@ssheleg/sheleg-dev 0.4.1 → 0.4.3

package/CHANGELOG.md

@@ -4,6 +4,48 @@ All notable changes to this project are documented here.
 Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 Versioning: [SemVer](https://semver.org/spec/v2.0.0.html).
 
+## v0.4.3 — 2026-08-14
+
+A red `validate` could not stop a publish, and this repository proved it.
+
+### Fixed
+
+- **The release now runs the whole validate suite before anything is published.** On
+  2026-08-12 this repository tagged v0.4.1 while its own `validate` run for that exact tag
+  **failed**, and npm served 0.4.1 four minutes later. Two separate workflows, nothing
+  connecting them: `release.yml` ran the structural validator and never the negative
+  self-tests, which are steps in `validate.yml`.
+- `validate.yml` gained a `workflow_call` trigger and `release.yml` calls it with
+  `needs: validate`, so the release runs **after** the real suite rather than beside a
+  copy of it. No plant is duplicated: there is still exactly one home for each.
+- **A guard keeps the connection there** — `check_release_gates_on_validate()` fails when
+  the trigger, the call, or the `needs` goes missing. A dependency nobody checks is a
+  dependency somebody removes. Watched failing against each of the three removals, with a
+  negative self-test in CI.
+
+## v0.4.2 — 2026-08-13
+
+Its own negative self-tests could not be run on a developer's machine, and one of
+them had been reporting a healthy guard as broken since 2026-08-12.
+
+### Fixed
+
+- **`main` was red for two days over a guard that works.** The over-long-description
+  plant replaced the literal `"BTCPay".`; the description stopped containing it, so
+  `str.replace` changed nothing, the validator honestly passed, and the step printed
+  *ERROR: validator accepted a description past the 1024-char limit*. Re-anchored on the
+  folded `>-` block's SHAPE and proven: the plant now produces a 1204-char description
+  and the validator rejects it. Standing instruction #6 of the family's retro, which
+  names this exact failure in another member.
+- **Three plants used `sed -i` and were no-ops on macOS.** BSD sed requires an argument
+  to `-i`, so they errored and changed nothing; they could only ever be exercised in CI,
+  which is how the broken one went unnoticed. Converted to Python — the rule
+  `task-pipeline` has enforced on itself for months.
+- **Every plant now asserts that it changed the file.** A plant that stops landing says
+  `PLANT DID NOT LAND: <why>` instead of blaming the guard it can no longer disarm.
+
+All four verified by running them: each lands, and each makes the validator fail.
+
 ## [0.4.1] — 2026-08-12
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/sheleg-dev",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Six integration skills for the layer a product reaches once it has users: Stripe subscription billing, crypto payments, ad and conversion tracking under Consent Mode v2, Google sign-in and the wider Google auth surface, and Core Web Vitals. This package is the installer CLI.",
   "bin": {
     "sheleg-dev": "bin/sheleg-dev.js"

package/plugins/sheleg-dev/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "sheleg-dev",
   "displayName": "Sheleg Dev",
   "description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score.",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"