@passioncode-ai/passioncode 0.1.24 → 0.1.25

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.25 - 2026-10-03
+
+### Changed
+
+- **`working-in-passioncode` follows the amended release-approval rule** (knowledge rules §11,
+  operator decision 2026-10-03): any member of `release-approvers` may approve a release run,
+  including the person who pushed the tag. Unchanged: approval is a person's act and an agent
+  never approves a release run, signing happens only in CI, admins cannot bypass, `v*` tags
+  only, and a published release is never rewritten.
+
 ## 0.1.24 - 2026-10-03
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.24",
+      "version": "0.1.25",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,6 +1,6 @@
 {
   "family": "passioncode",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "release": true,
   "members": [
     {
@@ -61,16 +61,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.24",
+      "ref": "v0.1.25",
       "commit": null,
-      "version": "0.1.24",
+      "version": "0.1.25",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:e754ad6eab6581d2fba7c887b903c4676239a85ceed74010ccec87b631586816",
+      "contentHash": "sha256:2212b2e2a6c017fe75dfa59b5941bf0247277decca8431d4e614a10770053bde",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",

package/payload/plugins/passioncode/skills/working-in-passioncode/SKILL.md

@@ -211,10 +211,12 @@ to a public surface.
 - **Signing (knowledge rules §11).** A published build is signed only in CI, in the
   repository's protected `release` environment, through `passioncode-ai/.github@v1`
   (`apple-signing`, `notarize`, `sign-sums`, `release-publish`). A member of
-  `release-approvers` who is not the tag's author approves it. No release key lives on a
-  laptop, and a locally signed build is a debug build: never attach it. You act as the person
-  whose account you use, so never approve a release you started; start it and say whose
-  approval is pending. A published release is never rewritten. Rehearse on `vX.Y.Z-rc.N` with
+  `release-approvers` approves it, and that may be whoever pushed the tag (operator,
+  2026-10-03; `prevent_self_review: true` in `.github` `release-signing/products.json`
+  restores four eyes). Admins cannot bypass, and only `v*` tags deploy. No release key lives
+  on a laptop, and a locally signed build is a debug build: never attach it. Approval is a
+  person's act: an agent never approves a release run, even when the account it uses could;
+  start it and say whose approval is pending. A published release is never rewritten. Rehearse on `vX.Y.Z-rc.N` with
   `publish=false`.
 - **Engine** (`project-observatory-dashboard`): contributors send PRs. A `vX.Y.Z` tag on the
   reviewed release commit runs its `release.yml`, which signs and publishes in CI. Machines then