abstractskill 0.3.3__tar.gz → 0.3.4__tar.gz

{abstractskill-0.3.3/src/abstractskill.egg-info → abstractskill-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: abstractskill
-Version: 0.3.3
+Version: 0.3.4
 Summary: Agent Skills (SKILL.md) parsing, discovery, trust gating, and demand derivation for AbstractFramework
 Author-email: Laurent-Philippe Albou <contact@abstractcore.ai>
 License-Expression: MIT
@@ -61,12 +61,16 @@ pip install abstractskill
 
 The wheel carries the library and the curated skill registry (the shelf below).
 
+What's new in 0.3.4: the `abstractframework-website` skill joins the shelf and
+`abstract-release` covers AbstractAvatar and the AbstractAssistant lanes; see
+the [changelog](CHANGELOG.md#034---2026-11-02).
+
 ## The bundled skill registry
 
 `pip install abstractskill` installs the reviewed shelf as package data:
 
 ```
-abstractskill/registry/skills/            # 15 curated skills (one folder per SKILL.md)
+abstractskill/registry/skills/            # 16 curated skills (one folder per SKILL.md)
 abstractskill/registry/licenses/          # upstream licenses of catalog-vendored skills
 abstractskill/registry/validations.yaml   # trust records: byte pins per skill tree
 abstractskill/registry/advisories.yaml    # do-not-use advisories (empty at v1, by design)

{abstractskill-0.3.3 → abstractskill-0.3.4}/README.md

@@ -28,12 +28,16 @@ pip install abstractskill
 
 The wheel carries the library and the curated skill registry (the shelf below).
 
+What's new in 0.3.4: the `abstractframework-website` skill joins the shelf and
+`abstract-release` covers AbstractAvatar and the AbstractAssistant lanes; see
+the [changelog](CHANGELOG.md#034---2026-11-02).
+
 ## The bundled skill registry
 
 `pip install abstractskill` installs the reviewed shelf as package data:
 
 ```
-abstractskill/registry/skills/            # 15 curated skills (one folder per SKILL.md)
+abstractskill/registry/skills/            # 16 curated skills (one folder per SKILL.md)
 abstractskill/registry/licenses/          # upstream licenses of catalog-vendored skills
 abstractskill/registry/validations.yaml   # trust records: byte pins per skill tree
 abstractskill/registry/advisories.yaml    # do-not-use advisories (empty at v1, by design)

{abstractskill-0.3.3 → abstractskill-0.3.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "abstractskill"
-version = "0.3.3"
+version = "0.3.4"
 description = "Agent Skills (SKILL.md) parsing, discovery, trust gating, and demand derivation for AbstractFramework"
 readme = "README.md"
 requires-python = ">=3.10"

{abstractskill-0.3.3 → abstractskill-0.3.4}/src/abstractskill/__init__.py

@@ -140,4 +140,4 @@ __all__ = [
     "validate_skill_name",
 ]
 
-__version__ = "0.3.3"
+__version__ = "0.3.4"

{abstractskill-0.3.3 → abstractskill-0.3.4}/src/abstractskill/registry/catalog.yaml

@@ -16,7 +16,7 @@
 # four yaml files shipped in the abstractskill wheel). Bump it whenever any
 # of that content changes; seed_registry() records it in <dest>/.seeded.json
 # and tests/test_bundled.py pins it to a content digest.
-version: "2026.10.27"
+version: "2026.11.02"
 
 skills:
 

{abstractskill-0.3.3 → abstractskill-0.3.4}/src/abstractskill/registry/skills/abstract-release/SKILL.md

@@ -5,8 +5,8 @@ description: Plan and run an AbstractFramework release wave across its packages
 
 # Abstract Release
 
-AbstractFramework is 34 packages in 22 repositories on 2026-10-27 (Python on PyPI, npm packages
-and apps, Rust crates on crates.io; `./scripts/deps.sh` in the workspace lists them). A release
+AbstractFramework contains Python packages on PyPI, npm packages and apps, and Rust crates on
+crates.io; `./scripts/deps.sh` lists the current workspace inventory. A release
 wave publishes the changed ones from the bottom of the dependency graph upward, so every package
 a parent depends on is already published, green, and visible on its registry before the parent
 raises its floor and publishes.
@@ -16,6 +16,38 @@ tag, publish), `coredoc` (README, docs, llms files, version source), `backlog` (
 its evidence) and `adr` (durable rules). This skill adds what only shows up across packages: the
 order, the gates between packages, floor propagation, and the root profile.
 
+## Read-only readiness audits
+
+When asked whether to release, produce evidence and a recommendation without executing a release.
+The checkout synchronization, checkpoint commits, branch integration and final build rules below
+apply when release execution is authorized; an audit does not authorize pulling, merging, staging
+operator edits, dispatching workflows, rerunning CI, or publishing. Read remote refs and CI through
+read-only GitHub APIs when needed and label cached tracking refs explicitly.
+
+Read `references/readiness-audit.md` for the audit evidence contract, registry-only build checks,
+missing-package discovery and the distinction between a release blocker and later roadmap work.
+
+## Non-negotiable rules (operator, 2026-10-28; release execution)
+
+1. **A release ships EVERY pending change of the work in scope.** Before cutting any package: every
+   pending change ON `main` (local unpushed commits, uncommitted edits: an operator's edit is committed
+   as `checkpoint` after a secret scan, never left aside) and every branch THE AGENTS CREATED to complete
+   a task is merged into an up-to-date `main`, tested and released. NOT every branch: the operator's own
+   branches (e.g. a private memory-block branch in AbstractCore) are theirs, are never merged, pushed or
+   touched unless the operator says so; when in doubt about a branch's owner, ask. "Held because the operator has edits" or "held because local main has
+   unpushed commits" is forbidden: fix the build, merge with origin, release. The only reasons to stop
+   are secrets in the tree or a failing test that cannot be fixed without a decision: then ask, with
+   the exact file and failure, and keep every other package moving.
+2. **Always pull before starting any work**, in every repository, every time: `git -C <repo> fetch
+   origin && git -C <repo> pull --ff-only origin main` before cutting a branch or a worktree; cut
+   worktrees from `origin/main`. Pull the local `main` again right after every merge on GitHub.
+3. **A release means every pending change has been merged into an up-to-date `main`.** The wave ends
+   only when `./scripts/status.sh` shows every repository on `main`, clean, 0 ahead, 0 behind, and
+   `./scripts/build.sh` passes from those checkouts. A checkout left on a feature branch, a merged PR
+   not pulled, or a repo "N ahead" is a release defect, reported as such, not as a note.
+4. A worker that cannot run `git merge` or `git rebase` or `git switch` asks the coordinator to do it
+   immediately; it never leaves the branch unmerged and moves on.
+
 ## Before you start
 
 - Default to a read-only plan. Commits, pushes, tags, workflow dispatches, publishes, CI reruns and
@@ -31,6 +63,8 @@ python3 "$SKILL_DIR/scripts/abstract_release_plan.py" "$AF_ROOT" --registry
 python3 "$SKILL_DIR/scripts/abstract_release_plan.py" "$AF_ROOT" --registry --json -o "$AF_ROOT/untracked/release-plan.json"
 ```
 
+  Two packages may share a registry name across registries (AbstractAvatar's crate and Python
+  package): the planner keys the crate as `<name>-crate`; a crate dependent's edge resolves to it.
   Without a path, the planner finds the workspace by walking up from the current directory
   (or reads `ABSTRACTFRAMEWORK_ROOT`). A package is in the wave when it has uncommitted changes,
   commits since its last release tag, a version with no tag, or (with `--registry`) a version not
@@ -47,8 +81,11 @@ python3 "$SKILL_DIR/scripts/abstract_release_plan.py" "$AF_ROOT" --registry --js
 Release by published dependency floors, not by what happens to pass locally:
 
 1. Independent lower packages: `abstractvoice`, `abstractvision`, `abstractmusic` (and the other
-   tier-0 media plugins), `abstractskill`, and the AbstractUIC npm packages (`ui-kit`,
-   `app-server`, `monitor-*`, `panel-chat`).
+   tier-0 media plugins), `abstractskill`, `abstractavatar` (one repository, TWO packages: the
+   crate `abstractavatar` on crates.io and the Python package `abstractavatar` on PyPI; the crate
+   first: `abstracttui`'s `avatar` feature depends on it, and `abstractcore-console`,
+   `abstractgateway-console` and `abstractcode` depend on `abstracttui` with that feature), and
+   the AbstractUIC npm packages (`ui-kit`, `app-server`, `monitor-*`, `panel-chat`).
 2. `abstractsemantics` and `abstractmemory` (AbstractMemory owns the memory graph).
 3. `abstractcore`.
 4. `abstractruntime`.
@@ -56,8 +93,20 @@ Release by published dependency floors, not by what happens to pass locally:
 6. `abstractgateway`.
 7. Apps on the gateway: `abstractassistant`, `abstractcode`, `abstractobserver`, `abstractentity`,
    `abstractflow`, `abstractcontinuum`, `abstractnote` (Python on the gateway and AbstractMemory,
-   plus its web app).
-8. Root `abstractframework`: pins, `RELEASE_VERSIONS`, install manifest, installers, install docs.
+   plus its web app). AbstractAssistant is one repository with FOUR lanes: the Python package
+   (PyPI, the desktop palette and the gateway seam), the web app (`web/`, `@abstractframework/assistant`,
+   served by the gateway; not on npm yet), the iPhone app (`phone/iphone`, App Store / TestFlight
+   through `scripts/release.py` and `scripts/upload-candidate.sh`, `iphone.yml`) and the watch app
+   (`watch/apple`, `watch.yml`, `scripts/testflight.sh`). The registry wave releases the Python
+   package; the Apple lanes release through App Store Connect with the operator's approval
+   (`app-store` environment) and are reported as their own rows, never folded into the PyPI row.
+8. Root `abstractframework`: pins, `RELEASE_VERSIONS`, `NPM_RELEASE_VERSIONS`,
+   `CRATE_RELEASE_VERSIONS` (includes `abstractavatar` and `abstracttui`), install manifest,
+   installers, install docs.
+9. The website, last and gated: once the root profile is on PyPI, run the `abstractframework-website`
+   skill — it updates the site branch locally (versions, install commands, new apps and
+   capabilities, refreshed screenshots and llms mirrors), serves it locally and hands the operator
+   the preview URL. The operator validates and pushes `gh-pages`; a wave never pushes the site.
 
 The planner refines this from the real manifests: it skips packages with nothing to release and
 adds every package downstream of a changed package for a floor review. `scripts/lib/packages.txt`
@@ -207,3 +256,91 @@ to release):
 - `references/package-inventory.md`: the tiers, and per package its version source, release
   trigger, registry environment, llms generator, and package-specific rules.
 - `references/package-discovery.md`: how the planner discovers packages and reads its output.
+
+## Keep every checkout in step with GitHub (repo sync rule)
+
+Observed 2026-10-27: several local `main` checkouts were dozens of commits behind their remotes
+(abstractuic 86, the root 10) because PRs were merged on GitHub while nobody pulled the local
+checkout, and new branches were then cut from the stale main. Rules, every time:
+
+1. Before cutting a branch or a worktree: `git -C <repo> fetch origin && git -C <repo> pull --ff-only origin main`
+   on the main checkout (a dirty checkout is left alone and reported; never stash someone else's work).
+2. After merging a PR on GitHub: pull the local main checkout immediately (the merge watcher does it).
+3. Worktrees are cut from `origin/main`, never from the local `main` ref.
+4. A sweep before any release wave: for each repo, `rev-list --count main..origin/main` must be 0;
+   `scripts/status.sh` at the root prints ahead/behind per repo.
+5. A root `main` that diverged (local release commits made elsewhere) is merged, never rebased: the
+   operator's commits keep their hashes; origin's pins and version win in conflicts, local docs and backlog
+   additions are kept, duplicated release sections are dropped.
+
+## Final gate: the local source build of the whole stack
+
+After the root pins are released, run the operator's own developer path before the final report:
+`./scripts/status.sh` (every repo on `main`, 0 behind, no checkout left on a feature branch by a worker)
+and `./scripts/build.sh` (editable Python installs, every npm package built from local packs, every Rust
+crate compiled tier by tier). A failure there is a release defect even when every registry install passes:
+a crate that does not compile from a clean checkout, a pin that does not resolve locally, a checkout left
+behind. Operator-modified files are reported, never built around: say which file fails and whose edit it is.
+
+## Final report: the summary table, then "show me your work"
+
+The per-package summary table (package | released | new capabilities | remaining work) is the right
+visibility level and stays. It is NOT the report. For every track of the wave add a "show me your work"
+section with exactly three parts, written for the operator who was not watching:
+
+- **(a) What was tested:** the suites and counts per package, the end-to-end runs on real weights or a
+  real gateway (what scenario, which model, which data), the mutation checks (which rule was removed and
+  which test went red), the adversarial review rounds and verdicts, the conformance fixtures (how many,
+  real vs synthetic).
+- **(b) What it enables or fixes:** in the operator's words: the user-visible behaviour before and after,
+  and which apps/clients actually consume it today versus which still have to migrate (name each client
+  and its state: migrated / designed-for / untouched). Never present a served capability as integrated
+  when no client reads it.
+- **(c) Proofs:** numbers a human can read: latency and memory before/after, sizes, counts, run ids,
+  PR links, registry versions, and one concrete example (a ledger, a run, a voice) walked end to end.
+
+A track whose clients are not migrated is reported as "foundation released, integration pending" with the
+migration list and an ETA, never folded into "done".
+
+## Think like an architect before closing anything (operator, 2026-10-28)
+
+Before a package is held, a track is called done, or a wave is closed, the coordinator (or its adversarial
+reviewer) answers these questions in writing:
+
+- What happens if I do not release all the pending changes I have been working on? What breaks for the
+  person who installs or builds from source tomorrow?
+- What happens if I do not release this package just yet? Which consumer is left on a stale floor?
+- Did I fully implement AND reuse the functionality I just created in the consumers of that code?
+  (A shared component in abstractuic or a gateway contract exists only when the apps consume it:
+  AbstractCode, AbstractAssistant, AbstractObserver, AbstractContinuum, AbstractFlow, AbstractNote,
+  the consoles.) List each consumer with migrated / pending.
+- Is the result production-grade for a person, not only green for CI?
+
+The goal is always a finished, production-grade solution that benefits from the change; the secondary goal
+is the supervisor's visibility: a roadmap while work is ongoing, and at the end a report that shows the
+work (what is new or fixed, what it enables now or later, why it is good). Keep it a dialogue: ask early
+when a decision is genuinely the operator's, decide and say so when it is not.
+
+## Backlog discipline for work left pending
+
+When a task cannot be carried on now (time, credits, a blocker, a decision), write the backlog item
+immediately, while the understanding is fresh: `proposed` when the need is likely, `planned` when it is
+certain; it carries the analysis, the chosen route, the evidence so far and the open decision.
+When an item is picked up later, start with an adversarial review of the item itself: is its knowledge
+still current, is it still the best route (new research, superseded component, changed contract)?
+
+## Changelog fragments (gateway, core, runtime; since 2026-10-29)
+
+These repos no longer edit `CHANGELOG.md [Unreleased]` per PR. Each PR adds `changelog.d/<pr-or-slug>.md`; CI fails a PR that touches source without a fragment. At release time, before the version bump commit:
+
+```
+python scripts/changelog.py check            # every fragment well-formed
+python scripts/changelog.py preview          # what the section will say
+python scripts/changelog.py assemble X.Y.Z   # writes the [X.Y.Z] section, deletes the fragments
+```
+
+Commit the assembled section with the version bump. Never hand-edit `[Unreleased]` in these repos.
+
+## A conflicting PR gets no CI run
+
+GitHub creates `pull_request` runs from the merge ref; a PR whose `mergeStateStatus` is DIRTY has none, so pushes to it create no run and no error. Before pushing a fix: merge `origin/main` into the branch, then `gh pr view N --json mergeStateStatus` must say CLEAN/BLOCKED, never DIRTY.

{abstractskill-0.3.3 → abstractskill-0.3.4}/src/abstractskill/registry/skills/abstract-release/references/package-inventory.md

@@ -4,7 +4,7 @@ What exists, in which order it releases, and how each package releases. The work
 `scripts/lib/packages.txt` is the machine-readable inventory (`./scripts/deps.sh` prints the tiers,
 `./scripts/deps.sh check` verifies them against the real manifests, `./scripts/deps.sh rdeps <id>`
 lists what must follow a bump). This page adds the release mechanics. Facts were read from the
-repositories and their GitHub settings on 2026-10-27; re-check a row before relying on it for an
+repositories and their GitHub settings on 2026-10-27 (AbstractAvatar and AbstractAssistant lanes: 2026-11-02); re-check a row before relying on it for an
 irreversible step.
 
 ## Tiers
@@ -14,8 +14,8 @@ depends on is published and visible.
 
 | Tier | Python (PyPI) | npm | Rust (crates.io) |
 |---|---|---|---|
-| 0 | abstractskill, abstractsemantics, AbstractMemory, abstractvision, abstractvoice, abstractmusic, abstractcamera | ui-kit, app-server, monitor-flow, monitor-gpu, monitor-memory, monitor-active-memory | abstracttui |
-| 1 | abstract3d (needs abstractvision) | panel-chat (peer of ui-kit) | abstracttui-graph, abstractcore-console, abstractcode (CLI) |
+| 0 | abstractskill, abstractsemantics, AbstractMemory, abstractvision, abstractvoice, abstractmusic, abstractcamera, abstractavatar (Python) | ui-kit, app-server, monitor-flow, monitor-gpu, monitor-memory, monitor-active-memory | abstractavatar (crate) |
+| 1 | abstract3d (needs abstractvision) | panel-chat (peer of ui-kit) | abstracttui (its `avatar` feature needs the abstractavatar crate), abstracttui-graph, abstractcore-console, abstractcode (CLI) |
 | 2 | abstractcore (needs voice, vision, music, 3d) | flow, observer, continuum, entity, code (web), note (web) | abstracttui-mermaid, abstractgateway-console |
 | 3 | AbstractRuntime (needs core, memory, semantics) | | |
 | 4 | abstractagent, abstractassistant | | |
@@ -35,6 +35,13 @@ Roles worth knowing when you order a wave:
   its `gateway` extra) plus a web app (`@abstractframework/note`). The gateway imports
   `abstractnote` lazily as an optional seam, so it is not a gateway dependency; AbstractNote
   releases after the gateway it needs.
+- **AbstractAvatar** is one repository with two packages that must stay at one version: the
+  crate (procedural avatars, the Wasm artifact) and the Python package over it. The crate releases
+  first (AbstractTUI's `avatar` feature, hence every console crate, resolves it from crates.io);
+  the Python package follows through its `release.yml`.
+- **AbstractAssistant** is one repository with four lanes: the Python package (PyPI), the web app
+  (`web/`, served by the gateway), the iPhone app and the watch app (App Store Connect through the
+  `app-store` environment, operator approval). Only the Python package is a registry release.
 - **abstractframework** (root) pins exact versions of the released matrix and releases last.
 
 Not released with the framework: the local test projects `abstractaudio`, `abstractsound`,
@@ -67,6 +74,7 @@ release needs a tag rule there.
 | Package | Repo | Version source | Trigger | `pypi` env policy | llms generator | Notes |
 |---|---|---|---|---|---|---|
 | abstractvoice | lpalbou/AbstractVoice | `abstractvoice/_version.py` (single source; pyproject reads it) | tag | main, tag `v*.*.*` | none (edit by hand) | PR CI: tests 3.9-3.12, Qwen3-TTS/ASR transformers floor and latest, build, docs (10 checks). release.yml publishes to PyPI with trusted publishing, creates the GitHub release, deploys docs. |
+| abstractavatar (Python) | lpalbou/AbstractAvatar | `pyproject.toml` (= `Cargo.toml` version) | tag `v*` or dispatch `-f version=X.Y.Z -f publish_confirmation=…` (read `release.yml`: created 2026-11-02) | `pypi` env, trusted publisher registered by the operator 2026-11-02 (project `abstractavatar`, workflow `release.yml`, environment `pypi`) | `scripts/docs.py` | Builds the native wheel matrix + sdist; the crate is NOT published by this workflow. |
 | abstractvision | lpalbou/AbstractVision | `src/abstractvision/__init__.py` | tag | no restriction | `scripts/generate_llms_full.py` | |
 | abstractmusic | lpalbou/AbstractMusic | `src/abstractmusic/_version.py` | tag or dispatch (`-f publish=true -f publish_confirmation=publish-abstractmusic-X.Y.Z`) | main, tag `v*.*.*` | none | |
 | abstractcamera | lpalbou/AbstractCamera | `src/abstractcamera/__init__.py` | tag | main, tag `v*` | `scripts/generate_llms_full.py` | Ships a package agent skill (`skills/camera-piloting/`). |
@@ -98,6 +106,7 @@ release needs a tag rule there.
 
 | Crate | Repo / path | Trigger | `crates-io` env policy |
 |---|---|---|---|
+| abstractavatar | lpalbou/AbstractAvatar, `.` | local `cargo publish` from the tagged commit (no crates.io workflow; `~/.cargo/credentials.toml` on the operator's machine); tag `v*` | none | First published 0.1.0 on 2026-11-02; the `avatar` feature of abstracttui resolves it from crates.io, never from a path. |
 | abstracttui | lpalbou/AbstractTUI | tag `v*`, or dispatch `-f publish=true` (without it the run only verifies) | no restriction |
 | abstracttui-graph, abstracttui-mermaid | lpalbou/AbstractTUI, `extensions/graph`, `extensions/mermaid` | with abstracttui: the `publish-family` job publishes graph, then mermaid (mermaid depends on graph) | no restriction |
 | abstractcore-console | lpalbou/AbstractCore, `console-tui/` | with AbstractCore | no restriction |

abstractskill-0.3.4/src/abstractskill/registry/skills/abstract-release/references/readiness-audit.md

@@ -0,0 +1,54 @@
+# Release readiness audit
+
+An audit answers what is published, what changed, what must ship together, and what evidence is
+still missing. It does not execute the wave. Preserve existing operator rules when refreshing
+this skill from AbstractSkill: compare all files first, because the registry copy may be older
+than the installed skill.
+
+## Evidence to collect
+
+- Record the observation time, local HEAD, branch and dirty state for every inventoried repo.
+  Query live remote-main SHAs when available; cached `origin/main` alone cannot prove current
+  ahead/behind. Do not pull or merge during the audit.
+- Run the planner with registry checks. Compare published versions, matching release tags and
+  the source changes beyond those tags. A published local version with newer source requires a
+  fresh version; publication of the old version is not proof that HEAD shipped.
+- Review open release-scope agent PRs as well as main. A clean checkout can still omit delivered
+  work on a branch. Protect operator branches and do not infer ownership from branch names alone.
+- Check CI for the proposed commit, not merely the latest successful run. Keep failed jobs,
+  pending checks, environment failures and missing checks distinct. Inspect failed-job evidence
+  before classifying a failure or recommending a rerun.
+- Check root pins, installer matrix and per-package dependency floors. Internal consistency of
+  the old root matrix does not show that it delivers the new capabilities.
+- Reconcile backlog claims against code, completed records, registry data and CI. Count lifecycle
+  files separately from unique tickets; planned/completed duplicates and old overview text are
+  not reliable estimates of remaining work.
+
+## Check the artifacts users install
+
+Local packs, editable siblings and path dependencies can hide missing published APIs. For a
+consumer using new shared UI exports, perform a clean source build in a temporary directory with
+dependencies resolved from the registry. A version-only lockfile check can pass while the build
+fails because a locally packed dependency reused an already-published version number.
+
+Inspect planner `inventory_gaps` even when `deps.sh check` succeeds. A newly added public crate
+can be absent from the inventory and release workflow. Cargo `path` plus `version` dependencies
+must resolve from crates.io when packaged: release and verify the new lower crate before the
+dependent package's `cargo publish --dry-run` verification job. Check its trusted publisher and
+the workflow graph; adding a late publish job after verification does not solve this dependency.
+
+Run applicable changelog fragment validation as a read-only check. Do not assemble fragments or
+bump versions during an audit. A malformed fragment can block release preparation even when a
+previous remote commit passed CI.
+
+## Verdict and sequencing
+
+Separate observed defects, missing required proof and later product work. A partial consumer
+migration is a foundation delivered with integration pending, not a complete feature. Security
+guards, registry-resolvable dependencies, required concurrency/isolation evidence and exact-commit
+CI are release gates when applicable; unrelated proposals do not all become blockers.
+
+Return a per-package release/skip/floor-review decision, proposed fresh versions (subject to a
+new registry check), dependency order, and exit criteria. Give effort ranges as estimates with
+assumptions, never promise a date without evidence. Preserve recorded release-scope obligations;
+do not silently defer already-delivered main changes to manufacture a smaller green wave.

{abstractskill-0.3.3 → abstractskill-0.3.4}/src/abstractskill/registry/skills/abstract-release/scripts/abstract_release_plan.py

@@ -608,7 +608,12 @@ def collect_requirements(
         for group, raw in raw_groups:
             req = parse_requirement(raw, group, known)
             # A crate only depends on crates; a Python/npm name that compacts to a
-            # crate name (or the reverse) is a different package.
+            # crate name (or the reverse) is a different package. A name shared by a
+            # crate and a Python package resolves to the crate for a crate dependent.
+            if req and pkg.ecosystem == "crates" and by_key_ecosystem(packages, req.target) != "crates":
+                alt = known.get(req.target + "-crate")
+                if alt is not None:
+                    req.target = alt
             if req and (pkg.ecosystem == "crates") != (by_key_ecosystem(packages, req.target) == "crates"):
                 continue
             add_internal_requirement(pkg, req)
@@ -623,6 +628,8 @@ def collect_requirements(
         by_key = {p.key: p for p in packages}
         for var in ("NPM_RELEASE_VERSIONS", "CRATE_RELEASE_VERSIONS"):
             for key, version in parse_version_dict(init_path, var).items():
+                if var == "CRATE_RELEASE_VERSIONS" and key + "-crate" in by_key:
+                    key = key + "-crate"
                 if key in by_key:
                     add_internal_requirement(
                         framework, InternalRequirement(key, f"{by_key[key].name}=={version}", var, "==", version)
@@ -778,6 +785,18 @@ def discover(root: Path) -> Tuple[List[Package], List[Dict[str, Any]], str]:
     keys: Dict[str, Package] = {}
     for pkg in packages:
         if pkg.key in keys:
+            # One repository can publish a crate AND a Python package under the same
+            # name (AbstractAvatar: crates.io `abstractavatar` + PyPI `abstractavatar`).
+            # They are different packages on different registries: the crate keys as
+            # `<name>-crate` so requirements and pins can tell them apart.
+            other = keys[pkg.key]
+            crate = pkg if pkg.ecosystem == "crates" else other if other.ecosystem == "crates" else None
+            if crate is not None and {pkg.ecosystem, other.ecosystem} != {"crates"}:
+                keys.pop(crate.key, None)
+                crate.key = crate.key + "-crate"
+                for remaining in (pkg, other):
+                    keys.setdefault(remaining.key, remaining)
+                continue
             raise PlanError(f"duplicate package {pkg.name}: {keys[pkg.key].path} and {pkg.path}")
         keys[pkg.key] = pkg
     collect_git_status(packages)

abstractskill-0.3.4/src/abstractskill/registry/skills/abstractframework-website/SKILL.md

@@ -0,0 +1,110 @@
+---
+name: abstractframework-website
+description: Update the abstractframework.ai website after a release wave so it describes the framework that is actually published (versions, install commands, every app and capability, refreshed screenshots and llms mirrors), verify every claim against code and registries, serve the result locally and hand the operator a preview URL. The site is GATED - this skill never pushes gh-pages; the operator validates the preview and publishes. Use at the end of every abstract-release wave, when the operator asks whether the site is current, or when a page describes a package that moved.
+---
+
+# AbstractFramework website update (gated)
+
+The site at https://abstractframework.ai is the `gh-pages` branch of lpalbou/AbstractFramework:
+static HTML (`index.html`, one page per package and per persona, `llms*.txt` mirrors, screenshots
+under `assets/`). Its job is to describe the framework a person can install TODAY. After every
+release wave it must say the released versions, the install commands that resolve, every app that
+exists (desktop, web, iPhone, watch, consoles), every capability (text, voice, vision, music, 3D,
+camera, memory, decisions, entities, automations) and what changed, in the operator's voice.
+
+**The gate.** This skill ends with a local preview URL and a branch, never with a push. The
+operator reads the preview, asks for changes, and pushes `gh-pages` personally. A worker that
+pushes, force-pushes, or rebases `gh-pages` has broken the operator's one rule for this surface.
+
+## Paths
+
+- Site worktree: `/Users/albou/tmp/abstractframework-ghpages` (a git worktree of the root repo on
+  a site branch). Published ref: `origin/gh-pages`. Start every update from it:
+  `git -C <worktree> fetch origin && git -C <worktree> switch -c site-<root version> origin/gh-pages`
+  (one branch per root version; an existing branch for the same version is resumed, never recreated).
+- Method and history: `/Users/albou/tmp/abstractframework/untracked/site-rethink/` (PLAN.md,
+  REPORT.md with the operator's rounds, CLAIMS.md, examples/, deliver/, shots/). Read REPORT.md's
+  operator rounds before changing copy: they are the record of what was accepted and refused.
+- Preview server: `python3 references/preview_server.py <worktree> --port 56265` (Range-capable,
+  needed for the videos). The URL to hand over is `http://127.0.0.1:56265/`.
+- Workspace: `/Users/albou/tmp/abstractframework/<repo>` (each its own git repo; `git -C`).
+
+## Invariants (operator decisions; keep them unless the operator changes them on the record)
+
+- Identity: the original dark site; content changes, identity does not. Tagline
+  "Write once. Generate everything. Run anywhere." Modality order voice, music, vision, 3D, camera.
+- Install: exactly three profiles, `abstractframework`, `abstractframework[apple]`,
+  `abstractframework[gpu]`, plus the short installer addresses (`abstractframework.ai/install.sh`,
+  `/install.ps1`, `/uninstall.sh`). Never `[remote]`, `[mlx]` or a per-package pip line as the
+  primary path. Provider badges list every provider the text names, never trimmed.
+- Names: PascalCase package names in prose (AbstractCore, AbstractAssistant); "Consoles" is not
+  a package; the Assistant is "One Click Away", never "Built for macOS" (OS-agnostic, tested most on
+  Apple). Entities are "persistent, self-evolving agents ... we are defining the field here", the
+  identity planted once; memory is reconstruction (passive / active / durable).
+- The "Ledger Is the Record of the Run" animation stays as it is.
+- Every code block is either RUN (a hermetic example under `untracked/site-rethink/examples/`,
+  its `run.log` next to it, the HTML comment `E<n> PASS`) or carries a visible "not executed" note.
+  No worker runs model generation for the site beyond what an example needs; one model process at
+  a time on the machine (the live gateway owns the GPU).
+- Screenshots come from a fresh scratch install of the RELEASED matrix (never from a dev tree),
+  captured at the sizes the page uses, including a 400 px phone capture for every new page or
+  redesigned interface. A pre-release capture is captioned as such.
+- Claims are text-only when the code says so: the adversary of 2026-09-29 found the operator's own
+  framings false in code (no hash-chained gateway ledgers, no re-execution on replay, `create_llm`
+  needs a provider). Verify before writing, write what the code does.
+
+## Procedure
+
+1. **Inventory what is published.** `python3 ~/.codex/skills/abstract-release/scripts/abstract_release_plan.py <workspace> --registry`
+   plus the root's `abstractframework/__init__.py` (`RELEASE_VERSIONS`, `NPM_RELEASE_VERSIONS`,
+   `CRATE_RELEASE_VERSIONS`) and `pip download abstractframework==<v> --no-deps` for the pins.
+   The site states the ROOT version and the versions the root pins; nothing "coming".
+2. **Diff the site against reality.** For every page: the versions it names, the install lines,
+   the package list, the apps and capabilities it describes, the screenshots' provenance, the
+   llms mirrors' headers. `grep -o "[0-9]\+\.[0-9]\+\.[0-9]\+" *.html | sort | uniq -c` finds stale
+   numbers fast. Read each released package's CHANGELOG from the version the site names to the
+   released one: that is the list of new features and fixes to tell.
+3. **Write the update ledger first** (`untracked/site-<root version>/CLAIMS.md`, same shape as the
+   2026-09-29 ledger): every factual claim to add or change, with the repository line, registry
+   JSON, or example run that supports it; every page to touch; every screenshot to refresh and
+   from which scratch install. New apps get their own section or page (the Assistant's web, iPhone
+   and watch apps; a new console); a new capability gets its place in the home grid and on the
+   package page that provides it (decision models on core.html, with the model family named as the
+   package docs name it).
+4. **Apply the changes** on the site branch, in commits named `site <root version>: <what>`.
+   Refresh `llms.txt` / `llms-full.txt` mirrors from each released repository's main at the tag
+   (headers kept). Regenerate `sitemap.xml` when pages are added.
+5. **Check.** `python3 references/check_site.py <worktree>`: every local link and asset resolves,
+   every page has one `<title>`, no leftover `TODO`/`PENDING` markers, every `<img>` exists and has
+   `width`/`height`, no version string older than the root's pins unless the ledger explains it, no
+   "coming soon". Open every changed page in the preview at desktop width and 400 px and look at it;
+   record a screenshot of each under `untracked/site-<root version>/shots/`.
+6. **Adversarial pass.** A reader that did not write the pages checks the ledger line by line
+   against the code and the registries, and the copy against the invariants above; fix or
+   withdraw every finding on the record (`REVIEW-<n>.md`).
+7. **Serve and hand over.** Start the preview server on the worktree, confirm it answers, and
+   end with the handover block below. Do not push. Do not merge into `gh-pages`. Leave the
+   worktree on the site branch so the operator's rounds continue there.
+
+## Handover block (the last thing a run prints)
+
+```
+Site branch: site-<root version> @ <sha> (worktree /Users/albou/tmp/abstractframework-ghpages)
+Preview: http://127.0.0.1:56265/   (server pid <pid>; restart: python3 ~/.codex/skills/abstractframework-website/references/preview_server.py <worktree> --port 56265)
+Changed pages: <list>   New pages: <list>   Screenshots refreshed: <n> (from abstractframework==<v> scratch install)
+Ledger: untracked/site-<root version>/CLAIMS.md   Review: REVIEW-1.md (<n> findings, <m> fixed)
+Not done / needs you: <anything the operator must decide or capture>
+To publish (operator only): git -C <worktree> push origin site-<root version>:gh-pages
+```
+
+## Pitfalls
+
+- A site built from the dev checkouts drifts from what `pip install` gives: scratch-install the
+  released root profile for screenshots and example runs (`uv venv` + `uv pip install
+  abstractframework[apple]==<v>` with `UV_CACHE_DIR=/Users/albou/.cache/uv`; delete the venv after).
+- The home page is one 180 KB file with inline sections per package: edit the section, not the
+  whole file; keep `assets/` names stable so the operator's cached screenshots stay valid.
+- `llms-full.txt` mirrors are large; refresh them from the released tag, not from a working tree
+  that carries unreleased docs.
+- A page for an app that exists on one platform only says so plainly (the watch app is watchOS,
+  the iPhone app iOS, the web app runs where the gateway runs).

abstractskill-0.3.4/src/abstractskill/registry/skills/abstractframework-website/references/check_site.py

@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+"""Static checks for the abstractframework.ai site worktree. Read-only.
+
+Usage: check_site.py <site dir> [--min-version-for <package>=<x.y.z> ...]
+Fails (exit 1) on: a local link or asset that does not resolve, a page without exactly one
+<title>, an <img> without width/height or whose file is missing, leftover TODO/PENDING/COMING SOON
+markers, and version strings below the given floors next to a package name.
+"""
+from __future__ import annotations
+
+import argparse
+import os
+import re
+import sys
+from html.parser import HTMLParser
+
+
+class Collector(HTMLParser):
+    def __init__(self) -> None:
+        super().__init__()
+        self.titles = 0
+        self.links: list[str] = []
+        self.imgs: list[tuple[str, bool]] = []
+
+    def handle_starttag(self, tag, attrs):  # noqa: ANN001
+        d = dict(attrs)
+        if tag == "title":
+            self.titles += 1
+        if tag in ("a", "link") and d.get("href"):
+            self.links.append(d["href"])
+        if tag in ("script", "source", "video", "audio") and d.get("src"):
+            self.links.append(d["src"])
+        if tag == "img" and d.get("src"):
+            self.imgs.append((d["src"], bool(d.get("width") and d.get("height"))))
+
+
+def local(ref: str) -> str | None:
+    if re.match(r"^(https?:|mailto:|tel:|data:|javascript:|#)", ref):
+        return None
+    return ref.split("#", 1)[0].split("?", 1)[0] or None
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("site")
+    ap.add_argument("--min-version-for", action="append", default=[], metavar="PKG=X.Y.Z")
+    a = ap.parse_args()
+    root = os.path.abspath(a.site)
+    floors = dict(x.split("=", 1) for x in a.min_version_for)
+    problems: list[str] = []
+    pages = [f for f in os.listdir(root) if f.endswith(".html")]
+    for page in sorted(pages):
+        text = open(os.path.join(root, page), encoding="utf-8", errors="replace").read()
+        c = Collector()
+        c.feed(text)
+        if c.titles != 1:
+            problems.append(f"{page}: {c.titles} <title> tags")
+        for marker in ("TODO", "PENDING-W", "COMING SOON", "coming soon", "FIXME"):
+            if marker in text:
+                problems.append(f"{page}: leftover marker {marker!r}")
+        for ref in c.links:
+            rel = local(ref)
+            if rel and not os.path.exists(os.path.join(root, rel.lstrip("/"))):
+                problems.append(f"{page}: broken local link {ref}")
+        for src, sized in c.imgs:
+            rel = local(src)
+            if rel and not os.path.exists(os.path.join(root, rel.lstrip("/"))):
+                problems.append(f"{page}: missing image {src}")
+            if not sized:
+                problems.append(f"{page}: <img {src}> without width/height")
+        for pkg, floor in floors.items():
+            for m in re.finditer(re.escape(pkg) + r"[^0-9\n]{0,40}?(\d+\.\d+\.\d+)", text):
+                found = tuple(int(x) for x in m.group(1).split("."))
+                if found < tuple(int(x) for x in floor.split(".")):
+                    problems.append(f"{page}: {pkg} {m.group(1)} is below the released {floor}")
+    for p in problems:
+        print(p)
+    print(f"{len(pages)} pages, {len(problems)} problems")
+    return 1 if problems else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

abstractskill-0.3.4/src/abstractskill/registry/skills/abstractframework-website/references/preview_server.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+"""Serve a static site directory locally with HTTP Range support (videos seek), no caching.
+
+Usage: preview_server.py <directory> [--port 56265] [--bind 127.0.0.1]
+Read-only: it never writes into the directory. Stop it with Ctrl-C or kill <pid>.
+"""
+from __future__ import annotations
+
+import argparse
+import os
+import re
+import sys
+from functools import partial
+from http import HTTPStatus
+from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
+
+
+class RangeHandler(SimpleHTTPRequestHandler):
+    def end_headers(self) -> None:
+        self.send_header("Cache-Control", "no-store")
+        self.send_header("Accept-Ranges", "bytes")
+        super().end_headers()
+
+    def send_head(self):  # noqa: ANN201 - stdlib signature
+        rng = self.headers.get("Range")
+        if not rng:
+            return super().send_head()
+        path = self.translate_path(self.path)
+        if os.path.isdir(path):
+            return super().send_head()
+        try:
+            size = os.path.getsize(path)
+        except OSError:
+            self.send_error(HTTPStatus.NOT_FOUND, "File not found")
+            return None
+        m = re.match(r"bytes=(\d*)-(\d*)$", rng.strip())
+        if not m:
+            return super().send_head()
+        start = int(m.group(1)) if m.group(1) else max(0, size - int(m.group(2) or 0))
+        end = int(m.group(2)) if m.group(1) and m.group(2) else size - 1
+        end = min(end, size - 1)
+        if start > end or start >= size:
+            self.send_response(HTTPStatus.REQUESTED_RANGE_NOT_SATISFIABLE)
+            self.send_header("Content-Range", f"bytes */{size}")
+            self.end_headers()
+            return None
+        fh = open(path, "rb")
+        fh.seek(start)
+        self.send_response(HTTPStatus.PARTIAL_CONTENT)
+        self.send_header("Content-Type", self.guess_type(path))
+        self.send_header("Content-Range", f"bytes {start}-{end}/{size}")
+        self.send_header("Content-Length", str(end - start + 1))
+        self.end_headers()
+        self._range_left = end - start + 1
+        return fh
+
+    def copyfile(self, source, outputfile) -> None:  # noqa: ANN001 - stdlib signature
+        left = getattr(self, "_range_left", None)
+        if left is None:
+            return super().copyfile(source, outputfile)
+        while left > 0:
+            chunk = source.read(min(65536, left))
+            if not chunk:
+                break
+            outputfile.write(chunk)
+            left -= len(chunk)
+        self._range_left = None
+
+    def log_message(self, fmt, *args) -> None:  # noqa: ANN001 - quiet by default
+        if os.environ.get("PREVIEW_VERBOSE"):
+            super().log_message(fmt, *args)
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("directory")
+    ap.add_argument("--port", type=int, default=56265)
+    ap.add_argument("--bind", default="127.0.0.1")
+    a = ap.parse_args()
+    directory = os.path.abspath(a.directory)
+    if not os.path.isdir(directory):
+        print(f"not a directory: {directory}", file=sys.stderr)
+        return 2
+    handler = partial(RangeHandler, directory=directory)
+    httpd = ThreadingHTTPServer((a.bind, a.port), handler)
+    print(f"serving {directory} at http://{a.bind}:{a.port}/ (pid {os.getpid()})", flush=True)
+    try:
+        httpd.serve_forever()
+    except KeyboardInterrupt:
+        pass
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

{abstractskill-0.3.3 → abstractskill-0.3.4}/src/abstractskill/registry/validations.yaml

@@ -8,16 +8,16 @@
 validations:
 - name: abstract-release
   source: codex-skills (maintainer)
-  tree_hash: f03e111097d8a8e1b8c39cb1e7c63bb9ad116e909b8b54478929274995c0b41b
+  tree_hash: e8c297c3c8a73d54a68fd754f789a54095ee701a8e36049de433342425e741a5
   level: adopted
   method: first-party-adoption
   audience: host
   validated_by: skill
-  validated_at: '2026-10-27'
+  validated_at: '2026-11-02'
   evidence:
     parser_roundtrip: true
     has_scripts: true
-    files: 7
+    files: 8
   notes: "Maintainer-authored skill (AbstractFramework release waves), rewritten 2026-10-27\
     \ from the release wave of that day: dependency order with AbstractNote after\
     \ the gateway, per-package mechanics (tag push vs workflow_dispatch, GitHub publishing-environment\
@@ -31,8 +31,19 @@ validations:
     \ requires_review at the gate until the operator enables them. Adversarially reviewed\
     \ before pinning (3 P0 / 6 P1 / 5 P2 folded: committed-but-unpublished detection,\
     \ per-workflow dispatch inputs, AbstractCode/Abstract3D triggers, scratch-gateway\
-    \ recipe verified live). Behavioral audit (backlog 0003) pending \u2014 upgrades\
-    \ to audited then."
+    \ recipe verified live). Re-reviewed and re-pinned 2026-11-02 from the maintainer\
+    \ copy: abstractavatar (crate first, then the Python package) in the order, AbstractAssistant's\
+    \ four lanes (PyPI, web, iPhone, watch; Apple lanes through the app-store environment),\
+    \ a gated step 9 handing the website to abstractframework-website (never pushes\
+    \ gh-pages), the operator's release-execution and repo-sync rules, the final local-build\
+    \ gate and 'show me your work' report, changelog fragments; NEW references/readiness-audit.md\
+    \ (read-only audit evidence contract); package-inventory rows for AbstractAvatar\
+    \ and the Assistant lanes. PLANNER PATCHED: a crate and a Python package sharing\
+    \ a name (abstractavatar) no longer abort with 'duplicate package' \u2014 the\
+    \ crate keys as <name>-crate, a crate dependent's edge resolves to it, CRATE_RELEASE_VERSIONS\
+    \ pins map to it (verified on the live workspace: 36 packages, abstractavatar-crate\
+    \ ordered before abstracttui; the previous planner aborts). Still read-only, stdlib\
+    \ only. Behavioral audit (backlog 0003) pending \u2014 upgrades to audited then."
 - name: abstractframework-gateway
   source: first-party
   tree_hash: bf438ba23526abf39e591865358c55ae8efa4da61437c4fc5527bafc68c6882d
@@ -58,6 +69,29 @@ validations:
     \ text) and close was taught as loop-release \u2014 re-taught to auto-wake-on-open\
     \ + restore-previous-on-close, refusal reasons verified against entity_visits.py\
     \ (paused/one-visit/consent-rite; sleep wakes)."
+- name: abstractframework-website
+  source: first-party
+  tree_hash: b91fe3fb6d167fee6f535c5d9004669233b978c822b6ccd8054b2382eae5d0d5
+  level: first_party
+  method: first-party
+  audience: host
+  validated_by: skill
+  validated_at: '2026-11-02'
+  evidence:
+    parser_roundtrip: true
+    has_scripts: true
+    files: 3
+  notes: "First-party skill (2026-11-02): update the abstractframework.ai site (the\
+    \ gh-pages branch of lpalbou/AbstractFramework) after a release wave \u2014 inventory\
+    \ what is published, diff the site against reality, a claims ledger before any\
+    \ copy change, apply on a site-<root version> branch, check, adversarial pass,\
+    \ serve locally and hand the operator a preview URL. GATED: the skill never pushes,\
+    \ force-pushes, rebases or merges gh-pages; the operator validates the preview\
+    \ and publishes. SCRIPTS-BEARING (two read-only stdlib helpers under references/):\
+    \ preview_server.py (static server with HTTP Range support, binds 127.0.0.1 by\
+    \ default, no writes) and check_site.py (static link/asset/title/marker/version-floor\
+    \ checker, no writes, no network), so requires_review at the gate until the operator\
+    \ enables them. Paths name the maintainer's workspace."
 - name: adr
   source: codex-skills (maintainer)
   tree_hash: a4cb55fcea54e969a9c342e314b4dda3556ce5e6fb0e210821350688c62c934b

{abstractskill-0.3.3 → abstractskill-0.3.4/src/abstractskill.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: abstractskill
-Version: 0.3.3
+Version: 0.3.4
 Summary: Agent Skills (SKILL.md) parsing, discovery, trust gating, and demand derivation for AbstractFramework
 Author-email: Laurent-Philippe Albou <contact@abstractcore.ai>
 License-Expression: MIT
@@ -61,12 +61,16 @@ pip install abstractskill
 
 The wheel carries the library and the curated skill registry (the shelf below).
 
+What's new in 0.3.4: the `abstractframework-website` skill joins the shelf and
+`abstract-release` covers AbstractAvatar and the AbstractAssistant lanes; see
+the [changelog](CHANGELOG.md#034---2026-11-02).
+
 ## The bundled skill registry
 
 `pip install abstractskill` installs the reviewed shelf as package data:
 
 ```
-abstractskill/registry/skills/            # 15 curated skills (one folder per SKILL.md)
+abstractskill/registry/skills/            # 16 curated skills (one folder per SKILL.md)
 abstractskill/registry/licenses/          # upstream licenses of catalog-vendored skills
 abstractskill/registry/validations.yaml   # trust records: byte pins per skill tree
 abstractskill/registry/advisories.yaml    # do-not-use advisories (empty at v1, by design)

{abstractskill-0.3.3 → abstractskill-0.3.4}/src/abstractskill.egg-info/SOURCES.txt

@@ -31,10 +31,14 @@ src/abstractskill/registry/skills/abstract-release/SKILL.md
 src/abstractskill/registry/skills/abstract-release/agents/openai.yaml
 src/abstractskill/registry/skills/abstract-release/references/package-discovery.md
 src/abstractskill/registry/skills/abstract-release/references/package-inventory.md
+src/abstractskill/registry/skills/abstract-release/references/readiness-audit.md
 src/abstractskill/registry/skills/abstract-release/references/release-process.md
 src/abstractskill/registry/skills/abstract-release/scripts/abstract_release_plan.py
 src/abstractskill/registry/skills/abstract-release/scripts/pypi_visibility_gate.py
 src/abstractskill/registry/skills/abstractframework-gateway/SKILL.md
+src/abstractskill/registry/skills/abstractframework-website/SKILL.md
+src/abstractskill/registry/skills/abstractframework-website/references/check_site.py
+src/abstractskill/registry/skills/abstractframework-website/references/preview_server.py
 src/abstractskill/registry/skills/adr/SKILL.md
 src/abstractskill/registry/skills/adr/agents/openai.yaml
 src/abstractskill/registry/skills/adr/references/adr-template-and-workflow.md

{abstractskill-0.3.3 → abstractskill-0.3.4}/tests/test_bundled.py

@@ -38,8 +38,8 @@ LICENSES = (
 # The bundle version must move whenever the bundled content moves. When this
 # test fails: bump `version:` in src/abstractskill/registry/catalog.yaml, then
 # update BOTH values below (the digest printed in the failure message).
-PINNED_VERSION = "2026.10.27"
-PINNED_DIGEST = "8e1930494cc8ab8e7ac28c4ccf2b96e6714f72a84f3b71d09b78ce2b2392bb8c"
+PINNED_VERSION = "2026.11.02"
+PINNED_DIGEST = "1486aef6fd33341f74a7d2310a45a3c4c930b40de740fa203b1fcd83935fd687"
 
 
 def _bundle_digest(root: Path) -> str:
@@ -70,11 +70,11 @@ def _all_items() -> set[str]:
     return skills | set(TRUST_FILES) | set(LICENSES)
 
 
-def test_bundled_dir_is_the_package_registry_with_15_skills() -> None:
+def test_bundled_dir_is_the_package_registry_with_16_skills() -> None:
     root = bundled_registry_dir()
     assert root == REPO / "src" / "abstractskill" / "registry"
     skills = sorted(p.name for p in (root / "skills").iterdir() if p.is_dir())
-    assert len(skills) == 15
+    assert len(skills) == 16
     assert all((root / "skills" / name / "SKILL.md").is_file() for name in skills)
     for name in TRUST_FILES:
         assert (root / name).is_file()

{abstractskill-0.3.3 → abstractskill-0.3.4}/tests/test_shelf.py

@@ -26,6 +26,7 @@ GUIDANCE = REPO / "src" / "abstractskill" / "registry" / "guidance.yaml"
 EXPECTED_SHELF = {
     "abstract-release",
     "abstractframework-gateway",
+    "abstractframework-website",
     "adversarial-iteration",
     "adr",
     "agora-collaboration",
@@ -49,6 +50,7 @@ EXPECTED_SHELF = {
 EXPECTED_LEVELS = {
     "abstract-release": TrustLevel.ADOPTED,
     "abstractframework-gateway": TrustLevel.FIRST_PARTY,
+    "abstractframework-website": TrustLevel.FIRST_PARTY,
     "adversarial-iteration": TrustLevel.FIRST_PARTY,
     "agora-collaboration": TrustLevel.FIRST_PARTY,
     "adr": TrustLevel.ADOPTED,
@@ -66,6 +68,7 @@ EXPECTED_LEVELS = {
 EXPECTED_SOURCES = {
     "abstract-release": "codex-skills (maintainer)",
     "abstractframework-gateway": "first-party",
+    "abstractframework-website": "first-party",
     "adversarial-iteration": "first-party",
     "agora-collaboration": "first-party",
     "adr": "codex-skills (maintainer)",
@@ -85,7 +88,9 @@ EXPECTED_SOURCES = {
 # name HERE — the admission review's explicit signature, never a silent pass.
 # abstract-release (2026-10-27): a read-only release planner and a registry
 # visibility gate (stdlib, HTTPS GETs to pypi.org / registry.npmjs.org only).
-EXPECTED_SCRIPTS_BEARING: set[str] = {"abstract-release"}
+# abstractframework-website (2026-11-02): two read-only helpers under
+# references/ (a local Range-capable preview server, a static site checker).
+EXPECTED_SCRIPTS_BEARING: set[str] = {"abstract-release", "abstractframework-website"}
 
 
 def test_shelf_discovers_exactly_the_expected_skills() -> None: