositories we already have.
 
+## `frontend` — the work is right; the judge cannot check it (2026-09-22)
+
+Target: `osobh/clawmates-frontend-scratch` (private, disposable), a Vite +
+React 19 + TypeScript + Tailwind v4 app with Vitest and Testing Library,
+checked locally before any mission touched it. Task: an accessible Tabs
+component (ARIA tablist/tab/tabpanel wiring, roving tabindex, Arrow/Home/End
+with wrap-around, Tailwind focus style), with the brief and `done_when`
+stating the same requirements.
+
+Mission 01a0cbc7 delivered one commit, +191 lines, three files. Re-run
+locally from the delivered branch: **10/10 tests pass (9 new), `tsc -b`
+clean**. The component is correct on every stated requirement; one nit, the
+tab buttons lack `type="button"`. The agents ran `npm test` and the
+typecheck repeatedly in the mission container, all green.
+
+The mission **failed**, both iterations, on the judge's side. The judge
+verifies in `clawmates-runtime` against a copy that, by design, excludes
+`node_modules` (the transport packer's list). It cannot reinstall:
+`clawmates_core` has no gateway, so `npm ci` gets `EAI_AGAIN`. Every npm
+project, which covers `frontend`, `mobile` and `threejs`, therefore fails any
+`done_when` that asks for a passing suite, however good the work. Rust
+escapes it only because the scratch crates have no dependencies. The judge
+read the source correctly both times; it failed only on the suite it could
+not run.
+
+Not counted as evidenced until the judge can run the suite itself. How it
+should get the dependencies (offline from the lockfile, registry egress, or
+not at all) is an operator decision about the verifier's isolation.
+
 ## One thing both runs showed: agents reach for Bash
 
 Cumulative tool calls across every mission since the policy shipped: