release: prepare SkillSync 0.2.0 installable archive

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.2.0 - 2026-10-19
+
+- Distribute exact citation digest/revision checks in the installable GitHub CLI
+  archive, retaining bounded read-only checks and privacy-safe HTML review.
+- Align package metadata, CLI version and current installation examples. The
+  public npm registry remains 0.1.0; previous GitHub releases are preserved.
+
 ## Unreleased source - 2026-10-18
 
 - Extend `reference_exists` with optional exact metadata bindings, such as a

README.md

@@ -2,17 +2,14 @@
 
 **Verify Agent Skills before you trust them.** SkillSync checks a local Skill's provenance, compatibility, and changes without executing it.
 
-> **Alpha · GitHub release v0.1.7 · Node.js 20+**
+> **Alpha · GitHub release v0.2.0 · Node.js 20+**
 > SkillSync performs offline checks of local Skill content. It does not execute Skill scripts, does not read credentials, and does not enable live provider, remote-worker, or runtime capabilities.
 
-GitHub v0.1.7 adds an offline human acceptance report on top of bounded composite-key reconciliation.
-Use `artifacts --compare <previous-artifacts.json>` to review whether a corrected
-delivery resolves finding categories or improves individual reconciliation counts.
-Changed contracts and incomplete history remain unavailable, without copying old
-messages or record values. See the [correction review guide](docs/artifact-delivery.md#review-a-correction-against-its-previous-report).
-The published GitHub package is v0.1.7 and includes these capabilities.
-The public npm registry remains at 0.1.0; use the verified GitHub archive below
-for the new features. This release is distributed through GitHub.
+GitHub v0.2.0 binds citations to exact source metadata, including digest and
+revision, and retains the offline human acceptance report, correction review
+and bounded composite-key reconciliation. Mismatched metadata produces an
+explicit finding without copying record values into the report. The npm
+registry remains at 0.1.0; use the verified GitHub archive for current features.
 
 [![Terminal demo](https://raw.githubusercontent.com/Chumaniac/skillsync/main/docs/assets/verify-demo.svg)](https://github.com/Chumaniac/skillsync/blob/main/docs/assets/verify-demo.svg)
 
@@ -22,24 +19,21 @@ for the new features. This release is distributed through GitHub.
 
 Tagged builds now publish a CLI tarball, checksums, a validated CycloneDX SBOM
 and a source manifest on [GitHub Releases](https://github.com/Chumaniac/skillsync/releases).
-[GitHub v0.1.7](https://github.com/Chumaniac/skillsync/releases/tag/v0.1.7)
-is published from main commit `7d302f3f69f007c94abfaf427e960c35b9e8b1fc`.
-[Release run 38862793975](https://github.com/Chumaniac/skillsync/actions/runs/38862793975)
-passed source/main binding, tests, package allowlist, SBOM and provenance checks.
-The downloaded archive, SBOM and source manifest matched all three checksums;
-GitHub attestation verification and an isolated install passed. The installed
-0.1.7 CLI generated the offline HTML review with the same findings and exit code
-as JSON, without exposing local paths or executing a Skill.
+[GitHub v0.2.0](https://github.com/Chumaniac/skillsync/releases/tag/v0.2.0)
+is distributed as a versioned CLI tarball with checksums, SBOM, source manifest
+and GitHub provenance. Its release workflow requires the exact immutable tag
+and an already successful main check before packaging. Earlier v0.1.7 assets
+and their dated verification evidence remain in the changelog and GitHub Releases.
 Installation uses Node.js 20+ and fetches the package's public dependencies;
 it needs no npm login.
 
 ```bash
-release_base="https://github.com/Chumaniac/skillsync/releases/download/v0.1.7"
-for asset in chumanic-skillsync-0.1.7.tgz checksums.txt sbom.cyclonedx.json release-manifest.json; do
+release_base="https://github.com/Chumaniac/skillsync/releases/download/v0.2.0"
+for asset in chumanic-skillsync-0.2.0.tgz checksums.txt sbom.cyclonedx.json release-manifest.json; do
   curl --fail --location --output "$asset" "$release_base/$asset"
 done
 shasum -a 256 -c checksums.txt
-npm install --prefix ./skillsync-tools ./chumanic-skillsync-0.1.7.tgz
+npm install --prefix ./skillsync-tools ./chumanic-skillsync-0.2.0.tgz
 ./skillsync-tools/node_modules/.bin/skillsync --version
 ```
 
@@ -57,7 +51,7 @@ npm install -g @chumanic/skillsync@0.1.0
 skillsync verify --path . --target codex
 ```
 
-**From source (0.1.7):**
+**From source (0.2.0):**
 
 ```bash
 git clone https://github.com/Chumaniac/skillsync.git
@@ -71,11 +65,11 @@ The command above verifies the included sample Skill. Replace the fixture path w
 
 ## What you get
 
-- Current source can bind a citation to its exact declared source metadata with
+- v0.2.0 can bind a citation to its exact declared source metadata with
   `reference_exists.matches`. An existing ID with a different digest or revision
   fails offline inspection without exposing record values. See the
   [synthetic citation example](fixtures/product/citation-metadata/README.md).
-  This feature requires a source build and is not in GitHub v0.1.7 or npm 0.1.0.
+  Install GitHub v0.2.0 or build the source; GitHub v0.1.7 and npm 0.1.0 lack this feature.
 
 - v0.1.7 produces an offline acceptance report with `artifacts --format html`.
   Reviewers see file binding, failed or incomplete identity checks, affected

docs/artifact-delivery.md

@@ -295,7 +295,7 @@ production/business integration.
 
 ## Bind citations to exact source metadata
 
-Status: current source, not included in the published GitHub v0.1.7 package.
+Status: included in GitHub v0.2.0; absent from GitHub v0.1.7 and npm 0.1.0.
 
 A valid source ID alone does not establish that a citation uses the reviewed
 revision or digest. Add an optional `matches` array to `reference_exists`:

fixtures/product/citation-metadata/README.md

@@ -1,6 +1,6 @@
 # Citation metadata example
 
-Status: current source; not in the published v0.1.7 package.
+Status: included in GitHub v0.2.0; absent from v0.1.7.
 
 This original synthetic catalog binds each citation ID to the declared source
 row and checks the exact digest and revision strings. It does not fetch a
@@ -11,7 +11,7 @@ skillsync artifacts --contract fixtures/product/citation-metadata/contract.json
   --path fixtures/product/citation-metadata/artifacts --format html > review.html
 ```
 
-A source build is required. In a copied artifact directory, change a citation's
+Use GitHub v0.2.0 or a source build. In a copied artifact directory, change a citation's
 revision from `r1` to `r2` while keeping its source ID. The current-source check
 reports `artifact.reference-value-mismatch`, the CSV data-record position and
 the declared metadata columns. It does not copy the ID or cell values into

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chumanic/skillsync",
-  "version": "0.1.7",
+  "version": "0.2.0",
   "private": false,
   "publishConfig": {
     "access": "public"

tests/cli/help.test.ts

@@ -12,7 +12,7 @@ describe("skillsync CLI", () => {
   it("reports the installed source version and lists the verification commands", async () => {
     const version = await runCli(["--version"]);
     expect(version.exitCode).toBe(0);
-    expect(version.stdout).toBe("0.1.7\n");
+    expect(version.stdout).toBe("0.2.0\n");
 
     const result = await runCli(["--help"]);
 

tests/cli/report.test.ts

@@ -255,7 +255,7 @@ describe("skillsync report", () => {
 
     const json = await runCli(["report", "--before", beforePath, "--after", afterPath, "--format", "json"]);
     expect(JSON.parse(json.stdout).conclusion).toBe("verified");
-    expect(JSON.parse(json.stdout).toolVersion).toBe("0.1.7");
+    expect(JSON.parse(json.stdout).toolVersion).toBe("0.2.0");
 
     const sarif = await runCli(["report", "--before", beforePath, "--after", afterPath, "--format", "sarif"]);
     const parsedSarif = JSON.parse(sarif.stdout) as {
@@ -266,7 +266,7 @@ describe("skillsync report", () => {
       }>;
     };
     expect(parsedSarif.version).toBe("2.1.0");
-    expect(parsedSarif.runs[0]?.tool.driver.version).toBe("0.1.7");
+    expect(parsedSarif.runs[0]?.tool.driver.version).toBe("0.2.0");
     expect(parsedSarif.runs[0]?.results[0]?.properties.issueId).toMatch(/^iss_/);
   });
 

tests/docs/documentation.test.ts

@@ -39,9 +39,10 @@ describe("release documentation", () => {
     };
 
     expect(readme).toContain("Verify Agent Skills before you trust them.");
-    expect(readme).toContain("Alpha · GitHub release v0.1.7 · Node.js 20+");
-    expect(readme).toContain("published GitHub package");
-    expect(readme).toContain("published GitHub package is v0.1.7");
+    expect(readme).toContain("Alpha · GitHub release v0.2.0 · Node.js 20+");
+    expect(readme).toContain("GitHub Releases");
+    expect(readme).toContain("download/v0.2.0");
+    expect(readme).toContain("chumanic-skillsync-0.2.0.tgz");
     expect(readme).toContain("## Install");
     expect(readme).toContain("npx --yes @chumanic/skillsync@0.1.0 verify");
     expect(readme).toContain([

tests/reporters/sarif.test.ts

@@ -44,7 +44,7 @@ describe("renderSarif", () => {
 
     expect(sarif.version).toBe("2.1.0");
     expect(sarif.runs[0]?.tool.driver.name).toBe("skillsync");
-    expect(sarif.runs[0]?.tool.driver.version).toBe("0.1.7");
+    expect(sarif.runs[0]?.tool.driver.version).toBe("0.2.0");
     expect(sarif.runs[0]?.tool.driver.rules[0]?.id).toBe("structure.missing-reference");
     expect(sarif.runs[0]?.tool.driver.rules[0]?.help?.text).toBe("Add the referenced file.");
     expect(sarif.runs[0]?.results[0]?.ruleId).toBe("structure.missing-reference");