@ssheleg/sheleg-dev 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -4,6 +4,51 @@ All notable changes to this project are documented here.
 Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 Versioning: [SemVer](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.2 — 2026-08-16
+
+**`CONTRIBUTING.md` described a different repository.** Its *Where things go* table routed
+contributions to `benchmarks.md`, `growth-plays.md`, `myths.md`, `algorithm-updates.md`,
+`aeo-geo.md` and `scripts/page_audit.py` — all six belong to `seo-aeo-audit`, and
+`git ls-files` here matched none of them. Sweeping every file name in the document found
+**eleven** absent, not six: also `deliverable-templates.md`, `technical-checks.md`,
+`threats-and-defense.md`, `test_page_audit.py`, and an `evidence-tiers.md` under a skill
+directory named `sheleg-dev` that has never existed — the six skills are `stripe-billing`,
+`crypto-payments`, `ad-tracking`, `google-signin`, `google-auth` and
+`frontend-performance`.
+
+Most of the document was a sibling's, adapted only at the edges. It claimed a
+standard-library auditor and a second test command; there is no runtime code in this
+repository at all, and `python3 test/validate.py` is the whole gate. Rewritten against what
+`git ls-files` actually returns: six skills, twenty reference files, one executable
+(`install.sh`), a four-way version sync, and the eight negative self-tests CI really runs.
+
+**The guard is narrow on purpose.** Only the *Where things go* table is checked, because a
+general "every path must exist" rule cannot tell a path being used from a path being
+discussed — the rewrite deliberately names three `seo-aeo-audit` files to send a reader to
+the right repository. The first draft of the guard read the whole section and flagged
+exactly those, one paragraph after the comment explaining why it must not. A bare filename
+resolves by basename, so `SKILL.md` passes as the generic it is while `benchmarks.md` still
+fails. Watched rejecting the original row verbatim.
+
+## v0.5.1 — 2026-08-16
+
+**This gate can now see an invariant it breaks one repository away.** The family umbrella
+routes work by matching a prompt against a table in `lib/triggers.js`, and every trigger
+there must be a word this skill's own `description` advertises. Nothing here knew that
+table existed. On 2026-08-16 `sheleg-design` 1.37.0 shipped green having dropped a phrase
+that was still a live trigger, the umbrella found out minutes after the tag, and it cost a
+patch release — because the member releases FIRST and the umbrella re-pins after.
+
+`test/validate.py` now asks the umbrella's own checker (`test/advertised_check.js`), which
+reads the module the hook itself calls. **No copy of the table lives here**, so there is
+nothing to drift. With no umbrella above this checkout — a standalone clone, and CI — it
+discloses rather than passing, because a check that cannot look must never read as one
+that looked.
+
+Watched refusing a real drop before shipping: every one of the seven members carrying
+routed triggers had one of its own advertised phrases removed and every one of them failed
+its own gate.
+
 ## v0.5.0 — 2026-08-14
 
 Two gaps found by reading a web2app funnel guide against the pack. Both are about

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/sheleg-dev",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Six integration skills for the layer a product reaches once it has users: Stripe subscription billing, crypto payments, ad and conversion tracking under Consent Mode v2, Google sign-in and the wider Google auth surface, and Core Web Vitals. This package is the installer CLI.",
   "bin": {
     "sheleg-dev": "bin/sheleg-dev.js"

package/plugins/sheleg-dev/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "sheleg-dev",
   "displayName": "Sheleg Dev",
   "description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score.",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"