super-ux 0.52.2 → 0.52.4

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## 0.52.4 — the registry card stopped being four releases stale
+
+`SKILL-CARD.md` carries the fields Anthropic's Skills-for-enterprise guidance asks every
+organisation to keep — *"written so somebody who did not build this can decide"*. It said
+`0.48.3` while this package shipped `0.52.3`.
+
+**Nothing read it, so it could only drift.** The version moves in `package.json`,
+`plugin.json` and `marketplace.json` on every release; the card was in no list. Measured
+2026-09-01 across the family: **four of nine cards were behind** — this one by four minor
+releases, `agent-stack` by ten.
+
+The check refuses a card whose `Version` row disagrees with `package.json`, and refuses a
+card that states no version at all: one a reader cannot see go stale is worse than one
+that lags visibly. Watched failing before it shipped. `repo validator checks`
+4617 → **4619**, recomputed by the command the fact itself cites rather than by hand.
+
+**And the same defect as the sibling, in the same kind of place.** `test/validate.py`
+carried an invalid escape sequence — a lone backslash-pipe in a non-raw docstring — which
+Python already warns about and future versions will reject. It sat in a paragraph
+explaining that *"the escape-awareness is the whole check"*. Now raw, zero escape
+warnings — as `agent-stack`'s was an hour earlier, from a paragraph explaining how to
+escape a pipe.
+
+## 0.52.3 — the front matter gets read by a parser, not by a regex
+
+- **`validate_front_matter_is_yaml` parses all 30 shipped front-matter blocks with PyYAML**
+  (`B-033`): 7 `SKILL.md`, 15 commands, 8 `.mdc` mirrors. `front_matter()` reads a block line
+  by line and never asks what a YAML parser would, so a `: ` inside an unquoted scalar turns
+  the whole block into an invalid mapping and ships anyway — green here, refused by every
+  installer that parses YAML, and the hub copy freezes on the previous version. The family
+  shipped exactly that twice in twelve days (`sheleg-design` 1.37.4 and 1.58.0, both
+  `mapping values are not allowed here`), so the remedy is **ported from the sibling that
+  paid for it** rather than reinvented.
+- **The two guards are the ones that history says matter.** It fails **closed** when PyYAML
+  is missing, because a guard that discloses and passes when its tool is absent is the hole
+  the first fix left open; and it refuses an **empty walk**, because globs that all match
+  nothing is a moved directory rather than a clean tree. Both watched: `yaml` blocked at
+  import, and the three globs renamed.
+- **`YAML_SELF_TEST` is a permanent plant, not a one-off.** This gate's whole claim is that
+  it sees what `front_matter()` cannot; a parser that stopped refusing that shape would leave
+  it green on a clean tree forever, so the shape is re-checked on every run.
+- PyYAML installed in both workflows: `setup-python` puts a different interpreter on PATH
+  than the runner's system one, which is where PyYAML is preinstalled.
+
 ## 0.52.2 — the evals stop being a promise, and 0.52.1's stowaways get their record
 
 - **The eval suite has dated rows instead of a vacant table** (SUX-04, family audit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-ux",
-  "version": "0.52.2",
+  "version": "0.52.4",
   "scripts": {
     "test": "python3 test/validate.py && python3 test/brand_lint_test.py && python3 test/ux_lint_test.py && python3 docs/ux/lint.py && python3 docs/brand/lint.py && node test/installer_test.js"
   },