fix(flows): pin released Garden and Babysitter artifacts

[miyaontherelay]

Problem

The live catalog still points Software Garden at Flows 2.0.22 and a pre-release legacy Babysitter example. That leaves the published Surface 2.0.26 trigger vocabulary, the canonical factory PR metadata fix, and the native existing-session Babysitter extension outside the hosted authority path.

Change

• advance the recommended Software Garden artifact to released Flows v2.0.26 at 8b33ebab8347514f80d9da5a81206a087f641714
• pin the exact canonical source SHA-256 and reject a factory artifact that loses the ticket-derived title or exactly-one Fixes #N contract
• point Babysitter at the native extensions/babysitter bundle from the same immutable release, never the legacy comment/merge-hook example
• pin native plugin digest bdf2187b9a242667d34bbc63e7a744753e146dc8cd6f4047047f2aed28f406ee and manifest SHA-256 5631a06bbdc8186f4ee0ff955610ead24d001c5197b59fb1fe81fe422c44f226
• require Surface/SDK 2.0.26, where all eleven GitHub event identities ship
• keep Babysitter as an extension of Software Garden, not a second Recommended Flow
• document that authored extension execution remains fail-closed; safe execution still depends on the reviewed Cloud capability adapter and authorized existing-session lineage/native delivery

Captured verification

$ npm run verify:recommended-flows
software-factory: verified v2.0.26 (8b33ebab8347514f80d9da5a81206a087f641714) sha256:49c993220b9c34fab2d4b0e51911656f62b8b657f534d988691960d45bb9d9b6

$ npm --workspace web exec vitest run lib/test/recommended-flow-contract.test.ts lib/test/recommended-flow-catalog.test.ts lib/test/flow-plugin-catalog.test.ts lib/test/flow-local.test.ts -- --testTimeout=30000
 Test Files  4 passed (4)
      Tests  59 passed (59)
   Duration  54.53s

$ cd web && ../node_modules/.bin/tsc --noEmit
[no output; exit 0]

Registry-backed clean-project proof:

$ flows add github:AgentWorkforce/flows@8b33ebab8347514f80d9da5a81206a087f641714#extensions/babysitter
Added babysitter@0.2.0 (flow-extension)
  digest sha256:bdf2187b9a242667d34bbc63e7a744753e146dc8cd6f4047047f2aed28f406ee
  integrations: github; harnesses: codex; mcp: none
  events: github pull_request[opened,synchronize,reopened,ready_for_review,closed,labeled,unlabeled]; github pull_request_review[submitted,dismissed]; github check_run[completed]; github issue_comment[created]
  hooks: none; handlers: yes
  writes (declared, unenforced): cloud:babysitter-turn

$ flows plugin verify --offline
OK babysitter@0.2.0 ... local digest matches lockfile; remote skipped

$ flows check software-factory.flow.ts
EXTENSION babysitter@0.2.0 ... -> 11 handler(s) composed after the base flow
REQUIRES github (on github pull_request), codex (plugin "babysitter")
CHECK PASSED software-factory.flow.ts

Release and rollout boundary

Flows v2.0.26 is already published by the human-run release workflow. This PR does not deploy or enable Babysitter. Cloud activation must continue returning 409/no writes for babysitter.enabled: true until Flows#552, Cloud#3940, Cloud#3942, the Relay native-turn route, RelayHistory receipts, and the capability-adapter isolation are merged, released, deployed, and proven end to end.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 32b3afec-5601-402a-b3a0-b014e915d9fa

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Preview deployed!

Environment	URL
Web	https://3d3c5789-agentrelay-web.agent-workforce.workers.dev

This is a Cloudflare Workers preview version of this PR's build.