@ikon85/agent-workflow-kit 0.26.0 → 0.26.1

package/.agents/skills/kit-update/SKILL.md

@@ -7,10 +7,10 @@ description: "Preview and transactionally apply a parity-verified agent-workflow
 
 Update an installed consumer only from the public scoped package
 `@ikon85/agent-workflow-kit`. The unscoped `agent-workflow-kit` package belongs
-to another publisher and is never a valid update source. Existing installs from
-`npx github:iKon85/agent-workflow-kit` remain valid, but updates must use the
-scoped npm release so the shared release-parity checker can prove that npm and
-the matching GitHub release contain the same artifact.
+to another publisher and is never a valid update source. Existing direct
+GitHub installs remain valid, but updates must use the scoped npm release so
+the shared release-parity checker can prove that npm and the matching GitHub
+release contain the same artifact.
 
 ## Workflow
 

package/.agents/skills/setup-workflow/SKILL.md

@@ -239,9 +239,9 @@ repository?"* Offer exactly **Yes**, **Later**, and **No**.
 - **Disable** — remove only exact kit-owned Agent commands and Git wiring
   first, then set `enabled: false`.
 
-Testreporter uses the parity-on profile from the seed. Other consumers are
-opt-in/manual: never copy its pnpm, path, shim, surface, or outage decisions
-without repository evidence and user confirmation.
+The seed's reference consumer uses the parity-on profile. Other consumers are
+opt-in/manual: never copy its package-manager, path, shim, surface, or outage
+decisions without repository evidence and user confirmation.
 
 ### 3. Section B — Triage labels
 

package/.agents/skills/setup-workflow/safety-guardrails.md

@@ -49,9 +49,9 @@ all-or-nothing switch.
 ## Profile shape
 
 Reconcile only `safetyGuardrails`; preserve every sibling section, unknown key,
-and consumer-owned value. The following is the Testreporter parity-on example,
-not a universal default. Other consumers choose each `enabled` value and fill
-only facts proven in their repository.
+and consumer-owned value. The following is the reference consumer's parity-on
+example, not a universal default. Other consumers choose each `enabled` value
+and fill only facts proven in their repository.
 
 ```json
 {

package/.claude/skills/kit-update/SKILL.md

@@ -7,10 +7,10 @@ description: "Preview and transactionally apply a parity-verified agent-workflow
 
 Update an installed consumer only from the public scoped package
 `@ikon85/agent-workflow-kit`. The unscoped `agent-workflow-kit` package belongs
-to another publisher and is never a valid update source. Existing installs from
-`npx github:iKon85/agent-workflow-kit` remain valid, but updates must use the
-scoped npm release so the shared release-parity checker can prove that npm and
-the matching GitHub release contain the same artifact.
+to another publisher and is never a valid update source. Existing direct
+GitHub installs remain valid, but updates must use the scoped npm release so
+the shared release-parity checker can prove that npm and the matching GitHub
+release contain the same artifact.
 
 ## Workflow
 

package/.claude/skills/setup-workflow/SKILL.md

@@ -239,9 +239,9 @@ repository?"* Offer exactly **Yes**, **Later**, and **No**.
 - **Disable** — remove only exact kit-owned Agent commands and Git wiring
   first, then set `enabled: false`.
 
-Testreporter uses the parity-on profile from the seed. Other consumers are
-opt-in/manual: never copy its pnpm, path, shim, surface, or outage decisions
-without repository evidence and user confirmation.
+The seed's reference consumer uses the parity-on profile. Other consumers are
+opt-in/manual: never copy its package-manager, path, shim, surface, or outage
+decisions without repository evidence and user confirmation.
 
 ### 3. Section B — Triage labels
 

package/.claude/skills/setup-workflow/safety-guardrails.md

@@ -49,9 +49,9 @@ all-or-nothing switch.
 ## Profile shape
 
 Reconcile only `safetyGuardrails`; preserve every sibling section, unknown key,
-and consumer-owned value. The following is the Testreporter parity-on example,
-not a universal default. Other consumers choose each `enabled` value and fill
-only facts proven in their repository.
+and consumer-owned value. The following is the reference consumer's parity-on
+example, not a universal default. Other consumers choose each `enabled` value
+and fill only facts proven in their repository.
 
 ```json
 {

package/README.md

@@ -332,6 +332,16 @@ still reference. Flags: `--force` (overwrite pre-existing files on `init`),
 
 ## Release notes
 
+### 0.26.1
+
+- changed: `.agents/skills/kit-update/SKILL.md`
+- changed: `.agents/skills/setup-workflow/SKILL.md`
+- changed: `.agents/skills/setup-workflow/safety-guardrails.md`
+- changed: `.claude/skills/kit-update/SKILL.md`
+- changed: `.claude/skills/setup-workflow/SKILL.md`
+- changed: `.claude/skills/setup-workflow/safety-guardrails.md`
+- changed: `scripts/release-delta-guard.mjs`
+
 ### 0.26.0
 
 - added: `.agents/skills/setup-workflow/safety-guardrails.md`

package/agent-workflow-kit.package.json

@@ -1,5 +1,5 @@
 {
-  "kitVersion": "0.26.0",
+  "kitVersion": "0.26.1",
   "files": [
     {
       "path": ".agents/skills/ask-matt/SKILL.md",
@@ -339,7 +339,7 @@
       "kind": "skill",
       "ownerSkill": "kit-update",
       "surface": "codex",
-      "sha256": "5b7a8c11b5852ee115fa8d3f66a3938d7b4db173a47d711da48abab635b2c261",
+      "sha256": "dbf2c0f696bd0ce45c5c2a315d40a3bbb99635e4ab384c788ac59f799fbf43de",
       "mode": 420,
       "origin": "kit"
     },
@@ -573,7 +573,7 @@
       "kind": "skill",
       "ownerSkill": "setup-workflow",
       "surface": "codex",
-      "sha256": "08793fc7c9164cde9f7e09154e02d5718428272b85fb67d74681d3a415d4d483",
+      "sha256": "8e223f625dcf941142005cbd9a4b6214358f68e3fd63cbee7bffef35b8b14ec8",
       "mode": 420,
       "origin": "kit"
     },
@@ -582,7 +582,7 @@
       "kind": "skill",
       "ownerSkill": "setup-workflow",
       "surface": "codex",
-      "sha256": "b012c477612944d276e7012461f3ec38ecc25b5d92966b667150e1fb547b20cb",
+      "sha256": "e4cac2f46ac5f16e9a1473b38a64979a7d767ccdc834a2540d20c733305ea2e7",
       "mode": 420,
       "origin": "kit"
     },
@@ -1499,7 +1499,7 @@
       "kind": "skill",
       "ownerSkill": "kit-update",
       "surface": "claude",
-      "sha256": "5b7a8c11b5852ee115fa8d3f66a3938d7b4db173a47d711da48abab635b2c261",
+      "sha256": "dbf2c0f696bd0ce45c5c2a315d40a3bbb99635e4ab384c788ac59f799fbf43de",
       "mode": 420,
       "origin": "kit"
     },
@@ -1751,7 +1751,7 @@
       "kind": "skill",
       "ownerSkill": "setup-workflow",
       "surface": "claude",
-      "sha256": "08793fc7c9164cde9f7e09154e02d5718428272b85fb67d74681d3a415d4d483",
+      "sha256": "8e223f625dcf941142005cbd9a4b6214358f68e3fd63cbee7bffef35b8b14ec8",
       "mode": 420,
       "origin": "kit"
     },
@@ -1760,7 +1760,7 @@
       "kind": "skill",
       "ownerSkill": "setup-workflow",
       "surface": "claude",
-      "sha256": "b012c477612944d276e7012461f3ec38ecc25b5d92966b667150e1fb547b20cb",
+      "sha256": "e4cac2f46ac5f16e9a1473b38a64979a7d767ccdc834a2540d20c733305ea2e7",
       "mode": 420,
       "origin": "kit"
     },
@@ -2303,7 +2303,7 @@
     {
       "path": "scripts/release-delta-guard.mjs",
       "kind": "script",
-      "sha256": "37a6f27b350bb98a19a8c53e1f6ee187b3a39c0ff5317141717bf9ab65129bad",
+      "sha256": "a51f30e7261e4efb0b5c5002f39353ef8e8be18a2bd39ad7139f1ce7a2e7e18d",
       "mode": 420,
       "origin": "kit"
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ikon85/agent-workflow-kit",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "Portable AI-agent workflow skills (plan → execute → land → learn) for Claude Code & Codex — grilling, TDD, diagnosis, two-axis code review, cross-model Codex review, design & domain-modeling, plus a skill router (ask-matt). npx init/update/diff/uninstall.",
   "type": "module",
   "bin": {

package/scripts/release-delta-guard.mjs

@@ -1,9 +1,10 @@
 /** Block shipped changes whose version or checked manifest does not match a fresh build. */
 import { execFileSync } from 'node:child_process';
-import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { mkdir, mkdtemp, readFile, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { sha256 } from '../src/lib/hash.mjs';
 import { buildKit } from './build-kit.mjs';
 
 const byPath = (manifest) => new Map(manifest.files.map((entry) => [entry.path, entry.sha256]));
@@ -41,6 +42,7 @@ function bumpKind(before, after) {
 export function assessRelease(input) {
   const delta = manifestDelta(input.baseManifest, input.builtManifest);
   const checkedDrift = manifestDelta(input.checkedManifest, input.builtManifest);
+  const payloadDrift = manifestDelta(input.builtManifest, input.payloadManifest);
   const errors = [];
   if (hasDelta(delta) && input.currentVersion === input.baseVersion) {
     errors.push(`shipped delta has no version bump (${describe(delta)}); version remains ${input.currentVersion}`);
@@ -52,6 +54,9 @@ export function assessRelease(input) {
   if (checkedDrift.added.length || checkedDrift.changed.length) {
     errors.push(`checked manifest is stale (${describe(checkedDrift)})`);
   }
+  if (hasDelta(payloadDrift)) {
+    errors.push(`npm package payload does not match built manifest (${describe(payloadDrift)})`);
+  }
   const recommendedBump = recommendBump(delta);
   const actual = bumpKind(input.baseVersion, input.currentVersion);
   const rank = { patch: 1, minor: 2, major: 3 };
@@ -68,18 +73,43 @@ function gitShowJson(repoRoot, ref, path) {
   return JSON.parse(execFileSync('git', ['show', `${ref}:${path}`], { cwd: repoRoot, encoding: 'utf8' }));
 }
 
+export async function packedPayloadManifest({ repoRoot, manifest }) {
+  const tempRoot = await mkdtemp(join(tmpdir(), 'awkit-package-payload-'));
+  try {
+    const packOutput = execFileSync(
+      'npm', ['pack', '--json', '--ignore-scripts', '--pack-destination', tempRoot],
+      { cwd: repoRoot, encoding: 'utf8' },
+    );
+    const [{ filename }] = JSON.parse(packOutput);
+    const unpackDir = join(tempRoot, 'unpacked');
+    await mkdir(unpackDir);
+    execFileSync('tar', ['-xzf', join(tempRoot, filename), '-C', unpackDir]);
+    return {
+      kitVersion: manifest.kitVersion,
+      files: await Promise.all(manifest.files.map(async (entry) => ({
+        ...entry,
+        sha256: sha256(await readFile(join(unpackDir, 'package', entry.path))),
+      }))),
+    };
+  } finally {
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+}
+
 export async function checkReleaseDelta({ repoRoot, baseRef = 'origin/main' } = {}) {
   repoRoot ??= join(dirname(fileURLToPath(import.meta.url)), '..');
   const distDir = await mkdtemp(join(tmpdir(), 'awkit-release-guard-'));
   try {
     await buildKit({ repoRoot, distDir });
     const currentPackage = JSON.parse(await readFile(join(repoRoot, 'package.json'), 'utf8'));
+    const builtManifest = JSON.parse(await readFile(join(distDir, 'agent-workflow-kit.package.json'), 'utf8'));
     return assessRelease({
       baseVersion: gitShowJson(repoRoot, baseRef, 'package.json').version,
       currentVersion: currentPackage.version,
       baseManifest: gitShowJson(repoRoot, baseRef, 'agent-workflow-kit.package.json'),
       checkedManifest: JSON.parse(await readFile(join(repoRoot, 'agent-workflow-kit.package.json'), 'utf8')),
-      builtManifest: JSON.parse(await readFile(join(distDir, 'agent-workflow-kit.package.json'), 'utf8')),
+      builtManifest,
+      payloadManifest: await packedPayloadManifest({ repoRoot, manifest: builtManifest }),
     });
   } finally { await rm(distDir, { recursive: true, force: true }); }
 }

package/scripts/release-delta-guard.test.mjs

@@ -1,8 +1,29 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { assessRelease } from './release-delta-guard.mjs';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { buildKit } from './build-kit.mjs';
+import {
+  assessRelease, manifestDelta, packedPayloadManifest,
+} from './release-delta-guard.mjs';
 
 const file = (path, sha256) => ({ path, sha256 });
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+test('fresh build manifest hashes match the actual npm package payload', async () => {
+  const tempRoot = await mkdtemp(join(tmpdir(), 'awkit-packed-manifest-test-'));
+  try {
+    const distDir = join(tempRoot, 'dist');
+    await buildKit({ repoRoot, distDir });
+    const built = JSON.parse(await readFile(join(distDir, 'agent-workflow-kit.package.json'), 'utf8'));
+    const packed = await packedPayloadManifest({ repoRoot, manifest: built });
+    assert.deepEqual(manifestDelta(built, packed), { added: [], removed: [], changed: [] });
+  } finally {
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+});
 
 test('an unbumped shipped change is blocked with its concrete delta', () => {
   const result = assessRelease({
@@ -10,6 +31,7 @@ test('an unbumped shipped change is blocked with its concrete delta', () => {
     baseManifest: { kitVersion: '1.2.3', files: [file('skill.md', 'old')] },
     builtManifest: { kitVersion: '1.2.3', files: [file('skill.md', 'new')] },
     checkedManifest: { kitVersion: '1.2.3', files: [file('skill.md', 'old')] },
+    payloadManifest: { kitVersion: '1.2.3', files: [file('skill.md', 'new')] },
   });
   assert.equal(result.ok, false);
   assert.deepEqual(result.delta.changed, ['skill.md']);
@@ -23,6 +45,7 @@ test('dead checked-manifest entries are rejected', () => {
     baseManifest: { kitVersion: '1.2.3', files: [] },
     builtManifest: { kitVersion: '1.3.0', files: [] },
     checkedManifest: { kitVersion: '1.3.0', files: [file('gone.md', 'old')] },
+    payloadManifest: { kitVersion: '1.3.0', files: [] },
   });
   assert.equal(result.ok, false);
   assert.match(result.errors.join('\n'), /dead entry: gone\.md/);
@@ -33,7 +56,7 @@ test('a matching regenerated manifest and semantic bump pass', () => {
   const result = assessRelease({
     baseVersion: '1.2.3', currentVersion: '1.3.0',
     baseManifest: { kitVersion: '1.2.3', files: [] }, builtManifest: current,
-    checkedManifest: current,
+    checkedManifest: current, payloadManifest: current,
   });
   assert.equal(result.ok, true);
   assert.equal(result.recommendedBump, 'minor');
@@ -45,9 +68,20 @@ test('shipped content rejects downgrade and malformed version transitions', () =
     const result = assessRelease({
       baseVersion: '1.2.3', currentVersion,
       baseManifest: { kitVersion: '1.2.3', files: [file('skill.md', 'old')] },
-      builtManifest: current, checkedManifest: current,
+      builtManifest: current, checkedManifest: current, payloadManifest: current,
     });
     assert.equal(result.ok, false, currentVersion);
     assert.match(result.errors.join('\n'), /invalid version transition: 1\.2\.3 ->/);
   }
 });
+
+test('actual npm payload drift is blocked even when checked and built manifests match', () => {
+  const scrubbed = { kitVersion: '1.2.3', files: [file('skill.md', 'scrubbed')] };
+  const result = assessRelease({
+    baseVersion: '1.2.3', currentVersion: '1.2.3',
+    baseManifest: scrubbed, builtManifest: scrubbed, checkedManifest: scrubbed,
+    payloadManifest: { kitVersion: '1.2.3', files: [file('skill.md', 'source')] },
+  });
+  assert.equal(result.ok, false);
+  assert.match(result.errors.join('\n'), /npm package payload.*changed: skill\.md/);
+});