Release telegram-dev 0.2.4

.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "telegram-dev",
       "displayName": "Telegram Dev",
       "description": "Telegram development, split by the API each surface actually speaks. telegram-bots covers the official HTTP Bot API \u2014 update_id as the only idempotency key, the allowed_updates default that drops three types in silence, the webhook secret header, rate limits as a design constraint, and Telegram Stars with its ten-second pre-checkout window. telegram-userbots covers MTProto and Telethon \u2014 the session file as a credential equal to the password, FloodWaitError as the API working rather than failing, and the account-ban risk a bot token does not carry. telegram-miniapps covers initData verification, the algorithm shipped as a runnable fixture, and the SDK package whose name moved.",
-      "version": "0.2.3",
+      "version": "0.2.4",
       "author": {
         "name": "ssheleg",
         "url": "https://x.com/sshlg93"

CHANGELOG.md

@@ -1,3 +1,14 @@
+## v0.2.4 — 2026-10-13
+
+- Validate the owner board's table shape, unique task IDs and immediate Markdown
+  separator before accepting a change.
+- Validate the release job's full-history checkout and refusing ancestry check;
+  reject unsupported or ambiguous workflow shapes. Forty-two process controls
+  cover hostile edits and valid board/workflow forms.
+- Run complete hosted validation nightly at 23:00 Europe/Warsaw or once for an
+  explicitly frozen draft-to-ready candidate. Tag releases retain their existing
+  validation and publication checks.
+
 ## v0.2.3 — a lightweight tag cannot publish a release
 
 - **The release refuses a lightweight tag.** `release.yml` gains one step, right after

SKILL-CARD.md

@@ -5,7 +5,7 @@
 | Field | Value |
 |---|---|
 | Pack | `telegram-dev` |
-| Version | `0.2.3` |
+| Version | `0.2.4` |
 | Skills | `telegram-bots`, `telegram-userbots`, `telegram-miniapps` |
 | License | MIT |
 | Source | https://github.com/ssheleg/telegram-dev |

docs/evidence/backlog.md

@@ -6,8 +6,9 @@ this board; the source requests are the hub's B-108 and B-109.
 
 | ID | Finding and acceptance | State | Evidence |
 |---|---|---|---|
-| GATE-01 | Own validator must reject missing boards, shifted columns and duplicate IDs using each table's header. | implemented on branch; independent review pending | [Task packet](member-gates-20261013/README.md), `test/member_gates_test.py` |
-| GATE-02 | Own validator must reject removal of the release job's full-history checkout or unconditional ancestry failure guard. | implemented on branch; independent review pending | [Task packet](member-gates-20261013/README.md), `test/member_gates_test.py` |
+| GATE-01 | Own validator must reject missing boards, shifted columns and duplicate IDs using each table's header. | verified and merged; patch release pending | [Task packet](member-gates-20261013/README.md), `test/member_gates_test.py` |
+| GATE-02 | Own validator must reject removal of the release job's full-history checkout or unconditional ancestry failure guard. | verified and merged; patch release pending | [Task packet](member-gates-20261013/README.md), `test/member_gates_test.py` |
 
-Remaining: independent review, owner integration, then the coordinator's separate
-release and family-pin wave. No native/provider or past release verdict is claimed.
+Source review and owner integration are complete; exact merge and eligible-run
+receipts are in the [release packet](releases/2026-10-13-member-gates/README.md).
+Remaining: patch publication and the coordinator's family-pin/install wave. No native/provider or past release verdict is claimed.

docs/evidence/releases/2026-10-13-member-gates/README.md

@@ -0,0 +1,56 @@
+# telegram-dev 0.2.4: release packet
+
+Objective: publish the already merged FW02 board and release-ancestry gates as
+an exact patch version. The operator authorized this release wave on 2026-10-13.
+Hub pins and global installation belong to the coordinating hub wave.
+
+## Source and acceptance
+
+- Source main: `85a5a5f13e2c7b24fddda5c53bb05f1634d969ed`; [PR 12](https://github.com/ssheleg/telegram-dev/pull/12).
+- Eligible source check: [run 38336371814](https://github.com/ssheleg/telegram-dev/actions/runs/38336371814), success.
+- [Implementation packet](../../member-gates-20261013/README.md): 42 process controls,
+  including 38 hostile plants and four valid shapes. The coordinator independently
+  replayed the final Telegram controls and verified identical sibling helper/harness hashes.
+- This release changes version metadata and evidence only; the source gate implementation
+  and CI job bodies remain the merged, reviewed ones.
+
+## Requirements and sequence
+
+1. Synchronize package, marketplace, plugin, existing skill metadata and skill card
+   to `0.2.4`; add the exact changelog section, preserving historical versions.
+2. Run the owner's required local gate sequentially; strict manifest validation and
+   payload dry-run supplement it. Record actual outcomes below.
+3. Independently review the frozen diff, push a draft PR, then promote it once for
+   eligible `ready_for_review` checks. Ordinary exact-head squash merge only.
+4. Create a new annotated `v0.2.4` at merged canonical main, after confirming the
+   tag and npm version are absent. Watch the existing release workflow, then verify
+   the exact registry version and GitHub release. Never rewrite an old tag.
+5. Hand source/tag/run receipts to the hub coordinator for pins and installation.
+
+## Current state and next task
+
+Plan committed before the metadata change. PR admission, tag creation, publication and installation remain pending.
+Next: freeze this receipt, push, then promote the reviewed draft once. No model/provider/native-runtime acceptance is inferred.
+
+Skills used: make-skill (release construction), task-pipeline (delivery),
+agent-sync (local advisory ownership), evidence-docs (source and check receipts).
+
+## Candidate review and payload
+
+The coordinator independently reviewed `a700bd2e85244c61ce0a72bace63ee7f37768fea`: **PASS**. Version fields,
+new changelog and existing skill metadata agree; there is no executable or workflow
+diff.
+`npm pack --dry-run --json` exited 0: 22 files, 146707 unpacked bytes;
+no `.env`, agent-sync state or Python cache residue. Both common gate files retain
+the same SHA-256 digests as the independently reviewed FW02 source wave.
+
+Draft [PR 13](https://github.com/ssheleg/telegram-dev/pull/13) preserves the
+no-per-push CI policy until local checks finish.
+
+## Local candidate checks
+
+`npm test`: structural 15, fixture checks, delivery invariants, installer 11 and audit regressions pass. `npm run test:negatives`: 15 owner plants plus 42 member process controls pass. Both strict Claude manifests pass. `git diff --check` passes.
+All test and strict-validation commands exited 0. Telegram's initial diff check
+found one receipt trailing space; it was removed and that check passed.
+The owner gate reports routed-trigger checks as unlooked outside the umbrella;
+this does not imply native/model or family-install acceptance.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/telegram-dev",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Three skills for building on Telegram, separated by which API each one speaks: the official HTTP Bot API for bots, MTProto (Telethon) for user accounts, and Mini Apps for the web layer whose whole security model is one signed blob.",
   "bin": {
     "telegram-dev": "bin/telegram-dev.js"

plugins/telegram-dev/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "telegram-dev",
   "displayName": "Telegram Dev",
   "description": "Telegram development, split by the API each surface actually speaks. telegram-bots covers the official HTTP Bot API \u2014 update_id as the only idempotency key, the allowed_updates default that drops three types in silence, the webhook secret header, rate limits as a design constraint, and Telegram Stars with its ten-second pre-checkout window. telegram-userbots covers MTProto and Telethon \u2014 the session file as a credential equal to the password, FloodWaitError as the API working rather than failing, and the account-ban risk a bot token does not carry. telegram-miniapps covers initData verification, the algorithm shipped as a runnable fixture, and the SDK package whose name moved.",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"