@passioncode-ai/passioncode 0.1.23 → 0.1.25

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.1.25 - 2026-10-03
+
+### Changed
+
+- **`working-in-passioncode` follows the amended release-approval rule** (knowledge rules §11,
+  operator decision 2026-10-03): any member of `release-approvers` may approve a release run,
+  including the person who pushed the tag. Unchanged: approval is a person's act and an agent
+  never approves a release run, signing happens only in CI, admins cannot bypass, `v*` tags
+  only, and a published release is never rewritten.
+
+## 0.1.24 - 2026-10-03
+
+### Changed
+
+- **`working-in-passioncode` carries the release-signing rule** (knowledge rules §11):
+  - a published build is signed only in CI, in the repository's `release` environment, through
+    `passioncode-ai/.github@v1`;
+  - it is approved by `release-approvers` but not by the tag's author;
+  - no release key lives on a laptop;
+  - an agent never approves a release it started;
+  - a published release is never rewritten.
+
+  The engine line now names its CI release.
+
 ## 0.1.23 - 2026-10-03
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.23",
+      "version": "0.1.25",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,6 +1,6 @@
 {
   "family": "passioncode",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "release": true,
   "members": [
     {
@@ -61,16 +61,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.23",
+      "ref": "v0.1.25",
       "commit": null,
-      "version": "0.1.23",
+      "version": "0.1.25",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:bc40957cac6955093ea1d60c431983adfe48caf09bac39519d4a5716c08526a8",
+      "contentHash": "sha256:2212b2e2a6c017fe75dfa59b5941bf0247277decca8431d4e614a10770053bde",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",

package/payload/plugins/passioncode/skills/working-in-passioncode/SKILL.md

@@ -208,9 +208,19 @@ to a public surface.
   `release.yml` publish when the repository variables `RELEASE_ENABLED` and
   `PUBLISH_NPMJS` are `true`. Check `gh variable list -R passioncode-ai/<repo>` before
   pushing a tag; publishing is a release decision, not a side effect.
-- **Engine** (`project-observatory-dashboard`): contributors send PRs; releases are cut
-  with the maintainer's release tooling, which is maintainer-only. Machines then run
-  `project-observatory full update --check` and `--apply`.
+- **Signing (knowledge rules §11).** A published build is signed only in CI, in the
+  repository's protected `release` environment, through `passioncode-ai/.github@v1`
+  (`apple-signing`, `notarize`, `sign-sums`, `release-publish`). A member of
+  `release-approvers` approves it, and that may be whoever pushed the tag (operator,
+  2026-10-03; `prevent_self_review: true` in `.github` `release-signing/products.json`
+  restores four eyes). Admins cannot bypass, and only `v*` tags deploy. No release key lives
+  on a laptop, and a locally signed build is a debug build: never attach it. Approval is a
+  person's act: an agent never approves a release run, even when the account it uses could;
+  start it and say whose approval is pending. A published release is never rewritten. Rehearse on `vX.Y.Z-rc.N` with
+  `publish=false`.
+- **Engine** (`project-observatory-dashboard`): contributors send PRs. A `vX.Y.Z` tag on the
+  reviewed release commit runs its `release.yml`, which signs and publishes in CI. Machines then
+  run `project-observatory full update --check` and `--apply`.
 - **Launcher** (`passioncode`): members are tagged first, `family.json` refs point at
   those tags, the payload is vendored from tags only.
 - **Contract pins.** `fabric-agent-contract` consumers carry explicit commit pins;