From 9db5420b45568dd08fc43d406dbf9ad1952f7891 Mon Sep 17 00:00:00 2001 From: YEONGUK LEE Date: Tue, 13 Oct 2026 17:15:44 +0900 Subject: [PATCH 1/4] docs: Prepare TypeScript skill 0.2.1 candidate --- README.ja.md | 2 +- README.ko.md | 2 +- README.md | 2 +- README.zh-CN.md | 2 +- docs/typescript-compatibility.md | 24 +++++++++++++++++++++++- docs/typescript.md | 20 +++++++++++--------- scripts/test-ts-skill.mjs | 2 +- session-peer-ts/SKILL.md | 20 +++++++++++++------- 8 files changed, 52 insertions(+), 22 deletions(-) diff --git a/README.ja.md b/README.ja.md index 65c7dc2..3c97ee0 100644 --- a/README.ja.md +++ b/README.ja.md @@ -46,7 +46,7 @@ npx -y skills@latest update session-peer --global --yes 状態が `queued`（キュー登録済み）または `submitted`（送信済み）でも、受信側がメッセージを消費したことは確認できません。送信結果が不明な場合は自動で再送しないでください。Codex の返信待ちは利用ガイドを参照してください。 -npm 版 TypeScript ランタイムには、別の `session-peer-ts` スキル 0.2.0 を使います。ランタイム 0.3.3 は、このスキルのメタデータを認識します。エージェント、プロジェクト/グローバルの適用範囲、レビュー済みコミットを指定したインストール手順は [TypeScript 設定ガイド](docs/typescript.md)を参照してください。 +npm 版 TypeScript ランタイム向けに公開されているのは、別の `session-peer-ts` スキル 0.2.0 です。ランタイム 0.3.3 と 0.3.4 は、このメタデータを認識します。このブランチの `session-peer-ts` スキル 0.2.1 は未公開の草案であり、候補ランタイム 0.3.5 の doctor 検査が必要です。草案のコミットをインストールの固定先にしないでください。対応ランタイムの公開後に、別途承認を受けてスキルを公開する必要があります。エージェント、プロジェクト/グローバルの適用範囲、レビュー済みコミットを指定したインストール手順は [TypeScript 設定ガイド](docs/typescript.md)を参照してください。 ## ドキュメント diff --git a/README.ko.md b/README.ko.md index 8d94fc0..3512ae1 100644 --- a/README.ko.md +++ b/README.ko.md @@ -46,7 +46,7 @@ npx -y skills@latest update session-peer --global --yes `queued` 또는 `submitted` 상태는 수신자가 메시지를 처리했다는 확인이 아닙니다. 제출 결과가 불확실한 경우 자동으로 재전송하지 마세요. Codex 회신 대기 절차는 사용 안내를 참고하세요. -npm TypeScript 런타임에는 별도의 `session-peer-ts` 스킬 0.2.0을 사용합니다. 런타임 0.3.3은 이 스킬의 메타데이터를 인식합니다. 에이전트, 프로젝트 또는 전역 설치 범위, 검토된 커밋을 명시하는 설치 방법은 [TypeScript 설정 안내](docs/typescript.md)를 참고합니다. +npm TypeScript 런타임용으로 공개된 스킬은 별도의 `session-peer-ts` 스킬 0.2.0이며, 런타임 0.3.3과 0.3.4가 이 메타데이터를 인식합니다. 이 브랜치의 `session-peer-ts` 스킬 0.2.1은 미발행 초안으로, 후보 런타임 0.3.5의 doctor 검사가 필요합니다. 초안 커밋을 설치 기준으로 사용하지 마세요. 지원 런타임이 실제로 공개된 뒤 별도 승인을 받아 스킬을 발행해야 합니다. 에이전트, 프로젝트 또는 전역 설치 범위, 검토된 커밋을 명시하는 설치 방법은 [TypeScript 설정 안내](docs/typescript.md)를 참고합니다. ## 문서 diff --git a/README.md b/README.md index b9a2412..df58865 100644 --- a/README.md +++ b/README.md @@ -46,7 +46,7 @@ The runtime command above is for pipx installations; keep using your existing ru A `queued` or `submitted` status does not confirm that the recipient consumed the message. Do not automatically resend after an uncertain submission; see the usage guide for Codex reply waiting. -The separate `session-peer-ts` skill 0.2.0 supports the npm TypeScript runtime; runtime 0.3.3 accepts its metadata profile. See the [TypeScript setup guide](docs/typescript.md) for an explicit agent, project/global scope, and reviewed commit installation. +The separate `session-peer-ts` skill 0.2.0 is the published skill for the npm TypeScript runtime; runtimes 0.3.3 and 0.3.4 accept its metadata profile. This branch prepares `session-peer-ts` skill 0.2.1 as an unpublished Draft requiring the proposed runtime 0.3.5 doctor guard. Do not adopt this Draft as an installation pin; the supporting runtime must be published before a separately approved skill release. See the [TypeScript setup guide](docs/typescript.md) for an explicit agent, project/global scope, and reviewed commit installation. ## Docs diff --git a/README.zh-CN.md b/README.zh-CN.md index fad0e6f..106cd37 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -46,7 +46,7 @@ npx -y skills@latest update session-peer --global --yes `queued` 或 `submitted` 状态不代表接收方已消费该消息。提交结果不确定时不要自动重发。Codex 回复等待流程请参阅使用指南。 -npm TypeScript 运行时使用独立的 `session-peer-ts` 技能 0.2.0。运行时 0.3.3 可识别此技能的元数据。指定智能体、项目/全局适用范围和经审查提交版本的安装步骤，请参阅 [TypeScript 设置指南](docs/typescript.md)。 +npm TypeScript 运行时目前使用已发布的独立 `session-peer-ts` 技能 0.2.0；运行时 0.3.3 和 0.3.4 可识别此元数据。本分支的 `session-peer-ts` 技能 0.2.1 是尚未发布的草案，需要候选运行时 0.3.5 的 doctor 检查。请勿将草案提交作为固定安装版本。必须先正式发布支持该配置的运行时，再另行获得批准后发布技能。指定智能体、项目/全局适用范围和经审查提交版本的安装步骤，请参阅 [TypeScript 设置指南](docs/typescript.md)。 ## 文档 diff --git a/docs/typescript-compatibility.md b/docs/typescript-compatibility.md index 7c9fc1e..a2c6767 100644 --- a/docs/typescript-compatibility.md +++ b/docs/typescript-compatibility.md @@ -26,6 +26,28 @@ Compatible and incompatible structural results carry `verification: metadata_onl Runtime 0.3.3's pure validator rejects a valid but unreviewed runtime identity such as `0.3.4` as `incompatible / skill_contract_mismatch / metadata_only`. This describes the released 0.3.3 validator supplied with identity `0.3.4`, not the published 0.3.4 guard: 0.3.4 explicitly adds that reviewed runtime row. Use reviewed runtime 0.3.3 or 0.3.4 for the successor doctor check; no other future identity is accepted by inference. An older CLI can meet the minimum while its doctor rejects this newer metadata profile; do not edit metadata to hide that result. Runtime adoption remains a user-authorized operation under the existing package manager. +## Draft skill 0.2.1 and runtime 0.3.5 candidate + +This worktree proposes TS skill `0.2.1`; it is not a published replacement for skill `0.2.0`. The published profiles and runtime rows above remain the public contract. Public runtimes 0.3.2, 0.3.3, and 0.3.4 reject the proposed 0.2.1 profile as `incompatible / skill_contract_mismatch / metadata_only`, even though its CLI minimum and coverage reference are unchanged. + +| Proposed profile | Skill version | Implementation | CLI minimum | Full coverage reference | Policy | +|---|---|---|---|---|---| +| Draft successor revision | `0.2.1` | `typescript` | `0.1.0` | `0.3.2` | `probe-help` | + +| Inspecting runtime | Legacy `0.1.0` | Published successor `0.2.0` | Draft successor `0.2.1` | Evidence scope | +|---|---|---|---|---| +| Public `0.3.2` | `compatible` | `incompatible` | `incompatible` | Published exact legacy tuple checker | +| Public `0.3.3` | `compatible` | `compatible` | `incompatible` | Published finite row | +| Public `0.3.4` | `compatible` | `compatible` | `incompatible` | Published finite row | +| Draft `0.3.5` | Proposed `compatible` | Proposed `compatible` | Proposed `compatible` | Exact candidate guard row; valid protected fields and healthy bounded input required; not publication evidence | +| Unknown or future combination | No automatic guarantee | No automatic guarantee | No automatic guarantee | No wildcard or arithmetic acceptance | + +The runtime proposal is [Draft #144 at `08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb`](https://github.com/abruption/session-peer-ts/blob/08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb/docs/design/typescript-skill-compatibility.md), compiled VERSION `0.3.5`. At that exact source, the design document SHA-256 is `251ba89481297891eab480344d5df556fd0d0fb94a3451f4bb69f01bf5989761` and `src/skill-metadata.ts` SHA-256 is `bd396f92992fcd84f7cea3c690443cba28f4ee09069d2eccdbbcfd21f35bc3f2`. Its [metadata fixtures](https://github.com/abruption/session-peer-ts/blob/08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb/test/skill-metadata.test.ts) explicitly cover all three profiles using the helper default, explicit `undefined`, and outer `inspectSkill`. Static source and fixture review is separate from running those tests, current-head CI, or proving publication; it does not demonstrate real message consumption or ACK. + +The proposed doctor requirement for skill 0.2.1 is the explicitly reviewed runtime 0.3.5 row, not the CLI minimum `0.1.0` or full coverage reference `0.3.2`. Optional operations still require the resolved executable's stable TypeScript version marker, affirmative help, and actual platform/native/security/permission prerequisites. Do not alter metadata to conceal an older doctor's rejection. + +Before this candidate can be published: review the exact complete skill bytes and finite profile; actually publish the supporting runtime guard; then obtain separate approval to finalize and publish the skill metadata/content/immutable pin. The published skill installation pin remains `8482cf644507c682915e35c85aa3384c53864906` and its release tag remains `session-peer-ts-v0.2.0`. This Draft head is not an installation pin. Four-language runtime guidance and PARITY pin adoption follow the separately approved skill publication. No Python skill, reference pin, 0.4 handoff design, installation, operation, merge, or publication is authorized by this candidate. + ## Minimum, full features, and guard acceptance - `runtime-min-version` is the CLI compatibility floor for the explicitly documented baseline command path in the named implementation. A runtime below it is unsupported. It is not a latest-version marker, a security recommendation, or the minimum for every optional feature. @@ -33,7 +55,7 @@ Runtime 0.3.3's pure validator rejects a valid but unreviewed runtime identity s - Between minimum and full, gate optional operations by their feature-specific version and affirmative help from the resolved TS executable. At or above full, actual platform/native prerequisites, allowlists, permissions, and unique-writer guards still apply. Help proves option presence only. - Doctor acceptance is a separate finite runtime/profile contract. Meeting minimum/full numerically does not establish metadata compatibility, and `metadata_only` does not grant network access, installation, update, or send authority. -The independent Python contract remains skill 0.3.2, minimum 0.9.1, full 1.0.1, and the security patch recommendation documented in its own instructions. TS versioning does not change the Python canonical skill, compatibility snapshot, or runtime/reference/parity pins. +The independent Python contract remains skill 0.3.3, minimum 0.9.1, full 1.0.1, and the security patch recommendation documented in its own instructions. TS versioning does not change the Python canonical skill, compatibility snapshot, or runtime/reference/parity pins. ## Runtime 0.3.3 input and result contract diff --git a/docs/typescript.md b/docs/typescript.md index 296e74b..ca16792 100644 --- a/docs/typescript.md +++ b/docs/typescript.md @@ -2,30 +2,32 @@ [Back to README](../README.md) -The separate `session-peer-ts` skill 0.2.0 describes the published npm TypeScript runtimes 0.3.3 and 0.3.4. The 0.3.4 publication source is [`afed4a5a8945012faf1b23d52cffecb70470a5b3`](https://github.com/abruption/session-peer-ts/blob/afed4a5a8945012faf1b23d52cffecb70470a5b3/RELEASING.md). The runtime runs without Python. Both runtimes use the command name `session-peer`, so resolve the intended executable and inspect its version and help before use. +The separate `session-peer-ts` skill 0.2.1 is an **unpublished documentation candidate** retaining the public CLI guidance through runtime 0.3.4. Its metadata requires the separately reviewed runtime 0.3.5 guard proposal in [Draft PR #144](https://github.com/abruption/session-peer-ts/pull/144), exact source [`08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb`](https://github.com/abruption/session-peer-ts/blob/08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb/src/skill-metadata.ts). That runtime is not yet published; the candidate is not an installation pin. Keep the published skill 0.2.0 source until supporting runtime publication and separate skill release approval. Both runtimes use the command name `session-peer`, so resolve the intended executable and inspect its version and help before use. The TS runtime runs without Python. ## Published support and independent versions -Published 0.2.0 added combined listing, bounded known Codex homes, guarded live-writer selection, explicit inactive queueing, read-only doctor, and explicit text output. Published 0.3.0 added multi-host SSH, constrained SSH options and a POSIX jump option, Tailscale routing hints, generated reply routes, opt-in return-route diagnostics, npm update checks and cached notices, and the optional shell `sp` alias. Runtime 0.3.3 adds the bounded metadata reader and supports this skill's successor profile. Always check the selected executable's actual version and supported command help. Wake, Antigravity, Relay, MCP, general wait, and Draft 0.4 handoff/observer designs remain unsupported. +Published 0.2.0 added combined listing, bounded known Codex homes, guarded live-writer selection, explicit inactive queueing, read-only doctor, and explicit text output. Published 0.3.0 added multi-host SSH, constrained SSH options and a POSIX jump option, Tailscale routing hints, generated reply routes, opt-in return-route diagnostics, npm update checks and cached notices, and the optional shell `sp` alias. Runtime 0.3.3 adds the bounded metadata reader and supports the published skill 0.2.0 profile; public 0.3.4 retains that support. Always check the selected executable's actual version and supported command help. Wake, Antigravity, Relay, MCP, general wait, and Draft 0.4 handoff/observer designs remain unsupported. | Version | Meaning | |---|---| -| Python repository tag `v0.3.2` | Independent Python skill release | -| Python skill `0.3.2` | Version of `session-peer/SKILL.md` | -| TS skill `0.2.0` | Version of `session-peer-ts/SKILL.md` | -| TS skill tag `session-peer-ts-v0.2.0` | Separate TS skill release; resolve its annotated tag to the exact commit recorded in the release | +| Python repository tag `v0.3.3` | Independent published Python skill release | +| Python skill `0.3.3` | Version of `session-peer/SKILL.md`; unchanged by this TS candidate | +| TS skill `0.2.1` | Unpublished candidate version of `session-peer-ts/SKILL.md` | +| Published TS skill `0.2.0` | Existing immutable release and installation pin | +| Published TS skill tag `session-peer-ts-v0.2.0` | Keep its recorded source `8482cf644507c682915e35c85aa3384c53864906` until a new release is authorized | +| Candidate tag `session-peer-ts-v0.2.1` | Not created; requires supporting runtime publication and separate skill approval | | TS runtimes `0.3.3` and `0.3.4` | Published npm package `session-peer`; independent of both skill versions | | `runtime-min-version` = `0.1.0` | CLI compatibility floor for the explicit baseline commands | | `runtime-full-version` = `0.3.2` | Coverage reference for this revision's published CLI features | -| Successor doctor acceptance | Runtimes `0.3.3` and `0.3.4` accept this exact metadata profile; public `0.3.2` rejects it | +| Candidate doctor acceptance | Unpublished runtime `0.3.5` explicitly accepts skill `0.2.1`; public `0.3.2`, `0.3.3` and `0.3.4` reject it | The minimum and full values are distinct from security recommendations, latest-version markers, doctor support, and delivery/ACK. Help establishes option presence only; platform/native prerequisites, permissions, allowlists, and writer guards still apply. See the [normative min/full definitions and separate doctor acceptance table](typescript-compatibility.md#minimum-full-features-and-guard-acceptance). -Use reviewed runtime 0.3.3 or 0.3.4 for doctor metadata compatibility with TS skill 0.2.0. Public 0.3.2 rejects the successor even though it meets the baseline CLI minimum and feature coverage values. Keep the existing package manager and obtain authorization before upgrading; do not edit metadata to hide a mismatch. Unknown future runtime/profile combinations are not automatically accepted. A compatible metadata check is not a content review, source authentication, freshness check, or delivery authorization. +For the published skill 0.2.0, reviewed runtimes 0.3.3 and 0.3.4 support doctor metadata inspection. This candidate skill 0.2.1 is different: all three public runtimes 0.3.2/0.3.3/0.3.4 reject it even when they meet its CLI minimum/full coverage values. Require actual publication of its supporting reviewed runtime before adopting it. The explicit 0.3.5 candidate row does not enable other future versions. Keep the existing package manager and obtain authorization before upgrading; do not edit metadata to hide a mismatch. Unknown future runtime/profile combinations are not automatically accepted. A compatible metadata check is not a content review, source authentication, freshness check, or delivery authorization. ## Install, update, and remove the skill -Choose the reviewed **40-character commit SHA** from the [TS skill release](https://github.com/abruption/session-peer-skill/releases/tag/session-peer-ts-v0.2.0), agent (`codex` or `claude-code`), and scope explicitly. The release records the peeled tag commit and SHA-256 of the canonical TS `SKILL.md`. Run in the intended project; omitting `--global` selects project scope. Inspect existing files before accepting an overwrite. For global scope add `--global` consistently to add/list/remove. Codex uses the shared `.agents/skills` directory, so agent selection is not an isolation boundary from other clients that discover that directory. +The commands below are for the existing published skill 0.2.0, not this candidate. Choose the reviewed **40-character commit SHA** from the [TS skill release](https://github.com/abruption/session-peer-skill/releases/tag/session-peer-ts-v0.2.0), agent (`codex` or `claude-code`), and scope explicitly. The release records the peeled tag commit and SHA-256 of the canonical TS `SKILL.md`. Run in the intended project; omitting `--global` selects project scope. Inspect existing files before accepting an overwrite. For global scope add `--global` consistently to add/list/remove. Codex uses the shared `.agents/skills` directory, so agent selection is not an isolation boundary from other clients that discover that directory. ```sh npx -y skills@1.7.0 add https://github.com/abruption/session-peer-skill/tree/REVIEWED_COMMIT/session-peer-ts \ diff --git a/scripts/test-ts-skill.mjs b/scripts/test-ts-skill.mjs index 56e7269..a4b96b4 100644 --- a/scripts/test-ts-skill.mjs +++ b/scripts/test-ts-skill.mjs @@ -10,7 +10,7 @@ const source = resolve('session-peer-ts'); const expected = readFileSync(join(source, 'SKILL.md'), 'utf8'); const metadata = expected.match(/^---\n([\s\S]*?)\n---/)?.[1]; assert.ok(metadata?.includes('name: session-peer-ts')); -for (const [key, value] of Object.entries({ version: '0.2.0', 'runtime-implementation': 'typescript', 'runtime-min-version': '0.1.0', 'runtime-full-version': '0.3.2', 'runtime-capability-policy': 'probe-help' })) { +for (const [key, value] of Object.entries({ version: '0.2.1', 'runtime-implementation': 'typescript', 'runtime-min-version': '0.1.0', 'runtime-full-version': '0.3.2', 'runtime-capability-policy': 'probe-help' })) { assert.ok(metadata.includes(` ${key}: "${value}"`), key); } try { diff --git a/session-peer-ts/SKILL.md b/session-peer-ts/SKILL.md index 42082ff..9adeca5 100644 --- a/session-peer-ts/SKILL.md +++ b/session-peer-ts/SKILL.md @@ -3,7 +3,7 @@ name: session-peer-ts description: Discover and message Claude Code or Codex sessions using the npm TypeScript session-peer CLI, locally or over SSH. Use for user-requested cross-session messaging with the TypeScript runtime; Python runtime guidance belongs to the separate session-peer skill. allowed-tools: Bash, Read metadata: - version: "0.2.0" + version: "0.2.1" runtime-implementation: "typescript" runtime-min-version: "0.1.0" runtime-full-version: "0.3.2" @@ -24,12 +24,18 @@ Python uses that command name too: if the marker is absent, select the Python sk which installation the user intends. Keep the resolved executable for every following command; do not replace another manager's launcher. -This skill revision is 0.2.0 and covers the published npm 0.3.3 and 0.3.4 runtimes. Its CLI -minimum is 0.1.0; its full-feature coverage reference is 0.3.2. The original 0.1.0 -supports only the historical baseline below. Runtimes 0.3.3 and 0.3.4 doctor accept this -exact successor metadata profile; public 0.3.2 doctor rejects it even though the -baseline CLI commands work. For supported doctor metadata inspection, use reviewed 0.3.3 or 0.3.4; -an upgrade still requires the user's request and the existing package manager. +This skill revision is an unpublished 0.2.1 candidate retaining the documented +public CLI features through npm runtime 0.3.4. Its CLI minimum is 0.1.0; its +full-feature coverage reference is 0.3.2. The original 0.1.0 supports only the +historical baseline below. Public runtimes 0.3.2, 0.3.3 and 0.3.4 doctor reject +this new exact metadata profile, even when baseline commands work. The separate +unpublished runtime 0.3.5 candidate explicitly accepts it; this is not current +public support. Before adopting this skill, require actual publication of the +reviewed supporting runtime and a separately approved immutable skill release. +Keep the published skill 0.2.0 pin until then. Any upgrade still requires the +user's request and the existing package manager. +The [exact 0.3.5 guard candidate](https://github.com/abruption/session-peer-ts/blob/08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb/src/skill-metadata.ts) +is design/source evidence, not publication or authorization to adopt this draft. Do not change metadata to silence an incompatibility. The skill version, npm version, and Python skill/repository tag are independent. Unknown versions or contradictory help require review before using an unverified operation; do not infer features from Python's From 0fcdc63e3f3839e63fe55d7024e656835c7f44bd Mon Sep 17 00:00:00 2001 From: YEONGUK LEE Date: Tue, 13 Oct 2026 19:22:30 +0900 Subject: [PATCH 2/4] docs: Finalize TS skill wording for published runtime 0.3.5 --- README.ja.md | 2 +- README.ko.md | 2 +- README.md | 2 +- README.zh-CN.md | 2 +- docs/typescript-compatibility.md | 30 +++++++++++++++++++----------- docs/typescript.md | 10 +++++----- session-peer-ts/SKILL.md | 22 +++++++++++----------- 7 files changed, 39 insertions(+), 31 deletions(-) diff --git a/README.ja.md b/README.ja.md index 3c97ee0..10328ed 100644 --- a/README.ja.md +++ b/README.ja.md @@ -46,7 +46,7 @@ npx -y skills@latest update session-peer --global --yes 状態が `queued`（キュー登録済み）または `submitted`（送信済み）でも、受信側がメッセージを消費したことは確認できません。送信結果が不明な場合は自動で再送しないでください。Codex の返信待ちは利用ガイドを参照してください。 -npm 版 TypeScript ランタイム向けに公開されているのは、別の `session-peer-ts` スキル 0.2.0 です。ランタイム 0.3.3 と 0.3.4 は、このメタデータを認識します。このブランチの `session-peer-ts` スキル 0.2.1 は未公開の草案であり、候補ランタイム 0.3.5 の doctor 検査が必要です。草案のコミットをインストールの固定先にしないでください。対応ランタイムの公開後に、別途承認を受けてスキルを公開する必要があります。エージェント、プロジェクト/グローバルの適用範囲、レビュー済みコミットを指定したインストール手順は [TypeScript 設定ガイド](docs/typescript.md)を参照してください。 +npm 版 TypeScript ランタイム向けに公開されているのは、別の `session-peer-ts` スキル 0.2.0 です。ランタイム 0.3.3、0.3.4、0.3.5 は、このメタデータを認識します。このブランチの `session-peer-ts` スキル 0.2.1 は承認待ちの未公開文書です。公開済みランタイム 0.3.5 の doctor はこのプロファイルに対応していますが、スキル自体はまだ公開されていません。別途承認を受けてスキルを公開するまでは、公開済み 0.2.0 のインストール用コミットを維持してください。エージェント、プロジェクト/グローバルの適用範囲、レビュー済みコミットを指定したインストール手順は [TypeScript 設定ガイド](docs/typescript.md)を参照してください。 ## ドキュメント diff --git a/README.ko.md b/README.ko.md index 3512ae1..892b440 100644 --- a/README.ko.md +++ b/README.ko.md @@ -46,7 +46,7 @@ npx -y skills@latest update session-peer --global --yes `queued` 또는 `submitted` 상태는 수신자가 메시지를 처리했다는 확인이 아닙니다. 제출 결과가 불확실한 경우 자동으로 재전송하지 마세요. Codex 회신 대기 절차는 사용 안내를 참고하세요. -npm TypeScript 런타임용으로 공개된 스킬은 별도의 `session-peer-ts` 스킬 0.2.0이며, 런타임 0.3.3과 0.3.4가 이 메타데이터를 인식합니다. 이 브랜치의 `session-peer-ts` 스킬 0.2.1은 미발행 초안으로, 후보 런타임 0.3.5의 doctor 검사가 필요합니다. 초안 커밋을 설치 기준으로 사용하지 마세요. 지원 런타임이 실제로 공개된 뒤 별도 승인을 받아 스킬을 발행해야 합니다. 에이전트, 프로젝트 또는 전역 설치 범위, 검토된 커밋을 명시하는 설치 방법은 [TypeScript 설정 안내](docs/typescript.md)를 참고합니다. +npm TypeScript 런타임용으로 공개된 스킬은 별도의 `session-peer-ts` 스킬 0.2.0이며, 런타임 0.3.3, 0.3.4, 0.3.5가 이 메타데이터를 인식합니다. 이 브랜치의 `session-peer-ts` 스킬 0.2.1은 사람의 승인을 기다리는 미발행 문서입니다. 공개 런타임 0.3.5의 doctor가 이 프로필을 지원하지만 스킬 자체는 아직 발행되지 않았습니다. 별도 승인을 받아 스킬을 발행하기 전까지 공개된 0.2.0의 설치 커밋을 유지하세요. 에이전트, 프로젝트 또는 전역 설치 범위, 검토된 커밋을 명시하는 설치 방법은 [TypeScript 설정 안내](docs/typescript.md)를 참고합니다. ## 문서 diff --git a/README.md b/README.md index df58865..81e0b02 100644 --- a/README.md +++ b/README.md @@ -46,7 +46,7 @@ The runtime command above is for pipx installations; keep using your existing ru A `queued` or `submitted` status does not confirm that the recipient consumed the message. Do not automatically resend after an uncertain submission; see the usage guide for Codex reply waiting. -The separate `session-peer-ts` skill 0.2.0 is the published skill for the npm TypeScript runtime; runtimes 0.3.3 and 0.3.4 accept its metadata profile. This branch prepares `session-peer-ts` skill 0.2.1 as an unpublished Draft requiring the proposed runtime 0.3.5 doctor guard. Do not adopt this Draft as an installation pin; the supporting runtime must be published before a separately approved skill release. See the [TypeScript setup guide](docs/typescript.md) for an explicit agent, project/global scope, and reviewed commit installation. +The separate `session-peer-ts` skill 0.2.0 is the published skill for the npm TypeScript runtime; runtimes 0.3.3, 0.3.4, and 0.3.5 accept its metadata profile. This branch prepares `session-peer-ts` skill 0.2.1 for human approval; its doctor profile is supported by published runtime 0.3.5, but the skill remains unreleased. Keep the published 0.2.0 installation pin until the separately approved skill release. See the [TypeScript setup guide](docs/typescript.md) for an explicit agent, project/global scope, and reviewed commit installation. ## Docs diff --git a/README.zh-CN.md b/README.zh-CN.md index 106cd37..d5b74e4 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -46,7 +46,7 @@ npx -y skills@latest update session-peer --global --yes `queued` 或 `submitted` 状态不代表接收方已消费该消息。提交结果不确定时不要自动重发。Codex 回复等待流程请参阅使用指南。 -npm TypeScript 运行时目前使用已发布的独立 `session-peer-ts` 技能 0.2.0；运行时 0.3.3 和 0.3.4 可识别此元数据。本分支的 `session-peer-ts` 技能 0.2.1 是尚未发布的草案，需要候选运行时 0.3.5 的 doctor 检查。请勿将草案提交作为固定安装版本。必须先正式发布支持该配置的运行时，再另行获得批准后发布技能。指定智能体、项目/全局适用范围和经审查提交版本的安装步骤，请参阅 [TypeScript 设置指南](docs/typescript.md)。 +npm TypeScript 运行时目前使用已发布的独立 `session-peer-ts` 技能 0.2.0；运行时 0.3.3、0.3.4 和 0.3.5 可识别此元数据。本分支的 `session-peer-ts` 技能 0.2.1 尚未发布，正在等待人工批准。已发布运行时 0.3.5 的 doctor 支持该配置，但技能本身仍未发布。在另行获得批准并发布技能之前，请继续使用已发布 0.2.0 的固定安装提交。指定智能体、项目/全局适用范围和经审查提交版本的安装步骤，请参阅 [TypeScript 设置指南](docs/typescript.md)。 ## 文档 diff --git a/docs/typescript-compatibility.md b/docs/typescript-compatibility.md index a2c6767..568b93b 100644 --- a/docs/typescript-compatibility.md +++ b/docs/typescript-compatibility.md @@ -2,10 +2,12 @@ [Back to TS setup](typescript.md) -TS skill 0.2.0 uses the successor profile supported by the published npm runtimes 0.3.3 and 0.3.4. Runtime 0.3.3 source: [`c0ed30273b9e9c0049df86ae3c38486a94289527`](https://github.com/abruption/session-peer-ts/blob/c0ed30273b9e9c0049df86ae3c38486a94289527/src/skill-metadata.ts). The 0.3.3 npm artifact has SHA-256 `3469cda6a7b2c89d42ed2a250d2e7b5b774293fee090968a4b261e824be4c075`; its verified provenance identifies that source and [publication workflow run 37907833518](https://github.com/abruption/session-peer-ts/actions/runs/37907833518). +TS skill 0.2.0 uses the successor profile supported by the published npm runtimes 0.3.3, 0.3.4, and 0.3.5. Runtime 0.3.3 source: [`c0ed30273b9e9c0049df86ae3c38486a94289527`](https://github.com/abruption/session-peer-ts/blob/c0ed30273b9e9c0049df86ae3c38486a94289527/src/skill-metadata.ts). The 0.3.3 npm artifact has SHA-256 `3469cda6a7b2c89d42ed2a250d2e7b5b774293fee090968a4b261e824be4c075`; its verified provenance identifies that source and [publication workflow run 37907833518](https://github.com/abruption/session-peer-ts/actions/runs/37907833518). Published runtime 0.3.4 explicitly retains the same two reviewed profiles; source: [`afed4a5a8945012faf1b23d52cffecb70470a5b3`](https://github.com/abruption/session-peer-ts/blob/afed4a5a8945012faf1b23d52cffecb70470a5b3/src/skill-metadata.ts). Its [release record](https://github.com/abruption/session-peer-ts/releases/tag/v0.3.4) records the npm artifact SHA-256 `6c8cb114485e067ac3e7f5792de7febf3680cb14dcda6e2c67df6cab773ca03c` and [publication workflow run 38194048045](https://github.com/abruption/session-peer-ts/actions/runs/38194048045). These are separate publication records, not a new property of doctor. +Published runtime 0.3.5 adds the explicit finite profile for skill 0.2.1 while retaining 0.1.0 and 0.2.0; source: [`a2057940ba19056fcaaa5551a7820f7414bd3bfa`](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/src/skill-metadata.ts). Its [release record](https://github.com/abruption/session-peer-ts/releases/tag/v0.3.5) identifies the published runtime; the npm tarball SHA-256 is `46f4a01f9570034fca49cfa5fad620f3f45b5f33b1a6714f29ea0a3c1e751ac0`, with registry integrity checked separately. This runtime publication does not publish the companion skill 0.2.1, which remains an unreleased preparation for human approval. + The Python skill, TS skill, skill release tags, and npm runtime have independent versions. TS skill publication follows the separate `session-peer-ts-vX.Y.Z` tag scheme. A runtime publication does not install or update either skill. ## Published profiles and finite doctor support @@ -20,15 +22,16 @@ The Python skill, TS skill, skill release tags, and npm runtime have independent | Public `0.3.2` | `compatible` | `incompatible` | Exact legacy metadata tuple; top-level name is not checked | | Public `0.3.3` | `compatible` | `compatible` | Exact supported profile plus valid root `name: session-peer-ts` and bounded readable/stable input | | Public `0.3.4` | `compatible` | `compatible` | Explicit finite legacy/successor row; same root-name, parser and bounded input requirements | +| Public `0.3.5` | `compatible` | `compatible` | Explicit finite row; also accepts the unreleased 0.2.1 profile as shown below | | Unknown or future combination | No automatic guarantee | No automatic guarantee | Review the actual runtime and profile; no wildcard or arithmetic acceptance | Compatible and incompatible structural results carry `verification: metadata_only`. This checks metadata structure/profile support; it does not verify source provenance, content SHA, installation integrity, freshness, CLI feature coverage, permission to send, consumption, or ACK. The npm provenance verification above is separate release evidence, not a property of doctor. -Runtime 0.3.3's pure validator rejects a valid but unreviewed runtime identity such as `0.3.4` as `incompatible / skill_contract_mismatch / metadata_only`. This describes the released 0.3.3 validator supplied with identity `0.3.4`, not the published 0.3.4 guard: 0.3.4 explicitly adds that reviewed runtime row. Use reviewed runtime 0.3.3 or 0.3.4 for the successor doctor check; no other future identity is accepted by inference. An older CLI can meet the minimum while its doctor rejects this newer metadata profile; do not edit metadata to hide that result. Runtime adoption remains a user-authorized operation under the existing package manager. +Runtime 0.3.3's pure validator rejects a valid but unreviewed runtime identity such as `0.3.4` as `incompatible / skill_contract_mismatch / metadata_only`. This describes the released 0.3.3 validator supplied with identity `0.3.4`, not the published 0.3.4 guard: 0.3.4 explicitly adds that reviewed runtime row. Use an explicitly reviewed runtime row (0.3.3, 0.3.4, or 0.3.5) for the published 0.2.0 successor doctor check; no other future identity is accepted by inference. An older CLI can meet the minimum while its doctor rejects this newer metadata profile; do not edit metadata to hide that result. Runtime adoption remains a user-authorized operation under the existing package manager. -## Draft skill 0.2.1 and runtime 0.3.5 candidate +## Unreleased skill 0.2.1 and published runtime 0.3.5 -This worktree proposes TS skill `0.2.1`; it is not a published replacement for skill `0.2.0`. The published profiles and runtime rows above remain the public contract. Public runtimes 0.3.2, 0.3.3, and 0.3.4 reject the proposed 0.2.1 profile as `incompatible / skill_contract_mismatch / metadata_only`, even though its CLI minimum and coverage reference are unchanged. +This worktree prepares TS skill `0.2.1` for human approval; it is not a published replacement for skill `0.2.0`. Runtime 0.3.5 has published its support for this profile, but the existing published skill release remains 0.2.0. Public runtimes 0.3.2, 0.3.3, and 0.3.4 reject the proposed 0.2.1 profile as `incompatible / skill_contract_mismatch / metadata_only`, even though its CLI minimum and coverage reference are unchanged. | Proposed profile | Skill version | Implementation | CLI minimum | Full coverage reference | Policy | |---|---|---|---|---|---| @@ -39,14 +42,16 @@ This worktree proposes TS skill `0.2.1`; it is not a published replacement for s | Public `0.3.2` | `compatible` | `incompatible` | `incompatible` | Published exact legacy tuple checker | | Public `0.3.3` | `compatible` | `compatible` | `incompatible` | Published finite row | | Public `0.3.4` | `compatible` | `compatible` | `incompatible` | Published finite row | -| Draft `0.3.5` | Proposed `compatible` | Proposed `compatible` | Proposed `compatible` | Exact candidate guard row; valid protected fields and healthy bounded input required; not publication evidence | +| Public `0.3.5` | `compatible` | `compatible` | `compatible` | Explicit published guard row; valid protected fields and healthy bounded input required; skill 0.2.1 itself remains unreleased | | Unknown or future combination | No automatic guarantee | No automatic guarantee | No automatic guarantee | No wildcard or arithmetic acceptance | -The runtime proposal is [Draft #144 at `08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb`](https://github.com/abruption/session-peer-ts/blob/08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb/docs/design/typescript-skill-compatibility.md), compiled VERSION `0.3.5`. At that exact source, the design document SHA-256 is `251ba89481297891eab480344d5df556fd0d0fb94a3451f4bb69f01bf5989761` and `src/skill-metadata.ts` SHA-256 is `bd396f92992fcd84f7cea3c690443cba28f4ee09069d2eccdbbcfd21f35bc3f2`. Its [metadata fixtures](https://github.com/abruption/session-peer-ts/blob/08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb/test/skill-metadata.test.ts) explicitly cover all three profiles using the helper default, explicit `undefined`, and outer `inspectSkill`. Static source and fixture review is separate from running those tests, current-head CI, or proving publication; it does not demonstrate real message consumption or ACK. +The [published 0.3.5 design](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/docs/design/typescript-skill-compatibility.md) and [metadata fixtures](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/test/skill-metadata.test.ts) cover the three finite profiles using the compiled VERSION `0.3.5` helper default, explicit `undefined`, and outer `inspectSkill`. Static source and fixture review remains separate from executing those tests or proving live message consumption or ACK. + +Historical review evidence: the 2026-10-13 Draft #144 review used exact source `08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb`; its design document SHA-256 was `251ba89481297891eab480344d5df556fd0d0fb94a3451f4bb69f01bf5989761` and `src/skill-metadata.ts` SHA-256 was `bd396f92992fcd84f7cea3c690443cba28f4ee09069d2eccdbbcfd21f35bc3f2`. The companion candidate at `9db5420b45568dd08fc43d406dbf9ad1952f7891` contained a 13,930-byte SKILL with SHA-256 `96d5a0d049f8a4d193703af3583b198a91079d44ae373de34e94a54e2296a4d6`. These are dated candidate review records, not the current final skill bytes, a release record, or an installation pin. -The proposed doctor requirement for skill 0.2.1 is the explicitly reviewed runtime 0.3.5 row, not the CLI minimum `0.1.0` or full coverage reference `0.3.2`. Optional operations still require the resolved executable's stable TypeScript version marker, affirmative help, and actual platform/native/security/permission prerequisites. Do not alter metadata to conceal an older doctor's rejection. +The doctor requirement for the prepared skill 0.2.1 is the explicitly reviewed and published runtime 0.3.5 row, not the CLI minimum `0.1.0` or full coverage reference `0.3.2`. Optional operations still require the resolved executable's stable TypeScript version marker, affirmative help, and actual platform/native/security/permission prerequisites. Do not alter metadata to conceal an older doctor's rejection. -Before this candidate can be published: review the exact complete skill bytes and finite profile; actually publish the supporting runtime guard; then obtain separate approval to finalize and publish the skill metadata/content/immutable pin. The published skill installation pin remains `8482cf644507c682915e35c85aa3384c53864906` and its release tag remains `session-peer-ts-v0.2.0`. This Draft head is not an installation pin. Four-language runtime guidance and PARITY pin adoption follow the separately approved skill publication. No Python skill, reference pin, 0.4 handoff design, installation, operation, merge, or publication is authorized by this candidate. +The supporting runtime publication gate is complete. Before skill 0.2.1 can be published, review the final complete skill bytes and finite profile and obtain separate approval to finalize and publish its metadata/content/immutable pin. The published skill installation pin remains `8482cf644507c682915e35c85aa3384c53864906` and its release tag remains `session-peer-ts-v0.2.0`. This preparation head is not an installation pin. Four-language runtime guidance and PARITY pin adoption follow the separately approved skill publication. Python skill/reference pins and 0.4 handoff designs remain independent. This document does not authorize installation, operations, merge, or publication. ## Minimum, full features, and guard acceptance @@ -59,7 +64,7 @@ The independent Python contract remains skill 0.3.3, minimum 0.9.1, full 1.0.1, ## Runtime 0.3.3 input and result contract -The same input/result contract applies to published 0.3.4, with its explicit additional runtime-identity row shown above. +The same input/result contract applies to published 0.3.4 and 0.3.5, with the explicit additional runtime/profile rows shown above. The [published limited grammar](https://github.com/abruption/session-peer-ts/blob/c0ed30273b9e9c0049df86ae3c38486a94289527/docs/design/typescript-skill-compatibility.md#limited-grammar-and-results) requires one root name scalar and one metadata map with the required quoted/plain string scalars. This is not a general YAML parser. A root name has no indented non-comment continuation, even across blank/comment lines; orphan indentation is malformed. Unrelated root fields can own ignored indented content. Plain and quoted names work before or after metadata. A literal ASCII space is required after `name:`; following whitespace is removed with `trimStart()`, so a space followed by a tab is accepted, while a tab immediately after the colon is rejected. Metadata separators retain their spaces-only grammar. @@ -73,13 +78,13 @@ The [published limited grammar](https://github.com/abruption/session-peer-ts/blo | Well-formed but unsupported name, profile, or valid runtime identity | `incompatible / skill_contract_mismatch` | `metadata_only` | | Exact supported name/profile/runtime and healthy bounded input | `compatible / skill_contract_compatible` | `metadata_only` | -The outer inspection result preserves `path`. Absent verification means the property is omitted, not `null`. An omitted or explicitly `undefined` pure-helper runtime argument uses the inspecting runtime's compiled VERSION (0.3.3 or 0.3.4) and is not an unavailable-identity fixture. Reader failures precede metadata verdicts. Canonicalization can wrap an earlier path error as `home_resolution_failed`, producing unknown/unreadable instead of the raw errno result; do not collapse all permission errors into unknown. +The outer inspection result preserves `path`. Absent verification means the property is omitted, not `null`. An omitted or explicitly `undefined` pure-helper runtime argument uses the inspecting runtime's compiled VERSION (0.3.3, 0.3.4, or 0.3.5) and is not an unavailable-identity fixture. Reader failures precede metadata verdicts. Canonicalization can wrap an earlier path error as `home_resolution_failed`, producing unknown/unreadable instead of the raw errno result; do not collapse all permission errors into unknown. For historical comparison, public [0.3.2 source](https://github.com/abruption/session-peer-ts/blob/f335f07352c842f2f6ceb12bd2ca6274b52f69f7/src/diagnostics.ts) does not check root name and classifies missing/duplicate/regex-nonmatching required scalars in a single metadata section as incompatible. Its empty/absent frontmatter and zero/multiple maps are unknown. The 0.3.3 parser classification is an intentional change, not a restatement of the older checker. ## Reader bounds and evidence limits -Runtimes 0.3.3 and 0.3.4 count **65,536 whole-file raw UTF-8 bytes**, including BOM, whitespace, line endings, and body. Read requests and allocation are capped at **65,537 bytes**, including one overflow-detection byte. Pre-read stat is an early check; fatal UTF-8 decoding follows bounded reading and stability checks. +Runtimes 0.3.3, 0.3.4, and 0.3.5 count **65,536 whole-file raw UTF-8 bytes**, including BOM, whitespace, line endings, and body. Read requests and allocation are capped at **65,537 bytes**, including one overflow-detection byte. Pre-read stat is an early check; fatal UTF-8 decoding follows bounded reading and stability checks. The reader canonicalizes managed symlinks, verifies regular-file evidence on the opened descriptor, and compares device/inode/size/mtime/ctime and path/alias evidence around the read. Observable growth, truncation, replacement, alias changes, or same-size timestamp changes produce unknown/unreadable. Every opened descriptor is closed. These checks detect observed changes; they do not authenticate content, create an atomic snapshot, protect against a writer restoring identical metadata, or impose a deadline on arbitrary filesystem I/O. @@ -89,6 +94,9 @@ The published [fixtures](https://github.com/abruption/session-peer-ts/blob/c0ed3 ## Review and release record +This historical section records the published skill 0.2.0 release. The 0.2.1 +preparation and its remaining approval gates are described separately above. + The [2026-10-09 design-only acceptance](https://github.com/abruption/session-peer-skill/blob/699a3251830c30c62d0f812363faf4d0eb0c8e0c/docs/typescript-compatibility.md) reviewed exact #126 `ba18bb806a6ba503381259b4255211af3adc0336` and #129 `bfb3d6f1256ab076a76660e08a7bf1ad071a6c6c`. It accepted the finite profiles, parser/status envelopes, G07 correction, and reader fixtures without authorizing publication. The final published source clarifies and fixtures its two nonblocking plain-name-after-map and whitespace details without changing parser behavior. The guard runtime was subsequently published before this successor skill was finalized. The user authorized this skill's versioned release. Its [separate release record](https://github.com/abruption/session-peer-skill/releases/tag/session-peer-ts-v0.2.0) records the final skill commit and content SHA-256. TS runtime guidance and PARITY can then adopt that same reviewed immutable skill pin in a separate runtime-repository change. Existing Python/reference pins remain independent. Runtime and skill adoption stay explicit manager-owned user choices; no postinstall, automatic deployment, PATH replacement, or global update is implied. diff --git a/docs/typescript.md b/docs/typescript.md index ca16792..02f4ee8 100644 --- a/docs/typescript.md +++ b/docs/typescript.md @@ -2,7 +2,7 @@ [Back to README](../README.md) -The separate `session-peer-ts` skill 0.2.1 is an **unpublished documentation candidate** retaining the public CLI guidance through runtime 0.3.4. Its metadata requires the separately reviewed runtime 0.3.5 guard proposal in [Draft PR #144](https://github.com/abruption/session-peer-ts/pull/144), exact source [`08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb`](https://github.com/abruption/session-peer-ts/blob/08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb/src/skill-metadata.ts). That runtime is not yet published; the candidate is not an installation pin. Keep the published skill 0.2.0 source until supporting runtime publication and separate skill release approval. Both runtimes use the command name `session-peer`, so resolve the intended executable and inspect its version and help before use. The TS runtime runs without Python. +The separate `session-peer-ts` skill 0.2.1 is prepared for release review against the **published npm runtime 0.3.5**. Its exact guard source is [`a2057940ba19056fcaaa5551a7820f7414bd3bfa`](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/src/skill-metadata.ts); see the [runtime publication record](https://github.com/abruption/session-peer-ts/releases/tag/v0.3.5). This skill is not yet published and this PR head is not an installation pin. Keep the published skill 0.2.0 source until separate skill release approval. Both runtimes use the command name `session-peer`, so resolve the intended executable and inspect its version and help before use. The TS runtime runs without Python. ## Published support and independent versions @@ -15,15 +15,15 @@ Published 0.2.0 added combined listing, bounded known Codex homes, guarded live- | TS skill `0.2.1` | Unpublished candidate version of `session-peer-ts/SKILL.md` | | Published TS skill `0.2.0` | Existing immutable release and installation pin | | Published TS skill tag `session-peer-ts-v0.2.0` | Keep its recorded source `8482cf644507c682915e35c85aa3384c53864906` until a new release is authorized | -| Candidate tag `session-peer-ts-v0.2.1` | Not created; requires supporting runtime publication and separate skill approval | -| TS runtimes `0.3.3` and `0.3.4` | Published npm package `session-peer`; independent of both skill versions | +| Prepared tag `session-peer-ts-v0.2.1` | Not created; supporting runtime is published, but skill approval and release are still separate | +| TS runtimes `0.3.3`, `0.3.4` and `0.3.5` | Published npm package `session-peer`; independent of both skill versions | | `runtime-min-version` = `0.1.0` | CLI compatibility floor for the explicit baseline commands | | `runtime-full-version` = `0.3.2` | Coverage reference for this revision's published CLI features | -| Candidate doctor acceptance | Unpublished runtime `0.3.5` explicitly accepts skill `0.2.1`; public `0.3.2`, `0.3.3` and `0.3.4` reject it | +| Prepared skill doctor acceptance | Published runtime `0.3.5` explicitly accepts skill `0.2.1`; public `0.3.2`, `0.3.3` and `0.3.4` reject it | The minimum and full values are distinct from security recommendations, latest-version markers, doctor support, and delivery/ACK. Help establishes option presence only; platform/native prerequisites, permissions, allowlists, and writer guards still apply. See the [normative min/full definitions and separate doctor acceptance table](typescript-compatibility.md#minimum-full-features-and-guard-acceptance). -For the published skill 0.2.0, reviewed runtimes 0.3.3 and 0.3.4 support doctor metadata inspection. This candidate skill 0.2.1 is different: all three public runtimes 0.3.2/0.3.3/0.3.4 reject it even when they meet its CLI minimum/full coverage values. Require actual publication of its supporting reviewed runtime before adopting it. The explicit 0.3.5 candidate row does not enable other future versions. Keep the existing package manager and obtain authorization before upgrading; do not edit metadata to hide a mismatch. Unknown future runtime/profile combinations are not automatically accepted. A compatible metadata check is not a content review, source authentication, freshness check, or delivery authorization. +For the published skill 0.2.0, reviewed runtimes 0.3.3 and 0.3.4 support doctor metadata inspection. Prepared skill 0.2.1 is different: public runtimes 0.3.2/0.3.3/0.3.4 reject it even when they meet its CLI minimum/full coverage values. Published runtime 0.3.5 explicitly supports this profile; skill publication and adoption still require separate approval. The exact 0.3.5 row does not enable other future versions. Keep the existing package manager and obtain authorization before upgrading; do not edit metadata to hide a mismatch. Unknown future runtime/profile combinations are not automatically accepted. A compatible metadata check is not a content review, source authentication, freshness check, or delivery authorization. ## Install, update, and remove the skill diff --git a/session-peer-ts/SKILL.md b/session-peer-ts/SKILL.md index 9adeca5..8f671f0 100644 --- a/session-peer-ts/SKILL.md +++ b/session-peer-ts/SKILL.md @@ -24,18 +24,18 @@ Python uses that command name too: if the marker is absent, select the Python sk which installation the user intends. Keep the resolved executable for every following command; do not replace another manager's launcher. -This skill revision is an unpublished 0.2.1 candidate retaining the documented -public CLI features through npm runtime 0.3.4. Its CLI minimum is 0.1.0; its -full-feature coverage reference is 0.3.2. The original 0.1.0 supports only the -historical baseline below. Public runtimes 0.3.2, 0.3.3 and 0.3.4 doctor reject -this new exact metadata profile, even when baseline commands work. The separate -unpublished runtime 0.3.5 candidate explicitly accepts it; this is not current -public support. Before adopting this skill, require actual publication of the -reviewed supporting runtime and a separately approved immutable skill release. -Keep the published skill 0.2.0 pin until then. Any upgrade still requires the +This skill revision is 0.2.1, retaining the documented public CLI features +through npm runtime 0.3.4. Its CLI minimum is 0.1.0; its full-feature coverage +reference is 0.3.2. The original 0.1.0 supports only the historical baseline +below. Public runtimes 0.3.2, 0.3.3 and 0.3.4 doctor reject this exact metadata +profile even when baseline commands work. Published runtime 0.3.5 explicitly +accepts it; use that reviewed runtime for doctor inspection, without inferring +support from a larger version number. Its [exact guard source](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/src/skill-metadata.ts) +and [publication record](https://github.com/abruption/session-peer-ts/releases/tag/v0.3.5) +are separate from this skill's release and do not authorize installation or +sending. Adopt only a separately approved immutable skill release; until it is +published, keep the existing skill 0.2.0 pin. Any upgrade still requires the user's request and the existing package manager. -The [exact 0.3.5 guard candidate](https://github.com/abruption/session-peer-ts/blob/08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb/src/skill-metadata.ts) -is design/source evidence, not publication or authorization to adopt this draft. Do not change metadata to silence an incompatibility. The skill version, npm version, and Python skill/repository tag are independent. Unknown versions or contradictory help require review before using an unverified operation; do not infer features from Python's From a4c1d0c2118682978b67d7691c35e0ff1c3de019 Mon Sep 17 00:00:00 2001 From: YEONGUK LEE Date: Tue, 13 Oct 2026 19:35:04 +0900 Subject: [PATCH 3/4] docs: Make TS skill release guidance time-neutral --- README.ja.md | 2 +- README.ko.md | 2 +- README.md | 2 +- README.zh-CN.md | 2 +- docs/typescript-compatibility.md | 27 ++++++++++++++------------- docs/typescript.md | 18 +++++++++--------- session-peer-ts/SKILL.md | 7 ++++--- 7 files changed, 31 insertions(+), 29 deletions(-) diff --git a/README.ja.md b/README.ja.md index 10328ed..281b401 100644 --- a/README.ja.md +++ b/README.ja.md @@ -46,7 +46,7 @@ npx -y skills@latest update session-peer --global --yes 状態が `queued`（キュー登録済み）または `submitted`（送信済み）でも、受信側がメッセージを消費したことは確認できません。送信結果が不明な場合は自動で再送しないでください。Codex の返信待ちは利用ガイドを参照してください。 -npm 版 TypeScript ランタイム向けに公開されているのは、別の `session-peer-ts` スキル 0.2.0 です。ランタイム 0.3.3、0.3.4、0.3.5 は、このメタデータを認識します。このブランチの `session-peer-ts` スキル 0.2.1 は承認待ちの未公開文書です。公開済みランタイム 0.3.5 の doctor はこのプロファイルに対応していますが、スキル自体はまだ公開されていません。別途承認を受けてスキルを公開するまでは、公開済み 0.2.0 のインストール用コミットを維持してください。エージェント、プロジェクト/グローバルの適用範囲、レビュー済みコミットを指定したインストール手順は [TypeScript 設定ガイド](docs/typescript.md)を参照してください。 +別の `session-peer-ts` スキル 0.2.1 のメタデータプロファイルは、公開済み npm ランタイム 0.3.5 がサポートしています。公開された内容が固定されたスキルリリースを選び、記録されたソースコミットとコンテンツハッシュを確認してください。ランタイムの公開はスキルの公開や更新を意味せず、インストールの許可も与えません。エージェント、プロジェクト/グローバルの適用範囲、レビュー済みコミットを指定したインストール手順は [TypeScript 設定ガイド](docs/typescript.md)を参照してください。 ## ドキュメント diff --git a/README.ko.md b/README.ko.md index 892b440..45f7147 100644 --- a/README.ko.md +++ b/README.ko.md @@ -46,7 +46,7 @@ npx -y skills@latest update session-peer --global --yes `queued` 또는 `submitted` 상태는 수신자가 메시지를 처리했다는 확인이 아닙니다. 제출 결과가 불확실한 경우 자동으로 재전송하지 마세요. Codex 회신 대기 절차는 사용 안내를 참고하세요. -npm TypeScript 런타임용으로 공개된 스킬은 별도의 `session-peer-ts` 스킬 0.2.0이며, 런타임 0.3.3, 0.3.4, 0.3.5가 이 메타데이터를 인식합니다. 이 브랜치의 `session-peer-ts` 스킬 0.2.1은 사람의 승인을 기다리는 미발행 문서입니다. 공개 런타임 0.3.5의 doctor가 이 프로필을 지원하지만 스킬 자체는 아직 발행되지 않았습니다. 별도 승인을 받아 스킬을 발행하기 전까지 공개된 0.2.0의 설치 커밋을 유지하세요. 에이전트, 프로젝트 또는 전역 설치 범위, 검토된 커밋을 명시하는 설치 방법은 [TypeScript 설정 안내](docs/typescript.md)를 참고합니다. +별도의 `session-peer-ts` 스킬 0.2.1 메타데이터 프로필은 공개 npm 런타임 0.3.5가 지원합니다. 공개된 불변 스킬 릴리스를 선택하고 기록된 소스 커밋과 콘텐츠 해시를 확인하세요. 런타임 발행은 스킬을 발행하거나 업데이트하지 않으며 스킬 설치 권한도 부여하지 않습니다. 에이전트, 프로젝트 또는 전역 설치 범위, 검토된 커밋을 명시하는 설치 방법은 [TypeScript 설정 안내](docs/typescript.md)를 참고합니다. ## 문서 diff --git a/README.md b/README.md index 81e0b02..dae05ad 100644 --- a/README.md +++ b/README.md @@ -46,7 +46,7 @@ The runtime command above is for pipx installations; keep using your existing ru A `queued` or `submitted` status does not confirm that the recipient consumed the message. Do not automatically resend after an uncertain submission; see the usage guide for Codex reply waiting. -The separate `session-peer-ts` skill 0.2.0 is the published skill for the npm TypeScript runtime; runtimes 0.3.3, 0.3.4, and 0.3.5 accept its metadata profile. This branch prepares `session-peer-ts` skill 0.2.1 for human approval; its doctor profile is supported by published runtime 0.3.5, but the skill remains unreleased. Keep the published 0.2.0 installation pin until the separately approved skill release. See the [TypeScript setup guide](docs/typescript.md) for an explicit agent, project/global scope, and reviewed commit installation. +The separate `session-peer-ts` skill 0.2.1 has a metadata profile supported by published npm runtime 0.3.5. Select a published immutable skill release and verify its recorded source commit and content hash. Runtime publication does not publish or update the skill or authorize its installation. See the [TypeScript setup guide](docs/typescript.md) for an explicit agent, project/global scope, and reviewed commit installation. ## Docs diff --git a/README.zh-CN.md b/README.zh-CN.md index d5b74e4..d493708 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -46,7 +46,7 @@ npx -y skills@latest update session-peer --global --yes `queued` 或 `submitted` 状态不代表接收方已消费该消息。提交结果不确定时不要自动重发。Codex 回复等待流程请参阅使用指南。 -npm TypeScript 运行时目前使用已发布的独立 `session-peer-ts` 技能 0.2.0；运行时 0.3.3、0.3.4 和 0.3.5 可识别此元数据。本分支的 `session-peer-ts` 技能 0.2.1 尚未发布，正在等待人工批准。已发布运行时 0.3.5 的 doctor 支持该配置，但技能本身仍未发布。在另行获得批准并发布技能之前，请继续使用已发布 0.2.0 的固定安装提交。指定智能体、项目/全局适用范围和经审查提交版本的安装步骤，请参阅 [TypeScript 设置指南](docs/typescript.md)。 +独立的 `session-peer-ts` 技能 0.2.1 元数据配置由已发布的 npm 运行时 0.3.5 支持。请选择已发布且不可变的技能版本，并核对其记录的源码提交和内容哈希。发布运行时不会发布或更新技能，也不代表获准安装技能。指定智能体、项目/全局适用范围和经审查提交版本的安装步骤，请参阅 [TypeScript 设置指南](docs/typescript.md)。 ## 文档 diff --git a/docs/typescript-compatibility.md b/docs/typescript-compatibility.md index 568b93b..37a9e5e 100644 --- a/docs/typescript-compatibility.md +++ b/docs/typescript-compatibility.md @@ -6,7 +6,7 @@ TS skill 0.2.0 uses the successor profile supported by the published npm runtime Published runtime 0.3.4 explicitly retains the same two reviewed profiles; source: [`afed4a5a8945012faf1b23d52cffecb70470a5b3`](https://github.com/abruption/session-peer-ts/blob/afed4a5a8945012faf1b23d52cffecb70470a5b3/src/skill-metadata.ts). Its [release record](https://github.com/abruption/session-peer-ts/releases/tag/v0.3.4) records the npm artifact SHA-256 `6c8cb114485e067ac3e7f5792de7febf3680cb14dcda6e2c67df6cab773ca03c` and [publication workflow run 38194048045](https://github.com/abruption/session-peer-ts/actions/runs/38194048045). These are separate publication records, not a new property of doctor. -Published runtime 0.3.5 adds the explicit finite profile for skill 0.2.1 while retaining 0.1.0 and 0.2.0; source: [`a2057940ba19056fcaaa5551a7820f7414bd3bfa`](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/src/skill-metadata.ts). Its [release record](https://github.com/abruption/session-peer-ts/releases/tag/v0.3.5) identifies the published runtime; the npm tarball SHA-256 is `46f4a01f9570034fca49cfa5fad620f3f45b5f33b1a6714f29ea0a3c1e751ac0`, with registry integrity checked separately. This runtime publication does not publish the companion skill 0.2.1, which remains an unreleased preparation for human approval. +Published runtime 0.3.5 adds the explicit finite profile for skill 0.2.1 while retaining 0.1.0 and 0.2.0; source: [`a2057940ba19056fcaaa5551a7820f7414bd3bfa`](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/src/skill-metadata.ts). Its [release record](https://github.com/abruption/session-peer-ts/releases/tag/v0.3.5) identifies the published runtime; the npm tarball SHA-256 is `46f4a01f9570034fca49cfa5fad620f3f45b5f33b1a6714f29ea0a3c1e751ac0`, with registry integrity checked separately. Runtime publication does not publish or update a companion skill or authorize its installation; select a published skill release using its recorded immutable source and content hash. The Python skill, TS skill, skill release tags, and npm runtime have independent versions. TS skill publication follows the separate `session-peer-ts-vX.Y.Z` tag scheme. A runtime publication does not install or update either skill. @@ -22,36 +22,38 @@ The Python skill, TS skill, skill release tags, and npm runtime have independent | Public `0.3.2` | `compatible` | `incompatible` | Exact legacy metadata tuple; top-level name is not checked | | Public `0.3.3` | `compatible` | `compatible` | Exact supported profile plus valid root `name: session-peer-ts` and bounded readable/stable input | | Public `0.3.4` | `compatible` | `compatible` | Explicit finite legacy/successor row; same root-name, parser and bounded input requirements | -| Public `0.3.5` | `compatible` | `compatible` | Explicit finite row; also accepts the unreleased 0.2.1 profile as shown below | +| Public `0.3.5` | `compatible` | `compatible` | Explicit finite row; also accepts the 0.2.1 profile as shown below | | Unknown or future combination | No automatic guarantee | No automatic guarantee | Review the actual runtime and profile; no wildcard or arithmetic acceptance | Compatible and incompatible structural results carry `verification: metadata_only`. This checks metadata structure/profile support; it does not verify source provenance, content SHA, installation integrity, freshness, CLI feature coverage, permission to send, consumption, or ACK. The npm provenance verification above is separate release evidence, not a property of doctor. Runtime 0.3.3's pure validator rejects a valid but unreviewed runtime identity such as `0.3.4` as `incompatible / skill_contract_mismatch / metadata_only`. This describes the released 0.3.3 validator supplied with identity `0.3.4`, not the published 0.3.4 guard: 0.3.4 explicitly adds that reviewed runtime row. Use an explicitly reviewed runtime row (0.3.3, 0.3.4, or 0.3.5) for the published 0.2.0 successor doctor check; no other future identity is accepted by inference. An older CLI can meet the minimum while its doctor rejects this newer metadata profile; do not edit metadata to hide that result. Runtime adoption remains a user-authorized operation under the existing package manager. -## Unreleased skill 0.2.1 and published runtime 0.3.5 +## Skill 0.2.1 and published runtime 0.3.5 -This worktree prepares TS skill `0.2.1` for human approval; it is not a published replacement for skill `0.2.0`. Runtime 0.3.5 has published its support for this profile, but the existing published skill release remains 0.2.0. Public runtimes 0.3.2, 0.3.3, and 0.3.4 reject the proposed 0.2.1 profile as `incompatible / skill_contract_mismatch / metadata_only`, even though its CLI minimum and coverage reference are unchanged. +Runtime 0.3.5 explicitly supports the TS skill `0.2.1` metadata profile. Profile support alone does not establish that particular skill bytes are published or approved for installation. Public runtimes 0.3.2, 0.3.3, and 0.3.4 reject the 0.2.1 profile as `incompatible / skill_contract_mismatch / metadata_only`, even though its CLI minimum and coverage reference are unchanged. -| Proposed profile | Skill version | Implementation | CLI minimum | Full coverage reference | Policy | +| Profile | Skill version | Implementation | CLI minimum | Full coverage reference | Policy | |---|---|---|---|---|---| -| Draft successor revision | `0.2.1` | `typescript` | `0.1.0` | `0.3.2` | `probe-help` | +| Successor revision | `0.2.1` | `typescript` | `0.1.0` | `0.3.2` | `probe-help` | -| Inspecting runtime | Legacy `0.1.0` | Published successor `0.2.0` | Draft successor `0.2.1` | Evidence scope | +| Inspecting runtime | Legacy `0.1.0` | Published successor `0.2.0` | Successor revision `0.2.1` | Evidence scope | |---|---|---|---|---| | Public `0.3.2` | `compatible` | `incompatible` | `incompatible` | Published exact legacy tuple checker | | Public `0.3.3` | `compatible` | `compatible` | `incompatible` | Published finite row | | Public `0.3.4` | `compatible` | `compatible` | `incompatible` | Published finite row | -| Public `0.3.5` | `compatible` | `compatible` | `compatible` | Explicit published guard row; valid protected fields and healthy bounded input required; skill 0.2.1 itself remains unreleased | +| Public `0.3.5` | `compatible` | `compatible` | `compatible` | Explicit published guard row; valid protected fields and healthy bounded input required; separate skill-release evidence required for installation | | Unknown or future combination | No automatic guarantee | No automatic guarantee | No automatic guarantee | No wildcard or arithmetic acceptance | The [published 0.3.5 design](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/docs/design/typescript-skill-compatibility.md) and [metadata fixtures](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/test/skill-metadata.test.ts) cover the three finite profiles using the compiled VERSION `0.3.5` helper default, explicit `undefined`, and outer `inspectSkill`. Static source and fixture review remains separate from executing those tests or proving live message consumption or ACK. -Historical review evidence: the 2026-10-13 Draft #144 review used exact source `08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb`; its design document SHA-256 was `251ba89481297891eab480344d5df556fd0d0fb94a3451f4bb69f01bf5989761` and `src/skill-metadata.ts` SHA-256 was `bd396f92992fcd84f7cea3c690443cba28f4ee09069d2eccdbbcfd21f35bc3f2`. The companion candidate at `9db5420b45568dd08fc43d406dbf9ad1952f7891` contained a 13,930-byte SKILL with SHA-256 `96d5a0d049f8a4d193703af3583b198a91079d44ae373de34e94a54e2296a4d6`. These are dated candidate review records, not the current final skill bytes, a release record, or an installation pin. +Historical review evidence: the 2026-10-13 Draft #144 review used exact source `08c507ca1c2a3805b189ee05bfdd32b0d3d2dacb`; its design document SHA-256 was `251ba89481297891eab480344d5df556fd0d0fb94a3451f4bb69f01bf5989761` and `src/skill-metadata.ts` SHA-256 was `bd396f92992fcd84f7cea3c690443cba28f4ee09069d2eccdbbcfd21f35bc3f2`. The companion candidate at `9db5420b45568dd08fc43d406dbf9ad1952f7891` contained a 13,930-byte SKILL with SHA-256 `96d5a0d049f8a4d193703af3583b198a91079d44ae373de34e94a54e2296a4d6`. These are dated candidate review records, not evidence for any later final skill bytes, a release record, or an installation pin. + +The doctor requirement for skill 0.2.1 is the explicitly reviewed and published runtime 0.3.5 row, not the CLI minimum `0.1.0` or full coverage reference `0.3.2`. Optional operations still require the resolved executable's stable TypeScript version marker, affirmative help, and actual platform/native/security/permission prerequisites. Do not alter metadata to conceal an older doctor's rejection. -The doctor requirement for the prepared skill 0.2.1 is the explicitly reviewed and published runtime 0.3.5 row, not the CLI minimum `0.1.0` or full coverage reference `0.3.2`. Optional operations still require the resolved executable's stable TypeScript version marker, affirmative help, and actual platform/native/security/permission prerequisites. Do not alter metadata to conceal an older doctor's rejection. +For a skill release, review the exact complete skill bytes and finite profile, verify actual supporting-runtime publication, and obtain separate approval for the skill metadata/content/immutable source. For installation, select a published immutable skill release and verify its recorded source commit and content SHA-256; a Draft or review checkpoint is not release evidence. Four-language runtime guidance and PARITY pin adoption follow the separately approved skill publication. Python skill/reference pins and 0.4 handoff designs remain independent. This document does not authorize installation, operations, merge, or publication. -The supporting runtime publication gate is complete. Before skill 0.2.1 can be published, review the final complete skill bytes and finite profile and obtain separate approval to finalize and publish its metadata/content/immutable pin. The published skill installation pin remains `8482cf644507c682915e35c85aa3384c53864906` and its release tag remains `session-peer-ts-v0.2.0`. This preparation head is not an installation pin. Four-language runtime guidance and PARITY pin adoption follow the separately approved skill publication. Python skill/reference pins and 0.4 handoff designs remain independent. This document does not authorize installation, operations, merge, or publication. +Historical checkpoint (2026-10-13): runtime 0.3.5 had been published, while companion skill 0.2.1 was an unreleased preparation awaiting human approval. At that checkpoint, the published TS skill 0.2.0 release tag was `session-peer-ts-v0.2.0` and its source commit was `8482cf644507c682915e35c85aa3384c53864906`. This dated record does not determine the current release state or prescribe an ongoing installation default. ## Minimum, full features, and guard acceptance @@ -94,8 +96,7 @@ The published [fixtures](https://github.com/abruption/session-peer-ts/blob/c0ed3 ## Review and release record -This historical section records the published skill 0.2.0 release. The 0.2.1 -preparation and its remaining approval gates are described separately above. +This historical section records the published skill 0.2.0 release on 2026-10-09. Release-selection requirements and the dated 0.2.1 review checkpoint are described separately above. The [2026-10-09 design-only acceptance](https://github.com/abruption/session-peer-skill/blob/699a3251830c30c62d0f812363faf4d0eb0c8e0c/docs/typescript-compatibility.md) reviewed exact #126 `ba18bb806a6ba503381259b4255211af3adc0336` and #129 `bfb3d6f1256ab076a76660e08a7bf1ad071a6c6c`. It accepted the finite profiles, parser/status envelopes, G07 correction, and reader fixtures without authorizing publication. The final published source clarifies and fixtures its two nonblocking plain-name-after-map and whitespace details without changing parser behavior. diff --git a/docs/typescript.md b/docs/typescript.md index 02f4ee8..26c6c1e 100644 --- a/docs/typescript.md +++ b/docs/typescript.md @@ -2,7 +2,7 @@ [Back to README](../README.md) -The separate `session-peer-ts` skill 0.2.1 is prepared for release review against the **published npm runtime 0.3.5**. Its exact guard source is [`a2057940ba19056fcaaa5551a7820f7414bd3bfa`](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/src/skill-metadata.ts); see the [runtime publication record](https://github.com/abruption/session-peer-ts/releases/tag/v0.3.5). This skill is not yet published and this PR head is not an installation pin. Keep the published skill 0.2.0 source until separate skill release approval. Both runtimes use the command name `session-peer`, so resolve the intended executable and inspect its version and help before use. The TS runtime runs without Python. +The separate `session-peer-ts` skill 0.2.1 documents the npm TypeScript runtime and its independently versioned metadata profile. Published runtime 0.3.5 supports this exact profile; its guard source is [`a2057940ba19056fcaaa5551a7820f7414bd3bfa`](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/src/skill-metadata.ts), with a separate [runtime publication record](https://github.com/abruption/session-peer-ts/releases/tag/v0.3.5). Runtime publication does not publish, install, update or authorize adoption of the skill. Select a separately approved, published immutable skill release and its recorded source/hash as described below. Both runtimes use the command name `session-peer`, so resolve the intended executable and inspect its version and help before use. The TS runtime runs without Python. ## Published support and independent versions @@ -11,23 +11,23 @@ Published 0.2.0 added combined listing, bounded known Codex homes, guarded live- | Version | Meaning | |---|---| | Python repository tag `v0.3.3` | Independent published Python skill release | -| Python skill `0.3.3` | Version of `session-peer/SKILL.md`; unchanged by this TS candidate | -| TS skill `0.2.1` | Unpublished candidate version of `session-peer-ts/SKILL.md` | -| Published TS skill `0.2.0` | Existing immutable release and installation pin | -| Published TS skill tag `session-peer-ts-v0.2.0` | Keep its recorded source `8482cf644507c682915e35c85aa3384c53864906` until a new release is authorized | -| Prepared tag `session-peer-ts-v0.2.1` | Not created; supporting runtime is published, but skill approval and release are still separate | +| Python skill `0.3.3` | Independent version of `session-peer/SKILL.md` | +| TS skill `0.2.1` | Version declared by `session-peer-ts/SKILL.md`; metadata alone is not publication evidence | +| Historical TS skill `0.2.0` | Separately published revision from 2026-10-09 | +| Historical tag `session-peer-ts-v0.2.0` | Its 2026-10-09 release records source `8482cf644507c682915e35c85aa3384c53864906`; this is not a pin for revision 0.2.1 | +| Revision tag `session-peer-ts-v0.2.1` | Verify a published, approved release and its recorded source/hash before selecting it; a tag name or PR head alone is insufficient | | TS runtimes `0.3.3`, `0.3.4` and `0.3.5` | Published npm package `session-peer`; independent of both skill versions | | `runtime-min-version` = `0.1.0` | CLI compatibility floor for the explicit baseline commands | | `runtime-full-version` = `0.3.2` | Coverage reference for this revision's published CLI features | -| Prepared skill doctor acceptance | Published runtime `0.3.5` explicitly accepts skill `0.2.1`; public `0.3.2`, `0.3.3` and `0.3.4` reject it | +| Skill doctor acceptance | Published runtime `0.3.5` explicitly accepts skill `0.2.1`; public `0.3.2`, `0.3.3` and `0.3.4` reject it | The minimum and full values are distinct from security recommendations, latest-version markers, doctor support, and delivery/ACK. Help establishes option presence only; platform/native prerequisites, permissions, allowlists, and writer guards still apply. See the [normative min/full definitions and separate doctor acceptance table](typescript-compatibility.md#minimum-full-features-and-guard-acceptance). -For the published skill 0.2.0, reviewed runtimes 0.3.3 and 0.3.4 support doctor metadata inspection. Prepared skill 0.2.1 is different: public runtimes 0.3.2/0.3.3/0.3.4 reject it even when they meet its CLI minimum/full coverage values. Published runtime 0.3.5 explicitly supports this profile; skill publication and adoption still require separate approval. The exact 0.3.5 row does not enable other future versions. Keep the existing package manager and obtain authorization before upgrading; do not edit metadata to hide a mismatch. Unknown future runtime/profile combinations are not automatically accepted. A compatible metadata check is not a content review, source authentication, freshness check, or delivery authorization. +For the published skill 0.2.0, reviewed runtimes 0.3.3 and 0.3.4 support doctor metadata inspection. Skill 0.2.1 is different: public runtimes 0.3.2/0.3.3/0.3.4 reject it even when they meet its CLI minimum/full coverage values. Published runtime 0.3.5 explicitly supports this profile; skill publication and adoption still require separate approval. The exact 0.3.5 row does not enable other future versions. Keep the existing package manager and obtain authorization before upgrading; do not edit metadata to hide a mismatch. Unknown future runtime/profile combinations are not automatically accepted. A compatible metadata check is not a content review, source authentication, freshness check, or delivery authorization. ## Install, update, and remove the skill -The commands below are for the existing published skill 0.2.0, not this candidate. Choose the reviewed **40-character commit SHA** from the [TS skill release](https://github.com/abruption/session-peer-skill/releases/tag/session-peer-ts-v0.2.0), agent (`codex` or `claude-code`), and scope explicitly. The release records the peeled tag commit and SHA-256 of the canonical TS `SKILL.md`. Run in the intended project; omitting `--global` selects project scope. Inspect existing files before accepting an overwrite. For global scope add `--global` consistently to add/list/remove. Codex uses the shared `.agents/skills` directory, so agent selection is not an isolation boundary from other clients that discover that directory. +Choose the skill version, agent (`codex` or `claude-code`), and scope explicitly. Find the selected TS tag in the [skill release catalog](https://github.com/abruption/session-peer-skill/releases) and verify its approved publication, recorded peeled tag commit, and canonical TS `SKILL.md` SHA-256. For this revision, the tag name is `session-peer-ts-v0.2.1`; if its publication or source/hash record cannot be verified, stop rather than using a Draft/PR head or a guessed future pin. Replace `REVIEWED_COMMIT` below with that verified **40-character commit SHA**, and compare the copied skill bytes to the release hash. Run in the intended project; omitting `--global` selects project scope. Inspect existing files before accepting an overwrite. For global scope add `--global` consistently to add/list/remove. Codex uses the shared `.agents/skills` directory, so agent selection is not an isolation boundary from other clients that discover that directory. ```sh npx -y skills@1.7.0 add https://github.com/abruption/session-peer-skill/tree/REVIEWED_COMMIT/session-peer-ts \ diff --git a/session-peer-ts/SKILL.md b/session-peer-ts/SKILL.md index 8f671f0..3136456 100644 --- a/session-peer-ts/SKILL.md +++ b/session-peer-ts/SKILL.md @@ -33,9 +33,10 @@ accepts it; use that reviewed runtime for doctor inspection, without inferring support from a larger version number. Its [exact guard source](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/src/skill-metadata.ts) and [publication record](https://github.com/abruption/session-peer-ts/releases/tag/v0.3.5) are separate from this skill's release and do not authorize installation or -sending. Adopt only a separately approved immutable skill release; until it is -published, keep the existing skill 0.2.0 pin. Any upgrade still requires the -user's request and the existing package manager. +sending. Adopt only a separately approved immutable skill release and its +recorded source pin. Runtime publication does not publish or install this +skill. Any upgrade still requires the user's request and the existing package +manager. Do not change metadata to silence an incompatibility. The skill version, npm version, and Python skill/repository tag are independent. Unknown versions or contradictory help require review before using an unverified operation; do not infer features from Python's From dc303b513d9da862f2ce21d648e168fdd847ae95 Mon Sep 17 00:00:00 2001 From: YEONGUK LEE Date: Tue, 13 Oct 2026 19:46:01 +0900 Subject: [PATCH 4/4] docs: Include runtime 0.3.5 in active reader guidance --- docs/typescript.md | 2 +- session-peer-ts/SKILL.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/typescript.md b/docs/typescript.md index 26c6c1e..11416ad 100644 --- a/docs/typescript.md +++ b/docs/typescript.md @@ -44,7 +44,7 @@ The TS metadata uses `runtime-implementation: "typescript"` and `runtime-capabil Resolve the executable before discovery. Explicit JSON remains a safe baseline; operations have no default output format. See the [agent instructions](../session-peer-ts/SKILL.md) for discovery, dry-run, SSH, and reply boundaries, and the [published CLI help](https://github.com/abruption/session-peer-ts/blob/afed4a5a8945012faf1b23d52cffecb70470a5b3/src/help.ts) for supported flags. -`doctor --json` performs read-only diagnostics; `ok:true` can coexist with `ready:false`. Skill inspection in runtimes 0.3.3 and 0.3.4 bounds whole-file UTF-8 reads to 65,536 bytes, with at most 65,537 bytes for overflow detection, and checks regular-file, descriptor/path, and observable stability evidence. It reads body bytes but interprets only frontmatter; `metadata_only` does not execute instructions, install, update, or make network requests. It does not authenticate content, freeze an atomic snapshot, or impose a deadline on arbitrary filesystem I/O. Public 0.3.2 had only a 64 KiB pre-read size check. See the [published compatibility contract and status table](typescript-compatibility.md); permission errors remain distinct from unknown input. +`doctor --json` performs read-only diagnostics; `ok:true` can coexist with `ready:false`. Skill inspection in runtimes 0.3.3, 0.3.4 and 0.3.5 bounds whole-file UTF-8 reads to 65,536 bytes, with at most 65,537 bytes for overflow detection, and checks regular-file, descriptor/path, and observable stability evidence. It reads body bytes but interprets only frontmatter; `metadata_only` does not execute instructions, install, update, or make network requests. It does not authenticate content, freeze an atomic snapshot, or impose a deadline on arbitrary filesystem I/O. Public 0.3.2 had only a 64 KiB pre-read size check. See the [published compatibility contract and status table](typescript-compatibility.md); permission errors remain distinct from unknown input. `doctor --check-return-route` is a separate, explicitly requested SSH probe. Metadata compatibility and forward SSH reachability do not prove that a send is authorized or that a return route works. diff --git a/session-peer-ts/SKILL.md b/session-peer-ts/SKILL.md index 3136456..4e2ad54 100644 --- a/session-peer-ts/SKILL.md +++ b/session-peer-ts/SKILL.md @@ -111,7 +111,7 @@ Skill checks report structural metadata compatibility, not freshness, authentic source, functional verification, or message readiness. `verification: metadata_only` means skill instructions/references are not executed and the skill check does not install, update, or make network requests. It is not a privacy guarantee -that body bytes are unread. Runtimes 0.3.3 and 0.3.4 bound whole-file UTF-8 reads to 65,536 +that body bytes are unread. Runtimes 0.3.3, 0.3.4 and 0.3.5 bound whole-file UTF-8 reads to 65,536 bytes, with a 65,537-byte overflow-detection buffer, and check regular-file, descriptor/path, and observable stability evidence before interpreting metadata. It does not authenticate content, freeze an atomic snapshot, protect against a