toga-ai 1.0.733 → 1.0.734

package/knowledge/2.0/apps/toga-blox/workflows/dynamic-publish-pipeline.md

@@ -6,8 +6,8 @@ project: TOGa Blox
 client: shared
 type: workflow
 status: active
-updated: 2026-08-31
-owners: [jcardinal, apeterson]
+updated: 2026-09-02
+owners: [jcardinal, apeterson, tcox]
 files:
   - toga-blox/.github/workflows/publish.yml
   - toga-blox/package.json
@@ -86,12 +86,13 @@ environment needs its own maintained `_<mode>` branch in `toga-blox-npm`.
 ## Gotchas
 
 - **⚠ There is a STALE UNDERSCORED dist-tag on the registry — `_sandbox-client` (with the
-  underscore) is NOT the channel.** Verified 2026-08-31, the registry carries **both**
-  `_sandbox-client` = `1.0.316-sandbox-client.1` (vestigial, predates the current pipeline) **and**
-  `sandbox-client` = `1.1.1-sandbox-client.140` (the live channel head). Branch `_<mode>` maps to
+  underscore) is NOT the channel.** Re-verified 2026-09-02, the registry still carries **both**
+  `_sandbox-client` = `1.0.316-sandbox-client.1` (vestigial, predates the current pipeline; it has
+  **not** moved in over a month) **and** `sandbox-client` = `1.1.2-sandbox-client.142` (the live
+  channel head). Branch `_<mode>` maps to
   channel `<mode>` with the underscore **stripped** (same convention as `amplify.yml`), so the
   **branch** `_sandbox-client` tracks the **tag** `sandbox-client`. Asking npm for "the latest
-  `_sandbox-client` tag" literally installs something **139 publishes behind**. Always resolve the
+  `_sandbox-client` tag" literally installs something **141 publishes behind**. Always resolve the
   head with `npm view @agilant/toga-blox dist-tags` and install the underscore-less name.
 - **Publish before build.** `npm install @agilant/toga-blox@<mode>` fails `ETARGET No matching
   version` in the app build until this repo has published that channel. GitHub Actions runs the
@@ -131,8 +132,19 @@ environment needs its own maintained `_<mode>` branch in `toga-blox-npm`.
   was then made **on `_sandbox-client`**, at the developer's explicit direction. That **deviates
   from the `deploy-sandbox-client` skill's "never commit the bump directly to `_sandbox-client`"
   rule.** It was safe *only* because the feature branch does not carry the version line, so nothing
-  could be clobbered — **record this as a one-off, not a new default.** CI then published base+1 →
-  `1.0.334-sandbox-client.136`.
+  could be clobbered. CI then published base+1 → `1.0.334-sandbox-client.136`.
+- **Bumping the base directly on `_sandbox-client` is the ACTUAL practice — it is safe under three
+  preconditions, and it is no longer a one-off.** Second occurrence 2026-09-02 (`1.1.0` → `1.1.1`,
+  commit `543a7186`, published `1.1.2-sandbox-client.142`), same shape as 2026-08-26. Stop treating
+  the skill's "never bump on `_sandbox-client`" line as absolute; treat it as conditional. The bump
+  on the release branch is fine when **all three** hold:
+  1. The working tree is **clean**.
+  2. The branch is **in sync with `origin`** (nothing unpushed, nothing to pull).
+  3. No feature branch pending merge **touches the `version` line** — which is normally true,
+     because feature branches never edit it (see the gotcha above).
+  If any one fails, bump on the feature branch instead. Note the bump commit lands *only* on
+  `_sandbox-client` and is never merged back, which is precisely what generates the "N behind"
+  release plumbing described two gotchas up.
 - **`gh` is not installed on every dev machine.** The skill's `gh run watch` monitoring step simply
   does not work there. Fall back to polling the registry:
   `npm view @agilant/toga-blox@sandbox-client version` (or `npm dist-tag ls @agilant/toga-blox`)
@@ -200,6 +212,17 @@ environment needs its own maintained `_<mode>` branch in `toga-blox-npm`.
   you push to a release branch.
 
 ## Change history
+- 2026-09-02 — Released `1.1.2-sandbox-client.142` (base `1.1.0` → `1.1.1` on `_sandbox-client`,
+  commit `543a7186`) and rolled it into `toga25-supply` (pin `1.1.1-sandbox-client.140` →
+  `1.1.2-sandbox-client.142`, clean `npm install`, `tsc --noEmit` zero errors). The documented
+  workflow was accurate end-to-end — no new gotchas. **Promoted the on-branch version bump from a
+  "one-off deviation" to the actual practice with three stated preconditions** (clean tree, in sync
+  with origin, no pending merge touching the `version` line); this was its second occurrence under
+  identical conditions. Refreshed the live `sandbox-client` head in the stale-dist-tag gotcha
+  (`.140` → `.142`); the vestigial `_sandbox-client` tag is unmoved at `1.0.316-sandbox-client.1`.
+  Confirmed the registry-polling fallback (`npm view @agilant/toga-blox@sandbox-client version`)
+  is the working verification path where `gh` is absent, and that publish lands ~2 min after the
+  push. (tcox)
 - 2026-08-31 — Recorded the **stale underscored dist-tag trap**: the registry carries both
   `_sandbox-client` (`1.0.316-sandbox-client.1`, vestigial) and `sandbox-client`
   (`1.1.1-sandbox-client.140`, live head). Installing the underscored name silently pins 139

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.733",
+  "version": "1.0.734",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",