nobrainer-tech-flow 0.0.0-stage → 2.4.0

package/docs/releases/v1.2.1.md

@@ -0,0 +1,92 @@
+# v1.2.1 publication and current-tag readback
+
+Original release verified at: `2026-08-29T23:24Z`. Current tag and archive
+reverified at: `2026-08-30T21:03Z`.
+
+```text
+VERSION: 1.2.1
+TAG: v1.2.1
+COMMIT_SHA: 0010140d19a7ff847dff776569772ef04d82c314
+TREE_SHA: 0a2640cc66df5a1a4227769d12f9670e4d996561
+RELEASE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.2.1
+TARBALL_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/archive/refs/tags/v1.2.1.tar.gz
+TARBALL_FILENAME: v1.2.1.tar.gz
+TARBALL_SHA256: 45ad2987f291ddd557497b6fc41421aa5fb5b2cbd151282a2ae54ce2ed2279e9
+PR_CI_RUN: 33216374869
+MAIN_CI_RUN: 33216427097
+GITHUB_RELEASE_IMMUTABLE: false
+TAG_PROTECTION_STATUS: NOT_VERIFIED
+ARCHIVE_FILE_MATCH: PASS
+ARCHIVE_SKILL_COUNT: 15
+ARCHIVE_TESTS_PASSED: 88
+ARCHIVE_TESTS_FAILED: 0
+ARCHIVE_TESTS_TOTAL: 88
+ARCHIVE_TESTS_STATUS: PASS
+ARCHIVE_QUICK_VALIDATE: 15/15 PASS
+ARCHIVE_SECRET_SCAN: PASS
+INSTALL_CLIENT: agents
+INSTALL_MODE: copy
+INSTALL_SKILL_COUNT: 15
+INSTALL_FILE_MATCH: PASS
+INSTALL_QUICK_VALIDATE: 15/15 PASS
+INSTALL_READBACK: PASS
+ACCEPTANCE: PASS
+```
+
+## GitHub state
+
+- Release: [NoBrainer Tech Skills v1.2.1](https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.2.1)
+- Published at: `2026-08-28T22:21:36Z`
+- Current `refs/tags/v1.2.1` and source commit:
+  `0010140d19a7ff847dff776569772ef04d82c314`
+- The GitHub release API still reports its historical `target_commitish`; it is
+  not the current tag ref after the metadata-only history rewrite.
+- Git tree: `0a2640cc66df5a1a4227769d12f9670e4d996561`
+- Source PR: [#26](https://github.com/nobrainer-tech/nobrainer-tech-skills/pull/26)
+- PR CI: [run 33216374869](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33216374869), Ubuntu and macOS passed
+- Merged-main CI: [run 33216427097](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33216427097), the tree-equivalent pre-rewrite commit passed
+- GitHub release API flags: `draft: false`, `prerelease: false`,
+  `immutable: false`
+
+The release object is not immutable according to GitHub's API. Tag protection
+was not independently verified. The current tag preserves the verified tree
+across a metadata-only history rewrite; historical CI binds that tree, not the
+current commit identity. GitHub documents that a tag archive can change when
+its tag moves, so security-sensitive consumers should pin the full current
+commit SHA above.
+
+## Downloaded source archive
+
+- The public tarball SHA-256 at the current readback was
+  `45ad2987f291ddd557497b6fc41421aa5fb5b2cbd151282a2ae54ce2ed2279e9`.
+- Every extracted file matched `git archive v1.2.1`; no path was missing or
+  added.
+- Exactly fifteen canonical skill directories and fifteen `SKILL.md` files
+  were present, and all version manifests reported `1.2.1`.
+- A fresh Gitleaks directory scan passed before Python generated bytecode.
+- The canonical validator and full unit suite passed from the archive without
+  `.git`: 88 passed, zero failed.
+- Python, shell and Node syntax checks passed.
+- All fifteen source skill folders passed the platform `quick_validate.py`.
+
+## Isolated installation
+
+The downloaded archive performed a dry-run and then a copy installation for
+the `agents` destination into a new temporary directory. All fifteen installed
+folders matched the archive source exactly and all fifteen installed copies
+passed `quick_validate.py`. No existing user installation was touched by this
+readback.
+
+## Proof boundary
+
+This proves GitHub source publication, tag-to-commit identity at readback,
+merged-main CI, extracted archive parity, source secret scan, archive-native
+tests and isolated portable installation. It does not prove client marketplace
+distribution, native client loading, clean-session routing, production behavior
+or buyer usefulness. Those levels remain separate in
+[the compatibility matrix](../COMPATIBILITY.md).
+
+Rollback is to pin the accepted `v1.1.0` full commit
+`711be31d654835a04ef8c70674c3e493aeb2da8a`, or another independently reviewed
+full commit, and remove only installation targets created by the exact recorded
+operation.

package/docs/releases/v1.3.0-publication-readback.md

@@ -0,0 +1,69 @@
+# v1.3.0 publication readback
+
+This post-release record is maintained on `main` after the source tag
+was created. It binds the published GitHub release to the exact merge, tag,
+portfolio and final5 Autoimprove receipt; it is separate from the candidate
+checkpoint contained in the source tag.
+
+```text
+VERSION: 1.3.0
+STATUS: PUBLISHED
+RELEASE_DATE: 2026-09-01
+SKILL_COUNT: 15
+PORTFOLIO: EXACT_FIFTEEN_CANONICAL_NOBRAINER_SKILLS
+AUTOIMPROVE_RESULT: PROMOTED_FINAL5
+AUTOIMPROVE_BASELINE_SHA256: 574db22aa0f809febc9bd29324e40308c76013cfce35a8141e637e42f1143529
+AUTOIMPROVE_CANDIDATE_SHA256: 223702bb56cd66448be4c53cc31b4f321f8c47fc736e18e3a9d2f67cc5f9233c
+AUTOIMPROVE_HOLDOUT: PASS
+AUTOIMPROVE_EVALUATOR: CALIBRATED
+AUTOIMPROVE_RECEIPT: docs/evals/artifacts/v1.3.0-autoimprove-integrity-final5-receipt.md
+DETERMINISTIC_TESTS_TOTAL: 102
+DETERMINISTIC_TESTS_STATUS: PASS
+SECRET_SCAN: PASS
+PUBLIC_SYNC: FETCH_ONLY
+AUTOMATED_PUBLIC_COMMIT_PUSH: BLOCKED
+MERGE_PR: 31
+MERGE: MERGED
+COMMIT_SHA: 8ae4a26548ce908fc5f98b22663f52e163541f56
+TREE_SHA: 726162390429c18db8c504833a502aeb0db09d41
+TAG: v1.3.0
+TAG_OBJECT_SHA: e7a76dd85cc3b2c101f7d1619f08022b903758bd
+TAG_COMMIT_SHA: 8ae4a26548ce908fc5f98b22663f52e163541f56
+TARGET_COMMITISH: main
+CI_UBUNTU_RUN: 33558906561
+CI_MACOS_RUN: 33558906561
+GITHUB_RELEASE_IMMUTABLE: false
+TAG_PROTECTION_STATUS: NOT_VERIFIED
+RELEASE_DRAFT: false
+RELEASE_PRERELEASE: false
+RELEASE_PUBLISHED_AT: 2026-09-01T21:05:10Z
+RELEASE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.3.0
+SOURCE_ARCHIVE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/archive/refs/tags/v1.3.0.tar.gz
+SOURCE_ARCHIVE_FILENAME: v1.3.0.tar.gz
+SOURCE_ARCHIVE_SHA256: cb6e270c261585ef133e0bbb419605e63abe562b46d12df88015c8861d25317a
+SOURCE_ARCHIVE_DOWNLOADED_AT: 2026-09-01T21:17:35Z
+SOURCE_ARCHIVE_TREE_MATCH: PASS
+SOURCE_ARCHIVE_PYCACHE_COUNT: 0
+SOURCE_ARCHIVE_SKILL_COUNT: 15
+SOURCE_ARCHIVE_VALIDATOR: PASS
+SOURCE_ARCHIVE_TESTS: 102/102 PASS
+SOURCE_ARCHIVE_SECRET_SCAN: PASS
+INSTALL_CLIENT: codex
+INSTALL_MODE: copy
+INSTALL_SKILL_COUNT: 15
+INSTALL_FILE_MATCH: PASS
+INSTALL_READBACK: PASS
+DISTRIBUTION: PUBLISHED
+ACCEPTANCE: PASS_RELEASE
+```
+
+PR #31 passed the Ubuntu and macOS portable-suite checks before merge. The
+annotated `v1.3.0` tag dereferences to merge commit
+`8ae4a26548ce908fc5f98b22663f52e163541f56` and tree
+`726162390429c18db8c504833a502aeb0db09d41`. The GitHub release is published,
+not draft and not prerelease; GitHub reports it as non-immutable. Client
+marketplace and runtime compatibility remain separate evidence levels. The
+published source archive was downloaded, matched against `git archive v1.3.0`,
+passed the validator, 102-test suite and secret scan, and installed into a
+fresh Codex copy destination; all 15 installed `SKILL.md` files matched the
+archive.

package/docs/releases/v1.3.0.md

@@ -0,0 +1,66 @@
+# v1.3.0 candidate checkpoint
+
+This record binds the untagged branch candidate to the exact fifteen-skill
+portfolio and the final5 Autoimprove receipt. It is not a publication record.
+
+```text
+VERSION: 1.3.0
+STATUS: RELEASE_CANDIDATE
+VERIFIED_DATE: 2026-09-01
+SKILL_COUNT: 15
+PORTFOLIO: EXACT_FIFTEEN_CANONICAL_NOBRAINER_SKILLS
+AUTOIMPROVE_RESULT: PROMOTED_FINAL5
+AUTOIMPROVE_BASELINE_SHA256: 574db22aa0f809febc9bd29324e40308c76013cfce35a8141e637e42f1143529
+AUTOIMPROVE_CANDIDATE_SHA256: 223702bb56cd66448be4c53cc31b4f321f8c47fc736e18e3a9d2f67cc5f9233c
+AUTOIMPROVE_HOLDOUT: PASS
+AUTOIMPROVE_EVALUATOR: CALIBRATED
+AUTOIMPROVE_RECEIPT: docs/evals/artifacts/v1.3.0-autoimprove-integrity-final5-receipt.md
+DETERMINISTIC_TESTS_TOTAL: 102
+DETERMINISTIC_TESTS_STATUS: PASS
+SECRET_SCAN: PASS
+PUBLIC_SYNC: FETCH_ONLY
+AUTOMATED_PUBLIC_COMMIT_PUSH: BLOCKED
+MERGE: NOT_PERFORMED
+TAG: NOT_CREATED
+DISTRIBUTION: NOT_PUBLISHED
+ACCEPTANCE: PASS_LOCAL_PR_CANDIDATE
+```
+
+## What changed
+
+- Ultra binds one portable goal and definition of done to the canonical plan,
+  with host-native goal readback only after scope is frozen.
+- Ordinary work gets a concise outcome-first Progress view; a durable ledger
+  appears only when dependency, handoff, recovery, multiple-writer or
+  consequential-effect risk justifies it.
+- Build, Dispatcher and Sessions now expose minimum-solution, critical-path,
+  context-receipt and delivery-acknowledgement boundaries without duplicating
+  ownership.
+- Autoimprove protects the evaluator from candidate writes, calibrates controls,
+  binds immutable score receipts, handles stochastic noise and continues with
+  Pareto-sized fresh experiments after a rejected candidate.
+- The portfolio remains exactly fifteen skills. Caveman's useful
+  evidence-budgeted brevity was adopted in the host-compatible workflow layer;
+  no sixteenth skill or client fork was introduced.
+
+## Behavioral evidence
+
+The final5 experiment used a frozen contract, a fresh sealed holdout, three paired
+repetitions, equal conditions and two blinded independent judges. Candidate
+outputs were 255/255/255 words; baseline outputs were 248/253/252. The candidate
+passed every hard gate and scored 8/8 in every valid judge repetition; the
+baseline scored 8/8 in two of three repetitions from each judge. Earlier
+rejected, invalid or infrastructure-only rounds were not reused as holdouts.
+
+See the [final5 receipt](../evals/artifacts/v1.3.0-autoimprove-integrity-final5-receipt.md),
+[behavioral evaluation](../evals/v1.3.0-autoimprove-integrity-2026-09-01.md),
+[compatibility boundary](../COMPATIBILITY.md) and
+[testing contract](../TESTING.md). The exact v1.2.1 commit remains the rollback
+anchor recorded in [its release readback](v1.2.1.md).
+
+## Runtime boundary
+
+This candidate record does not upgrade client-specific compatibility by
+inference. The Codex and Claude rows in [COMPATIBILITY.md](../COMPATIBILITY.md)
+remain scoped to their own clean-session evidence. Merge, tag and distribution
+require their own owner-gated readback after this candidate review.

package/docs/releases/v1.3.1-publication-readback.md

@@ -0,0 +1,76 @@
+# v1.3.1 publication readback
+
+This post-release record binds the published GitHub source release to the exact
+merge, tag, portfolio, BRIEF evaluation and isolated archive installation. It is
+separate from the candidate checkpoint contained in the source commit.
+
+```text
+VERSION: 1.3.1
+STATUS: PUBLISHED
+RELEASE_DATE: 2026-09-02
+SKILL_COUNT: 15
+PORTFOLIO: EXACT_FIFTEEN_CANONICAL_NOBRAINER_SKILLS
+WRITING_BRIEF_RESULT: PASS
+WRITING_BRIEF_HOLDOUT: PASS 5/5
+WRITING_BRIEF_EVALUATION: docs/evals/v1.3.1-writing-brief-2026-09-02.md
+INDEPENDENT_REVIEW: CLEAN
+INDEPENDENT_REVIEW_SESSION: 01a0616f-da41-7cf2-a81d-c8c5febb8403
+DETERMINISTIC_TESTS_TOTAL: 105
+DETERMINISTIC_TESTS_STATUS: PASS
+SECRET_SCAN: PASS
+PUBLIC_SYNC: FETCH_ONLY
+AUTOMATED_PUBLIC_COMMIT_PUSH: BLOCKED
+MERGE_PR: 33
+MERGE: MERGED
+COMMIT_SHA: d1e0ea761d4bf439973727668ee871e2b367797e
+TREE_SHA: 1c5c34fd2560f0a4e39e0c05085d350eb404997e
+TAG: v1.3.1
+TAG_OBJECT_SHA: e712049a952ca1dc14432070be11533081faa171
+TAG_COMMIT_SHA: d1e0ea761d4bf439973727668ee871e2b367797e
+TARGET_COMMITISH: main
+CI_PR_RUN: 33617119505
+CI_MAIN_RUN: 33617181865
+GITHUB_RELEASE_IMMUTABLE: false
+TAG_PROTECTION_STATUS: NOT_VERIFIED
+RELEASE_DRAFT: false
+RELEASE_PRERELEASE: false
+RELEASE_PUBLISHED_AT: 2026-09-02T10:01:32Z
+RELEASE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.3.1
+SOURCE_ARCHIVE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/archive/refs/tags/v1.3.1.tar.gz
+SOURCE_ARCHIVE_FILENAME: v1.3.1.tar.gz
+SOURCE_ARCHIVE_SHA256: 79fd101206aa8b1cc6bb3d219f8e984c1a3a34102f01382d687ccec5640d2bc6
+SOURCE_ARCHIVE_DOWNLOADED_AT: 2026-09-02T10:03Z
+SOURCE_ARCHIVE_TREE_MATCH: PASS
+SOURCE_ARCHIVE_FILE_COUNT: 241
+SOURCE_ARCHIVE_PYCACHE_COUNT: 0
+SOURCE_ARCHIVE_SKILL_COUNT: 15
+SOURCE_ARCHIVE_VALIDATOR: PASS
+SOURCE_ARCHIVE_SUITE_VALIDATOR: PASS
+SOURCE_ARCHIVE_TESTS: 105/105 PASS
+SOURCE_ARCHIVE_PYTHON_SYNTAX: PASS
+SOURCE_ARCHIVE_SHELL_SYNTAX: PASS
+SOURCE_ARCHIVE_SECRET_SCAN: PASS
+INSTALL_CLIENT: agents
+INSTALL_MODE: copy
+INSTALL_SKILL_COUNT: 15
+INSTALL_FILE_MATCH: PASS
+INSTALL_READBACK: PASS
+DISTRIBUTION: PUBLISHED
+ACCEPTANCE: PASS_RELEASE
+```
+
+PR #33 passed the Ubuntu and macOS portable-suite checks before merge. The
+annotated `v1.3.1` tag dereferences to merge commit
+`d1e0ea761d4bf439973727668ee871e2b367797e` and tree
+`1c5c34fd2560f0a4e39e0c05085d350eb404997e`. The post-merge main run also passed.
+
+The public source archive matched `git archive v1.3.1` file-by-file, contained
+exactly fifteen skills and no generated bytecode before scanning, passed both
+validators, 105/105 tests, Python and shell syntax checks, and the source
+Gitleaks scan. A copy installation into an isolated `agents` destination matched
+all fifteen source skill files. The source channel is published; client-specific
+marketplace loading, automatic alias routing, production behavior and buyer
+usefulness remain separate unverified evidence levels.
+
+Rollback is to the accepted `v1.3.0` release and its exact merge commit
+`8ae4a26548ce908fc5f98b22663f52e163541f56`, or to revert PR #33.

package/docs/releases/v1.3.1.md

@@ -0,0 +1,59 @@
+# v1.3.1 candidate checkpoint
+
+This record binds the untagged candidate to the exact fifteen-skill portfolio,
+the English `BRIEF` writing contract and its fresh behavioral holdout. It is not
+a publication record.
+
+```text
+VERSION: 1.3.1
+STATUS: RELEASE_CANDIDATE
+VERIFIED_DATE: 2026-09-02
+SKILL_COUNT: 15
+PORTFOLIO: EXACT_FIFTEEN_CANONICAL_NOBRAINER_SKILLS
+WRITING_BRIEF_RESULT: PASS
+WRITING_BRIEF_HOLDOUT: PASS 5/5
+WRITING_BRIEF_EVALUATOR: INDEPENDENT
+WRITING_BRIEF_EVALUATION: docs/evals/v1.3.1-writing-brief-2026-09-02.md
+WRITING_BRIEF_SOURCE_BINDING: PASS
+INDEPENDENT_RELEASE_REVIEW: CLEAN
+INDEPENDENT_RELEASE_REVIEW_SESSION: 01a0616f-da41-7cf2-a81d-c8c5febb8403
+DETERMINISTIC_TESTS_STATUS: PASS
+DETERMINISTIC_TESTS_TOTAL: 105
+SECRET_SCAN: PASS
+PUBLIC_SYNC: FETCH_ONLY
+AUTOMATED_PUBLIC_COMMIT_PUSH: BLOCKED
+MERGE: NOT_PERFORMED
+TAG: NOT_CREATED
+DISTRIBUTION: NOT_PUBLISHED
+ACCEPTANCE: PASS_LOCAL_PR_CANDIDATE
+```
+
+## What changed
+
+- `nobrainer-writing` now has an English-first `BRIEF` mode with the `nb-brief`
+  alias and focused Markdown-first templates for comments, bugs, issues, user
+  stories and requests.
+- Bug reports expose `Environment`, `URL`, `Steps to reproduce`, `Current
+  behavior`, `Expected behavior` and `Evidence` separately.
+- Evidence follows the affected surface: API request/response, database
+  read-only query/result, or UI screenshot/MP4. Missing required proof returns
+  `INPUT_REQUIRED`.
+- The public GitHub bug template follows the same diagnostic fields. The
+  canonical portfolio remains exactly fifteen skills.
+
+## Behavioral evidence
+
+The fresh holdout covers incomplete API evidence, a database failure with
+query/result evidence, a UI failure with screenshot evidence and a complete API
+request/response failure. The candidate must preserve supplied facts and
+uncertainty, keep the required field order, and refuse to draft when a required
+surface artifact is absent.
+The frozen prompt, normalized output and independent judge are linked from
+[`the evaluation record`](../evals/v1.3.1-writing-brief-2026-09-02.md).
+
+## Runtime boundary
+
+This candidate does not upgrade client-specific compatibility by inference.
+Merge, tag and distribution require their own owner-gated readback after the
+candidate review. `v1.3.0` remains the rollback source release until the new
+release is independently published and verified.

package/docs/releases/v1.4.0-publication-readback.md

@@ -0,0 +1,81 @@
+# v1.4.0 publication readback
+
+This retrospective record binds the published GitHub source release to its
+merge, tag, archive and isolated installation. It also records the coherence
+gap found after publication: the release shipped candidate wording in its
+README/release notes and its diagram did not yet show the quick path. The gap
+is the reason for the v1.5.0 coherence hardening.
+
+```text
+VERSION: 1.4.0
+STATUS: PUBLISHED_WITH_COHERENCE_GAP
+RELEASE_DATE: 2026-09-02
+SKILL_COUNT: 15
+PORTFOLIO: EXACT_FIFTEEN_CANONICAL_NOBRAINER_SKILLS
+WRITING_BRIEF_RESULT: PASS_STATIC_CONTRACT
+WRITING_BRIEF_HOLDOUT: NOT_RUN_FOR_V1.4_DELTA
+WRITING_BRIEF_EVALUATION: NOT_RE_EVALUATED
+INDEPENDENT_REVIEW: MAIN_MANUAL_CLEAN
+INDEPENDENT_REVIEW_SESSION: NOT_APPLICABLE
+DETERMINISTIC_TESTS_TOTAL: 107
+DETERMINISTIC_TESTS_STATUS: PASS
+SECRET_SCAN: PASS
+PUBLIC_SYNC: FETCH_ONLY
+AUTOMATED_PUBLIC_COMMIT_PUSH: BLOCKED
+MERGE_PR: 35
+MERGE: MERGED
+COMMIT_SHA: 215c0bb0d6dbfe9b45ecf3202ec198a2c219b3b2
+TREE_SHA: 7987bb164c18350579ad435798d20ff2b2d2d534
+TAG: v1.4.0
+TAG_OBJECT_SHA: 60d703e5ea373c457140c8337c1a430ba9dfea30
+TAG_COMMIT_SHA: 215c0bb0d6dbfe9b45ecf3202ec198a2c219b3b2
+TARGET_COMMITISH: main
+CI_PR_RUN: 33635566979
+CI_MAIN_RUN: 33635697993
+GITHUB_RELEASE_IMMUTABLE: false
+TAG_PROTECTION_STATUS: NOT_VERIFIED
+RELEASE_DRAFT: false
+RELEASE_PRERELEASE: false
+RELEASE_PUBLISHED_AT: 2026-09-02T13:26:48Z
+RELEASE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.4.0
+SOURCE_ARCHIVE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/archive/refs/tags/v1.4.0.tar.gz
+SOURCE_ARCHIVE_FILENAME: v1.4.0.tar.gz
+SOURCE_ARCHIVE_SHA256: c80b4544c2b66f9b41e711d634480d34651867113269b3abde5564e5315cdad9
+SOURCE_ARCHIVE_DOWNLOADED_AT: 2026-09-02T13:28Z
+SOURCE_ARCHIVE_TREE_MATCH: PASS
+SOURCE_ARCHIVE_FILE_COUNT: 243
+SOURCE_ARCHIVE_PYCACHE_COUNT: 0
+SOURCE_ARCHIVE_SKILL_COUNT: 15
+SOURCE_ARCHIVE_VALIDATOR: PASS
+SOURCE_ARCHIVE_SUITE_VALIDATOR: PASS
+SOURCE_ARCHIVE_TESTS: 107/107 PASS
+SOURCE_ARCHIVE_PYTHON_SYNTAX: PASS
+SOURCE_ARCHIVE_SHELL_SYNTAX: PASS
+SOURCE_ARCHIVE_SECRET_SCAN: PASS
+INSTALL_CLIENT: agents
+INSTALL_MODE: copy
+INSTALL_SKILL_COUNT: 15
+INSTALL_FILE_MATCH: PASS
+INSTALL_READBACK: PASS
+DISTRIBUTION: PUBLISHED
+COHERENCE_AUDIT: FAIL_POST_RELEASE
+COHERENCE_FINDING: candidate wording and stale diagram were found after publication
+COHERENCE_REMEDIATION: v1.5.0 adds a mandatory public-surface coherence gate
+ACCEPTANCE: PUBLISHED_WITH_GAP_RECORDED
+```
+
+PR #35 passed the Ubuntu and macOS portable-suite checks before merge. The
+annotated `v1.4.0` tag dereferences to merge commit
+`215c0bb0d6dbfe9b45ecf3202ec198a2c219b3b2` and tree
+`7987bb164c18350579ad435798d20ff2b2d2d534`. The post-merge main run also
+passed.
+
+The public source archive matched `git archive v1.4.0` file-by-file, contained
+exactly fifteen skills and no generated bytecode, passed the validator, 107/107
+tests, Python and shell syntax checks and the source Gitleaks scan. A copy
+installation into an isolated `agents` destination matched all fifteen source
+skill files. Source publication is verified; client-specific marketplace
+loading and runtime behavior remain separately evidence-scoped.
+
+Rollback is to the accepted `v1.3.1` release and its exact merge commit
+`d1e0ea761d4bf439973727668ee871e2b367797e`, or to revert PR #35.

package/docs/releases/v1.4.0.md

@@ -0,0 +1,43 @@
+# v1.4.0 candidate checkpoint
+
+This record binds the untagged candidate to the exact fifteen-skill portfolio,
+the compact Ultra quick path and the updated BRIEF diagnostic contract. It is
+not a publication record.
+
+```text
+VERSION: 1.4.0
+STATUS: RELEASE_CANDIDATE
+VERIFIED_DATE: 2026-09-02
+SKILL_COUNT: 15
+PORTFOLIO: EXACT_FIFTEEN_CANONICAL_NOBRAINER_SKILLS
+ULTRA_QUICK_PATH: PASS
+WRITING_ENV_INDICATOR: PASS
+WRITING_BUG_FIELDS: PASS
+WRITING_COMMENT_FIELDS: PASS
+WRITING_UI_EVIDENCE_LABEL: PASS
+DETERMINISTIC_TESTS_STATUS: PASS
+DETERMINISTIC_TESTS_TOTAL: 107
+SECRET_SCAN: PASS
+PUBLIC_SYNC: FETCH_ONLY
+AUTOMATED_PUBLIC_COMMIT_PUSH: BLOCKED
+MERGE: NOT_PERFORMED
+TAG: NOT_CREATED
+DISTRIBUTION: NOT_PUBLISHED
+ACCEPTANCE: PASS_LOCAL_PR_CANDIDATE
+```
+
+## What changed
+
+- `nobrainer-ultra` now names a quick path for one coherent, reversible small
+  change. It still requires local inspection, a nearest check, diff/status
+  readback and escalation when scope, risk, proof or an owner gate expands.
+- `nobrainer-writing` uses one environment block for bugs and comments with the
+  environment name, exact URL and user used. Bug reports require an explicit
+  `Description`, omit the separate `Impact` field and call UI screenshot or MP4
+  proof `Evidence`.
+- API request/response and database query/result proof remain separate and
+  copyable. The public bug template and regression tests follow the contract.
+
+The candidate keeps the existing fifteen-skill inventory and the previous
+`v1.3.1` release remains the rollback source until a fresh publication readback
+is complete.

package/docs/releases/v1.5.0-publication-readback.md

@@ -0,0 +1,76 @@
+# v1.5.0 publication readback
+
+This post-release record binds the published GitHub source release to the PR
+#36 merge, annotated tag, source archive and isolated copy installation. The
+tag remains bound to the reviewed merge commit. The current `main` documentation
+was aligned after tag creation through a separate post-release metadata PR; the
+tag archive intentionally retains the pre-publication candidate checkpoint so
+the distinction is auditable rather than silently rewritten.
+
+```text
+VERSION: 1.5.0
+STATUS: PUBLISHED_WITH_POST_RELEASE_METADATA_UPDATE
+RELEASE_DATE: 2026-09-02
+SKILL_COUNT: 15
+PORTFOLIO: EXACT_FIFTEEN_CANONICAL_NOBRAINER_SKILLS
+MODEL_POSITIONING: WORKFLOW_READY_ONLY
+MODEL_RUNTIME_PROOF: NOT_VERIFIED
+WRITING_BRIEF_RESULT: PASS_STATIC_CONTRACT
+WRITING_BRIEF_HOLDOUT: NOT_RUN_FOR_V1.5_DELTA
+WRITING_BRIEF_EVALUATION: NOT_RE_EVALUATED
+INDEPENDENT_REVIEW: MAIN_MANUAL_CLEAN
+INDEPENDENT_REVIEW_SESSION: NOT_APPLICABLE
+DETERMINISTIC_TESTS_TOTAL: 109
+DETERMINISTIC_TESTS_STATUS: PASS
+SECRET_SCAN: PASS
+PUBLIC_SYNC: FETCH_ONLY
+AUTOMATED_PUBLIC_COMMIT_PUSH: BLOCKED
+MERGE_PR: 36
+MERGE: MERGED
+COMMIT_SHA: 1bd73efc68a8bd4f6b616456f6c308cc9938dd57
+TREE_SHA: 29e09e68f813415666cae621e8cc021b2c517141
+TAG: v1.5.0
+TAG_OBJECT_SHA: 3811305655df03c823bda2c549a621beb0d079f1
+TAG_COMMIT_SHA: 1bd73efc68a8bd4f6b616456f6c308cc9938dd57
+TARGET_COMMITISH: main
+CI_PR_RUN: 33677122293
+CI_MAIN_RUN: 33677274121
+GITHUB_RELEASE_IMMUTABLE: NOT_VERIFIED
+TAG_PROTECTION_STATUS: NOT_VERIFIED
+RELEASE_DRAFT: false
+RELEASE_PRERELEASE: false
+RELEASE_PUBLISHED_AT: 2026-09-02T20:08:09Z
+RELEASE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.5.0
+SOURCE_ARCHIVE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/archive/refs/tags/v1.5.0.tar.gz
+SOURCE_ARCHIVE_FILENAME: v1.5.0.tar.gz
+SOURCE_ARCHIVE_SHA256: ab1242189184b1fbcf46a0b41c45fec9d3f3f662beea051a3a3fd945d520a7f1
+SOURCE_ARCHIVE_DOWNLOADED_AT: 2026-09-02T20:14:58Z
+SOURCE_ARCHIVE_TREE_MATCH: PASS
+SOURCE_ARCHIVE_FILE_COUNT: 247
+SOURCE_ARCHIVE_PYCACHE_COUNT: 0
+SOURCE_ARCHIVE_SKILL_COUNT: 15
+SOURCE_ARCHIVE_VALIDATOR: PASS
+SOURCE_ARCHIVE_SUITE_VALIDATOR: PASS
+SOURCE_ARCHIVE_TESTS: 109/109 PASS
+SOURCE_ARCHIVE_PYTHON_SYNTAX: PASS
+SOURCE_ARCHIVE_SHELL_SYNTAX: PASS
+SOURCE_ARCHIVE_SECRET_SCAN: PASS
+INSTALL_CLIENT: agents
+INSTALL_MODE: copy
+INSTALL_SKILL_COUNT: 15
+INSTALL_FILE_MATCH: PASS
+INSTALL_READBACK: PASS
+DISTRIBUTION: PUBLISHED
+CURRENT_MAIN_METADATA_READBACK: PASS
+ACCEPTANCE: PUBLISHED_WITH_POST_RELEASE_METADATA_UPDATE
+```
+
+The source archive matched `git archive v1.5.0` file-by-file, contained exactly
+fifteen skills and no generated bytecode, passed both validators, 109/109 tests,
+Python and shell syntax checks and the source Gitleaks scan. An isolated copy
+installation matched all fifteen source `SKILL.md` files. Direct Astra and
+Claude Fable 5.1 / Mythos 5.1 runtime support remains unverified; the model
+positioning is limited to a portable workflow contract.
+
+Rollback is to the accepted `v1.4.0` release and its exact merge commit
+`215c0bb0d6dbfe9b45ecf3202ec198a2c219b3b2`, or to revert PR #36.

package/docs/releases/v1.5.0.md

@@ -0,0 +1,54 @@
+# v1.5.0 candidate checkpoint
+
+This record binds the candidate to the exact fifteen-skill portfolio, the
+public-surface coherence gate and refreshed README/flow artifacts. It is not a
+publication record.
+
+```text
+VERSION: 1.5.0
+STATUS: RELEASE_CANDIDATE
+VERIFIED_DATE: 2026-09-02
+SKILL_COUNT: 15
+PORTFOLIO: EXACT_FIFTEEN_CANONICAL_NOBRAINER_SKILLS
+COHERENCE_GATE: PASS
+README_COHERENCE_READBACK: PASS
+MERMAID_FLOW_READBACK: PASS
+SVG_FLOW_READBACK: PASS
+V1.4_PUBLICATION_GAP_RECORDED: PASS
+DETERMINISTIC_TESTS_TOTAL: 109
+DETERMINISTIC_TESTS_STATUS: PASS
+PUBLIC_SYNC: FETCH_ONLY
+AUTOMATED_PUBLIC_COMMIT_PUSH: BLOCKED
+MERGE: NOT_PERFORMED
+TAG: NOT_CREATED
+DISTRIBUTION: NOT_PUBLISHED
+ACCEPTANCE: PASS_LOCAL_PR_CANDIDATE
+```
+
+## What changed
+
+- `nobrainer-ultra` now makes a public-surface decision part of every scope:
+  update affected README, docs, templates, assets and flow, or record
+  `PUBLIC_SURFACE: NOT_NEEDED` with a reason. Public contract, routing and
+  workflow changes use the full lifecycle and require fresh SVG and README
+  Mermaid readback.
+- `nobrainer-writing` now uses `ENV:` for bug/comment context, omits speculative
+  bug workaround/root-cause fields and keeps feature issues to the essential
+  Description, affected user, desired outcome and evidence fields.
+- The quick path is limited to edits with no public contract, routing, workflow
+  or portfolio impact; scope expansion escalates to the full lifecycle.
+- Root workflow instructions, the routing reference, `CONTRIBUTING.md` and the
+  pull-request template carry the same rule.
+- README's Mermaid flow and `assets/nobrainer-workflow.svg` show the quick path
+  and the public-surface coherence gate.
+- The v1.4.0 publication gap is recorded in
+  [`v1.4.0-publication-readback.md`](v1.4.0-publication-readback.md) instead of
+  being silently rewritten.
+
+The candidate keeps exactly fifteen skills. It also carries the portable
+`STANDARD`/`EXTENDED`/`ROUTED` model policy: model, effort, budget and escalation
+are explicit, and unsupported routing stays unverified rather than falling back
+silently. README and compatibility docs position the candidate as an Astra Ready
+Flow for current Codex and Claude Fable 5.1 / Mythos 5.1 workflows without
+claiming direct provider runtime support. No automated public commit, push,
+PR, merge, tag or publication is part of the repository's scheduled jobs.