gm-skill 2.0.2178 → 2.0.2180

package/AGENTS.md

@@ -167,10 +167,18 @@ A task that reduces to read/investigate/report, or a change confined to files th
 
 ## Cascade pipeline
 
-Push to any rs-* sibling -> `cascade.yml` -> rs-plugkit `release.yml` -> single `plugkit.wasm` (npm `plugkit-wasm` + `plugkit-bin` Releases) -> auto-bump `gm.json::plugkitVersion` -> `publish.yml` ships gm-skill+gm-plugkit+SKILL.md mirror. Step sequence + PUBLISHER_TOKEN: the recall store (`recall: cascade pipeline`).
+Push to any rs-* sibling -> `cascade.yml` -> rs-plugkit `release.yml` -> single `plugkit.wasm` (npm `plugkit-wasm` + `plugkit-bin` Releases) -> best-effort gm-metadata-sync commit -> `publish.yml` ships gm-skill+gm-plugkit+SKILL.md mirror. Step sequence + PUBLISHER_TOKEN: the recall store (`recall: cascade pipeline`).
+
+**`gm.json.plugkitVersion` is informational-only, never a functional pin** -- nothing reads it; the real runtime pin is `gm-plugkit/plugkit.version`, always overridden by `resolveLatestRemoteVersion()` before use. `publish.yml`'s drift-check no longer gates on it. Mechanism detail: the recall store (`recall: gm cascade pin-toil design`).
+
+**Every downloaded wasm artifact is sha256-verified against the sha published alongside that exact resolved release, fetched fresh, never against a locally-committed value alone** -- `gm-plugkit/bootstrap.js::fetchRemoteSha()`. Floating past the committed pin never weakens verification. Detail: the recall store (`recall: gm cascade pin-toil design`).
+
+**Submodule pointers auto-sync via `.github/workflows/submodule-sync.yml`** (30min schedule, `git submodule update --remote --merge`, auto-commit) instead of hand-bumped chore commits -- reproducibility preserved since each commit still pins exact SHAs, only main's HEAD advances automatically.
 
 The `gm-runner` crate and its separate `gm-runner.yml` CI workflow are retired along with the binary itself (see the WASM-guest section above) -- confirmed absent from rs-plugkit's `crates/` and `.github/workflows/`, no longer a stage in the cascade.
 
+**The three agentplug-* wasm-plugin repos (agentplug-bert, agentplug-libsql, agentplug-treesitter) share one reusable release workflow** hosted in rs-plugkit (`wasm-plugin-release.yml`, `workflow_call`). Parameterization + the build_env/pre_build_steps quoting caveat: the recall store (`recall: gm cascade pin-toil design`).
+
 **Repos involved (push to any triggers cascade):** `AnEntrypoint/{rs-codeinsight, rs-search, rs-plugkit, gm}`. rs-learn and rs-exec are retired (crates removed from / never depended on by rs-plugkit; their spool-dispatch and memory surfaces reimplemented natively in rs-plugkit wasm_dispatch; repos archived as tombstones, README points at rs-plugkit). Roles, npm package names, legacy-retirement detail: the recall store (`recall: cascade repos involved roles`, `recall: legacy gm-skill variants retired`).
 
 **agentplug is a separate parallel pipeline that CONSUMES the cascade's output, not a stage in it.** The cascade above produces the wasm guest (`plugkit-bin` release). `AnEntrypoint/{agentplug, agentplug-bert, agentplug-libsql, agentplug-treesitter}` are their own repos: agentplug's CI builds only the native host binary (`agentplug-runner`, 6 platforms, published to `AnEntrypoint/agentplug-bin`) and the sibling plugins their own `*-bin` releases; none of them build or publish the gm wasm. agentplug fetches the SAME `plugkit-slim.wasm` from `plugkit-bin` at runtime. The two pipelines are cleanly decoupled at the `plugkit-bin` release artifact -- a plugkit-core change flows through the cascade to `plugkit-bin`, and every host (agentplug-runner included) picks it up via its 600s poll, with no agentplug rebuild needed. An agentplug-host change (a new native subsystem like browser/task) rebuilds only `agentplug-runner`, independent of the cascade.

package/bin/plugkit-slim.wasm.sha256

@@ -1 +1 @@
-6aa343337008b72713fe60660a3f460345117dcece30e8491c8d28d62f1e40ef  plugkit-slim.wasm
+c5ff416bf78105a38943ee6be617dd1052101428eae97dd1b1173f54ddf22afe  plugkit-slim.wasm

package/bin/plugkit.version

@@ -1 +1 @@
-0.1.1031
+0.1.1034

package/bin/plugkit.wasm.sha256

@@ -1 +1 @@
-1afa52f433634994009112e196294de48c81e9a22c2f7aff28456aa4118477d0  plugkit.wasm
+34a675417d9c56f0a5eea64d21e7811f44427219d9f4427213c8b9cb87d28022  plugkit.wasm

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.2178",
+  "version": "2.0.2180",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.",
   "main": "index.js",
   "bin": {

package/gm-plugkit/plugkit-slim.wasm.sha256

@@ -1 +1 @@
-6aa343337008b72713fe60660a3f460345117dcece30e8491c8d28d62f1e40ef  plugkit-slim.wasm
+c5ff416bf78105a38943ee6be617dd1052101428eae97dd1b1173f54ddf22afe  plugkit-slim.wasm

package/gm-plugkit/plugkit.version

@@ -1 +1 @@
-0.1.1031
+0.1.1034

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.2178",
+  "version": "2.0.2180",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",
@@ -17,5 +17,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "plugkitVersion": "0.1.1031"
+  "plugkitVersion": "0.1.1034"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.2178",
+  "version": "2.0.2180",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",