@vegastack/vegafactory 0.19.0 → 0.19.5

package/README.md

@@ -1,11 +1,11 @@
 # @vegastack/vegafactory
 
-Installer for VegaStack Agent Skills — a family of self-contained skills for Claude Code, Codex, and Hermes, shipped in one integrity-checked package.
+The VegaFactory command-line tool installs and verifies a bundled family of VegaStack Agent Skills for Claude Code, Codex, and Hermes, and it runs the local workflow, dispatcher, statistics, and service commands. The separately published `@vegastack/vegafactory-dashboard` package is the local read-only web app; this CLI downloads that package at its own exact version only when `vegafactory dashboard` is first used.
 
 Install the whole dev workflow, once per machine:
 
 ```sh
-npx @vegastack/vegafactory skills add --group dev --global
+npx @vegastack/vegafactory@latest skills add --group dev --global
 ```
 
 `--global` is the recommended install: the skills land in your home directory and are available in every project you open. Drop it for a project-local install when a repository should carry its own copy.
@@ -308,9 +308,11 @@ read is projected to the current verified repository scope before totals, rows o
 source is unavailable, safely retained data stays visible with explicit unavailable, stale and
 partial state; unavailable dispatcher observation is not reported as idle.
 
-This source revision still uses the dashboard's native semantic table and existing root setup.
-Signature-verified provider/Table copy-in and descriptor-backed packed browser evidence remain
-pending; no registry credential, hash-only component or completed accessibility claim is implied.
+The registry-downloaded `0.19.0` pair passed descriptor/inventory verification, installed-CLI
+launch identity and health checks, and scoped HTTP response smoke across all nine destinations.
+That was not an interactive browser run. This source revision still uses the dashboard's native
+semantic table and existing root setup; signature-verified provider/Table copy-in, keyboard,
+automated accessibility, theme and viewport evidence remain pending.
 
 ## Flags
 
@@ -348,13 +350,13 @@ Prefer a project install when a repository should carry its own copy — so coll
 
 ## Integrity model
 
-The package ships a checksum manifest that is verified at install and by `verify` — it proves the installed bytes match what was packed, not who published it. Publisher identity is attested separately by npm provenance, generated by the trusted-publishing release pipeline. Verify it with `npm audit signatures` or on the package's npm page.
+The package ships a checksum manifest that is verified at install and by `verify` — it proves the installed bytes match what was packed, not who published it. A version with npm provenance adds a verifiable source/workflow link; inspect the selected version on npm rather than assuming every release carries one. The direct `0.19.0` bootstrap and the current automated publisher explicitly omit provenance. Verify available signatures and attestations with `npm audit signatures` or on the package's npm page.
 
 ## Network and telemetry
 
-Zero telemetry, in the sense that matters: **nothing is ever sent to VegaStack or to any third party.**
+VegaFactory sends no product telemetry to VegaStack or to an analytics service.
 
-The tool makes three kinds of network call, all to somewhere you already own:
+The tool makes four kinds of network call, all to the npm registry or infrastructure you already own:
 
 - `doctor`'s single version check against registry.npmjs.org;
 - `sync`'s shallow git fetch of the control room named by the project's `control-room:` knob;

package/dist/dashboard-artifact.json

@@ -1,10 +1,10 @@
 {
   "schemaVersion": 1,
   "name": "@vegastack/vegafactory-dashboard",
-  "version": "0.19.0",
-  "sha256": "7b4d94611fce1c1e00b9b936b43f114658859fe0f86e729285dd34878b841a21",
-  "integrity": "sha512-izz2anvHxXe7jE1K+LjeqV0KRkqNJU8gKvVzvN222reI5Q+r1E7GULLRQIBk4rJw5Np7yrsUO8x37u11wtYpcw==",
-  "bytes": 126813011,
+  "version": "0.19.5",
+  "sha256": "06ac0483425e85c72722f7885a9098522f85b1007fdc8dd88209cb61cf9affd1",
+  "integrity": "sha512-Im0uFCHae1p660SzayqgjoT2ezlsjyW5SSRUJjR08eRHjCz0UyVCkfIEytu8CwuGvhQYI5/KtYE9/13FMeId+Q==",
+  "bytes": 126852463,
   "files": [
     {
       "path": "LICENSE",
@@ -13,7 +13,7 @@
     },
     {
       "path": "README.md",
-      "sha256": "2fe8d48fd7250c14d548d56d8b366a75b395e16680bba2ed252b241a4db18635",
+      "sha256": "058d5aacd261ec968e4f931492585cd4f28e0ccbb225ef1345f96671eb1906e8",
       "mode": 420
     },
     {
@@ -13668,7 +13668,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/BUILD_ID",
-      "sha256": "7c2ca77bc2fc570ee5f057d7a65f782824c3d2bb3ab8322c9aed0028bcf92ddc",
+      "sha256": "0342879636495ee2b23c69ea9e87678afd809aad7bd584e0d5c822414c718f8c",
       "mode": 420
     },
     {
@@ -13678,7 +13678,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/build-manifest.json",
-      "sha256": "cd8baf2e0b0d24326b66dc31f26e8138a2e78387761d14d801cca87fb785b192",
+      "sha256": "e62f1ec54cfd19d39a5b94be81c9411a02f05ac79c51d19fbaf3d211d29b8ff6",
       "mode": 420
     },
     {
@@ -13688,12 +13688,12 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/prerender-manifest.json",
-      "sha256": "989fdf9d979fc5f722e107450d99109976290431f04ff489a04e09b07b4cf95b",
+      "sha256": "c3dd30b2c4abef3ee49e2a537992cb473e5a9639d5b6185dd478464d0ed077bf",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/required-server-files.json",
-      "sha256": "c48a075de1f139f55abb6e74f84943d40ce39e15745c363b46ff81294eb10e1f",
+      "sha256": "0742bb7dec156a72d658fde6316e4340d4f87bfe9dc62936c4e6b3b4f91b2020",
       "mode": 420
     },
     {
@@ -13708,7 +13708,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_global-error.html",
-      "sha256": "6139795f0fb111c374c42d25b0730e68cc39399327e7f7b3d17cf5aad9eb8f85",
+      "sha256": "fd202b0a008e9f00f6d1f41329677ec4ad142bd6168071172ac1c0b41731287d",
       "mode": 420
     },
     {
@@ -13718,22 +13718,22 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_global-error.rsc",
-      "sha256": "29c76bf81043cedbfc5b09a2a89a0ef1a5efea80c3edda5821f23e5a05167e18",
+      "sha256": "59c1323978d539882477d6783cf1c099a7d6be7ad8c13668feb02c5c40ea08ae",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_global-error.segments/__PAGE__.segment.rsc",
-      "sha256": "11543819a1e356caca26216292ed0ce5e1f1ac4b7c0399eb19c3b38b6eb6dffc",
+      "sha256": "00c23188046dc298e9a186446e471561f2a12540fba1043ea67e619f8215c6af",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_global-error.segments/_full.segment.rsc",
-      "sha256": "29c76bf81043cedbfc5b09a2a89a0ef1a5efea80c3edda5821f23e5a05167e18",
+      "sha256": "59c1323978d539882477d6783cf1c099a7d6be7ad8c13668feb02c5c40ea08ae",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_global-error.segments/_tree.segment.rsc",
-      "sha256": "39cba8b2a378b84250c33dc6c3a38aec9208fc16f544149a5b21f3baf6556074",
+      "sha256": "ad4ba1bed25125a1e8a72cc67b4b06dd392c76e4fe598422b56d254bf3e144d5",
       "mode": 420
     },
     {
@@ -13783,7 +13783,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_not-found.html",
-      "sha256": "5dc99b73ee03f466889243bcadd885d90f65b41ebc846db8b6f3b598ba2661a8",
+      "sha256": "e7a9ca2605b034b57de756c2059d1a518d6a8728ce8865f492236994b0dad1d7",
       "mode": 420
     },
     {
@@ -13793,22 +13793,22 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_not-found.rsc",
-      "sha256": "1aa25bd23621db9dc877e63c470957ee5c6dbf5484d75a5894fab398c36f7051",
+      "sha256": "50c5f06bc431f115c8df3c002e6fb986616bfaa27bb676438673a4a05bdd33a9",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_not-found.segments/_full.segment.rsc",
-      "sha256": "1aa25bd23621db9dc877e63c470957ee5c6dbf5484d75a5894fab398c36f7051",
+      "sha256": "50c5f06bc431f115c8df3c002e6fb986616bfaa27bb676438673a4a05bdd33a9",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_not-found.segments/_not-found/__PAGE__.segment.rsc",
-      "sha256": "d8de11be282bca9549de6f506b7fb7ab75f2196f9f25d57add1d46076599ed02",
+      "sha256": "0879d72f3527c5c4734e7cb7732c30db05cd23ca0bc63c6c7135600ab7168858",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_not-found.segments/_tree.segment.rsc",
-      "sha256": "4edb36233769eefbc6241c75da61cc5bebc6c1a2c06ee76600ad1d7d0c0e3800",
+      "sha256": "ea06cee32c263b5cdb95e27d4ada1b6657117771c18c30fd4808c6513f4917aa",
       "mode": 420
     },
     {
@@ -13868,7 +13868,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/activity/page.js.nft.json",
-      "sha256": "2eb28958dd03e5b1616720617158f24390ff513233dca944e4e5ebed309ac772",
+      "sha256": "33acbbee1883085c67a9ed4689cdd68de368dd7ad32ac7da2842ac2686cac871",
       "mode": 420
     },
     {
@@ -13913,7 +13913,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/api/health/route.js.nft.json",
-      "sha256": "20142b4ca3b4e54f06ed0e33d2cfb13c929e26fe207785a87acd5960285e03e8",
+      "sha256": "36dc7e8f7f59a7180c2c9d1cb2b917397a03e78cdc6815041a49bfa6b74032ed",
       "mode": 420
     },
     {
@@ -13948,7 +13948,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/board/page.js.nft.json",
-      "sha256": "e21a0164a36e10c56bf9ddc47f317f613af70e6adecd0969cc8a0b4f6dfcaf17",
+      "sha256": "f9a76c4b21f079e973505c6e8f22ab9db7d0cc69eb70b0c711bdc37f375b6fae",
       "mode": 420
     },
     {
@@ -13993,7 +13993,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/dispatcher/page.js.nft.json",
-      "sha256": "876ef376408d458a4408fdcdd6e1c7d04fe02a099675eba1b29681950c17176d",
+      "sha256": "9773a55c0027b5aeecb461e14fa7d906fc8fa08c3bbf2a3db0476aa6eff7e430",
       "mode": 420
     },
     {
@@ -14038,7 +14038,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/page.js.nft.json",
-      "sha256": "afe8366aacfddc83e9dc98834bd71a8ef671ca876a83b4d665c80efc0da1f403",
+      "sha256": "0744bbc200862ab19ca72053569f4612ed8d83f81bf0e1047c4abe33e443d793",
       "mode": 420
     },
     {
@@ -14083,7 +14083,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/people/[login]/page.js.nft.json",
-      "sha256": "d06ae47ead94a9105f9a6f53236f422652e17bdcb3dd0c9df137beddaebaa734",
+      "sha256": "5bb0fc2a7d775909fdf00bd727429f682fee9732cf061372342507ccc7a0b91f",
       "mode": 420
     },
     {
@@ -14128,7 +14128,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/people/page.js.nft.json",
-      "sha256": "44d5f901903054491594ab4d30f0fe60e6f2918ed72e2e1957ca1489704ef762",
+      "sha256": "f1cfa2edd9745b40979468e3296be20318cf8b51f5880f306cb6bda099efa105",
       "mode": 420
     },
     {
@@ -14173,7 +14173,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/performance/page.js.nft.json",
-      "sha256": "cec85a35f45addcdd820fdd4b7fe10ba1663835d4c7c4fcc437eb5ef77594c09",
+      "sha256": "ca08aada62c9af838161bf9051b9ff67453f561cbead15cbce14abc32072a1dc",
       "mode": 420
     },
     {
@@ -14218,7 +14218,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/repo/[owner]/[name]/page.js.nft.json",
-      "sha256": "d90e985da4dea45dccbeec7b3a6230e5dd566d378c02b1b009bf176e99fb75cc",
+      "sha256": "e76426d3c30e5638ec72fb0e64bfb25173976955042f6f232b300b49ccc94806",
       "mode": 420
     },
     {
@@ -14263,7 +14263,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/skills/page.js.nft.json",
-      "sha256": "67c2353093c0f12d8b15695051911fea8e3a2ad21eb50afa3b5b73d6f6952997",
+      "sha256": "667dd7dc636c9c40491c4acf3409a084a36d5ef229f9f6f51f97b67e724a9c59",
       "mode": 420
     },
     {
@@ -15078,7 +15078,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/middleware-build-manifest.js",
-      "sha256": "453982b72ff7e7a37d41338cfb34be8750734807cf69f0743829e59fea4cb4e8",
+      "sha256": "fb7a5f796455c5884945536e8ac6e7fad5c6eceead7e879d4f80fb91da8bb95c",
       "mode": 420
     },
     {
@@ -15103,12 +15103,12 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/pages/404.html",
-      "sha256": "5dc99b73ee03f466889243bcadd885d90f65b41ebc846db8b6f3b598ba2661a8",
+      "sha256": "e7a9ca2605b034b57de756c2059d1a518d6a8728ce8865f492236994b0dad1d7",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/pages/500.html",
-      "sha256": "6139795f0fb111c374c42d25b0730e68cc39399327e7f7b3d17cf5aad9eb8f85",
+      "sha256": "fd202b0a008e9f00f6d1f41329677ec4ad142bd6168071172ac1c0b41731287d",
       "mode": 420
     },
     {
@@ -15118,12 +15118,27 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/server-reference-manifest.js",
-      "sha256": "5352ec6fd558bf653581879b0e7f3a7194da4fa9674d5061cadd3fe001b404cd",
+      "sha256": "1666f19cb024a68bd963d717002d67a18f873b11bdc400f2db140aa3ceb7f3e9",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/server-reference-manifest.json",
-      "sha256": "73fd3879f3a24b2c856b4684ea082542778e4ab4fb30620173025d027fa47cd0",
+      "sha256": "433e1189c03632a7f3183daa881b6093c033f409d8891e0c523548d8daebfe59",
+      "mode": 420
+    },
+    {
+      "path": "dist-standalone/packages/dashboard/.next/static/Cm_SmnoCpVGagO6nR8WqE/_buildManifest.js",
+      "sha256": "9476e0afd3f9da68a64e6ec58631191fd3eaca62c9f5a377e7517fe9a89e59ea",
+      "mode": 420
+    },
+    {
+      "path": "dist-standalone/packages/dashboard/.next/static/Cm_SmnoCpVGagO6nR8WqE/_clientMiddlewareManifest.js",
+      "sha256": "5483e3295dc35dfe29ea932efc85341c916f10ff78ff5b0e965e003710893a4a",
+      "mode": 420
+    },
+    {
+      "path": "dist-standalone/packages/dashboard/.next/static/Cm_SmnoCpVGagO6nR8WqE/_ssgManifest.js",
+      "sha256": "678f6ce2cb80b1fe72fc67e7412be6e2ab6ada083111b64f7c40d35e3cba5e00",
       "mode": 420
     },
     {
@@ -15176,24 +15191,9 @@
       "sha256": "8917d76a368a5bd96306af173899c65854cfa6100dc4cb8d7eeb1b4eb183da49",
       "mode": 420
     },
-    {
-      "path": "dist-standalone/packages/dashboard/.next/static/hEhWpQ4CfL_5vZcaUbTmP/_buildManifest.js",
-      "sha256": "9476e0afd3f9da68a64e6ec58631191fd3eaca62c9f5a377e7517fe9a89e59ea",
-      "mode": 420
-    },
-    {
-      "path": "dist-standalone/packages/dashboard/.next/static/hEhWpQ4CfL_5vZcaUbTmP/_clientMiddlewareManifest.js",
-      "sha256": "5483e3295dc35dfe29ea932efc85341c916f10ff78ff5b0e965e003710893a4a",
-      "mode": 420
-    },
-    {
-      "path": "dist-standalone/packages/dashboard/.next/static/hEhWpQ4CfL_5vZcaUbTmP/_ssgManifest.js",
-      "sha256": "678f6ce2cb80b1fe72fc67e7412be6e2ab6ada083111b64f7c40d35e3cba5e00",
-      "mode": 420
-    },
     {
       "path": "dist-standalone/packages/dashboard/CHANGELOG.md",
-      "sha256": "85c57e11ef8e141535a3e703f0769d58e3f5c340f0f9091cb770c85fc8c18a40",
+      "sha256": "f39afca575c8ce7a9d0a2850e5733170ddc7f7af67c342985d7f91bb32595ea2",
       "mode": 420
     },
     {
@@ -15203,7 +15203,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/README.md",
-      "sha256": "2fe8d48fd7250c14d548d56d8b366a75b395e16680bba2ed252b241a4db18635",
+      "sha256": "058d5aacd261ec968e4f931492585cd4f28e0ccbb225ef1345f96671eb1906e8",
       "mode": 420
     },
     {
@@ -20913,7 +20913,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/package.json",
-      "sha256": "8d0bc4e9bb54a4e1cd2fb77147798250763cff8ffc01de7d1adc8893ba2290aa",
+      "sha256": "5c6bdf8fe7b28afe9fa32dcf03b97021df321bd70ed8cfd670388bf92157aeaf",
       "mode": 420
     },
     {
@@ -20928,7 +20928,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/server.js",
-      "sha256": "94c70473c8d8e8e91806c527599a16dc082d19dab0513174d9fd401d262786de",
+      "sha256": "3a63413fdb9680d81b16ae0d4450db5d24fe9c0b134a61e2f29fec0b3c1af017",
       "mode": 420
     },
     {
@@ -21231,9 +21231,14 @@
       "sha256": "f8e9a8d884d8283b3564adc2cf4250c7ddf00e33f7c5dee20a1c5cb1f78b56fc",
       "mode": 420
     },
+    {
+      "path": "dist-standalone/packages/dashboard/tsconfig.tsbuildinfo",
+      "sha256": "d0f12d83d997f7f53700beffc2b134f7eebc6d0628ded4772ee4375d075ff235",
+      "mode": 420
+    },
     {
       "path": "package.json",
-      "sha256": "8d0bc4e9bb54a4e1cd2fb77147798250763cff8ffc01de7d1adc8893ba2290aa",
+      "sha256": "5c6bdf8fe7b28afe9fa32dcf03b97021df321bd70ed8cfd670388bf92157aeaf",
       "mode": 420
     }
   ]

package/dist/index.js

@@ -20821,7 +20821,8 @@ __export(exports_dashboard, {
   dashboardInstallReceipt: () => dashboardInstallReceipt,
   dashboardCacheNamespace: () => dashboardCacheNamespace,
   SERVER_ENTRY: () => SERVER_ENTRY,
-  DASHBOARD_PACKAGE: () => DASHBOARD_PACKAGE
+  DASHBOARD_PACKAGE: () => DASHBOARD_PACKAGE,
+  DASHBOARD_HEALTH_TIMEOUT_MS: () => DASHBOARD_HEALTH_TIMEOUT_MS
 });
 import { execFile as execFile5, spawn as spawn6 } from "node:child_process";
 import { chmod, lstat as lstat11, mkdir as mkdir11, mkdtemp as mkdtemp2, open as open8, readFile as readFile15, readdir as readdir4, rename as rename7, rm as rm7, writeFile as writeFile5 } from "node:fs/promises";
@@ -21042,7 +21043,7 @@ async function runDashboard(options) {
     return 2;
   }
   const version = paths.source === "override" ? "unverified-development" : options.version;
-  const deadline = Date.now() + HEALTH_TIMEOUT_MS;
+  const deadline = Date.now() + DASHBOARD_HEALTH_TIMEOUT_MS;
   for (const port of portCandidates(flags.port, PORT_SPAN).filter((port2) => port2 <= 65535)) {
     if (Date.now() >= deadline)
       break;
@@ -21050,7 +21051,7 @@ async function runDashboard(options) {
     const env = launchEnv({ env: { ...environment, cacheFile, port, version, instanceId: identity.instanceId, bin: process.argv[1] ?? "vegafactory" } });
     const attempt = launchDashboardChild(paths.entry, { ...process.env, ...env }, flags.json);
     try {
-      const ready = await waitDashboardChild(attempt, identity, port, Math.min(deadline, Date.now() + 2000));
+      const ready = await waitDashboardChild(attempt, identity, port, deadline);
       if (!ready) {
         if (!await stopDashboardChild(attempt)) {
           console.error("error: dashboard child termination is unverified; retained ownership, no port retry");
@@ -21083,7 +21084,7 @@ async function runDashboard(options) {
       return 1;
     }
   }
-  console.error("error: no owned dashboard instance became ready within 20 seconds");
+  console.error(`error: no owned dashboard instance became ready within ${DASHBOARD_HEALTH_TIMEOUT_MS / 1000} seconds`);
   return 1;
 }
 function launchDashboardChild(entry, env, quiet = true) {
@@ -21452,7 +21453,7 @@ async function downloadDashboard(version, descriptor) {
   }
   return Buffer.concat(chunks);
 }
-var DASHBOARD_PACKAGE = "@vegastack/vegafactory-dashboard", SERVER_ENTRY = "dist-standalone/packages/dashboard/server.js", DEFAULT_PORT = 7777, PORT_SPAN = 10, HEALTH_TIMEOUT_MS = 20000, run2 = (command, args, options = {}) => new Promise((resolve14) => {
+var DASHBOARD_PACKAGE = "@vegastack/vegafactory-dashboard", SERVER_ENTRY = "dist-standalone/packages/dashboard/server.js", DEFAULT_PORT = 7777, PORT_SPAN = 10, DASHBOARD_HEALTH_TIMEOUT_MS = 60000, run2 = (command, args, options = {}) => new Promise((resolve14) => {
   execFile5(command, args, { ...options, maxBuffer: 32 * 1024 * 1024 }, (error, stdout, stderr) => {
     const code = error ? error.code : 0;
     resolve14({ code: typeof code === "number" ? code : error ? 1 : 0, stdout, stderr });
@@ -21938,8 +21939,6 @@ The dashboard (a local, read-only web view over the control room and the live bo
   Fetches @vegastack/vegafactory-dashboard at this CLI's version on first use and
   serves it on 127.0.0.1. Run "vegafactory dashboard --help" for the whole surface.
 
-Reserved (not yet available): dashboard
-
 Run "vegafactory skills list" to see the bundled skills.
 `;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vegastack/vegafactory",
-  "version": "0.19.0",
-  "description": "Installer and verifier for VegaStack Agent Skills (Claude Code, Codex, and Hermes)",
+  "version": "0.19.5",
+  "description": "VegaFactory CLI for installing Agent Skills and running local development workflows",
   "license": "MIT",
   "type": "module",
   "repository": {

package/skill/skill-maintainer/references/release-ops.md

@@ -27,8 +27,8 @@ profile carries a schema version to validate against.
 2. Maintainer, at release time: `bunx changeset version` (applies changesets to `packages/cli/package.json` and the changelog), then `bun install` so any dependency changes riding along reach the lockfile, commit on a `chore/release-<version>` branch and open its PR — main is branch-protected with no admin exemption, so the bump reaches main by merge and never by direct push. That install does **not** update the workspace's own version inside `bun.lock`: measured on the bun the root `packageManager` line pins, the recorded version is left unchanged by a plain install, by `--force`, and even by `--lockfile-only`, so it sits at an older number indefinitely. `bun install --frozen-lockfile`, which CI and the release workflow both run, passes with it, and nothing in this repo reads it: `packages/cli/package.json` is the single release identity. Never hand-edit the lockfile to "correct" it. The release record is `packages/cli/CHANGELOG.md`, changesets-written — never by hand; the root `CHANGELOG.md` is the frozen pre-0.3.0 record pointing there.
 3. Merge the release PR on the operator's word, pull main, then tag that merged commit `v<version>` and push the tag. Tags are not branch-protected, so the tag push is unaffected.
 4. The release workflow prepares one immutable CLI/dashboard pair before either package publishes. `scripts/release-artifacts.mjs prepare <evidence-dir> v<version>` requires clean source and records full source/tree identity, toolchains, check and built-skill scan evidence, build-graph and shipped-runtime SBOMs. It builds/assembles dashboard and CLI/skills, scans, packs dashboard with scripts disabled, derives its regular-file descriptor into generated CLI dist, then packs CLI with scripts disabled. Rebuilding CLI invalidates its descriptor. The final external manifest binds both exact tarballs and each required build/runtime SBOM by filename, scope and SHA-256; publication and release asset verification refuse missing or changed evidence. Only completed preparation writes the finalized manifest; generated descriptors are never committed.
-5. `scripts/release-publish.mjs <manifest> --publish --promote` runs only inside the repository-wide serialized Release workflow on the operator's word. All versions and recovery reruns share that workflow concurrency group with cancellation disabled; direct local live publishing refuses. A successful immutable pair upload precedes this command. It uses retained tarballs with scripts disabled and the existing authentication arrangement; this work does not restore provenance or change runners. Stage dashboard before CLI under a non-latest candidate tag. Compare registry integrity and downloaded payload bytes separately from provenance; #156 owns actual registry/attestation evidence. Only a definite public/authenticated 404 means absent. Network, rate-limit and auth failures stop recovery; a timed-out publish is read back before any later attempt. Matching existing versions resume; conflicting bytes require an operator-selected new version.
-6. The states are prepared → dashboard-present → pair-present → smoked → promoted. Smoke the downloaded pair in clean homes before changing either latest tag or claiming release success. Promotion is not atomic: each pending mutation and confirmed per-package tag readback is recorded, so a failed second-tag promotion leaves a recorded partial state. Rerun the same workflow: it restores the finalized pair and available prior observations, verifies both registry identities, repeats smoke, then reconciles tags and lost responses before retrying. If no finalized pair exists, only affirmative skipped-publication records for every prior attempt permit retrying failed preparation; missing/expired pair evidence after possible publication is a refusal, never permission to rebuild. Never retag historical releases or move latest backward. Retain the finalized pair before the first registry mutation, and upload attempt outcomes separately. After workflow completion, download/verify those same artifacts instead of preparing or publishing a second local pair. Retain tarballs, manifests, SBOMs and failure logs as CI artifacts and release assets; copy needed evidence before artifact retention expires. A platform is qualified only by results for this same descriptor-backed pair on that actual OS/architecture. Missing Linux guest execution remains unperformed; macOS or source engines cannot prove Ubuntu x64 compatibility.
+5. `scripts/release-publish.mjs <manifest> --publish --promote` runs only inside the first attempt of the repository-wide serialized Release workflow on the operator's word. All versions share that workflow concurrency group with cancellation disabled; direct local live publishing refuses. A successful immutable pair upload precedes this command. It uses retained tarballs with scripts disabled and the existing authentication arrangement; this work does not restore provenance or change runners. Stage dashboard before CLI under a non-latest candidate tag. Compare registry integrity and downloaded payload bytes separately from provenance; #156 owns actual registry/attestation evidence. Only a definite public/authenticated 404 means absent. After either publish call, poll exact registry integrity and downloaded bytes for up to 10 minutes (61 observations separated by 10 seconds); a conflict stops immediately, while absence or unavailability never authorizes resubmitting an attempted artifact. A failed run is immutable and rolls forward through a fresh patch/tag.
+6. The states are prepared → dashboard-present → pair-present → smoked → promoted. Smoke the downloaded pair in clean homes before changing either latest tag or claiming release success. Promotion is not atomic: each pending mutation and confirmed per-package tag readback is recorded, so a failed second-tag promotion remains failure evidence for the next roll-forward. GitHub deletes prior-attempt artifacts when a workflow run is rerun, so `GITHUB_RUN_ATTEMPT` greater than one is refused before preparation; do not rerun the same run, retag a historical release, rebuild a possibly published version, or move latest backward. Retain the finalized pair before the first registry mutation and upload the same attempt's outcome separately. After workflow completion, download/verify those artifacts instead of preparing or publishing a second local pair. Retain tarballs, manifests, SBOMs and failure logs as CI artifacts and release assets; copy needed evidence before retention expires. A platform is qualified only by results for this same descriptor-backed pair on that actual OS/architecture. Missing Linux guest execution remains unperformed; macOS or source engines cannot prove Ubuntu x64 compatibility.
 
 Contributors do not bump versions in PRs; releases are maintainer-driven.
 

package/skill-integrity.json

@@ -183,7 +183,7 @@
       "files": {
         "SKILL.md": "81fc5d089e4edb15f8d6511887c65e1ea01bd134ba27fc7a324ffb1e5cff6961",
         "agents/openai.yaml": "dd356907fdbfd7937e67d7daf06ac659ab36e7da0b0a4d0ffecb8b6eea31fdbe",
-        "references/release-ops.md": "f88b04a06cb8f8590bc5a3533c0d033d941e10a14df4edca61c68919f6b8f2df",
+        "references/release-ops.md": "6c6d34ba0d43f1a72f24e2d0a4cb3dcee8f90287b1dd7ce728472f434305839e",
         "references/standards.md": "a9cb33f9425881307f2ef0d6f4cdb1133f782a50c7b5a87419c09c179899fdbf",
         "refresh/REFRESH.md": "d3ba44be2c264b849d8a815111c049e782720428d5d0c5cea23998b05e50d58f",
         "refresh/sources.json": "4977152381d53555196ac676f95e61b4eaa301309a17560da5cda722010eb80f"