v0.4.0

[0.4.0] - 2026-06-03

• add: a JSON Schema for source-paths.json plus a check-jsonschema CI gate that meta-validates the schema and validates the bootstrap template and every bundled example against it. The schema transcribes the contract verify.sh Check 1/2 enforce, including its null/empty-string-as-absent reading of optional cross-axis fields (plugin/skill-engine/engine-bootstrap-templates/source-paths.schema.json, .github/workflows/lint.yml).
• add: a grounded-citation eval corpus for the MCP example and a keyless grounded_rate.py --dry-run CI gate that validates each example's eval-prompts.json without calling the API (examples/modelcontextprotocol-python-sdk-context/research/{eval-prompts.json,eval-results.md}, .github/workflows/lint.yml).
• change: the navigator's default Claims policy now requires an inline SHA-pinned permalink on every load-bearing claim — the behavior the grounded-citation eval measures — propagated to both navigator templates, all three examples, and the artifact contract (plugin/skill-engine/engine-bootstrap-templates/navigator*.md.template, examples/*/SKILL.md, plugin/skill-engine/docs/02-artifact-contract.md).
• change: harden the clone-to-cache flow — git ls-remote / clone calls carry the -- argument terminator across engine-bootstrap, discover, and refresh, and the clone path additionally guards the source_id and skips an unsafe id or an empty resolved SHA rather than aborting the run (plugin/skill-engine/skills/{engine-bootstrap,discover,refresh}/SKILL.md).
• change: make the verify.sh catalog/skill-json comment-strip robust to inline and multi-line HTML comments via a shared strip_md_comments awk helper (kept byte-identical across the four copies), with a new verify-bijection suite pinning the behavior (plugin/skill-engine/engine-bootstrap-templates/verify.sh, examples/*/verify.sh, plugin/skill-engine/tests/verify-bijection/run.sh).
• change: run each bundled example through verify.sh, a strict permalink-density floor, and the grounded-rate dry-run in CI, and tighten the skill-content-eval semgrep rule to match real eval calls rather than "eval (parenthetical)" prose (.github/workflows/lint.yml, .semgrep/skill-content.yml, plugin/skill-engine/tests/permalink_density.py).
• change: document the per-contextualizer CLI as an optional pattern rather than a generated surface, and reframe the README hero around auditable/offline grounding instead of a base-model comparison (README.md, CAPABILITIES.md, plugin/skill-engine/docs/{04-delivery,05-invariants,06-release-doctrine}.md).
• fix: correct doc claims that had drifted from the shipped code — verify.sh's actual enforcement surface, the coverage-testing figures, the navigator body section list, and the schema / version-sync cross-references (plugin/skill-engine/docs/{02-artifact-contract,05-invariants,13-coverage-testing}.md, plugin/skill-engine/engine-bootstrap-templates/release-command.md.template).