Release v1.4.0 - Safe ownership, evidence, and reproducible setup · haiqigeng/1-web-analyst-mcp-setup

Highlights

Adds a real installable SKILL.md with Codex UI metadata while keeping AGENTS.md as a lightweight cross-agent entry point.
Makes Apply ownership-safe: selected clients only, preview mode, timestamped backups, collision refusal, and managed ownership records.
Adds ResetMcpConfig to remove only unchanged kit-owned entries. ResetKit now cleans local credentials and runtime state without silently deleting client configuration.
Records factual Configured, Authenticated, Visible, and Verified evidence, including target and human-verifiable read-only proof in onboarding reports.
Resolves npm and PyPI packages to exact local versions after update checks, preventing floating @latest launches.
Makes the MCP catalog the provider source of truth and adds lifecycle-based freshness windows plus scheduled provider checks.
Expands validation from 6 to 26 behavior and safety tests, with PowerShell 7, Windows PowerShell 5.1, JSON schema enforcement, and release-archive secret scanning.

Run CheckMcpUpdates before Apply; local MCP launchers now require an exact generated version lock.
Run Apply -Client Selected -Preview before the real Apply to inspect client paths and server names.
To disconnect, run ResetMcpConfig -Client Selected -ConfirmedMcpEndpointDeletion before ResetKit.
Existing unowned MCP entries with the same server name are preserved and cause Apply to stop with a clear collision message.

GitHub Actions: passed on the release commit.
Pester: 26/26 tests passed.
JSON schemas and skill metadata: valid.
Release audit: passed; 35 tracked reusable files.
Audited archive SHA256: 35A44F643FCB48C359F9404AEE5CC866A89666D3C1098D6AD3080FFFF3687D0B.

See README.md for first use and CHANGELOG.md for the complete change list.