docs: record verified 0.4.0 publication

[abruption]

Summary

Refs #150; follows merged release preparation #151.

Record the verified public session-peer 0.4.0 release in VALIDATION.md, RELEASING.md, PARITY.md and the skill compatibility design. Historical records are preserved. This documentation commit is later than the immutable npm/tag source and must not be used to replace that publication source.

• npm latest 0.4.0; preview 0.1.0-preview.1 unchanged.
• Exact publication source: dde3923efe116f87f38b1639b29b889d2b832e44.
• Workflow 39077096491 attempt 1, user-approved stage 414547b1-1b55-45dc-a0a4-9ca40407beec.
• Reviewed/local/Actions/staged/public tarballs byte-identical: SHA256 84adc8b50ef8f03a2c2170e3c36a97b573f28a6bcbeb7dbc965e16c3b37a57c9.
• Registry signature audit, full Sigstore signature/certificate/transparency/identity-issuer verification, payload source/subject/run matching and isolated install/list/removal passed. All 71 allowlisted files and 18 packaged Markdown byte matches checked.
• Annotated tag object 7aad7bc6400499fbc1c323bd62f2210b3507fc9a peels to the publication source; GitHub v0.4.0 is published as Latest.
• Fresh stage-only publisher inspection is distinguished from the user-waived web publish-2FA policy read. Actual environment and final npm approvals were completed; no token/protection bypass.
• Separately installed public 0.4.0 pure validator accepted published skill 0.2.1 and exact complete a969 candidate 0.3.0 bytes with default/undefined/explicit/outer inspection; old/future negatives preserved. The isolated installation was removed. No candidate instruction/native/model/ACK test, skill publication or pin adoption is implied.

Validation

node scripts/check-repository.mjs and git diff --check pass. These four Markdown additions do not change runtime/package/lock/workflows/fixtures, so no additional local runtime suite was run. Exact head 08b24db4ab750cf02efbc00e402fe61d0d7ef488: CI 12/12 SUCCESS including Windows native 22/24, CLI39078137472 and CodeQL39078135932, with no rerun. Both current-head automatic Code/Security reviews completed without findings. Actual release validation and historical platform/native boundaries are recorded precisely in the documents.

Boundaries

Documentation only. No new package/version/tag, npm dispatch, skill publication, installation or operations change. Existing npm 0.4.0, its tag and release continue to identify the original source dde3923. This PR remains for human review/merge; no automatic merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T23:14:10.954657Z	08b24db	PR opened
🔒 Security Review	✅ Completed 2026-10-17T23:14:37.284975Z	08b24db	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[abruption]

Exact canonical skill finalization review — 2026-10-18 KST

Companion Draft37 head eb7a1a903e14b35be140e4eec91847dbc3f9d4c8 now prepares canonical session-peer-ts/SKILL.md:22,839 raw UTF-8 bytes, SHA256 c510bcfee1d4d1f9c3a992d7ad25d69c9a9881950c627eec60f3b45659071b9e. Setup, compatibility, operational handoff guide and manifest hashes matched the transmitted exact values. Direct source/document comparison and a separate read-only review found no new normative blocker; these exact contents/profile were accepted for design/content only.

The verified public0.4.0 tarball was separately installed into a temporary prefix. Its actual bundled validator accepted the NEW canonical whole bytes with compiled default, explicit undefined, explicit0.4.0 and outer inspectSkill: compatible/skill_contract_compatible/metadata_only. Historical0.3.2–0.3.6 and unreviewed0.3.7/0.4.1/0.5.0 identities rejected the new profile; malformed identities returned unknown/skill_metadata_missing without verification. Candidate instructions/native/model/send/ACK were not executed, no user skill was installed, and the temporary package prefix was removed.

This does not publish/install the skill, grant merge/tag/release permission or adopt an installation pin. The original runtime publication/tag source remains dde3923; subsequent verification main98074a0 is documentation only. The user-confirmed skill session received one queued acceptance report under STS-040-SKILL-CANDIDATE-20261017-A; queued is not consumption or agreement. Current-head review and separate human skill-publication approval remain the receiving repository's gates. This comment changes no TS source/artifact or already merged documentation.