Skip to content

v0.3.5 — TS skill profile compatibility

Choose a tag to compare

View all tags
@abruption abruption released this 13 Oct 10:16
v0.3.5
a205794
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changes

  • Extend the finite TypeScript skill metadata matrix to the exact 0.2.1 profile, alongside existing 0.1.0/0.2.0 profiles. Historical runtime verdicts remain explicit; arbitrary future versions are not accepted.
  • Verify the complete reviewed skill candidate through the compiled 0.3.5 default and file inspector. Metadata compatibility does not authenticate instructions or authorize sending, consumption or ACK.
  • Align all four language READMEs/guides and the skill-design matrix with merged source, including the Codex review corrections for artifact status and evidence links. Existing CLI behavior, Python reference and published skill pin remain intact.

Upgrade

npm install --global --ignore-scripts session-peer@0.3.5

Both SSH endpoints must use exactly 0.3.5. npm does not update a separately managed skill. The published skill 0.2.0 pin remains valid; successor skill finalization/publication and an immutable install pin remain separate. No 0.4 handoff, general ACK/wait, Side Session or Steer experiment is included.

Verified publication

  • npm latest=0.3.5; preview=0.1.0-preview.1 unchanged.
  • Source: a2057940ba19056fcaaa5551a7820f7414bd3bfa.
  • Stage workflow 38380726060; protected npm environment approval recorded for abruption, followed by user-confirmed npm stage approval.
  • Reviewed local, retained Actions and public tarball bytes match. Stage metadata SHA-1 matched the same archive; a pre-approval staged tarball download was not performed because approval occurred before that inspection step. Public raw-byte equality was independently verified afterward.
  • SHA-256: 46f4a01f9570034fca49cfa5fad620f3f45b5f33b1a6714f29ea0a3c1e751ac0.
  • Integrity: sha512-EJc2B5tcruzHXiHDd7tyJjv2DBLYE7IHJiPVHBzLY9fSVasEQRdwx+ZZmiyBF8WHpQ7+pI3SO2VXwsQTgOWP+Q==.
  • Public provenance SHA-512 subject and source/repository/workflow/ref/event/run tuple match; npm signature audit, exact-version isolated installation/removal and 18 packaged Markdown/source byte comparisons passed.
  • Exact-main CLI and CodeQL passed, including Windows Node 22/24 CI. Fixture CI is not new live-agent/observer/steering qualification. No fleet/global installation or runtime operations changes.

For this release, the operator explicitly skipped fresh Trusted Publisher mapping and package publish-MFA policy reads. Those settings are not freshly confirmed; actual protected-environment approval and final npm stage approval were not skipped. Historical permissions evidence is not reclassified as a current settings audit.

Assets 2
Loading