vibesubin 0.5.0

TL;DR

v0.5.0 turns three social-contract invariants into machine checks, closes seven coverage gaps in ship-cycle surfaced by the user's typical release-cycle prompt, adds docs/ADDING-A-SKILL.md so a fresh contributor can author a skill without reverse-engineering, and fixes four real bugs surfaced during review.

Validator teeth

scripts/validate_skills.py now enforces four invariants that were social contract only:

• Harsh mode section present in every worker — mirrors CLAUDE.md never-do #4
• Sweep marker present in the six editable workers — mirrors never-do #7
• Manifest version sync between marketplace.json and plugin.json — mirrors never-do #8
• Path-traversal guard on backtick-quoted promised paths — defensive

New tests/test_validate_skills.py (11 tests, pytest + tmp_path) ensures the checks cannot regress silently. Wired into the existing validate-skills CI workflow.

ship-cycle workflow coverage

Seven additions close the gaps the typical release-cycle prompt exposed:

• Step 0.5 — Offer upstream review (invoke /vibesubin sweep, invoke a targeted worker, or proceed with operator-pasted findings) before assuming findings exist.
• Step 5.5 — Write PRD.md (themes + north-star goals + success metrics + deferred items) before clustering. New references/prd-template.md.
• Step 9a — Parallel dispatch (10+ simultaneous workers) for independent issues with explicit opus/max defaults.
• Step 9b — CI-green gate before gh pr merge.
• Step 5 acceptance criteria — mandatory test plan / docs plan / handoff notes fields per issue. Missing any field blocks Step 6.
• Step 11 audit trail — handoff notes propagate from issue body into close comment.
• Release pipeline — pre-merge and pre-tag CI-green verification via gh statusCheckRollup.

New contributor doc

docs/ADDING-A-SKILL.md (136 lines) — frontmatter schema, required sections checklist, validator contract, output shape, per-change-type file checklist, wrapper-skill rules. Linked from CLAUDE.md and MAINTENANCE.md.

Bug fixes

• manage-config-env ghost references in three locations (fight-repo-rot SKILL.md × 2, README.md, .env.example.template) replaced with the correct post-split skill names.
• audit-security/SKILL.md Sweep mode section added — it was the only sweep specialist missing the canonical heading.
• install.sh --dry-run no longer creates ~/.claude/skills — previously violated its own no-mutation contract.
• v0.4.0 CHANGELOG P2 bullet corrected in place — claim of "universal bullet in all 10 skills" was literally false (6 universal + 4 anchored variants).

Security

• .gitignore additions (*.pem *.key id_rsa* id_ed25519* *credentials* secrets/ *.pfx *.p12) — root .gitignore now matches the manage-secrets-env template defaults.
• install.sh --force symlink-traversal guard — blocks the local foot-gun where rm -rf could follow a symlink to delete data outside the install target.
• validator path-traversal guard on promised paths (see above).

Cleanup

• 5 empty references/ directories deleted (fight-repo-rot, setup-ci, vibesubin, manage-assets, write-for-ai). They were not git-tracked but surfaced as ambiguous structure cues.
• Umbrella ## Tone: balanced vs. harsh heading renamed to canonical ## Harsh mode — no hedging. Aligns with new validator Check A.
• codex-fix heading same canonical form.
• MAINTENANCE.md — removed references to two files that never existed; added CLAUDE.md to AI-session reading order; added pointer to new docs/ADDING-A-SKILL.md.

Intentionally skipped

• v0.4.1 patch release — the four real bugs were bundled into v0.5.0 alongside validator teeth and the new contributor doc. No separate 0.4.1 tag exists; every change intended for it is in 0.5.0.
• Dependency CVE scan, CI lint workflow, uninstall --dry-run, branch protection, repo-level secret scanning, README parity check, workflow-audit extension — out of scope. Not skill-coverage or invariant problems.

---

Full history in CHANGELOG.md.