Absolutely right? Prove all of it.
Tired of your agent calling the page, the email, the WordPress build, the billing and the ad tracking done, only to find one of them wasn’t? The All-Access Bundle gives it every pack’s checks, now and later, so it proves each one before it says it’s finished.
$149. The six separately: $234.
Works with
Fit check
Not sure which pack fits? Find yours in two questions
Every requirement, in detailSound familiar?
Tap every one you’ve lived through.
Nothing yet? Lucky you.
Why it keeps happening
Each stack your agent drives has its own ways of failing quietly. A Bricks page write returns success and renders nothing. A Cloudflare Pages site serves a second copy that search can index. The agent reports what the tool told it, and no tool told it otherwise.
So you become the check, in every stack at once. You read the email on your phone, load the site logged out, scroll the automation’s runs and the commit log. Each takes its own way of looking, and soon you’re doing the jobs you handed it.
What the CRM answered
Success. The sequence was created, from a request that set its sender name, from address and reply-to.
What it kept
None of them. All five sender fields were discarded, and no read-back shows it. Only a delivered email’s From line did.
The fix
The All-Access Bundle is Spotter Round, the Agent Setup Pack, the Email Pack, the WordPress Pack, the App Stack Pack and the Campaign Tracker Pack, plus every pack added after them. Each ships its own checks, and the planted failures that prove them.
Each pack byte for byte as it sells alone, plus one small plugin that installs all six in one step.
Every pack’s checks ship with the planted failures they have to catch first, so a green result means something.
New packs join the bundle as they ship, and every future version of every pack is included at no charge. Programs, which add a maintained starter and support, are sold separately.
Proof
Three checks from three different packs, run from a fresh unzip of the bundle. Each was aimed at a known result, a refusal included, and landed where it was aimed.
[ Shot 01 ]
hosted-asset-guard.mjs --selftest
Aimed: a 404 page served as an image; the guard must refuse it
ok 404 refused
ok 200 HTML from a catch-all refused
ok zero-byte image refused
18 cases behaved as designed
Landed where it was aimed // exit 0
[ Shot 02 ]
git commit -m refused
Aimed: a commit in a shared main checkout; the floor must refuse it
pre-commit: REFUSED — this is the MAIN checkout of repo, and it is shared:
- 1 linked worktree(s): ../repo-sibling
Not: --no-verify — it skips this repository's other hooks and leaves no record.
Landed where it was aimed // exit 1
[ Shot 03 ]
app-stack/ci/verify.sh
Aimed: one pack’s whole harness, planted failures included; it must end verified
ok 21 stripe-skills check(s), including planted failures
ok 9 script(s) with --selftest, each run by a check here
pack app-stack 1.2.2: 13 ran (13 passed, 0 failed) · 0 skipped · 7 not applicable to this pack
VERIFIED — shippable
Landed where it was aimed // exit 0
Who it’s for
The nineteen skills, grouped by the pack they ship in. Start with spotter-start: it routes each change to the right skill in any pack.
served.mjs --selftest
ok a behind deploy is NOT reported as a cache problem (expected origin, got origin)
ok a stale cache and a behind deploy get different verdicts
28 cases behaved as designed
served.mjs --selftest
ok a behind deploy is NOT reported as a cache problem (expected origin, got origin)
ok a stale cache and a behind deploy get different verdicts
28 cases behaved as designed
Verification for agent-written web work. A real build at real screen sizes, in light and dark; no cut-off text; a design that didn’t move; a speed claim measured fairly; and a live site that serves your new build, not an old copy.
secret.sh --selftest
ok a value of two lines: refused, exit 1, the stored value untouched
ok a value wrapped in a terminal's paste markers: refused, exit 1
50 cases behaved as designed
One set of rules, proven to reach every coding agent, several agents on one project without landing work on each other’s branches, and API keys handed over without entering the chat.
band-lock-guard.mjs --selftest
ok live text in the band: refused
ok accent border on a locked button cell: refused
ok dark block names .band: refused
37 cases behaved as designed
HTML email that survives real inboxes, dark mode and all, sent by Postmark, SureContact or anything else, and every Supabase Auth email from one generator. It’s checked against the email you built and a real send, not a preview in your browser.
page-review.mjs --selftest
ok planted page: findings counted, no control failed, exit 1
ok broken detector (min-words 6): the control fails, the run says so, exit 3
42 cases behaved as designed
Bricks 2.4 and later, Automatic.css and SureCart: the WordPress stack, proven rather than assumed, and sign-in screens on brand. One skill names the ways each tool fails without an error, and ships scripts that refuse the mistake before it reaches a live site. The other styles WordPress’s log-in screens and the Fortress security plugin’s two-factor pages from one set of colors and fonts.
passkey-check.mjs --selftest
ok userVerification "required" removed [uv-required]
ok an RLS policy comparing aal inline [aal2-sql]
ok live: the key never reaches the output, even when the server echoes it back
64 cases behaved as designed
Cloudflare Pages, Stripe billing on Supabase, passkey sign-in on Supabase Auth, SureContact and OttoKit: the web-app stack, proven rather than assumed. Each skill ships scripts that refuse the mistake before a customer finds it.
worker-check.mjs --selftest
PASS lead: no email or name anywhere in D1
PASS surecart: a test-mode order is stored live=0 and NOT sent to Meta without a test code
372/372 passed
Short links from a Google Sheet, first-touch UTM tags kept without cookies, leads and purchases sent to Meta from the server, and cost per lead in one sheet, set up the same way for every client and proven on the live Worker.
All nineteen skills, each with its job in one line. Every pack also works on its own; none leans on a skill another pack ships.
spotter-start
Which check fits the change you just made, in any pack you have installed.
verification-protocol Also free on its own
A real build, real screen sizes, both light and dark, and a clean browser console.
layout-proof
No cut-off text, nothing spilling off the screen — and the check isn’t fooling itself.
visual-fidelity-gate
Proves the design didn’t move: same pixels, three browsers, nothing jumping as the page loads.
build-ab-harness
Faster than last time, measured so the two runs can honestly be compared.
post-deploy-proof
Every address fetched twice, so an old copy a cache is still handing out can’t pass for the new build.
universal-agent-setup
The same rules reach every coding agent, and a doctor shows which instruction files each tool loads.
multi-agent-workflow
One worktree per agent, a peer detector and a git floor: several agents, no work landing on another’s branch.
secret-handoff
An API key reaches your agent in two one-line steps, hidden as you type it, and never in the chat or the transcript.
html-email
Dark mode that holds in Apple Mail and the Gmail app, a logo that doesn’t halo, and images proven reachable.
supabase-email-templates
Every Supabase Auth email from one generator, pushed with a partial update and read back field by field.
wordpress-bricks-stack
Templates staged behind conditions, a backup before every write, palettes that really render, and a page reviewer that can fail.
wordpress-login-screens
WordPress’s log-in screens on any theme and the Fortress security plugin’s two-factor pages, in one look, with proof the live page serves your current file.
cloudflare-pages
Every pages.dev address kept out of search and your domain kept in, checked in the build and at the edge.
stripe-on-supabase
Billing that goes live without a migration and can’t be bought at the wrong price.
supabase-passkeys
A passkey unlocked with a fingerprint, face or PIN counts as two factors, without locking anyone out.
surecontact-integration
The drip in the CRM matches the email you approved, byte for byte, and its silent failures are measured.
ottokit-integration
Automations kept as JSON in your repo, called only when the server’s id and an automation title you name both match, with other workspaces’ runs dropped.
campaign-tracker
Short links, first-touch UTM tags, leads and purchases sent to Meta from the server, and cost per lead in one sheet, for every client.
One download: a plugin marketplace with every pack as its own plugin, byte for byte the zip it sells as, and one more plugin that installs them all. Here is where each folder lands, and what it proves.
all-access/
Unzip it anywhere. Claude Code adds the folder as a plugin marketplace and installs every pack in one step, or install.sh copies all nineteen skills into your skills folder as plain skills, moving any folder of the same name aside rather than overwriting it.
CHANGELOG.md names the version of each pack inside, and the bundle’s own version moves whenever one of them does. Every pack’s plugin carries its own ci/verify.sh: everything that pack must survive, in one command, run from this download.
A check that has never failed is a green light with extra steps. Every pack’s checks ship with a planted failure they have to catch. Run that first: if a check calls the planted failure fine, don’t trust it on your real work either.
Run the broken examples
# run from the project you are checking, with the bundle unzipped at /path/to/all-accessnode /path/to/all-access/plugins/email-pack/skills/html-email/scripts/hosted-asset-guard.mjs --selftest # plants a 404 page where an image belongs and must refuse itbash /path/to/all-access/plugins/agent-setup/skills/secret-handoff/scripts/secret.sh --selftest # plants bad pastes in a temporary store and must refuse eachnode /path/to/all-access/plugins/wordpress-pack/skills/wordpress-bricks-stack/scripts/page-review.mjs --selftest # breaks the detector and must call the run not evidencebash /path/to/all-access/plugins/app-stack/ci/verify.sh # runs a whole pack with its planted failures and must end VERIFIEDWe call these negative controls: a planted defect the check has to fail on. The first serves a 404 page where an image belongs; the second pastes two lines, a blank and the wrong shape; the third breaks the page reviewer’s detector, and the run must say it isn’t evidence; the fourth runs a pack’s full harness, planted failures included.
The check that has never failed is the one to distrust.
The skills are plain text files your agent reads. The scripts are commented, and never run on their own. One installer finds every pack’s skills.
claude plugin marketplace add /path/to/all-accessclaude plugin install all-access@all-accessOne pack at a time: claude plugin install spotter-round@all-access. To try every pack for one session: claude --plugin-dir /path/to/all-access/plugins (Claude Code 2.1.265 or later).
The written skills need nothing. Most scripts need Node 18 or newer; the Agent Setup Pack’s need bash and git instead. The browser and image checks need these in the project you’re checking:
npm i -D playwright sharp && npx playwright install chromium webkit firefoxCommented scripts, and nothing compressed into a blob. Each pack’s own README says what its scripts touch; read it before you run them.
All-Access Bundle
$149.
The six separately: $234
Please don't resell it or share it outside your company.
Yes. The skills are plain text files and the checks are plain Node and shell scripts, so any agent can run them. Claude Code loads the skills from its skills folder. Codex, Cursor and the rest take a skill pasted into your repository’s AGENTS.md, and Gemini CLI reads that file once its settings name it.
No. Each folder under plugins/ is byte for byte the zip that pack sells as, with its own README, changelog, license and checks. The bundle adds one small plugin that installs them all, and the same install.sh every pack ships, which finds every pack’s skills.
Yes. Each pack is its own plugin in the bundle’s marketplace, so claude plugin install spotter-round@all-access adds just that one. On claude.ai, upload any single skill folder; in other tools, paste only the skills you want.
Numbered downloads with a list of what changed, one changelog per pack. The bundle includes every future version of every pack at no charge, and every pack added later; its own version moves whenever a pack in it does. You never pay for a new version, and you are never forced to update.
More than you paid for: everyone who bought Spotter Round before version 2 gets the All-Access Bundle, every pack now and every pack we add later.
Less: every pack you own counts $39 toward the $149 bundle. One pack makes it $110, two make it $71, three make it $32, and four or more make it free. Sign in on the upgrade page with the email you bought with, and it shows your price, applied when checkout opens.
No tracking, no license check, no analytics, nothing phoning home. Every request goes to an address you give a script, or to a vendor you run it against (Supabase, SureContact, OttoKit) with a key you supply; the Pages checker’s opt-in --from-wrangler mode lists your hosts through your own wrangler login, and the Campaign Tracker Pack’s scripts reach Cloudflare through it and call only your client’s own Worker. Lighthouse and wrangler come through npx, which fetches them from the npm registry unless your project already has them. Each pack’s README names them all, and the scripts are commented, and meant to be read.
Run the controls that ship with them: a script’s own --selftest, the broken examples in a pack’s examples/ folder, or the whole harness in its ci/ folder. That’s the answer we would want from anybody selling us this.
Yes — that’s what it’s for. One company covers every project that company delivers.
Fourteen days, no questions. A product about checking things that argued with you over a refund would be a poor advertisement for itself.
In the bundle
Each pack also sells on its own and ships its own checks. The bundle is all six, plus every pack added after them.
The layout, the pixels, the speed and the live deploy: your agent’s work, proven before it says it’s done.
One set of rules, proven to reach every coding agent, several agents on one project without landing work on each other's branches, and API keys handed over without entering the chat.
HTML email that survives real inboxes, dark mode and all, sent by Postmark, SureContact or anything else, and every Supabase Auth email from one generator.
Bricks 2.4 and later, Automatic.css and SureCart: the WordPress stack, proven rather than assumed, and sign-in screens on brand, including the Fortress security plugin’s two-factor pages.
Cloudflare Pages, Stripe billing on Supabase, passkey sign-in on Supabase Auth, SureContact and OttoKit: the web-app stack, proven rather than assumed.
Campaign tracking set up the same way for every client: short links from a Google Sheet, first-touch UTM tags without cookies, leads and purchases sent to Meta from the server, and cost per lead in one sheet.