v1.9.19 - Pipeline hardening

[1.9.19] - 2026-10-12

Pipeline hardening: baseline wiring, count reconciliation, CI integrity gate

Verified release command: bin/make-release.ps1 -Version 1.9.19 -BundledCount 275 -OnDiskCount 302 -Title "Pipeline hardening" (add -DryRun to preview). It fails closed unless the tree is clean, on main, and the manifest row count matches -BundledCount. The version is single-sourced from that parameter, which is then propagated into CHANGELOG, README, tag, and release title.

Method. Deep-dived all three pipeline families (install, verify, sync/release) with an
evidence-first pass, then empirically confirmed each finding against the live environment rather
than trusting the docs.

Root cause found and fixed — the security gate never applied its own baselines. skillspector scan was invoked bare in install-skill.ps1, so every operator-reviewed suppression was inert and
reviewed skills re-blocked on each install. Verified directly: diagram-design returns exit 1
(hard block) without --baseline and exit 0 (pass) with it. setup/install-skill.ps1 now
resolves a baseline (-BaselinePath → <repoRoot>\baselines\ → ~/dev/baselines/ →
$env:SKILL_BASELINES_DIR) and passes --baseline; Phase 1b deploys baselines/*.baseline.yaml
to ~/dev/baselines/ so the helper works with no repo root in scope. The scan-log row records
baseline:<file>|none for traceability.

Count truth reconciled (manifest is now the single source). The manifest holds 275 rows
(274 active + 1 disabled); disk holds 302 dirs. README, AGENTS.md and SETUP_GUIDE.md carried
three mutually inconsistent sets (257/258/275, 284/302, 18/20 CLIs, 11/12 MCP). All present-tense
claims corrected.

make-release.ps1 could not fix the drift it was meant to. Its on-disk regex
\(\*\*\d+\*\* on disk\) matched 0 times in README, and no pattern touched the five
hard-coded 258 prose sites, so a release stamped the numbers that were already right and left
the stale ones. Patterns corrected; all four now match (probed against the live README).

New CI gate (the bundle had none). bin/check-bundle-integrity.ps1 checks only repo artifacts
(PowerShell AST parse, JSON validity, manifest rows/duplicates/local/* resolution, and manifest
count == README/AGENTS claims == release-script patterns). Wired to
.github/workflows/bundle-integrity.yml on push/PR to main. Verified to pass clean (10/0/0) and
to fail on an injected stale count.

Fixes:

area	change
setup/install-skill.ps1	--baseline resolution + -BaselinePath param; scan-log baseline column; atomic staged-rename install (Install-SkillTree) so an interrupted copy can no longer leave a half-installed skill. Mirrored to bin/install-skill.ps1 and ~/dev/bin/.
setup/setup-global-skills.ps1	Phase 1b deploys baselines/*.baseline.yaml to ~/dev/baselines/.
bin/make-release.ps1	4 dead/stale README count patterns replaced with 8 working ones; active/disabled split derived from the manifest; ASCII-safe patterns (BOM-less UTF-8 was parsed as ANSI by PS 5.1, corrupting emoji/em-dash literals); release-body extraction guarded against a top-section [Unreleased].
.vscode/tasks.json	verify-all hard-coded another machine's path (C:\Users\colorfire-ai-395\...) → ${workspaceFolder}.
bin/check-bundle-integrity.ps1, .github/workflows/bundle-integrity.yml	New gate + CI.
README / AGENTS.md / SETUP_GUIDE.md / unblock report	Counts corrected; baseline mechanism documented.

Consolidation: real MCP validator, shared audit lib, deduped scripts

• bin/validate-mcp.ps1 was not a validator — it printed a summary and never set an exit
  code, so verify-global-bundle.ps1's MCP gate was always green. It now asserts every template
  server is present and exits 1 on a miss (negative-tested with a 1-of-12 fixture).
• bin/lib/bundle-common.ps1 — shared Initialize-BundlePath, Get-BundleRoot,
  Get-NormalizedMcpName, Get-BundleMcpServers, Test-BundleMcpServers. Removes the
  copy-pasted PATH prelude and MCP cross-check from verify-state.ps1 / validate-mcp.ps1.
• Deleted 3 zero-consumer duplicates — bin/check-mcp-cmds.ps1 (its only consumer was a
  plan doc; its config check is now real in verify-state), bin/audit-mcp.ps1 and
  bin/retest-mcp.ps1 (superseded by bin/mcp-smoke-test.ps1). bin/ is back to the 27
  top-level scripts the README documents.
• verify-global-bundle.ps1 now exits non-zero explicitly and its MCP gate can actually fail.

Temp-clone leak in the installer

install-skill.ps1's cleanup used a single Remove-Item -Recurse -Force -ErrorAction SilentlyContinue,
which silently fails on the read-only pack/object files git creates — 51 skill_install_* clones
(12 MB) plus ~77 scan/ref logs were found leaked in %TEMP%. New Remove-TempTree clears
read-only/hidden/system attributes and retries, warning if anything survives; the per-run scan and
ref logs are now removed too. Verified against a clone containing read-only git