@passioncode-ai/passioncode 0.1.23 → 0.1.24

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.1.24 - 2026-10-03
+
+### Changed
+
+- **`working-in-passioncode` carries the release-signing rule** (knowledge rules §11):
+  - a published build is signed only in CI, in the repository's `release` environment, through
+    `passioncode-ai/.github@v1`;
+  - it is approved by `release-approvers` but not by the tag's author;
+  - no release key lives on a laptop;
+  - an agent never approves a release it started;
+  - a published release is never rewritten.
+
+  The engine line now names its CI release.
+
 ## 0.1.23 - 2026-10-03
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.23",
+      "version": "0.1.24",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,6 +1,6 @@
 {
   "family": "passioncode",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "release": true,
   "members": [
     {
@@ -61,16 +61,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.23",
+      "ref": "v0.1.24",
       "commit": null,
-      "version": "0.1.23",
+      "version": "0.1.24",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:bc40957cac6955093ea1d60c431983adfe48caf09bac39519d4a5716c08526a8",
+      "contentHash": "sha256:e754ad6eab6581d2fba7c887b903c4676239a85ceed74010ccec87b631586816",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",

package/payload/plugins/passioncode/skills/working-in-passioncode/SKILL.md

@@ -208,9 +208,17 @@ to a public surface.
   `release.yml` publish when the repository variables `RELEASE_ENABLED` and
   `PUBLISH_NPMJS` are `true`. Check `gh variable list -R passioncode-ai/<repo>` before
   pushing a tag; publishing is a release decision, not a side effect.
-- **Engine** (`project-observatory-dashboard`): contributors send PRs; releases are cut
-  with the maintainer's release tooling, which is maintainer-only. Machines then run
-  `project-observatory full update --check` and `--apply`.
+- **Signing (knowledge rules §11).** A published build is signed only in CI, in the
+  repository's protected `release` environment, through `passioncode-ai/.github@v1`
+  (`apple-signing`, `notarize`, `sign-sums`, `release-publish`). A member of
+  `release-approvers` who is not the tag's author approves it. No release key lives on a
+  laptop, and a locally signed build is a debug build: never attach it. You act as the person
+  whose account you use, so never approve a release you started; start it and say whose
+  approval is pending. A published release is never rewritten. Rehearse on `vX.Y.Z-rc.N` with
+  `publish=false`.
+- **Engine** (`project-observatory-dashboard`): contributors send PRs. A `vX.Y.Z` tag on the
+  reviewed release commit runs its `release.yml`, which signs and publishes in CI. Machines then
+  run `project-observatory full update --check` and `--apply`.
 - **Launcher** (`passioncode`): members are tagged first, `family.json` refs point at
   those tags, the payload is vendored from tags only.
 - **Contract pins.** `fabric-agent-contract` consumers carry explicit commit pins;