v1.0.3

The drift check could not see the bugs it was meant to prevent. Every one of the eight fixes in v1.0.2 passed it clean, because it asked a single question, does this tool exist, and answered that correctly while a tool documented with invented parameters, a capability the skill denied, and a limit wrong by three orders of magnitude went unflagged.

Parameters are verified against the schema

check_mcp_drift.py now compares every documented parameter against the tool's inputSchema, and separately reports required parameters a skill never mentions. Reintroducing the v1.0.2 bug reproduces it by name:

Documented parameters that DO NOT EXIST on the tool:
  linkedin-analytics: linkedin_create_reshare has no parameter 'postedId'
  (it takes: commentary, parent, platformId, visibility)

It found a ninth bug on its first run

bluesky-post documented altTexts on create_post. No such parameter exists, and alt text cannot be set through this API at all: the value is not processed, the media model never persists an alt property, and platformSettings rejects Bluesky outright.

The skill promised it in four places, including a best practice telling users to always add it. All corrected, with the reason stated once and an instruction not to report alt text as published when it was not.

Two live tools nobody had documented

The same run surfaced post_stats and profile_stats, which return engagement counters and follower counts for Bluesky and Mastodon. Now documented in bluesky-post.

Platform limits have a source of truth

check_platform_limits.py compares stated character limits, image counts and video-only claims against GET /api/v1/platform-limits, which is generated from @publora/platform-limits rather than maintained by hand.

It checks only what parses unambiguously and stays quiet about the rest, because a check that cries wolf on prose is one people learn to skip. Reintroducing two v1.0.2 bugs reproduces both:

Limits that disagree with the API:
  bluesky-post: character limit stated as 280, API says 300
  tiktok-post: calls tiktok video-only, but the API reports image support (35 max)

Both run every Monday with --require-key, so a missing secret fails loudly rather than leaving a green schedule that checks nothing.