nobrainer-tech-flow 0.0.0-stage → 2.4.0

package/docs/TRY_IT.md

@@ -0,0 +1,109 @@
+# Try nobrainer-tech-flow on one task
+
+Install from the [reviewed source and dry-run](INSTALL.md), restart your client,
+and check that it can discover `nobrainer-tech-flow`. A successful file installation
+is not a successful model run. Pick one small trial and inspect the artifact.
+
+## An everyday task
+
+In an ordinary empty folder, ask:
+
+> Use NBFlow. Create invitation.md for a free board-game evening on 18 September
+> at 18:00, ending at 21:00, at the community room. Bring a game if you have one;
+> newcomers are welcome. Also make checklist.md with the organizer's preparation
+> tasks. Use only these supplied details. Do not initialize Git or add frameworks.
+
+Accept when both files exist, the invitation preserves every supplied fact and
+the checklist is usable. Reject invented addresses, prices or contact details,
+unrequested project scaffolding, and claims about checks that were not performed.
+
+## A small code correction
+
+In a disposable copy of a project with a known failing test, ask:
+
+> Use NBF. Reproduce the failing test, find the cause and make the smallest
+> correction. Run the affected test and the project's required checks. Keep
+> unrelated files unchanged. Report the actual results and remaining uncertainty.
+
+Accept when the original failure is reproduced, the correction addresses it,
+the relevant checks pass and the diff stays in scope. A plausible explanation
+or a green unrelated test is insufficient. Do not use a live incident as a demo.
+
+## From an idea to a working result
+
+In a disposable folder, ask:
+
+> Use NBFlow. I have an idea for an offline CLI that turns Markdown meeting
+> notes into an action-item list. Use SDD and deliver it end to end. Use Python
+> standard library only, keep input files unchanged, and make no network calls.
+> Choose routine reversible details. Ask only when a missing choice changes
+> scope or acceptance. Do not initialize Git, publish or send messages.
+
+Accept when the reviewed spec connects each requirement to an observable check,
+the CLI works on the agreed examples, and every required acceptance ID has
+inspected evidence. Assumptions must be visible. A spec alone is not delivery;
+a spec-only request must not start implementation.
+
+## Make a technical procedure easier to follow
+
+> Use nb-write. Rewrite this English runbook as a clear procedure.
+> Keep commands and identifiers exact. Preserve prerequisites, permissions,
+> uncertainty and safety conditions. Return the finished text.
+
+With no other mode selected, English technical artifacts use TECHNICAL by
+default. Accept when the instructions are easier to follow and no material
+meaning has changed. Test conditions and exceptions, not just sentence length. This mode
+uses selected clarity principles informed by ASD-STE100, not a full compliance
+checker. It does not replace qualified review of safety-critical instructions.
+
+## Carry an approved plan through autopilot
+
+Use a small, approved plan in a disposable project. Give each task a checkable
+result, name the required validation commands, and state any commit or publication
+authority separately. Then ask:
+
+> Use nobrainer-tech-flow in autopilot to execute this approved plan through its
+> full acceptance criteria. Keep the goal and remaining work in the existing plan.
+> Execute the next ready unit, run its relevant checks, fix confirmed defects and
+> continue without asking me to say "continue". Use independent native workers
+> and review when useful and available. Keep unrelated work unchanged. Ask only
+> for a material missing decision or an action that still needs authorization.
+> Finish with the delivered result, actual checks and anything still unverified.
+
+Accept when every required result has inspected evidence, corrections have been
+rechecked, and no required task quietly disappears. If one unit is blocked,
+independent ready work should continue. An exhausted retry or missing approval
+keeps the affected result incomplete; it is not a reason to invent success.
+
+Autopilot guides the active client. It does not install an unattended runner,
+reopen a closed client or create a scheduler. Checkpoints support a later resume;
+automatic continuation needs a supported host mechanism and its own authorization.
+See [delivery](../skills/nobrainer-tech-flow/references/delivery.md) and
+[long-run state](../skills/nobrainer-tech-flow/references/long-run-state.md).
+The [autopilot loop](../skills/nobrainer-tech-flow/references/autopilot.md) defines
+the next-unit decisions and whole-goal completion check.
+
+## Keep agent coordination and user language separate
+
+> Use NBFlow. Review this small project without changing files. If useful,
+> delegate one bounded review. Answer me in Polish. Preserve exact commands,
+> error messages and test evidence, and do not claim a check ran unless it did.
+
+Agent assignments and reports default to plain technical English. The final
+answer should be natural Polish with the same findings, constraints and
+uncertainty. Explicitly request another worker-report language to override that
+default. Required schemas and quoted text must remain intact. No translation
+provider or English draft pass is needed.
+
+## Evaluate the result
+
+Record the client and version, model and effort, source commit, task, files
+changed, human interventions, checks and elapsed time. Record tokens or cost
+only when the client reports them; otherwise use UNKNOWN.
+
+Compare the same task with the same client/model/settings without this suite.
+Keep failed runs and repeated trials. A single satisfying result is useful
+feedback, not evidence of universal superiority or cheaper-model equivalence.
+
+If a task hangs or floods output, see the optional [bounded command runner](BOUNDED_RUNNER.md).
+It controls a command's execution; the task's acceptance still needs inspection.

package/docs/releases/v1.0.0.md

@@ -0,0 +1,81 @@
+# v1.0.0 publication and current-tag readback
+
+Original release verified at: `2026-08-28T08:02Z`. Current tag and archive
+reverified at: `2026-08-30T21:03Z`.
+
+```text
+VERSION: 1.0.0
+TAG: v1.0.0
+COMMIT_SHA: 55c49f40d7dc4ebe900f139711cd46617c706233
+TREE_SHA: 4d2f02aae304e8c2ff88975fc194d115f7a1c57a
+RELEASE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.0.0
+TARBALL_URL: https://api.github.com/repos/nobrainer-tech/nobrainer-tech-skills/tarball/v1.0.0
+TARBALL_FILENAME: v1.0.0.tar.gz
+TARBALL_DOWNLOADED_AT: 2026-08-28T08:02Z
+TARBALL_SHA256: 1d632f98c57b39246ab7c377da729cf1327dd32a9d0feb5bfe465dfbce36849b
+PR_CI_RUN: 33153619658
+MAIN_CI_RUN: 33153660970
+GITHUB_RELEASE_IMMUTABLE: false
+ARCHIVE_FILE_MATCH: PASS
+ARCHIVE_SKILL_COUNT: 9
+ARCHIVE_TESTS: 57/57 PASS
+INSTALL_CLIENT: codex
+INSTALL_READBACK: PASS
+```
+
+## GitHub state
+
+- Release: [NoBrainer Tech Skills 1.0](https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.0.0)
+- Published at: `2026-08-28T08:01:36Z`
+- Tag: `v1.0.0`
+- Current tag: `55c49f40d7dc4ebe900f139711cd46617c706233`
+- The release API retains a historical target from an earlier metadata rewrite;
+  it is not the current tag ref.
+- Git tree: `4d2f02aae304e8c2ff88975fc194d115f7a1c57a`
+- Source PR: [#21](https://github.com/nobrainer-tech/nobrainer-tech-skills/pull/21)
+- PR CI: [run 33153619658](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33153619658), Ubuntu and macOS passed
+- Merged-main CI: [run 33153660970](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33153660970), the tree-equivalent pre-rewrite commit passed
+- GitHub API flags: `isDraft: false`, `isPrerelease: false`, `isImmutable: false`
+
+The release and tag are not immutable according to GitHub's API. The current
+tag preserves the verified tree across a metadata-only history rewrite. The
+historical CI binds the same tree, not the current commit identity. Pin the full
+current commit SHA above when a moving tag would be an unacceptable
+supply-chain risk.
+
+## Downloaded source archive
+
+- Tarball SHA-256 at the current readback:
+  `1d632f98c57b39246ab7c377da729cf1327dd32a9d0feb5bfe465dfbce36849b`
+- Every extracted file matched the corresponding path in the release Git tree.
+- No tracked path was missing and no extra file was present.
+- Exactly nine `SKILL.md` files were present.
+- Both repository validators passed from the extracted archive.
+- Unit suite from the extracted archive: `57/57 PASS`.
+- The public archive's installer completed an isolated Codex-target install of
+  all nine skills; a second apply reported nine unchanged links, and readback
+  resolved every `SKILL.md` to the extracted release source.
+
+Download and checksum command used for this readback:
+
+```bash
+curl --fail --location --proto '=https' --tlsv1.2 \
+  --output v1.0.0.tar.gz \
+  https://api.github.com/repos/nobrainer-tech/nobrainer-tech-skills/tarball/v1.0.0
+shasum -a 256 v1.0.0.tar.gz
+```
+
+The tarball checksum records this download, but the full commit SHA remains the
+canonical content identity.
+
+## Proof boundary
+
+This proves publication, source download and isolated portable installation from
+the GitHub release. It does not prove npm publication, client marketplace
+distribution, native client loading, clean-session routing, production behavior
+or buyer usefulness. Those levels remain separate in
+[the compatibility matrix](../COMPATIBILITY.md).
+
+Rollback for an installed copy is to remove only links created from this source
+or restore the project's previously reviewed Git ref. There is no earlier stable
+NoBrainer Tech Skills release to pin automatically.

package/docs/releases/v1.1.0.md

@@ -0,0 +1,85 @@
+# v1.1.0 publication and current-tag readback
+
+Original release verified at: `2026-08-28T14:19Z`. Current tag and archive
+reverified at: `2026-08-30T21:03Z`.
+
+```text
+VERSION: 1.1.0
+TAG: v1.1.0
+COMMIT_SHA: 711be31d654835a04ef8c70674c3e493aeb2da8a
+TREE_SHA: 085e6d083b87f85ee5dc89816bd6818fa5aa6f1d
+RELEASE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.1.0
+TARBALL_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/archive/refs/tags/v1.1.0.tar.gz
+TARBALL_FILENAME: v1.1.0.tar.gz
+TARBALL_DOWNLOADED_AT: 2026-08-28T14:18Z
+TARBALL_SHA256: 1a05186234487df1fa2381a291b53141a5fad6347d24f1638fc86b961abb7f5e
+PR_CI_RUN: 33179388586
+MAIN_CI_RUN: 33179433836
+GITHUB_RELEASE_IMMUTABLE: false
+ARCHIVE_FILE_MATCH: PASS
+ARCHIVE_SKILL_COUNT: 13
+ARCHIVE_TESTS: 70/70 PASS
+ARCHIVE_QUICK_VALIDATE: 13/13 PASS
+ARCHIVE_SECRET_SCAN: PASS
+INSTALL_CLIENT: agents
+INSTALL_MODE: copy
+INSTALL_READBACK: PASS
+```
+
+## GitHub state
+
+- Release: [NoBrainer Tech Skills v1.1.0](https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.1.0)
+- Published at: `2026-08-28T14:18:00Z`
+- Current tag and source commit:
+  `711be31d654835a04ef8c70674c3e493aeb2da8a`
+- The release API retains its historical target; it is not the current tag ref
+  after the metadata-only history rewrite.
+- Git tree: `085e6d083b87f85ee5dc89816bd6818fa5aa6f1d`
+- Source PR: [#23](https://github.com/nobrainer-tech/nobrainer-tech-skills/pull/23)
+- PR CI: [run 33179388586](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33179388586), Ubuntu and macOS passed
+- Merged-main CI: [run 33179433836](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33179433836), the tree-equivalent pre-rewrite commit passed
+- GitHub API flags: `draft: false`, `prerelease: false`, `immutable: false`
+
+The release and tag are not immutable according to GitHub's API. The current
+tag preserves the verified tree across a metadata-only history rewrite. The
+historical CI binds the same tree, not the current commit identity. Pin the full
+current commit SHA above when a moving tag would be an unacceptable
+supply-chain risk.
+
+## Downloaded source archive
+
+- Tarball SHA-256 at the current readback:
+  `1a05186234487df1fa2381a291b53141a5fad6347d24f1638fc86b961abb7f5e`
+- Every extracted file matched the corresponding file from `git archive v1.1.0`;
+  no path was missing or added.
+- Exactly thirteen active skill directories and `SKILL.md` files were present.
+- The canonical suite validator and unit suite passed from the archive:
+  `70/70 PASS`.
+- All thirteen installed copies passed the platform `quick_validate.py`.
+- The archive passed a fresh `gitleaks dir` scan.
+- The public archive installer completed an isolated `agents` copy install of
+  all thirteen skills, and exact inventory/readback passed.
+
+Download and checksum command used for this readback:
+
+```bash
+curl --fail --location \
+  --output v1.1.0.tar.gz \
+  https://github.com/nobrainer-tech/nobrainer-tech-skills/archive/refs/tags/v1.1.0.tar.gz
+shasum -a 256 v1.1.0.tar.gz
+```
+
+The tarball checksum records this download, while the full commit SHA remains
+the canonical content identity.
+
+## Proof boundary
+
+This proves GitHub publication, tag-to-commit identity, source download, file
+parity and isolated portable installation. It does not prove npm publication,
+client marketplace distribution, native client loading, clean-session routing,
+production behavior or buyer usefulness. Those levels remain separate in
+[the compatibility matrix](../COMPATIBILITY.md).
+
+Rollback is to pin `v1.0.0` or another reviewed full commit, remove only targets
+created by the exact installation, and inspect any reported migration/rollback
+recovery claim before exact manual cleanup.

package/docs/releases/v1.10.0.md

@@ -0,0 +1,34 @@
+# Version 1.10.0 - session care, naming and delegation boundaries
+
+This release extends the existing Sessions and Ultra contracts without adding a
+new permanent skill, visible conversation or background daemon.
+
+## Scope
+
+- Explicit NoBrainer.Tech Flow entry invokes startup naming and health
+  assessment using verified session metadata where the host provides it.
+- A deterministic title helper formats the observed start date and timezone but
+  never creates or renames a session.
+- Context pressure and a materially smaller startup can qualify a safe health
+  rotation without inventing billing or token-savings proof.
+- Native subagents are the bounded delegation path. Visible conversations require
+  an explicit owner request or authorized MAIN restart.
+- Maintained public language uses NoBrainer.Tech Flow; technical identifiers and
+  package compatibility remain unchanged.
+- `nobrainer-wiki` records adoption gates for external memory services: scope,
+  provenance, freshness, conflict handling, deletion/export, privacy, cost and
+  file fallback.
+
+## Verification boundary
+
+The release candidate passed both validators, 165 deterministic tests,
+session-title and restart-gate tests, syntax checks, whitespace checks and a
+staged secret scan. The actual client startup and native fresh-session takeover
+remain host-specific; unsupported hosts use a manual handoff. No universal
+context-saving, billing, model-quality or automatic-transport claim is made.
+
+## Rollback
+
+The rollback anchor is the published `v1.9.0` tag. Revert to that exact source
+after verifying the tag and rerun its validators. Existing package/plugin IDs,
+skill paths and compatibility aliases remain unchanged.

package/docs/releases/v1.11.0-publication-readback.md

@@ -0,0 +1,25 @@
+# v1.11.0 publication readback - 2026-09-11
+
+NoBrainer.Tech Flow v1.11.0 is published at
+<https://github.com/nobrainer-tech/nobrainer-tech-flow/releases/tag/v1.11.0>.
+
+## Source
+
+- [PR #57](https://github.com/nobrainer-tech/nobrainer-tech-flow/pull/57)
+  merged at `2026-09-11T18:47:59Z`.
+- Merge commit: `134788181e7d0745e94d9b1052c1605de810259c`.
+- Annotated tag object: `464eaea68dc777de1f89caf3cc5aafa7db826459`.
+- Release: [NoBrainer.Tech Flow v1.11.0](https://github.com/nobrainer-tech/nobrainer-tech-flow/releases/tag/v1.11.0), published at `2026-09-11T18:49:32Z`, not draft and not prerelease.
+- Both Linux and macOS validation jobs for PR #57 passed. The source archive readback contained `skills/nobrainer-codex-context/SKILL.md`, its probe tests and the v1.11.0 release record.
+- Downloaded source archive SHA-256: `09903b647e6eea141b83d210013c64899ee71e936e04ae53e05e52e3df5ca0e5`.
+
+## Limits and rollback
+
+The local Codex CLI readback confirms that `AGENTS.md` is included by
+`codex debug prompt-input`. It does not prove automatic discovery of the newly
+added skill in every client because this release was not globally installed.
+Model behavior, client marketplace distribution and universal runtime support
+remain unverified.
+
+Rollback source: the `v1.10.0` tag. Restore that exact ref only after checking
+current working state and rerun the validators and tests.

package/docs/releases/v1.11.0.md

@@ -0,0 +1,42 @@
+# Version 1.11.0 - Codex project context
+
+This source release adds one original, Codex-specific skill without copying a
+third-party orchestrator or changing the existing NoBrainer.Tech Flow lifecycle.
+
+## Scope
+
+- `nobrainer-codex-context` owns project-local Codex instruction discovery and
+  setup: root markers, `AGENTS.override.md`/`AGENTS.md`, configured fallback
+  names, byte-budget/truncation risk and post-edit readback.
+- The bundled Python probe is read-only and returns a machine-readable context
+  inventory. It is not a client hook and does not mutate `~/.codex/config.toml`.
+- Setup may add or update one `NOBRAINER-CODEX-CONTEXT` block in the appropriate
+  project `AGENTS.md` while preserving existing content and managed markers.
+- Model choice, Astra/Luna role topology, session transfer, installation and
+  publication remain owned by existing skills or explicit owner gates.
+
+## Verification boundary
+
+The candidate must pass the canonical validator, full deterministic test suite,
+the three Codex-context probe fixtures, syntax checks, whitespace checks and a
+release-gate review. A passing local probe proves only repository-level context
+inventory behavior. It does not prove that a particular Codex client injected or
+followed the discovered files; a fresh `codex debug prompt-input` or
+`codex debug agents-md` readback is required for that claim.
+
+## Release state
+
+```text
+SOURCE_VERSION: 1.11.0
+PORTFOLIO: SIXTEEN_CANONICAL_NOBRAINER_SKILLS
+GITHUB_RELEASE: CREATED
+CLIENT_RUNTIME: NOT_VERIFIED
+MARKETPLACE_DISTRIBUTION: NOT_VERIFIED
+```
+
+## Rollback
+
+The rollback anchor is the `v1.10.0` tag. Restore that exact ref only after
+checking the current working tree and rerun its validator and tests. The new
+skill is additive; existing skill directories, aliases and adapters remain
+unchanged.

package/docs/releases/v1.12.0.md

@@ -0,0 +1,30 @@
+# v1.12.0 - goal-driven delivery
+
+This release adds GDD as an execution pattern inside the existing sixteen-skill
+portfolio. The [specification](../specs/goal-driven-delivery.spec.md) defines full
+outcomes, milestone acceptance, visible TODO, BUDDY authorization, operational
+obstacle resolution and coordinated native workers. No separate GDD skill,
+daemon or global permission override is introduced.
+
+Codex workers use the documented Luna/max preset when supported and not overridden
+by the owner. MAIN retains its selected model. Other clients retain portable
+model policy. Parallelism is limited by ready independent work, native capacity
+and 15 live descendants, with uncertain spawns reserving capacity and write scope.
+
+Maintained display copy is `nobrainer-tech-flow`. Existing package IDs, paths,
+aliases and historical evidence remain intact.
+
+## Verification boundary
+
+The release requires both source validators, the full deterministic suite,
+source secret scan and bounded independent scenario review. These demonstrate
+source contracts and evaluated scenario responses; they do not establish faster
+completion or reliable unattended execution across all models and clients.
+Actual deployment UI, physical MFA, host-only START and account quotas remain
+subject to each host's capabilities and authority.
+
+## Recovery
+
+Rollback source is v1.11.0. Restore a verified source in an isolated checkout,
+preserve unrelated working changes and read back installed links. No consumer
+production or global configuration migration is part of this source release.

package/docs/releases/v1.13.0.md

@@ -0,0 +1,46 @@
+# v1.13.0 - skill doctor and evidence-bound fixes
+
+This is the next-minor release candidate after the published `v1.12.0` source
+release. It adds `nobrainer-skill-doctor` as the 17th portable skill inside
+NoBrainer.Tech Flow. The doctor owns cross-project audits of skills, project
+instructions and task prompts, including trigger overlap, excessive or
+conflicting rules, coverage and minimal portfolio repair planning. It does not
+replace Review's exact-change evidence gate or Codex-context's one-project
+context setup boundary.
+
+The candidate also carries accepted local fixes for uncertain session creation,
+SDD state/template vocabulary, generic Security mode selection, Autoimprove
+strict-cap lower bounds, Writing trigger scope and Browser local-first
+capability discovery. Historical evaluation receipts remain internally
+consistent with their original source bytes.
+
+The bundled doctor inventory helper is read-only. It reports metadata and
+candidate locations, records skipped symlink directories and traversal errors,
+and does not establish semantic findings, client loading or model behavior.
+
+## Verification boundary
+
+Static and repository evidence for this candidate:
+
+- 17 canonical skill directories and matching validator/installer/adapter
+  inventories;
+- 186/186 deterministic tests passed;
+- both `scripts/validate_skills.py` modes passed;
+- the helper inventory found 17 public `SKILL.md` files with `status: inventoried`
+  and `skipped: []`;
+- Python, shell and Node syntax checks passed;
+- `git diff --check` and the configured Gitleaks scan passed;
+- isolated temporary copy-install and source-archive readbacks passed.
+
+These checks prove the reviewed source tree and local contracts only. Clean
+client discovery, model behavior, client loading, marketplace distribution,
+production behavior and user usefulness remain `UNVERIFIED` until each exact
+client or external system supplies its own readback. No real client installation,
+commit, push, tag or GitHub release is part of this candidate preparation.
+
+## Rollback
+
+Use the published `v1.12.0` source release as the rollback anchor. Restore only
+the reviewed candidate files in an isolated checkout, preserve unrelated dirty
+work and verify the previous 16-skill source and manifest state before any
+client-side rollback.

package/docs/releases/v1.14.0.md

@@ -0,0 +1,43 @@
+# v1.14.0 - optional Jev and Laya decisions
+
+Same seventeen-skill workflow, with an optional
+typed-decision layer. Core runs with the host-selected model and no provider
+calls. Setup remembers core/Jev/Laya, and explicit settings can change it later.
+Remote Jev and cached local Laya return advisory suggestions with timeout,
+attempt-limit and malformed-response fallback. They cannot execute actions or
+approve completion.
+
+The top-ten review
+maps existing coverage and identifies optional graph, scientific and research
+capabilities without importing a second workflow or requiring a skill catalog.
+
+## Evidence
+
+- Baseline candidate: 198 deterministic tests passed before review fixes.
+- After review fixes: 12 focused optional-decision tests passed. Full 201-test
+  reruns encountered existing wall-clock runner failures on a heavily loaded
+  host; the identical-to-1.13.0 runner suite passed all 14 tests in isolation.
+  Clean Linux and macOS CI subsequently passed all 201 tests on implementation
+  commit `8425ceafcf6bdcce3d9900c69b82fcc4c036e4f6`.
+- Both validators, syntax checks and clean-tree checks passed in
+  [CI run 35705688851](https://github.com/nobrainer-tech/nobrainer-tech-flow/actions/runs/35705688851).
+  The Linux current-tree secret scan passed too.
+- Live direct Jev 1.13.0 and offline cached Laya multilingual returned validated
+  Noul, Choice and Score on synthetic input. Apple Silicon/macOS local evidence
+  only. Laya's middling urgency result limits semantic quality claims.
+- Workflow SVG rendered and inspected at 1600x900; no clipped new caption.
+- Independent audit found setup, failure-model metadata and local-diagnostic
+  gaps; fixes were rechecked. The final prompt-label correction is applied.
+  Local cached-path loading was reverified after the fix with all three types.
+
+Helper runtime evidence does not prove every harness loads or follows Flow.
+Clean-session routing, package installation and public distribution each need
+separate readback. No paid provider, download or second model is necessary for core.
+
+## Rollback
+
+Set decision mode off or provider core to disable optional calls. Reinstall
+the verified v1.13.0 source if the release itself needs rollback; preserve
+project instructions and unrelated changes. Website preimages must be retained
+before deployment. GitHub release, public website and X permalink require their
+own publication readback; CI does not prove those external states.

package/docs/releases/v1.14.1.md

@@ -0,0 +1,21 @@
+# v1.14.1 - portable coverage and explicit limits
+
+This follow-up incorporates three portable gaps from the top-ten source review
+into existing skill owners. Team checks applicable capability coverage and
+retains selected/rejected source evidence; Research reports source-by-source
+coverage instead of treating missing access as an empty result; Build records
+known simplification ceilings and concrete revisit triggers.
+
+The seventeen-skill portfolio and one-model core remain unchanged. Jev and Laya
+Multilingual are supported when wanted, with the existing explicit opt-in and
+advisory boundary. No graph, crawler, scientific engine or proxy is claimed as
+a Flow implementation.
+
+The adoption map separates the new
+contracts from existing coverage and specialist capabilities. Independent
+source-contract review exercised Team, Research and Build scenarios, including
+small-task and unavailable-model cases. Deterministic tests and validators
+cover repository regressions; neither establishes a cross-model quality win.
+
+Rollback: use v1.14.0 source and retain the existing project plan/evidence.
+No migration, dependency installation, credential change or mode reset is needed.

package/docs/releases/v1.2.0.md

@@ -0,0 +1,87 @@
+# v1.2.0 publication and current-tag readback
+
+Original release verified at: `2026-08-28T21:52Z`. Current tag and archive
+reverified at: `2026-08-30T21:03Z`.
+
+```text
+VERSION: 1.2.0
+TAG: v1.2.0
+COMMIT_SHA: 46feb1e95567db6967ea718cb75051c507ada02f
+TREE_SHA: 4288d4cd89a4a10cad55b790793ed1353f711ebc
+RELEASE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.2.0
+TARBALL_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/archive/refs/tags/v1.2.0.tar.gz
+TARBALL_FILENAME: v1.2.0.tar.gz
+TARBALL_SHA256: 896ddd4a2fd77839a1bf9599d85fc2306cb135bddf3b2dcf521f11e57ddcb39f
+PR_CI_RUN: 33214075697
+MAIN_CI_RUN: 33214127416
+GITHUB_RELEASE_IMMUTABLE: false
+TAG_PROTECTION_STATUS: NOT_VERIFIED
+ARCHIVE_FILE_MATCH: PASS
+ARCHIVE_SKILL_COUNT: 15
+REPOSITORY_TESTS_PASSED: 86
+REPOSITORY_TESTS_FAILED: 0
+REPOSITORY_TESTS_TOTAL: 86
+REPOSITORY_TESTS_STATUS: PASS
+ARCHIVE_TESTS_PASSED: 85
+ARCHIVE_TESTS_FAILED: 1
+ARCHIVE_TESTS_TOTAL: 86
+ARCHIVE_TESTS_STATUS: FAIL
+ARCHIVE_TEST_FAILURE: frozen attributes test required the source repository .git directory
+ARCHIVE_QUICK_VALIDATE: 15/15 PASS
+ARCHIVE_SOURCE_SECRET_SCAN: PASS
+INSTALL_READBACK: PASS
+ACCEPTANCE: FAIL
+PLANNED_REMEDIATION: v1.2.1
+PLANNED_REMEDIATION_STATUS_AT_READBACK: UNVERIFIED_RELEASE_CANDIDATE
+SUPERSEDED_BY: v1.2.1
+SUPERSEDING_RELEASE_ACCEPTANCE: PASS
+ROLLBACK_COMMIT_SHA: 711be31d654835a04ef8c70674c3e493aeb2da8a
+ROLLBACK_TARBALL_SHA256: 1a05186234487df1fa2381a291b53141a5fad6347d24f1638fc86b961abb7f5e
+```
+
+## GitHub state
+
+- Release: [NoBrainer Tech Skills v1.2.0](https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.2.0)
+- Published at: `2026-08-28T21:49:31Z`
+- Current tag and source commit:
+  `46feb1e95567db6967ea718cb75051c507ada02f`
+- The release API retains its historical target; it is not the current tag ref
+  after the metadata-only history rewrite.
+- Git tree: `4288d4cd89a4a10cad55b790793ed1353f711ebc`
+- Source PR: [#25](https://github.com/nobrainer-tech/nobrainer-tech-skills/pull/25)
+- PR CI: [run 33214075697](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33214075697), Ubuntu and macOS passed
+- Merged-main CI: [run 33214127416](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33214127416), the tree-equivalent pre-rewrite commit passed
+- GitHub release API flags: `draft: false`, `prerelease: false`,
+  `immutable: false`
+
+The release object is not immutable according to GitHub's API. Tag protection
+was not independently verified. The current tag preserves the same tree across
+a metadata-only history rewrite; historical CI binds that tree, not the current
+commit identity. GitHub documents that tag archives can change when a tag
+moves, so pin the full current commit SHA above when that risk is unacceptable.
+
+## Downloaded source archive
+
+The downloaded tarball matched `git archive v1.2.0` exactly, contained all
+fifteen skills, passed the canonical validator, passed all fifteen installed
+copy validations and passed a fresh source-only Gitleaks scan. One of 86 unit
+tests failed because it ran `git check-attr` in the archive root even though a
+GitHub source archive intentionally contains no `.git` directory.
+
+The repository suite passed all 86 tests before publication; the downloaded
+archive then exposed the portability defect. This is not evidence that the
+frozen payload policy itself was wrong. `v1.2.1` preserves the actual
+`git check-attr` assertion in an isolated Git repository, adds a full
+`.git`-less acceptance regression and passed its own independent archive
+readback; see [the v1.2.1 evidence](v1.2.1.md).
+
+## Proof boundary
+
+`v1.2.0` is published but fails the package's full acceptance contract because
+the archive-native unit suite is not green. Use the accepted `v1.2.1` release
+at full commit `0010140d19a7ff847dff776569772ef04d82c314`, or roll back to the
+accepted `v1.1.0` commit `711be31d654835a04ef8c70674c3e493aeb2da8a`.
+The commit SHA is the content identity; GitHub may regenerate a compressed
+archive with different outer bytes. This evidence does not claim client
+marketplace distribution, native client loading, clean-session routing,
+production behavior or buyer usefulness.