@flowstack-ui/agent-tools 0.1.0-bootstrap.0 → 0.1.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "flowstack-ui",
-  "version": "0.1.0-bootstrap.0",
+  "version": "0.1.1",
   "description": "Exact-version workflows for building, composing, reviewing, and maintaining FLOWSTACK UI.",
   "author": {
     "name": "FLOWSTACK UI",

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.1.1
+
+### Changed
+
+- Route all four public workflows through the hosted exact-version FLOWSTACK
+  MCP when local resolver execution is unavailable, while preserving the local
+  installed-package resolver as the stronger project evidence path.
+- Require hosted workflows to establish exact locked-source inventory,
+  zero-failure coverage, package guides, and selected owner guidance instead of
+  stopping merely because a client cannot execute bundled Node scripts.
+
 ## 0.1.0
 
 ### Added

package/docs/releasing.md

@@ -20,6 +20,12 @@ commit contained in protected `main`.
    `https://agents.brick-ui.com` and retain the deployment commit plus index
    digest as release evidence.
 
+The `Publish` workflow is idempotent. A protected-tag push is the normal
+release path. If infrastructure interrupts a partial release, dispatch the
+same workflow from `main` with the existing protected tag; it checks out that
+immutable tag, verifies any existing archive by integrity, and publishes only
+missing exact archives.
+
 Trusted publishers must be configured separately on npm for both packages,
 restricted to this repository and the release workflow. Do not use a local npm
 token, a mutable dependency range, an unverified archive, or a tag that is not

package/docs/testing.md

@@ -30,3 +30,8 @@ boundary, archive ingestion, all four skill contracts, plugin metadata, MCP
 protocol behavior, and both exact npm archives in isolated consumers. Hosted
 verification is separate because it compares a deployed production surface
 with the already-verified local corpus.
+
+The canonical host is checked daily and on demand by the `Hosted drift`
+workflow. It runs the same corpus byte/digest and MCP protocol verifier against
+`https://agents.brick-ui.com`, cancels superseded runs, restores no package
+manager cache, and fails within ten minutes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowstack-ui/agent-tools",
-  "version": "0.1.0-bootstrap.0",
+  "version": "0.1.1",
   "description": "Version-aware delivery adapters for public FLOWSTACK Agent Knowledge.",
   "type": "module",
   "license": "MIT",

package/skills/flowstack-ui-builder/SKILL.md

@@ -9,9 +9,10 @@ Build from package-owned guidance, not remembered component rules.
 
 ## Resolve authority
 
-1. Inspect the target project's dependencies and lockfile. Run `scripts/resolve-agent-knowledge.mjs` from this skill for every FLOWSTACK package and owner you use. Pass `--project`, `--package`, and, when selecting an owner, `--kind` plus `--id`. If that exact package is not installed, also pass its exact `--version`; ranges and implicit locked-version selection are rejected.
-2. Read the resolved manifest, zero-failure coverage, package guides, and selected owner artifacts. Prefer the installed package. The resolver may use Agent Tools only when its locked route has the exact requested or installed version.
-3. Stop with an unavailable-version report if exact guidance cannot be resolved. Never substitute current, latest, sibling-repository, or remembered guidance.
+1. Inspect the target project's dependencies and lockfile. Determine one exact version for every FLOWSTACK package you use; ask for the exact version when the environment cannot expose the dependency graph. Ranges and inferred `latest` versions are not evidence.
+2. When local script execution is available, run `scripts/resolve-agent-knowledge.mjs` from this skill for every package and owner. Pass `--project`, `--package`, and, when selecting an owner, `--kind` plus `--id`. If that exact package is not installed, also pass its exact `--version`. Read the resolved manifest, zero-failure coverage, package guides, and selected owner artifacts.
+3. When local script execution is unavailable, use the plugin-provided FLOWSTACK MCP tools instead. Call `list_flowstack_packages` and require the exact package/version with `locked-source` provenance. Call `list_components` for that exact package/version to establish its closed owner inventory and zero-failure coverage, then call `get_package_guide` for the required package guides and `get_component_guidance` for every selected component or operation owner. Use `resolve_interface_job` only as a source-backed selection aid; still load every selected guide and owner explicitly.
+4. Prefer the installed package when the local resolver can prove it. Treat hosted MCP results as exact public locked-release guidance, never as proof of the consumer's installed files. Stop with an unavailable-version report only when neither exact local resolution nor exact hosted MCP resolution succeeds. Never substitute current, latest, sibling-repository, or remembered guidance.
 
 ## Select the layer
 

package/skills/flowstack-ui-compose/SKILL.md

@@ -13,7 +13,11 @@ Start from a supplied Blueprint or an application plan that identifies the jobs,
 
 ## Resolve exact public guidance
 
-Inspect the target dependencies and lockfile. Run `scripts/resolve-agent-knowledge.mjs` for Brick and every other selected public package or owner. Pass an exact `--version` whenever that package is not installed; ranges and implicit locked-version selection are rejected. Read the resolved manifest, zero-failure coverage, package guides, and selected artifacts. Use installed artifacts or an exact matching Agent Tools locked route only. Stop and report an unavailable version rather than substituting latest, current-main, or remembered guidance.
+Inspect the target dependencies and lockfile and determine an exact version for Brick and every other selected public package; ask for the exact version when the environment cannot expose it. When local script execution is available, run `scripts/resolve-agent-knowledge.mjs` for every package and owner, passing an exact `--version` whenever that package is not installed. Read the resolved manifest, zero-failure coverage, package guides, and selected artifacts.
+
+When local execution is unavailable, use the plugin-provided FLOWSTACK MCP tools. Call `list_flowstack_packages` and require each exact package/version with `locked-source` provenance. Call `list_components` for each exact package/version to establish its closed owner inventory and zero-failure coverage, then call `get_package_guide` for the required package guides and `get_component_guidance` for every selected owner. `resolve_interface_job` may narrow a supplied job, but it never replaces reading the exact guides and owners. Hosted results prove an exact locked public release, not the consumer's installed files.
+
+Stop and report an unavailable version only when neither exact local resolution nor exact hosted MCP resolution succeeds. Never substitute latest, current-main, sibling-repository, or remembered guidance.
 
 ## Map the composition
 

package/skills/flowstack-ui-maintainer/SKILL.md

@@ -11,7 +11,11 @@ Coordinate public package work without collapsing repository or release boundari
 
 Read the workspace and repository instructions that apply to the target. Identify the owner before editing: Atom owns public behavior, Brick finished presentation, Colors reviewed color candidates, Theme compiled semantic artifacts, the private Blocks registry owns paid copy-owned compositions, the public Blocks CLI owns only source-free authenticated delivery, and Agent Tools owns exact-version delivery adapters for public package guidance.
 
-Resolve every affected public package and existing public owner with `scripts/resolve-agent-knowledge.mjs`. Pass `--project`, `--package`, and, for a selected owner, `--kind` plus `--id`; pass an exact `--version` whenever the package is not installed. When resolving a staged or locked archive, also pass its recorded `--archive-sha256`; the resolver must return that locked archive identity. Read the resolved zero-failure coverage, package guides, and selected artifacts. Never substitute a sibling checkout, current-main guidance, or a remembered API for an exact dependency boundary. Do not use Agent Tools to resolve private Blocks source, item guidance, bundles, or authenticated responses.
+Resolve every affected public package and existing public owner against one exact version. When local script execution is available, use `scripts/resolve-agent-knowledge.mjs`. Pass `--project`, `--package`, and, for a selected owner, `--kind` plus `--id`; pass an exact `--version` whenever the package is not installed. When resolving a staged or locked archive, also pass its recorded `--archive-sha256`; the resolver must return that locked archive identity. Read the resolved zero-failure coverage, package guides, and selected artifacts.
+
+When local execution is unavailable and the evidence target is an already released public version, use the plugin-provided FLOWSTACK MCP tools. Call `list_flowstack_packages` and require the exact package/version with `locked-source` provenance. Call `list_components` to establish the closed owner inventory and zero-failure coverage, then call `get_package_guide` and `get_component_guidance` for every affected guide and owner. Hosted MCP cannot qualify an unpublished candidate, a staged archive, or its digest; those require the local resolver and exact `--archive-sha256`. Stop if that candidate evidence cannot be executed.
+
+Never substitute a sibling checkout, current-main guidance, latest version, or a remembered API for an exact dependency boundary. Do not use Agent Tools or hosted MCP to resolve private Blocks source, item guidance, bundles, or authenticated responses.
 
 A new owner requires two passes. Before editing, resolve the baseline package guides and the closest existing owners rather than pretending the new ID exists. Add the public API and canonical Agent Knowledge, regenerate closed coverage, and pack a uniquely identified candidate. Then resolve the new owner from that candidate before a dependent repository adopts it. Do not let the same package version identify materially different candidates across a dependency handoff; use the repository-approved next or prerelease version, or require the exact archive digest when repository policy prevents an early version change.
 

package/skills/flowstack-ui-review/SKILL.md

@@ -9,7 +9,11 @@ Review against package-owned evidence, not remembered component rules.
 
 ## Establish exact evidence
 
-Inspect the target dependency graph and lockfile. Use `scripts/resolve-agent-knowledge.mjs` for each FLOWSTACK package and reviewed owner, then read its resolved manifest, zero-failure coverage, package guides, and selected artifacts. Pass an exact `--version` whenever that package is not installed; ranges and implicit locked-version selection are rejected. The resolver accepts installed artifacts or exact matching Agent Tools routes only. If the installed/requested version is unavailable, report that as a blocking finding; never review against latest or current-main guidance.
+Inspect the target dependency graph and lockfile and determine every exact FLOWSTACK package version under review; ask for an exact version when the environment cannot expose it. When local script execution is available, use `scripts/resolve-agent-knowledge.mjs` for each package and reviewed owner, then read its resolved manifest, zero-failure coverage, package guides, and selected artifacts. Pass an exact `--version` whenever that package is not installed.
+
+When local execution is unavailable, use the plugin-provided FLOWSTACK MCP tools. Call `list_flowstack_packages` and require each exact package/version with `locked-source` provenance. Call `list_components` to establish the exact package's closed owner inventory and zero-failure coverage, then call `get_package_guide` for every governing guide and `get_component_guidance` for every reviewed owner. Hosted MCP proves the locked public release guidance, not the consumer's installed file contents; base implementation findings on code the user supplied or the environment can actually inspect.
+
+If neither the exact local resolver nor exact hosted MCP can resolve the requested version, report that as a blocking finding. Never review against latest, current-main, sibling-repository, or remembered guidance.
 
 ## Audit ownership