fix: preserve reviewed versions in archive metadata

CHANGELOG.md

@@ -11,6 +11,12 @@ Component artifacts are versioned and released independently via git tags:
 - **`super-agent` CLI** — `cli-v*` tags publish cross-platform binaries.
 - **`@superagentskill/sdk`** — versioned in `packages/sdk-ts/package.json`.
 
+## [0.6.1] — 2026-10-23 — *Genesis* (alpha) — Maintenance release
+
+### Changed
+
+- bind optional archive metadata to the reviewed version
+
 ## [0.6.0] — 2026-10-23 — *Genesis* (alpha) — Feature update
 
 ### Changed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "tanstack_start_ts",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "private": true,
   "sideEffects": false,
   "type": "module",

plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "superagentskill",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Agent skills and candidate workflows from Super Agent Skill. Published registry packages expose available trust and execution evidence; candidate workflows include offline fixtures.",
   "author": {
     "name": "Super Agent Skill",

src/lib/plugins/artifacts.ts

@@ -48,3 +48,13 @@ export function verifyArtifact(files: unknown, digest: string): Record<string, s
   if (artifactDigest(parsed) !== digest) throw new Error("Bundle integrity check failed");
   return parsed;
 }
+
+/** Bind optional source-manifest metadata to the immutable registry version without rewriting files. */
+export function bindManifestVersion<T extends { version?: string }>(
+  manifest: T,
+  version: string,
+): T & { version: string } {
+  if (manifest.version !== undefined && manifest.version !== version)
+    throw new Error("Archive manifest version does not match its reviewed registry version");
+  return { ...manifest, version };
+}

src/lib/plugins/package.server.ts

@@ -1,4 +1,4 @@
-import { verifyArtifact } from "./artifacts";
+import { verifyArtifact, bindManifestVersion } from "./artifacts";
 /**
  * Builds an Agent Plugins v1 portable package for a published catalog item.
  * Server-only: reads the live registry and reuses the SKILL.md serializer.
@@ -62,16 +62,12 @@ export async function loadPluginPackage(
     const files = new Map(Object.entries(verifyArtifact(artifact.files, artifact.sha256)));
     const { runPluginConformance } = await import("./conformance");
     const report = runPluginConformance(files);
-    if (
-      !report.conformant ||
-      !report.manifest ||
-      (report.manifest.version ?? "0.1.0") !== ver.version
-    )
+    if (!report.conformant || !report.manifest)
       throw new Error("Stored package failed conformance");
     return {
       slug: pkg.slug,
       pluginName: report.manifest.name,
-      manifest: report.manifest,
+      manifest: bindManifestVersion(report.manifest, ver.version),
       mcp: files.has("mcp.json")
         ? (JSON.parse(files.get("mcp.json")!) as McpConfig)
         : buildMcpConfig(),

src/lib/version.ts

@@ -12,7 +12,7 @@
  * We are still pre-1.0: rapid evolution, no stability guarantees.
  */
 
-export const PLATFORM_VERSION = "0.6.0" as const;
+export const PLATFORM_VERSION = "0.6.1" as const;
 export const PLATFORM_CODENAME = "Genesis" as const;
 export const PLATFORM_STAGE: "alpha" | "beta" | "ga" = "alpha";
 export const PLATFORM_BUILD_DATE = "2026-10-23" as const;
@@ -30,6 +30,13 @@ export type ChangelogEntry = {
  * Every deployed change appends a new entry (or amends the top one before shipping).
  */
 export const CHANGELOG: ChangelogEntry[] = [
+  {
+    version: "0.6.1",
+    date: "2026-10-23",
+    kind: "patch",
+    title: "Maintenance release",
+    highlights: ["bind optional archive metadata to the reviewed version"],
+  },
   {
     version: "0.6.0",
     date: "2026-10-23",

tests/business-platform.test.ts

@@ -215,3 +215,18 @@ test("business relevance beats unrelated popularity while preserving the trust f
     false,
   );
 });
+
+import { bindManifestVersion } from "../src/lib/plugins/artifacts.ts";
+test("optional source manifest version uses the reviewed registry version without rewriting source", () => {
+  const source = { name: "portable-skill" };
+  assert.deepEqual(bindManifestVersion(source, "0.1.0"), {
+    name: "portable-skill",
+    version: "0.1.0",
+  });
+  assert.equal(bindManifestVersion(source, "1.2.3").version, "1.2.3");
+  assert.deepEqual(source, { name: "portable-skill" });
+  assert.throws(
+    () => bindManifestVersion({ version: "2.0.0" }, "0.1.0"),
+    /reviewed registry version/,
+  );
+});