@mutmutco/kilo-plugin 4.1.13 → 4.1.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/kilo-plugin",
-  "version": "4.1.13",
+  "version": "4.1.14",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/skills/release/SKILL.md

@@ -699,6 +699,29 @@ Off the publish environment, either:
 - skip the registry identity read with
   `node scripts/release-distribution.mjs verify "X.Y.0" --skip-npm-view` and verify published content
   by hand the same way (including the staged-payload split above when applicable).
+
+**Unpacked proof scratch must not pollute the checkout (#5702).** npm unpack copies full package trees
+including staged `skills/` into whatever directory you choose. Those copies are **not** registered skill
+payloads — if they remain anywhere scannable under the repo root when the next release fold runs
+`check-skill-payload`, the gate fails with `unregistered authored or copied skills`. Prefer unpacking
+**outside** the repository:
+```bash
+PROOF=$(mktemp -d "${TMPDIR:-/tmp}/mmi-release-proof.XXXXXX")
+# unpack both tarballs under $PROOF, diff -r, then:
+rm -rf "$PROOF"
+```
+If you must unpack inside the checkout, use the org-managed gitignored scratch at repo-root `tmp/`
+(`mktemp -d tmp/mmi-release-proof.XXXXXX`) — **not** `.jerv/tmp/` (agent session scratch still lives on
+disk and must not carry npm proof trees between releases). Remove the proof tree **immediately** after the
+diff succeeds; do not leave it for the next `--apply`.
+
+Before the next `release --apply`, confirm no leftover proof copies remain outside org scratch:
+```bash
+node scripts/check-skill-payload.mjs --contract
+```
+A failure naming `unregistered authored or copied skills` means a proof tree (or other rogue copy) is
+still on disk — delete it and rerun the contract check before retrying the train.
+
 Do not treat an off-runner SSRI mismatch as a broken release, and do not change how the runner publishes
 to paper over a local packer difference.