diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 25d8d0f..27640c6 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -11,7 +11,7 @@ "name": "telegram-dev", "displayName": "Telegram Dev", "description": "Telegram development, split by the API each surface actually speaks. telegram-bots covers the official HTTP Bot API \u2014 update_id as the only idempotency key, the allowed_updates default that drops three types in silence, the webhook secret header, rate limits as a design constraint, and Telegram Stars with its ten-second pre-checkout window. telegram-userbots covers MTProto and Telethon \u2014 the session file as a credential equal to the password, FloodWaitError as the API working rather than failing, and the account-ban risk a bot token does not carry. telegram-miniapps covers initData verification, the algorithm shipped as a runnable fixture, and the SDK package whose name moved.", - "version": "0.2.3", + "version": "0.2.4", "author": { "name": "ssheleg", "url": "https://x.com/sshlg93" diff --git a/CHANGELOG.md b/CHANGELOG.md index b6be142..63af2a1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,14 @@ +## v0.2.4 — 2026-10-13 + +- Validate the owner board's table shape, unique task IDs and immediate Markdown + separator before accepting a change. +- Validate the release job's full-history checkout and refusing ancestry check; + reject unsupported or ambiguous workflow shapes. Forty-two process controls + cover hostile edits and valid board/workflow forms. +- Run complete hosted validation nightly at 23:00 Europe/Warsaw or once for an + explicitly frozen draft-to-ready candidate. Tag releases retain their existing + validation and publication checks. + ## v0.2.3 — a lightweight tag cannot publish a release - **The release refuses a lightweight tag.** `release.yml` gains one step, right after diff --git a/SKILL-CARD.md b/SKILL-CARD.md index bdbc2fb..96e827c 100644 --- a/SKILL-CARD.md +++ b/SKILL-CARD.md @@ -5,7 +5,7 @@ | Field | Value | |---|---| | Pack | `telegram-dev` | -| Version | `0.2.3` | +| Version | `0.2.4` | | Skills | `telegram-bots`, `telegram-userbots`, `telegram-miniapps` | | License | MIT | | Source | https://github.com/ssheleg/telegram-dev | diff --git a/docs/evidence/backlog.md b/docs/evidence/backlog.md index a5057c5..65f955b 100644 --- a/docs/evidence/backlog.md +++ b/docs/evidence/backlog.md @@ -6,8 +6,9 @@ this board; the source requests are the hub's B-108 and B-109. | ID | Finding and acceptance | State | Evidence | |---|---|---|---| -| GATE-01 | Own validator must reject missing boards, shifted columns and duplicate IDs using each table's header. | implemented on branch; independent review pending | [Task packet](member-gates-20261013/README.md), `test/member_gates_test.py` | -| GATE-02 | Own validator must reject removal of the release job's full-history checkout or unconditional ancestry failure guard. | implemented on branch; independent review pending | [Task packet](member-gates-20261013/README.md), `test/member_gates_test.py` | +| GATE-01 | Own validator must reject missing boards, shifted columns and duplicate IDs using each table's header. | verified and merged; patch release pending | [Task packet](member-gates-20261013/README.md), `test/member_gates_test.py` | +| GATE-02 | Own validator must reject removal of the release job's full-history checkout or unconditional ancestry failure guard. | verified and merged; patch release pending | [Task packet](member-gates-20261013/README.md), `test/member_gates_test.py` | -Remaining: independent review, owner integration, then the coordinator's separate -release and family-pin wave. No native/provider or past release verdict is claimed. +Source review and owner integration are complete; exact merge and eligible-run +receipts are in the [release packet](releases/2026-10-13-member-gates/README.md). +Remaining: patch publication and the coordinator's family-pin/install wave. No native/provider or past release verdict is claimed. diff --git a/docs/evidence/releases/2026-10-13-member-gates/README.md b/docs/evidence/releases/2026-10-13-member-gates/README.md new file mode 100644 index 0000000..c97c6e1 --- /dev/null +++ b/docs/evidence/releases/2026-10-13-member-gates/README.md @@ -0,0 +1,56 @@ +# telegram-dev 0.2.4: release packet + +Objective: publish the already merged FW02 board and release-ancestry gates as +an exact patch version. The operator authorized this release wave on 2026-10-13. +Hub pins and global installation belong to the coordinating hub wave. + +## Source and acceptance + +- Source main: `85a5a5f13e2c7b24fddda5c53bb05f1634d969ed`; [PR 12](https://github.com/ssheleg/telegram-dev/pull/12). +- Eligible source check: [run 38336371814](https://github.com/ssheleg/telegram-dev/actions/runs/38336371814), success. +- [Implementation packet](../../member-gates-20261013/README.md): 42 process controls, + including 38 hostile plants and four valid shapes. The coordinator independently + replayed the final Telegram controls and verified identical sibling helper/harness hashes. +- This release changes version metadata and evidence only; the source gate implementation + and CI job bodies remain the merged, reviewed ones. + +## Requirements and sequence + +1. Synchronize package, marketplace, plugin, existing skill metadata and skill card + to `0.2.4`; add the exact changelog section, preserving historical versions. +2. Run the owner's required local gate sequentially; strict manifest validation and + payload dry-run supplement it. Record actual outcomes below. +3. Independently review the frozen diff, push a draft PR, then promote it once for + eligible `ready_for_review` checks. Ordinary exact-head squash merge only. +4. Create a new annotated `v0.2.4` at merged canonical main, after confirming the + tag and npm version are absent. Watch the existing release workflow, then verify + the exact registry version and GitHub release. Never rewrite an old tag. +5. Hand source/tag/run receipts to the hub coordinator for pins and installation. + +## Current state and next task + +Plan committed before the metadata change. PR admission, tag creation, publication and installation remain pending. +Next: freeze this receipt, push, then promote the reviewed draft once. No model/provider/native-runtime acceptance is inferred. + +Skills used: make-skill (release construction), task-pipeline (delivery), +agent-sync (local advisory ownership), evidence-docs (source and check receipts). + +## Candidate review and payload + +The coordinator independently reviewed `a700bd2e85244c61ce0a72bace63ee7f37768fea`: **PASS**. Version fields, +new changelog and existing skill metadata agree; there is no executable or workflow +diff. +`npm pack --dry-run --json` exited 0: 22 files, 146707 unpacked bytes; +no `.env`, agent-sync state or Python cache residue. Both common gate files retain +the same SHA-256 digests as the independently reviewed FW02 source wave. + +Draft [PR 13](https://github.com/ssheleg/telegram-dev/pull/13) preserves the +no-per-push CI policy until local checks finish. + +## Local candidate checks + +`npm test`: structural 15, fixture checks, delivery invariants, installer 11 and audit regressions pass. `npm run test:negatives`: 15 owner plants plus 42 member process controls pass. Both strict Claude manifests pass. `git diff --check` passes. +All test and strict-validation commands exited 0. Telegram's initial diff check +found one receipt trailing space; it was removed and that check passed. +The owner gate reports routed-trigger checks as unlooked outside the umbrella; +this does not imply native/model or family-install acceptance. diff --git a/package.json b/package.json index 02d645c..95d38c8 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@ssheleg/telegram-dev", - "version": "0.2.3", + "version": "0.2.4", "description": "Three skills for building on Telegram, separated by which API each one speaks: the official HTTP Bot API for bots, MTProto (Telethon) for user accounts, and Mini Apps for the web layer whose whole security model is one signed blob.", "bin": { "telegram-dev": "bin/telegram-dev.js" diff --git a/plugins/telegram-dev/.claude-plugin/plugin.json b/plugins/telegram-dev/.claude-plugin/plugin.json index 7b930b2..54d2abb 100644 --- a/plugins/telegram-dev/.claude-plugin/plugin.json +++ b/plugins/telegram-dev/.claude-plugin/plugin.json @@ -3,7 +3,7 @@ "name": "telegram-dev", "displayName": "Telegram Dev", "description": "Telegram development, split by the API each surface actually speaks. telegram-bots covers the official HTTP Bot API \u2014 update_id as the only idempotency key, the allowed_updates default that drops three types in silence, the webhook secret header, rate limits as a design constraint, and Telegram Stars with its ten-second pre-checkout window. telegram-userbots covers MTProto and Telethon \u2014 the session file as a credential equal to the password, FloodWaitError as the API working rather than failing, and the account-ban risk a bot token does not carry. telegram-miniapps covers initData verification, the algorithm shipped as a runnable fixture, and the SDK package whose name moved.", - "version": "0.2.3", + "version": "0.2.4", "author": { "name": "ssheleg", "url": "https://x.com/sshlg93"