@awebai/claude-skills 0.2.0 → 0.2.1

package/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "aweb-skills",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "aweb agent coordination skills — teach your Claude Code agent how to use the aw CLI for mail, chat, tasks, and team coordination."
 }

package/README.md

@@ -1,7 +1,8 @@
 # `@awebai/claude-skills`
 
-Content-only Claude Code plugin packaging the three canonical aweb skills:
-`aweb-coordination`, `aweb-messaging`, `aweb-team-membership`.
+Content-only Claude Code plugin packaging the four canonical aweb skills:
+`aweb-coordination`, `aweb-messaging`, `aweb-team-membership`, and
+`aweb-bootstrap`.
 
 Distinct from [`@awebai/claude-channel`](https://github.com/awebai/aweb/tree/main/channel),
 which ships the real-time channel runtime and requires

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/claude-skills",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Content-only Claude Code plugin shipping the canonical aweb agent-coordination skills: aweb-coordination, aweb-messaging, aweb-team-membership, aweb-bootstrap.",
   "license": "MIT",
   "homepage": "https://aweb.ai",

package/skills/aweb-team-membership/SKILL.md

@@ -39,7 +39,7 @@ Interpret failures by layer:
 - Missing signing key: local identity is incomplete.
 - Missing team certificate: identity may exist but cannot act in the team.
 - Active team mismatch: the identity has multiple memberships but this workspace is using the wrong one.
-- Address route, inbound-mode, or contact failure: the sender and recipient may both exist, but route validation or `inbound_mode=open|contacts_only` policy prevents discovery or inbound delivery.
+- Address route, inbound-mode, or contact failure: the sender and recipient may both exist, but route validation or `inbound_mode=open|team_and_contacts` policy prevents discovery or inbound delivery.
 
 ## Joining a team
 
@@ -143,7 +143,7 @@ For custodial identities, rotation and recovery are cloud-account operations. Do
 
 First contact to a global identity uses a concrete address route such as `<domain>/<alias>`. A bare `did:aw` is identity binding, not a first-contact delivery route. Legacy reachability fields may still appear in support/audit views, but they are compatibility/audit state, not live delivery authority.
 
-Delivery authorization is `inbound_mode=open|contacts_only`: `open` accepts valid senders after route validation, while `contacts_only` requires an exact active identity contact after the route is valid. Contacts do not synthesize routes and are not team-global authority.
+Delivery authorization is `inbound_mode=open|team_and_contacts`: `open` accepts valid routed senders, while `team_and_contacts` accepts verified same-team senders plus exact active identity contacts after the route is valid. Team membership is always delivery authority in `team_and_contacts`; contacts only add trusted non-team senders. Contacts do not synthesize routes or resolver visibility.
 
 Contacts are saved identity/address relationships for repeated cross-team messaging. They are per-identity, not per-team. Add a contact when repeated communication is expected; otherwise use a one-shot namespace address.
 
@@ -168,8 +168,8 @@ Treat teams as separate coordination boundaries for tasks, locks, roles, instruc
 Check:
 
 1. Global address registration and route resolution.
-2. Inbound mode (`open` or `contacts_only`).
-3. Exact active contact state when the recipient uses `contacts_only`.
+2. Inbound mode (`open` or `team_and_contacts`).
+3. Verified shared team membership, or exact active contact state for non-team senders, when the recipient uses `team_and_contacts`.
 4. Whether X is using a same-team alias or a concrete cross-team address.
 5. Whether the active team is the intended team for sender context.
 6. Whether the workspace has a valid certificate.

package/skills/aweb-team-membership/references/team-membership-reference.md

@@ -40,9 +40,9 @@ Addressability and delivery authorization are separate:
 
 - First contact uses a concrete address route (`domain/alias`).
 - `did:aw` is identity binding, not a first-contact delivery route.
-- `inbound_mode=open|contacts_only` controls delivery after route validation.
-- Exact active identity contacts authorize `contacts_only`; contacts do not create routes or resolver visibility.
-- Legacy reachability/access-mode fields may still appear in support or migration output, but they are compatibility/audit state, not live delivery authority.
+- `inbound_mode=open|team_and_contacts` controls delivery after route validation.
+- `team_and_contacts` accepts verified same-team senders plus exact active identity contacts for trusted non-team senders. Contacts do not create routes or resolver visibility.
+- Legacy reachability fields may still appear in support or migration output, but they are compatibility/audit state, not live delivery authority.
 - `aw contacts ...` manages saved contact relationships.
 - `aw directory <domain>/<alias>` performs directory lookup.